How should one prevent soql injection when using dynamic soql? 

XMLStreanWriter, XMLStreamReader 

Messaging.InboundEmailHandler 

with sharing keyword 

Utilize the String.escapeSingleQuotes(string) method