>Then you don't know. I use Mark's builder and it does not use parameters. In fact the CA class itself does not use parameters. Next time put a breakpoint on the BeforeUpdate statement and see what is being passed as the SQL statement.

>>Not many. I used views and only lately switched to CAs.
>
>Nuff said.
>
>Hands up those (other than Mike) who use such "injection proof" statements in their bound forms.

BTW, I only used CA for native VFP tables. If my memory servers, I recall ?curCA.field in all commands. Is it different for SQL Server?