[jdlshore]

The proper solution to SQL injection is parameterized queries, not input sanitization, to my knowledge.

[drunkpotato]

The irony here is that if you use the log4j equivalent of parameterized queries, parameterized logging strings, you're still vulnerable to this CVE, even if you did everything right.