lightangel, read this article:

/thread104591.html

(about sql inj)

and this: /threadnav43966-1-10.html