quote:
Ok, maybe I missed something all this time but I have never had a special character bother other than ' as long as wrapped in single quotes 'nnnnnn'. So what is everyone running into that I have yet to hit?
there are some more characters to watch. Look at this one:
http://www.nextgenss.com/papers/advanced_sql_injection.pdf
I've just visited the site and there is a new one out:
http://www.nextgenss.com/papers/more_advanced_sql_injection.pdf
and they've added some I saw for the first time like
http://www.nextgenss.com/papers/tp-SQL2000.pdf
http://www.nextgenss.com/papers/asp.pdf
Hope you never hit it 
Cheers,
Frank
--
Frank Kalis
Microsoft SQL Server MVP
Webmaster: http://www.insidesql.org/blogs
My blog: http://www.insidesql.org/blogs/frankkalis/[/url]