More concisely: Every time you let a user input something, you're giving them a chance to try to extract or destroy something in your database. But preventing it is REALLY simple. It's astonishing that this is still a problem in 2011, it goes to show what happens when everybody outsources and nobody gives a f*ck about quality. Grandpa was a foreman, he used to say if you pay workers more they hammer in an extra nail and the building won't fall down in the next earthquake. Same goes.