Which of the following is the BEST way to protect against Structured Query language (SQL) injection?

Boundary checking addresses buffer overflow vulnerabilities by validating the size of input, but it does not prevent malicious SQL metacharacters or syntax from being injected into a query.

Restricting the SELECT command alone is insufficient because SQL injection can exploit INSERT, UPDATE, DELETE, and other statements, and attackers can still manipulate logic within permitted commands.

Restricting HTML source code is a client-side measure that addresses cross-site scripting (XSS) concerns, not SQL injection, which occurs at the database layer regardless of HTML output.

Stored procedures are precompiled SQL code stored in the database that accept parameters as data, not executable code, meaning user-supplied input cannot alter the query's logic or structure. Because the SQL statement is defined in advance and parameters are strongly typed, even malicious input like ' OR '1'='1 is treated as a literal string rather than SQL syntax. This parameterization technique is the most robust and widely recommended defense against SQL injection.