Which two techniques protect against injection attacks? (Choose two.)

Input validation is a critical defense that ensures user-supplied data conforms to expected types, formats, and ranges, rejecting any malicious input that could exploit injection vulnerabilities.

Trimming whitespace from user input is a form of sanitization but does not directly protect against the malicious code or commands characteristic of injection attacks.

Limiting text areas to a specific character count, such as 255 characters, may constrain the size of an injection payload but does not inherently prevent the injection of malicious commands within that limit.

String escaping of user free text involves converting special characters within the input into their literal representations, preventing them from being interpreted as executable code or commands by backend systems or interpreters.

While restricting input to predefined options like dropdowns or checkboxes can prevent injection by removing free-text entry, it is a design constraint rather than a universally applicable technique when free-text input is required.