substitute

Never mind scrubbing input, they should be using bind variables. For example, if they're using Perl, instead of

$dbh->do("insert into visitor (name) values ('$field');"

they should be using

my $sth = $dbh->prepare( "insert into visitor(name) values (?)");
$sth->execute($name);

That way, it because $name is never interpolated into a SQL string, it doesn't matter what's in $name. PHP has support for bind variables as well.