What is the preferred method for preventing SQL injection?

Always using prepared statements for all SQL queries.

Always using the available database-specific escaping functionality on all variables prior to building the SQL query.

Using addslashes() to escape variables to be used in a query.

Using htmlspecialchars() and the available database-specific escaping functionality to escape variables to be used in a query.