It's SQL Server. Every security setting you would use to ensure proper protection of the system is the same when dealing with web pages as when dealing with traditional client server situations. For details on securing your servers, I recommend Denny Cherry's book on security.
"The credit belongs to the man who is actually in the arena, whose face is marred by dust and sweat and blood"
- Theodore Roosevelt
Author of:
SQL Server Execution Plans
SQL Server Query Performance Tuning