Yeah I found this out the hard way back in 1997 writing ASP pages using SQL Server. I learned to sanitize my data inputs. It all started with employees who had

Yeah I found this out the hard way back in 1997 writing ASP pages using SQL Server. I learned to sanitize my data inputs. It all started with employees who had Irish names like O`Brian, they would cause database errors when trying to insert their name. I found out the data entry clerks didn't know the difference between the "`" apostrophe and "'" single quote character. So I wrote a SQL filter function to double up the single quotes if one is entered. As it turned out some employees where using the single quote for SQL Injection and it foiled their attempts and they filed support tickets for it. I could not replicate the error and then I asked how they were entering the data, and none of them wanted to tell me. So I made a logging code when their user ID is used to access the database and noticed they were trying to use the single quote to gain access to other tables and in some cases entering "1 or 1" and other stuff that just returned all the results in a table. I had to filter out SQL commands, system characters, and other things, even HTML statements because they would stick them in there to deface ASP pages and insert messages. This was a law firm I worked for, and they had no clue their users were doing this, it was an Intranet site that was not accessible from the Internet. For stopping their 'cracking' of ASP pages, I gained a lot of enemies for that. Some would send denial of service attacks to my Windows PC, some would file fake complaints about me to get rid of me and replace me with someone who didn't sanitize inputs. Eventually I got too sick to work, and was fired for being mentally ill after all the stress I had caused me to develop schizoaffective disorder.