But what if hacker enter the value like john lucas;select * from dbo

in first name textbox

By your point of view i have to make store procedure for each table insert, update and delete

1. First do the following query to allow to execute xp_cmdshell

-- To allow advanced options to be changed.

...

First of all you have to crosscheck the datatype of the date column in sql server.

According that you have to format the date which you pass through the Access form.