Learn what SQL injection is and how to defend against it

Article is good, but I would phrase this a bit differently.

To avoid SQL injection attacks, keep the data separate from SQL. So that data stays as data and is not read as commands by the SQL parser:

• If the code needs a number, change it to a number explicitly
• If it's a string, use bind parameters
• If it's an enum, double-check that the value is strictly from the enum