How would you answer an interview scenario involving SQL injection?

In an interview, I would first define SQL injection and the problem it solves, then explain how I would use parameters or safe ORM query APIs, avoid string concatenation for SQL, validate dynamic identifiers against allowlists, minimize database privileges, and test raw-query paths carefully. I would also call out the main failure mode: escaping quotes manually or validating only common attack strings is brittle and can be bypassed across different query contexts and database engines. Finally, I would describe how I would test, monitor, and safely roll back or recover the solution.