Input validation
Checking that what arrives is what you expect, in type, length and format, and refusing it if not. It must run on the server, because anyone can skip the browser and send the request directly.
It stops plenty of bugs and shrinks what an attacker can try. It does not make a query safe, and an agent asked to "sanitise inputs" may reach for a list of banned characters and call the job done.
Say it to your agent
“Validate this request body on the server with a schema: name is 1 to 60 characters, age is an integer from 0 to 150, and unknown fields are rejected. Don't filter for bad words. Injection is handled by the parameterised query, not by this.”