Instead of policing every line of code you can also mitigate SQL injection by restricting the access of the database handle the user-facing queries are using *

Instead of policing every line of code you can also mitigate SQL injection by restricting the access of the database handle the user-facing queries are using * All read-only queries use a read-only (SELECT only) database account. Injecting; DROP TABLES or INSERT, UPDATE, etc (DML commands) just error out. * User accounts and logins are stored in a different database, so only the code responsible for login and registration can access those tables/database. * All queries should use prepared statements which effectively treats all injected text as just text rather than database commands.