15. The method defined in claim 1 further comprising checking string values against one or more existing policies to prevent SQL injection attacks.
15. The method defined in claim 1 further comprising checking string values against one or more existing policies to prevent SQL injection attacks. 16. The method defined in claim 15 wherein at least one security policy classifies, as tainted, any SQL query in which characters in tokens are non-literals, and the method includes flagging an error if such a query is identified.