Hi,
can anyone suggest me how to avoid sql injection in web form

hello there:
SQL Injection solutions:

• All input to the app from a user, a component, or another program shoul dbe validated
• Use parameterized SQL querirs
• Use Stored Procedure
• Use SQL execute-only primission
• Use proper escaping for SQL identifiers and Data Definition Language (DDL) statement
• Handle buffer lengths property
• Use a Least-Privileged Database Acount
• Avoid Disclosing Detailed Error Information

These r General but u may Google each to get more info about

HTH

__________________
Always,
Hovik Melkomian.

The key thing to do is use parameters in your SQL statements. If you concatenate user input, it can be interpreted as part of the SQL command; hence the danger of SQL injection attacks. If you specify the user input as a parameter, then the DB understands what parts are SQL command and what is data. Someone can attempt a SQL injection attack, but it won't affect the command that is run which eliminates the danger.

__________________
-------------------------

Whatever you can do or dream you can, begin it. Boldness has genius, power and magic in it. Begin it now.
-Johann von Goethe

When Two Hearts Race... Both Win.
-Dove Chocolate Wrapper

Chroniclemaster1, Founder of www.EarthChronicle.com
A Growing History of our Planet, by our Planet, for our Planet.