ASP.NET

<system.runtime.remoting>>
    <debug loadTypes="true" />
    <customErrors mode="off" />
</system.runtime.remoting>

function killChars(strWords)
dim badChars
dim newChars

badChars = array("select", "drop", ";", "--", "insert", "delete", "xp_")
newChars = strWords

for i = 0 to uBound(badChars)
newChars = replace(newChars, badChars(i), "")
next

killChars = newChars

end function 

Private Sub lblRegister_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles lblRegister.Click
       Dim myConnection As OdbcConnection
       Dim myCommand As OdbcCommand
       Dim strInsert As String
       Dim strSQL As String
       strSQL = String.Empty

        myConnection = New OdbcConnection("Driver={MySQL ODBC 3.51 Driver};Server=myServer;Database=myDB;User=myUser; Password=myPW;Option=3;")
           strSQL = String.Format("SELECT UserName FROM myTable WHERE (UserName='{0}');", txtUserName.Text)
           myCommand = New OdbcCommand(strSQL, myConnection)
           myCommand.CommandType = CommandType.Text
           myConnection.Open()

           Dim result As Integer = CType(myCommand.ExecuteScalar,Integer)
           ' If record count > 0, then UserName already exists in the database
           If result > 0 Then
              lblMessage.Text = "User name already exists in the database"
          Else
              strInsert = "INSERT into myTable (Password,UserName)values (?,?)"
              Dim myCommand1 As OdbcCommand = New OdbcCommand(strInsert, myConnection)
              myCommand1.Parameters.Add(new OdbcParameter("@Password", txtPassword.Text))
              myCommand1.Parameters.Add(new OdbcParameter("@UserName", txtUserName.Text))

              Dim result1 As Integer = myCommand1.ExecuteNonQuery()
          End If
              'close the connection
              myConnection.Close()
End Sub

strSQL = String.Format("SELECT UserName FROM myTable WHERE (UserName='{0}');", txtUserName.Text)

strInsert = "INSERT into myTable (Password,UserName)values (?,?)"