We've all been pounded with "beware of SQL Injection Attacks" - yet I found a rather nice blog post here: http://blogs.msdn.com/dglover/archive/2005/06/01/423727.aspx that hands out a nice filter method for SQL Server. You might as well have a look and see if you can introduce it into your stored procedures....