Add sql injection protection to DnnSqlDataSource

[iJungleboy]

Various Ideas

1. Require sql to only include placeholders like @value1 @value2 etc. (or ?, ?, ?) and provide the resolution separately.
2. Automatically convert all tokens in the SQL to parameters, and supply them separately (so the SQL would contain Select * from Events where CategoryId = [QueryString:CatId] - but would then be converted to Select * ... where CategoryId = @par1

I personally prefer #2, but there is a minor problem that you might otherwise write sql with quotes or merged strings like WHERE SomeColumn = 'InitialText' + '[QueryString:...]' which would require you to remove the quotes. So there may be a break between preparing SQL in another tool and copy/pasting it to the DnnSqlDataSource

[iJungleboy]

Added 2 layers in the EAV - one to prevent sql-string assembly and one to prevent insert/drop etc. statements in the SQL.