Click here to monitor SSC
SQLServerCentral is supported by Redgate
 
Log in  ::  Register  ::  Not logged in
 
 
 


Convert Existing Stored Procedure To CLR Stored Procedure


Convert Existing Stored Procedure To CLR Stored Procedure

Author
Message
azinyama
azinyama
Forum Newbie
Forum Newbie (8 reputation)Forum Newbie (8 reputation)Forum Newbie (8 reputation)Forum Newbie (8 reputation)Forum Newbie (8 reputation)Forum Newbie (8 reputation)Forum Newbie (8 reputation)Forum Newbie (8 reputation)

Group: General Forum Members
Points: 8 Visits: 10
Good day all!!!

I have just started learning about CLR Stored Procedures and I wanted to know how to convert my existing stored procedures to CLR Stored Procedures. Could you show me, with code, what this stored procedure should look like. I'm using VS 2010, VB.Net, MSSQL Server 2008.



ALTER PROCEDURE [dbo].[user_login]
-- Add the parameters for the stored procedure here
@User_UserName VARCHAR(50),
@User_Password VARCHAR(50),
@Station VARCHAR(50),
@Users_RowID INT OUTPUT,
@Users_Name VARCHAR(100) OUTPUT,
@Success BIT OUTPUT,
@Default_Message VARCHAR(200) OUTPUT
AS

BEGIN TRANSACTION
-- SET NOCOUNT ON added to prevent extra result sets from
-- interfering with SELECT statements.
SET NOCOUNT OFF;

DECLARE @rowsaffected INT
DECLARE @User_Status_RowID INT
DECLARE @User_Cursor CURSOR

-- Insert statements for procedure here
SET @Success = 0
SET @Users_RowID = 0
SET @Users_Name = ''
SET @User_Status_RowID = 0

IF EXISTS (SELECT * FROM [dbo].[user] WHERE User_UserName = @User_UserName AND CONVERT(varbinary, User_Password) = CONVERT(varbinary, @User_Password))
BEGIN
SELECT @Users_RowID = User_RowID, @User_Status_RowID = User_Status_RowID
FROM dbo.[user]
WHERE User_UserName = @User_UserName AND User_Password = @User_Password

SELECT @Users_Name = (User_SName + ', ' + User_FName + '. ' + Title_Descr)
FROM dbo.[user]
INNER JOIN dbo.title ON (dbo.[user].Title_RowID = dbo.title.Title_RowID)
WHERE User_UserName = @User_UserName AND User_Password = @User_Password

IF ((LOWER(@User_UserName) <> 'administrator') AND (@User_Status_RowID = 1))
BEGIN
SET @Default_Message = 'User ''' + @Users_Name + ''' is already logged in.'
SET @Success = 0
RETURN
END
ELSE
BEGIN
EXEC [dbo].[user_status_update] @User_UserName, @Station, 1, @rowsaffected OUTPUT

IF ((@rowsaffected = 2) AND (@@ERROR = 0))
BEGIN
SET @Default_Message = 'You have been logged in successfully'
SET @Success = 1
END
ELSE
BEGIN
ROLLBACK TRANSACTION
SET @Default_Message = 'An error occured while attempting to log you in. Please try again'
SET @Success = 0
RETURN
END
END
END
ELSE
BEGIN
ROLLBACK TRANSACTION
SET @Default_Message = 'Invalid username and/or password. Try again'
SET @Success = 0
RETURN
END

SET NOCOUNT ON;

COMMIT TRANSACTION



Abu Dina
Abu Dina
Right there with Babe
Right there with Babe (727 reputation)Right there with Babe (727 reputation)Right there with Babe (727 reputation)Right there with Babe (727 reputation)Right there with Babe (727 reputation)Right there with Babe (727 reputation)Right there with Babe (727 reputation)Right there with Babe (727 reputation)

Group: General Forum Members
Points: 727 Visits: 3323
Why do you want to convert this to CLR? Unless I'm missing something, I don't see what a CLR version of this sproc is going to give you that a T-SQL version doesn't do.

