>Thanks for all the links, I passed them on to our web folks.
>
One more question.

In one of the links I see that we're throwing SQLInjectionException. I guess it is a special class based on Exception, but the author didn't provide a definition for it. I changed the code to use just Exception instead, but I'm wondering what exactly should have been here?

Thanks.