SQL injection is a common attack where an attacker can execute arbitrary SQL code on a database. To prevent this, developers should use parameterized queries, which separate SQL code from data. Python’s DB-API supports parameterized queries, ensuring user input is safely handled. ORMs like SQLAlchemy abstract the database layer, automatically handling query parameterization. This reduces the risk of injections by preventing direct execution of user inputs as SQL code.