[outworlder]

About the SQL injection thing: you do not need to use stored procedures, just parametrized queries. And do not 'sanitize' input text to prevent SQL injections, ever. It will bite you in the future.