A validated invoice ID is inserted into a SQL query. Which control protects the SQL inter…

A validated invoice ID is inserted into a SQL query. Which control protects the SQL interpretation boundary?

1. Bind the ID as a parameter through the database driver.
2. Add the Access-Control-Allow-Origin response header.
3. HTML-encode the ID before string concatenation.
4. Make the ID a UUID so it is difficult to guess.