A client builds a query using a customer-supplied string. What is the best approach to avoid mixing untrusted values with query syntax?

1. Concatenate the raw value into the SQL text
2. Use parameterized queries
3. Grant the client broader account permissions
4. Increase the result-page size