How could you prevent SQL injection and data compromization from an attacker?

Item=1 UNION SELECT 1,2,name FROM master..sysobjects WHERE xtype= U
User=1 UNION SELECT 1,2,name FROM master..sysdatabases
User=1 or 1=1--

A] This gives the attacker a list of table names. b] This does not give any extra information, since 1 or 1=1 will be quoted. c] This gives an attacker a list of databases. d] This dumps the contents of the items table. e] This does not give the attacker extra information directly, but the delay indicates a vulnerability this query is useful for blind SQL injection.