It's also created some issues. My boss now want to ensure we are validating user entered values. His fear "...what to prevent someone from entering a select * or delete statement". Fine. But the parameter is defiined as a varchar(4) so it will only pass the first 4 characters anyway.