I came across an application that had SQL injection vulnerabilities everywhere (100s of ASP files). Query parameters were concatenated into strings over 1000s o

I came across an application that had SQL injection vulnerabilities everywhere (100s of ASP files). Query parameters were concatenated into strings over 1000s of lines. It would have been a year's project to properly parameterize every query across every system. Management wasn't too concerned until I showed them that I could drop the entire database (and the other databases on that DBMS) by putting a URL into IE6. Our eventual fix was to pass every query through a regex that would stop the worst queries (DROP, TRUNCATE), while making it a priority that everyone start writing safe queries and fixing bad query generation code when it is seen.