I'm no security expert.......but cant you proxy against such attacks by now? SQL injections are old news. Its a tried and tested method that should have been defeated by now. WTF. Is it any specific versions of SQL? M$ SQL, MySQL. Why not use Oracle, or Dbase, something else? I'd ventrure to say most sites are cracked through thier GD databases. I remember years ago, when I was a bushy tailed consultant, I had firewall devices that could proxy every damned bit. Oh, I forgot, iptables is all you need, jackasses.... Astaro firewall, and yes even M$'s own ISS platforms can do this, application layer proteciton...... I guess they cant be bothered to stop picking apart the new bugs that get generated by the downloadable code kits to worry about protecting thier boarders, because why would anyone bother compromising an antivirus company..... Jerks.