Well I thought it would be a simple act of checking the data before submitting it... maybe a select case? You could check if it's html or sql code... look for keywords. it's not supposed to be text anyways so you could prob check for that and deny it. If this isnt correct then my understanding is flawed but I would think that would work - I do know about php and mysql but I have not done anything to that extent. So my advice may not work but it does sound good :-)