There's a lot of information out there on how to avoid SQL injection attacks, but I wanted to point you to this blog due to the recent increase in such attacks. 

Thank you, Buck Woody, for bringing this to our (SQL Server MVPs) attention.