A public application executes database commands assembled directly from untrusted search text. Which change most directly prevents SQL injection?

1. Use parameterized queries
2. Increase the database connection timeout
3. Move the application to another subnet
4. Hide the database version banner