Such is the case with SQL queries. They seem so innocent, and so useful. But dangers lurk within every space-separated keyword. Consider a basic query crafted using ordinary C# string concatenation: / ...

I think it's been aluded to above, but SP's or Parameterised quieries are the way to go for no other reason that security.<BR><BR>If you are combinging strings to make a query, all a hacker has to ...