@Tao Klerks

I guessed the right answer without reading the question at any length because I'd seen it before!

As I am more of a developer who uses Sql than a Dba with an understanding of coding I am also aware of the continuing debate amongst developers who want to use inline Sql as opposed to SPs. But I believe that you are right in saying use SPs, and parameters and you *should* be alright.