To prevent SQL injection, employ input validation, parameterized queries, and prepared statements in your API code. Avoid dynamically constructing SQL queries with user input.