title: How to prevent SQL injection attack on a text box?
body: <p>My VB.net page has a text box that accepts SQL statements and returns a DataSet using ExecuteDataSet command of SQL Helper. What do you think is the best way to prevent statements such as Delete, Truncate, Drop, Insert, etc. from being executed? The text box should only accept Select statements. I'm thinking of trapping the input string thru Javascript or thru server validation but I'm sure there are more efficient ideas to do this. Thanks in advance.</p>
  
  <p>EDIT: My text box acts like a query analyzer, therefore it accepts a line of SQL statement and then return a dataset based on the entered string </p>