Thanks Steve, appreciate it. I thought I was missing something obvious on this question 🙂

dobberteen (6/18/2008)

---

we've been getting hammered by the version of the attack that inserts the javascript mentioned above, thanks to a complete lack of input validation and total reliance on the:

rs.Source...

GSquared (6/18/2008)

---

liam.stirling (6/18/2008)

---

GSquared (6/18/2008)

---

Jim, Venky and Mike, run the sample from BOL. The second cursor, the one with the column_details data in it, returns a recordset. You can...

The encryption and decryption functions return a varbinary(8000). Just use the + append operator and a WHILE loop. There are a few blogs worth checking out, especially the...

I think the numbers tell the story here - 97% of us got the answer to this QoD wrong, only 3% got it right. That's not a normal distribution...

GSquared (6/18/2008)

---

I figured it out! On the describe_cursor_columns one, you don't get the number of rows in the original cursor, but you can count the number of rows in...

The symmetric key encryption functions max out at 8,000 bytes returned. With SQL Server metadata and AES block size this means you can encrypt slightly less bytes than that...

No that's a correct system SP. I'm trying to figure out how to get...

timothyawiseman (6/6/2008)

---

Did you only us this portion:

declare @a varchar(1000);set @a=cast(0x73656C656374206E616D652066726F6D207379732E6461746162617365733B...

Brad (6/6/2008)

---

Stored procedures have to be properly parameterized too. I've seen garbage like this way too many times:

string sql = "EXEC my_stored_proc " + param1;

Which still leaves you wide...

Before I write I always...

Brad (6/6/2008)

---

Good question, but the answer leaves me a bitter. I assumed Stored Procedures were in use with proper parameter types. (which is what I use). So...

GSquared (6/6/2008)

---

The problem I was bringing up is that, according the news articles in May this year, thousands of servers did NOT have adequate SQL injection prevention measures, and according...

Tao Klerks (6/6/2008)

---

Hi, the sample actually assumes old-style ASP (usually coded in VBScript), but the point is not the extraction of the list of databases.

Getting the list of databases using...

Hugo Kornelis (6/6/2008)

---

Mike,

My assumption on reading the questing was that "account=" is generated by the page, and the rest comes from an input box. The user is supposed to just...