Re-designing the database to overcome network and application issues is usually a very bad idea.

It would be better to re-write the application to work as a n-tier application instead of...

It isn't always easy to convince even experienced developers that SQL Injection can be a problem. Look at this current thread.

Avoiding injection on stored procedure

http://www.sqlservercentral.com/Forums/Topic678702-8-1.aspx

You really seem to be missing the point, and your posts didn't address the specific example I posted.

I just ran this script creating the table, loading some rows into it,...

The script on this link works with SQL Server 7.0, 2000, and 2005 (and probably 2008) and has a number of queries to analyze the info various ways:

Total by Database...

Nothing will be simpler than backup and restore, especially for large databases.

It can be scripted, and scheduled in a job.

I didn't test every possible method, so who knows if something better will turn up.

Don't speak too soon for the wheel's still in spin and there's no tellin' who that...

The only ways I can think of are:

Grant them the permissions on the source database.

Make them sysadmin on the server where the read-only database is located.

Neither is a really a...

If anyone is interested in the most efficient way to do it, take a look at performance tests on this this thread:

http://www.sqlteam.com/forums/topic.asp?TOPIC_ID=122003

And no, the most effiecient wasn't the solution I...

bitbucket (3/18/2009)

---

Michael Valentine Jones

Since the title of this thread is “Avoiding injection on stored procedure”, have you considered what would happen if they passed the following as parameters:

[Execute USPDeleteAnswers @Id...

Consider this variation of B. It allows you the flexibility to use a QuestionGroup in multiple Surveys without having to re-enter the questions for each Survey.

TableKeys

Survey

PK = SurveyID

QuestionGroup

PK =...

It doesn't seem to handle tab indents very well. The indents below are all over the place, even though they are all a single tab character.

I think it would...

Collecting bonuses and laying off workers while the business sinks like a stone.

You still have to get the users out of...

bitbucket (3/18/2009)

---

Might I suggest:

CREATE PROCEDURE USPDeleteAnswers

@Id varchar(50),

@QId varchar(100)

AS

DECLARE @sql nvarchar(255)

SET @sql = 'DELETE FROM tblUserAnswer where Id = ''' + @Id + ''' and QuestionId in (' + ...

select [Nine Digits] = right(1000000000+num,9)

from

( --Test Data

select num = 456 union all

select num = 3456 union all

select num = 123456

) a

Results:

Nine Digits

-----------

000000456

000003456

000123456