if he can trace your sql, he should be an admin or sa!
to such a person, what's security ?
besides bde, odbc,ado,db-lib can be also traced by sql monitor.
one way to avoid some special sql statement to be traced is to
write stored procedure and encrypt them.
btw:if you use sql 7, u can use app role to avoid primary user
logon sql server outside your application
