Parameterized queries separate SQL logic from data, preventing injection by treating user input as literal values not executable code. SSL/TLS (A) encrypts transmission but doesnt stop injection. URL/HTML encoding (B) mitigates XSS, not SQLi. Directory restrictions (D) address information disclosure, not injection. Parameterized queries (also called prepared statements) are the primary defense.