The only fully effective way to prevent all types of SQLi vulnerabilities in web applications, including out-of-band SQLi, is to use parameterized queries (also known as prepared statements) to access SQL databases.
Visit the famous Bobby Tables site with examples of parameterized queries.