Razvan raises a good point, and one that reinforces the suggestion that a data layer is a good idea.  It's much easier to prevent SQL Injection and the like in a dedicated data layer, than on every individual SQL call.

Tony