Hey all.
Got a quick question.
If I have a bunch of input fields. i.e. for a search box, or for an input form etc etc, I always use the input from these to search/insert or whatever the database, but I always use stored procedures using parameters. Is this still open to abuse?
Is there anything else I need to do? Remove certain characters etc? Whats the proper way to do it?
Thanks, Paul.
...
Go to the complete details ...