I heard about SQL injections user can try to enter into Textboxes.
What are the most common ones to watch for?

I heard about this somewhere but I don't know the specifics.

If I wanted to find information, I could enter something like:

' union select NULL, name, NULL, NULL from master..sysdatabases where name <> '

This would be ideal for a string value, where the where clause would be like:

where data = 'match this'

The final with injected SQL would be:

where data = 'match this' union select NULL, name, NULL, NULL from master..sysdatabases where name <> ''

Use stored procedures where possible (not hard-codes SQL strings), look for -- or union select statements.

This is primary SQL based, oracle would have a different recommendation.

Brian