Use a STORED PROCEDURE that allows ONLY VALID DATA. If strKeyValue happens to be ''Drop Table *'' or something like that, you could be in trouble.