Which of the following can be used as a countermeasure against the SQL injection attack? Each correct answer represents a complete solution. Choose two.

mysql_escape_string() is deprecated and does not consider the active connection's character set, meaning multi-byte encoding attacks can bypass its escaping in certain configurations, leaving the application vulnerable.

session_regenerate_id() is a PHP session management function that creates a new session ID to prevent session fixation attacks - it has no effect on database query construction or SQL injection.

mysql_real_escape_string() escapes special characters in user input while accounting for the current database connection's character set, preventing attackers from injecting SQL metacharacters that break query structure.

Prepared statements (parameterized queries) are the most robust defense - they pre-compile the SQL structure and bind user-supplied values as typed parameters, making it structurally impossible for input data to be interpreted as SQL code.