&gt;&gt; How are you turning the user supplied string into the SQL string literal string? Is your method for doing so guaranteed to always produce a valid SQL string literal which represents the supplied string?<p>Yes. This is trivial. Any self-respecting junior programmer should be able to write this routine.