title: Can a Regular Expression Be Used to Prevent SQL Injection
body: <p>Before I ask - I do know about paranterised queries but this question is specifically baout regular expressions to prevent SQL injection</p>
  
  <p>Let's say I have a querystring with a paramater of <code>q</code> and I have a regular expression of <code>^201[0-9]Q[0-9]$</code> that I run against the parameter that's passed into SQL.</p>
  
  <p>Would this suffice as protection or can the regex be exploited anyway? Some pseudo code:</p>
  
  <pre><code> if NOT validateToken(quarter) then
       sql = "EXEC dbo.spTest '"&amp;quarter&amp;"'"
   end if
  </code></pre>
  
  <p>Thanks</p>