---------------------------------------------------------


It takes a minimal capacity for rational thought to see that the corporate 'free press' is a structurally irrational and biased, and extremely violent, system of elite propaganda.
David Edwards - Media lens

Society has varying and conflicting interests; what is called objectivity is the disguise of one of these interests - that of neutrality. But neutrality is a fiction in an unneutral world. There are victims, there are executioners, and there are bystanders... and the 'objectivity' of the bystander calls for inaction while other heads fall.
Howard Zinn
azinyama
azinyama
Forum Newbie
Forum Newbie (8 reputation)Forum Newbie (8 reputation)Forum Newbie (8 reputation)Forum Newbie (8 reputation)Forum Newbie (8 reputation)Forum Newbie (8 reputation)Forum Newbie (8 reputation)Forum Newbie (8 reputation)

Group: General Forum Members
Points: 8 Visits: 10
I am developing an application that is going to be setup on a server that is in a public area, that anyone will have access to. My thinking was that CLR Stored Procedures are more secure than the regular stored procedures because they can't be edited from the server. The stored procedure I posted is the log in procedure I'm using. However the other procedures I have are more complex, carrying out billing and remittance logic, etc. So I wanted to hide the logic from the anyone who might try to make unauthorized changes. I posted the simplest stored procedure so that I could learn how to implement it starting with the basics.
Jason-299789
Jason-299789
Ten Centuries
Ten Centuries (1.1K reputation)Ten Centuries (1.1K reputation)Ten Centuries (1.1K reputation)Ten Centuries (1.1K reputation)Ten Centuries (1.1K reputation)Ten Centuries (1.1K reputation)Ten Centuries (1.1K reputation)Ten Centuries (1.1K reputation)

Group: General Forum Members
Points: 1136 Visits: 3229
You might want to read this http://msdn.microsoft.com/en-us/library/ms254498(v=vs.80).aspx

Personally, I think you're doing this for the wrong reasons, and if you really want to stop people altering/deleteing SP's then a Database level trigger that monitors and/or logs alterations to SP's and functions, or one that prevents them from running ALTER PROCEDURE or ALTER FUNCTION commands is the best option.

You might even be able to acomplish this with Audit Logging on the database see http://msdn.microsoft.com/en-us/library/dd392015(v=sql.100).aspx

_________________________________________________________________________
SSC Guide to Posting and Best Practices
Lowell
Lowell
SSChampion
SSChampion (14K reputation)SSChampion (14K reputation)SSChampion (14K reputation)SSChampion (14K reputation)SSChampion (14K reputation)SSChampion (14K reputation)SSChampion (14K reputation)SSChampion (14K reputation)

Group: General Forum Members
Points: 14992 Visits: 39024
azinyama (11/5/2012)


I am developing an application that is going to be setup on a server that is in a public area, that anyone will have access to.

If you are trying to block the DBA from seeing the CLR body, you are just making it more difficult...if the CLR is deployed, i can still extract the assembly and run it through a decompiler.

Now for end users, SQL server is deny by default...that means no one can do anything unless you give them permission to do something, so it's really advantageous to learn how to be tight with permissions instead of granting db_owner to everyone, for example.

So for example, you can give people EXECUTE permissions on a stored procedure(s), and all they can do is call it,they cannot see the procedure body unless you give them permission to do so.(db_ddladmin,db_owner, VIEW DEFINITION)

My thinking was that CLR Stored Procedures are more secure than the regular stored procedures because they can't be edited from the server.

you are introducing a big performance hit by trying to do everything in CLR...the code you posted already has a cursor in it, which is something you want to avoid up front, and use set based operations to take advantage of SQL's abilities.
The stored procedure I posted is the log in procedure I'm using. However the other procedures I have are more complex, carrying out billing and remittance logic, etc. So I wanted to hide the logic from the anyone who might try to make unauthorized changes. I posted the simplest stored procedure so that I could learn how to implement it starting with the basics.


CLR's have their place, but they should be reserved to do things you cannot normally do in TSQL..if you relpace existing functionality with a CLR, it will be slower, with very very rare exceptions.

Lowell

--
help us help you! If you post a question, make sure you include a CREATE TABLE... statement and INSERT INTO... statement into that table to give the volunteers here representative data. with your description of the problem, we can provide a tested, verifiable solution to your question! asking the question the right way gets you a tested answer the fastest way possible!

Eugene Elutin
Eugene Elutin
Hall of Fame
Hall of Fame (3.1K reputation)Hall of Fame (3.1K reputation)Hall of Fame (3.1K reputation)Hall of Fame (3.1K reputation)Hall of Fame (3.1K reputation)Hall of Fame (3.1K reputation)Hall of Fame (3.1K reputation)Hall of Fame (3.1K reputation)

Group: General Forum Members
Points: 3054 Visits: 5478
There is another powerful feature which will make even viewing a stored procedure code a big hassle, it's called ENCRYPTION:
Read about option ENCRYPTION in here:
http://msdn.microsoft.com/en-us/library/ms187926.aspx

_____________________________________________
"The only true wisdom is in knowing you know nothing"
"O skol'ko nam otkrytiy chudnyh prevnosit microsofta duh!":-D
(So many miracle inventions provided by MS to us...)

