[vbresults]

Originally Posted by Angel-Wings

Hmm - wouldn't a good way be to use stored procedures ?

Then this problem is solved on the DB level instead of trying to escape some input - which won't hurt too for sure.

And the DB user would just need the EXECUTE permission, no more "dangerous" things like CREATE TABLE, DROP etc.

IIRC you'd need to create another connection to the DB and it's more complex. I could be wrong on the connection part, but either way it's far more complex.