>>I am not sure, in general how I can use the parametrized command with Cursor Adapter approach. For example, say I have a user entry form where Cursor Adapter is created, fills cursor with data from the back end (SQL Server). Then, when user makes changes, the program simply executes TableUpdate() which updates the table in the SQL Server. Could someone enter the "malicious" entry (similar to your example) in one of the fields and cause the table dropped or something like this on TableUpdate()?

No, because Tableupdate() generates parameterized sql and in the case of RV has done so since 1995. This isn't well understood outside the VFP community and even VFP gurus who habitually advise against RVs were unaware that VFP is injection-proof unless you follow their advice to roll your own SP/SPT as you have to with other tools. ;-) Actually that's not so true any more, e.g. Linq, but it's still an example of how advanced VFP was and still is in some respects- e.g. automatic resultset spooling to disk that was in FP since the late 1980s but is just starting to appear in other MS tools this year. But lets not go there. ;-)