A vulnerability scan of a customer-facing web application flags a critical SQL injection vulnerability in a login form. The development team confirms the finding is valid: the application concatenates user-supplied credentials directly into dynamic SQL statements. As the security analyst, which secure coding control should you recommend the developers implement to most effectively eliminate this class of vulnerability?