Lessons learnt on limiting search criteria

It is a common practise according to my own experience that developers seldom set limits for search conditions. Say an ASP page to search for invoices, usually you'll see that users can enter any date range even lasting quite a few years, e.g., from 1995 to 2005. Well, maybe the programer never realized how serious the effect could be. Take applications in our company for example, because of similar queries, we have to face OutOfMemoryException every a few days, this make us really frustrated. And only after days and days of tracing through IIS log and memory monitoring did we find out the real cause.

So, come to conclusion,

1. Never accept once-for-all(or empty search criteria) query.
2. Always set default returned rows, never return all the rows if possible.
3. Always returns recordset page by page