What is the solution? I'm learning about SQL. As far as I understand it, the best thing to do is to bind the parameters using the database's built-in capability to do so...

That's right – parameter binding is the way to go.

There is also an old way which also correctly escapes parameters but is easier to get wrong by forgetting to add it somewhere, which is using your database library's function to escape input before concatenating it into a directly-executed SQL string.

Here are some examples of those methods – in PHP, because it’s the only language I’ve used to build a site without an ORM (which is another option). It’s been a while since I used PHP, but as far as I can tell, with PHP’s built-in library, you would use PDO (PHP Data Objects) for parameter binding. For escaping input for SQL strings, you would use mysql_real_escape_string() (or its relative for your database engine).

You are correct. Note that what you described is not "validating the input checking for harmful SQL code". The latter is a specific case of "enumerating badness", which is a known mistake security wise. Edit: fortunately in the actual list of the errors the advice given is not to check for harmful code, but to whitelist known safe input.

Yeah sure, if someone really wants the user name cheez"; DROP TABLE USERS; that's up to them :-)