I can just give you a couple of general directions since your question is not very clearly stated. Sorry if I am off from what you are looking for.

1. If you are afraid of SQL injection you might consider an alternative to passing a string value in the QueryString and pass an integer instead. You could have a table for example to store your departments with at least an ID and a DepartmentName columns. Then your redirect could be "departmentid=1" and in your code you will typecast the QueryString to an integer and would know that departmentid=1 is actually "electrical".

2. You could look into how to write stored procedures. They are secure and ideally all your database access will be done through stored procedures. Then you can use a string variable and pass it to the stored procedure as a parameter.

3. Never print the QueryString parameter directly on the page like this.
lblMessage.Text = Request.QueryString["message"].ToString();
If you need to do this you should sanitize the string by using a regular expression or any other means you know of.

---

Hristo Evtimov
www.packflash.com