security issues for this are big. I'd turn it off by default and then have it configurable via a connection string parameter (which also makes it fully backwards compatible).
In my own apps I always funnel all sql calls through my own wrapper and I do include sql in the message, but it's also my app and not a component and I know I never show users the raw error message. :-)
Sam
We're hiring! B-Line Medical is seeking .NET Developers for exciting positions in medical product development in MD/DC. Work with a variety of technologies in a relaxed team environment. See ads on http://careerbuilder.com.