And whatever you do, beware of SQL Injection. The user could type in all sorts of nasty things in the text boxes that would end up as SQL commands. Use parameters instead.