Question

I’ve got some free-response text fields and I’m not sure how to scrub them to prevent SQL injection. Any ideas?

Answer 1

Create a parameterized query instead of concatenating the user’s input into the query.

Here is how to do this in classic asp:
http://blog.binarybooyah.com/blog/post/Classic-ASP-data-access-using-parameterized-SQL.aspx

It’s also important to note that the only way you can be 100% safe from sql injection is to parameterize any sql statement that uses user input, even once it’s in the database. Example: Say you take user input via a parameterized query or stored procedure. You will be safe on the insert, however you need to make sure that anything down the road that uses that input also uses a parameter. Directly concatenating user input is a bad idea anywhere, including inside the db.