Today a small post that I had in mind since some time... a quick-list of how to fortify against SQL Injection (and some more general best practices). You can do some javascript, client-side validations to avoid postbacks, but rembember: never, ever trust...