Do you expect a better answer for the second than "use a framework that parses the input in a way that escapes the input such that it's not interpreted as a command"?
In my experience, many developers and even experienced security engineers can fail to give this answer though.
Knowing that you need to use a framework that takes care of input sanitizing is enough for the typical dev.
Edit: Expecting "prepared statements" as "the" answer seems close to making it a trivia question rather than "sufficient understand for doing the job" question.