title: SQL injection-proofing TextBoxes
body: <p>I've found some tutorials on this already, but they aren't exactly what I'm looking for, I can use the following for username fields and password fields</p>
  
  <pre class="lang-vb.net prettyprint-override"><code>Private Sub UsernameTextBox_KeyPress(ByVal sender As Object, ByVal e As System.Windows.Forms.KeyPressEventArgs) Handles UsernameTextBox.KeyPress
      If Char.IsDigit(e.KeyChar) OrElse Char.IsControl(e.KeyChar) OrElse Char.IsLetter(e.KeyChar) Then
          e.Handled = False
      Else
          e.Handled = True
      End If
  End Sub
  </code></pre>
  
  <p>But for an email field how would I go about protecting against SQL injection for that textbox, as some email accounts have periods or dashes in them?</p>
  
  <p><strong>Update:</strong>
  Below is an example of an insert statement I use.  </p>
  
  <pre><code>Dim con As SqlConnection
  con = New SqlConnection()
  Dim cmd As New SqlCommand
   Try
    con.ConnectionString = "Data Source=" &amp; Server &amp; ";Initial Catalog=" &amp; Database &amp; ";User ID=" &amp; User &amp; ";Password=" &amp; Password &amp; ";"
    con.Open()
    cmd.Connection = con
    cmd.CommandText = "INSERT INTO TB_User(STRUserID, password, Email) VALUES('" &amp; UsernameTextBox.Text &amp; "', '" &amp; MD5Hash(PasswordTextBox.Text) &amp; "', '" &amp; EmailTextBox.Text &amp; "')"
    cmd.ExecuteNonQuery()
  Catch ex As Exception
    MessageBox.Show("Error while inserting record on table..." &amp; ex.Message, "Insert Records")
  Finally
    con.Close()
  End Try
  </code></pre>
  
  <p>So I need to run this with parametrized queries rather than how I'm doing it now?</p>