Even then, you have to be careful. Somebody could enter a text field that inserts their own SQL into the middle of your SQL statement. Say they enter something like a JOIN statement for text field data--SQL syntax might allow construction of a valid statement that causes you problems. If they figure out which field is appended last to your WHERE clause, they could close the quotes and append an additional statement. E.g.,

data: Smith' JOIN...'

the single quote closes your WHERE clause properly and the JOIN is appended:

result: WHERE LastName='Smith' JOIN....'



Sshhhhhhhhhhhh!!!!!!!!!!!!!! you're giving away secrets.
Be astonished at how many coders leave an easy in/out through that door.