Here's a BIG bug.
Type s'mores into the search box.
A critical error has occurred.
Incorrect syntax near 'mores'.
.... this means that input is NOT sterilized, offering an opportunity for SQL injection. I can't even describe what a huge security hole this is.
To fix this, input MUST be sterilized before bouncing to SQL.
To do so (at least in VisualBasic, I'm sure there's something similar in C#) you would do this:
Userinput = REPLACE(Userinput,"'","''") (replace a single ' with two 's)
Userinput = REPLACE(Userinput,CHR(34),"""") (Replace a single " with a double "")
.... this needs to be fixed right away. :(
Additionally, any other text input boxes SHOULD be sterilized. The easiest way to do this is with a function; something like:
UserInput = Sterilize(UserInput)
FUNCTION Sterilize(UserInput)
UserInput = Replace(UserInput,"'","''")
UserInput = Replace(UserInput,CHR(34),"""")
Sterilze = UserInput
End Function
.... this method prevents SQL injection and SQL Errors.