Discussion on:

Secure SQL Server: Encryption and SQL injection attacks

i guess if you're expecting an int, make sure it's an int before you go plugging it into a sql statement.

Dim cId : cId = CLng(Request("CUSTOMER_ID"))

also, i learned this trick from someone, when dealing with strings. replace all ' with '' or with some other character that isn't used as a string delimiter in sql server, like the ` so if someone tries to log in to a site using sql injection, you've got them covered. you could also use the HTML &#XXX; equivalent of ' . Good article!

well done