How can we prevent SQL Injection Attack?

How can we prevent SQL Injection Attack?

1. a) Show the database error to the users
2. b) Do not remove potential malicious code
3. c) Use the user input directly
4. d) Use input validation