How do you prevent SQL injection beyond basic parameterization?

Use parameters, whitelist inputs, avoid dynamic SQL, and use stored procedures where appropriate.

Combine parameterized queries with strict input validation/whitelisting for identifiers (like column names), avoid concatenating SQL, and use least-privileged DB accounts. Consider using sp_executesql for dynamic scenarios safely.