A security review finds direct concatenation of untrusted input into SQL. Which remediation is most appropriate?

1. Removing all database error logs
2. Base64-encoding the input before concatenation
3. Parameterized queries with appropriate authorization
4. HTML escaping alone