Rob,

I sorta lost sight of the "simple" part of your request. Sorry about that, I got carried away.

One thing I want to caution you about: Do not ever design it so that somebody can send an SQL statement from a browser into your database application directly. That could allow all kinds of mischief, including sending something like "DELETE * FROM Table" to destroy your database. Always handle each field in a separate form variable, and construct the SQL statement back in the safety of the server.

Even then, you have to be careful. Somebody could enter a text field that inserts their own SQL into the middle of your SQL statement. Say they enter something like a JOIN statement for text field data--SQL syntax might allow construction of a valid statement that causes you problems. If they figure out which field is appended last to your WHERE clause, they could close the quotes and append an additional statement. E.g.,

data: Smith' JOIN...'

the single quote closes your WHERE clause properly and the JOIN is appended:

result: WHERE LastName='Smith' JOIN....'

Simple techniques to guard against this include limiting the length of strings (a good idea in general to avoid buffer overrun attacks and data flooding), and removing or escaping any quotes in the data.

--Robert