andy1 - 10:25 am on May 27, 2008 (gmt 0)

Thanks for the welcome. :)

Yep you're right, my fields are full of that script (appended).

Am I right in thinking that to prevent this I need to get the ASP form verification code changed to detect the script string, for example, and then deny it? And more importantly, block their IP.