Nice article. Thanks. That article is at about the level I need! Yes, so far I'm trying to stay with the single byte character set. If my business 'goes int

Nice article. Thanks. That article is at about the level I need! Yes, so far I'm trying to stay with the single byte character set. If my business 'goes international', then to convert my code to handle all the world's languages I'll have plenty of money and get consulting from Microsoft and/or hire people! I never spent much time writing SQL queries, have been away from SQL writing ASP.NET and other work, so am rusty on SQL and ADO.NET. But I just checked some of my old ADO.NET code and see that at times I did 'parameterize' some queries instead of just doing a string 'concatenation' to get the SQL command 'text'. So, if parameterizing permits sending SQL Server just any garbage data safely, and it SHOULD, then I should be fairly safe just by parameterizing, which is easy enough to do. Your article also mentioned threats that could come from inside a stored procedure: So far all my ADO.NET SQL work is so simple I've not been tempted to write stored procedures! So I don't have any stored procedures to be threats! My usage of SQL Server is intended to be dirt simple, almost simple enough for just some key-value store. But I writing for SQL Server anyway expecting that at some point I will be glad I did, e.g., for some off-line analyses. Thanks for your article and your post here.