Protecting C# from SQL and XML Injection