James - I am happy to help you with this.  The key is to seperate the reader account from the writer account, and make sure that the reader account can't do updates.  Additionally, only logged in users should be able to utilize the writer account.  Also, none of the accounts should have access to the calls which enumerate tables (access to system tables should be blocked).  While IP addresses are a good measure, the main point of banning IP addresses is to minimize denial of service attacks at the router/firewall level.  The best solution is to contain all database access in a middle tier - either .Net components or TSQL stored procedures, but that will take a while to refactor.

With respect to Jon's issue, I have the same problem.  Best I can tell, PP uses two different, and sometimes incompatible ways to fetch/store cookies.  I could tell you more, but I'd need to examine the codebase.