To be honest the original query was meant to be platform/language agnostic - so all/any comments/suggestions are being gratefully received
Coding is something I haven't done much of, so whilst I understand the requirement to properly check/santise input and to use parameterised queries etc I've never actually had to do it - hence the reason for the original question.
I want to start coding more, but (being aware of the usual issues that people create for themselves by not doing it properly) I want to get into good secure habits from the start