@sqldba referenced this great link on the topic of poisoned parameterized queries http://is.gd/jixd