Input passed via the "article" parameter to pilot.asp and kb.asp is not properly sanitised before being used in a SQL query. Input passed via the "specific" parameter to cart.asp is not properly sanitised before being used in a SQL query. Input passed via the "countrycode" parameter to contact.asp is not properly sanitised before being used in a SQL query. Input passed via the "srch" parameter to search.asp is not properly sanitised before being used in a SQL query. Input passed to the "countrycode" parameter in contact.asp is not properly sanitised before being returned to the user. Input passed to the "USERNAME" parameter in gateway.asp and cart.asp is not properly sanitised before being returned to the user. Input passed to the "specific" parameter in quote.asp and buyitnow.asp is not properly sanitised before being returned to the user.