How should SQL injection be designed for production?

For production, use parameters or safe ORM query APIs, avoid string concatenation for SQL, validate dynamic identifiers against allowlists, minimize database privileges, and test raw-query paths carefully. Add automated tests and observability around the critical behavior, document ownership and failure handling, and review the design when traffic, dependencies, or security requirements change.