To prevent SQL-injection attacks, never use string concatenation to build a SQL command, always use the SqlCommand class (or OleDbCommand class, etc) with parameterized commands. if possible consider using stored procedures. These are some of the common...