thanx for perfect explanation. I believe that by using parameters U can avoid injection simply by replace varchar to int for particular tokens (eg. tabID is integer) and for the rest,... hope that ADO.NET parameter validator would produce good results ;-)

I am curious how do U plan to implement parameters ? because currently U put simply [Portal:PortalID] string into SQL, parameter must always preceed w/ @ and no special chars is allowed ?? (eg. @Portal_PortalID), by change this U would break compatibility.... Will U do double replacement ? mean first replace normal token with parameter, then load SQL and set parameters by used tokens ?

A.

Hi Adam,

I do have the same requirement. But I am not able to use tokens.

Can you please send me the source code you have modified?

I am trying hard to figure out a way to display the data..

Appreciate your help!

Thank you so much

Adam - I'm in need of token replacement as well.

Please send a copy of your dll to tom AT seablick DOT com. 

Thanks.