Step 1. Constrain Input Constrain Input in ASP.NET Web Pages Constrain Input in Data Access Code Step 2. Use Parameters with Stored Procedures Review Your Application's Use of Parameterized Stored Procedures Step 3. Use Parameters with Dynamic SQL Using Parameter Batching Use escape routines to handle special input characters. Use a least-privileged database account. Avoid disclosing error information.