Comment by kingkilr

One point in and its already dead wrong, you never filter input, only output.

Edit: Everyone talking about databases: paramaterized queries, check them out.