A procedure builds SQL by concatenating a user-supplied search string. What should the developer use for values instead?

1. Raw concatenation with a comment asking users to be careful
2. Properly parameterized SQL with validated structure
3. A longer query timeout
4. More database privileges for the caller