If I have a limit in the database on the number of characters that a field can hold is that enough to stop someone from dropping a massive file in the query to take down the server or do I need to check the length ahead of time server side?

you have to check every kind of data that is coming from forms or from the requeststring

That would be a very good idea

do substring during insert with a simple code..

Originally Posted by dostind

do substring during insert with a simple code..

Not that simple.
You need to clean every piece of data before calling the database.

[IMG]file:///tmp/moz-screenshot.jpg[/IMG]

Originally Posted by willcode4beer

Not that simple.
You need to clean every piece of data before calling the database.

[IMG]file:///tmp/moz-screenshot.jpg[/IMG]

Not simple at all (( I try to understand and even try to do by myself... Nothing... Its like another planet for me. SEO -yes, copywriting - yes, but no database )))

willcode4beer thats a funny cartoon, nice find