I'm not saying SQLString is a bad idea. It's a good idea. I'm saying that the strategic advice to "validate input" didn't help you here, because to get to SQLString, you had to know specifically that there was a string-based SQL attack to mitigate. "Validate input" is like saying "know all possible bugs". Obviously, you should mitigate the bugs you know about! You just shouldn't pretend that telling someone to "validate input" is going to accomplish that. It's like telling people "don't have bugs".