During a review of a public-facing web application, an IS auditor discovers that user-supplied data entered into search fields is passed directly into database queries without filtering. Which control would MOST effectively prevent the resulting security exposure?