How to post your question to get the best and quick help
Jason-299789
Jason-299789
Ten Centuries
Ten Centuries (1.1K reputation)Ten Centuries (1.1K reputation)Ten Centuries (1.1K reputation)Ten Centuries (1.1K reputation)Ten Centuries (1.1K reputation)Ten Centuries (1.1K reputation)Ten Centuries (1.1K reputation)Ten Centuries (1.1K reputation)

Group: General Forum Members
Points: 1136 Visits: 3229
Eugene Elutin (11/5/2012)
There is another powerful feature which will make even viewing a stored procedure code a big hassle, it's called ENCRYPTION:
Read about option ENCRYPTION in here:
http://msdn.microsoft.com/en-us/library/ms187926.aspx




The problem is that the encryption is easily reversed if you're determined enough, it might stop a casual person but anyone with any tenacity or google will be able to bybass that quickly once they have a script.

This is one thread on MSDN about it though it appears that you need to have Admin rights.

http://social.msdn.microsoft.com/Forums/en/transactsql/thread/e7056ca8-94cd-4d36-a676-04c64bf96330


Lowel is correct you're better using Permissions to prevent this from happening and if it does happen using an Database trigger and Audit to trace changes so you know who to point the finger at and prove that someone has done something they shouldnt.

_________________________________________________________________________
SSC Guide to Posting and Best Practices
azinyama
azinyama
Forum Newbie
Forum Newbie (8 reputation)Forum Newbie (8 reputation)Forum Newbie (8 reputation)Forum Newbie (8 reputation)Forum Newbie (8 reputation)Forum Newbie (8 reputation)Forum Newbie (8 reputation)Forum Newbie (8 reputation)

Group: General Forum Members
Points: 8 Visits: 10
Thank you all for the advice. Will look into permissions option...
azinyama
azinyama
Forum Newbie
Forum Newbie (8 reputation)Forum Newbie (8 reputation)Forum Newbie (8 reputation)Forum Newbie (8 reputation)Forum Newbie (8 reputation)Forum Newbie (8 reputation)Forum Newbie (8 reputation)Forum Newbie (8 reputation)

Group: General Forum Members
Points: 8 Visits: 10
Another question though...

What would I then do about preventing people from using Windows Authentication to log in???
Abu Dina
Abu Dina
Right there with Babe
Right there with Babe (727 reputation)Right there with Babe (727 reputation)Right there with Babe (727 reputation)Right there with Babe (727 reputation)Right there with Babe (727 reputation)Right there with Babe (727 reputation)Right there with Babe (727 reputation)Right there with Babe (727 reputation)

Group: General Forum Members
Points: 727 Visits: 3323
When you create the SQL Server logins, specify SQL Server Authentication only?

However, windows authentication (when configured correctly) is very secure and will be less headache for your DBAs ;-)

---------------------------------------------------------


It takes a minimal capacity for rational thought to see that the corporate 'free press' is a structurally irrational and biased, and extremely violent, system of elite propaganda.
David Edwards - Media lens

Society has varying and conflicting interests; what is called objectivity is the disguise of one of these interests - that of neutrality. But neutrality is a fiction in an unneutral world. There are victims, there are executioners, and there are bystanders... and the 'objectivity' of the bystander calls for inaction while other heads fall.
Howard Zinn
Go


Permissions

You can't post new topics.
You can't post topic replies.
You can't post new polls.
You can't post replies to polls.
You can't edit your own topics.
You can't delete your own topics.
You can't edit other topics.
You can't delete other topics.
You can't edit your own posts.
You can't edit other posts.
You can't delete your own posts.
You can't delete other posts.
You can't post events.
You can't edit your own events.
You can't edit other events.
You can't delete your own events.
You can't delete other events.
You can't send private messages.
You can't send emails.
You can read topics.
You can't vote in polls.
You can't upload attachments.
You can download attachments.
You can't post HTML code.
You can't edit HTML code.
You can't post IFCode.
You can't post JavaScript.
You can post emoticons.
You can't post or upload images.

Select a forum

































































































































































SQLServerCentral


Search