WOW....this very, very bad.

I just want to see if I have this right.

I have an sql database on my server.

Now, no one can access this database unless they have the password.

But what your saying is, if I make a request for some data, and instead of someone inputing, for example their email address, they could put in some special code which when returned to the database gets stored.

But these charcters are so special that when the database gets to them it crashes the sql interpreter in such a manner that it could crash through the database and delete all your data.

Is that correct???

DennisK
__________________
The one stop toy shop: www.toysofamerica.