Viewing 15 posts - 28,951 through 28,965 (of 49,552 total)
In which method? The one on my blog or the one shown here?
The one on my blog, no. http://sqlinthewild.co.za/index.php/2009/04/03/dynamic-sql-and-sql-injection/
The one shown here, absolutely yes.
exec PTicketSearch NULL,NULL, '''; DROP TABLE ProblemTicket;...
Gail Shaw
Microsoft Certified Master: SQL Server, MVP, M.Sc (Comp Sci)
SQL In The Wild: Discussions on DB performance with occasional diversions into recoverability
December 10, 2010 at 12:00 am
That command you just posted had double quotes around the string (I checked, it's the character "). That's not what I put into the procedure I fixed for you earlier....
Gail Shaw
Microsoft Certified Master: SQL Server, MVP, M.Sc (Comp Sci)
SQL In The Wild: Discussions on DB performance with occasional diversions into recoverability
December 9, 2010 at 3:58 pm
dso808 (12/9/2010)
That's all that was returned. Interesting - what do you think?
Read my last post.
I do not recommend this approach. Take a look at the method on my blog...
Gail Shaw
Microsoft Certified Master: SQL Server, MVP, M.Sc (Comp Sci)
SQL In The Wild: Discussions on DB performance with occasional diversions into recoverability
December 9, 2010 at 3:54 pm
Not sure if it's available for download, except possibly as part of the trial version of SQL Server. If it's not included in one of the SQL Express packages, it's...
Gail Shaw
Microsoft Certified Master: SQL Server, MVP, M.Sc (Comp Sci)
SQL In The Wild: Discussions on DB performance with occasional diversions into recoverability
December 9, 2010 at 2:45 pm
dso808 (12/9/2010)
I then put in the double quotes.
Look again, those were not double quotes. They're two single quotes. (two so that the quote is escaped and appears within the...
Gail Shaw
Microsoft Certified Master: SQL Server, MVP, M.Sc (Comp Sci)
SQL In The Wild: Discussions on DB performance with occasional diversions into recoverability
December 9, 2010 at 2:41 pm
dso808 (12/9/2010)
--...
Gail Shaw
Microsoft Certified Master: SQL Server, MVP, M.Sc (Comp Sci)
SQL In The Wild: Discussions on DB performance with occasional diversions into recoverability
December 9, 2010 at 2:05 pm
If you insist on doing it this way, make sure that you check and re-check the varcahr params for malicious code.
See corrections within. You're missing quotes.
dso808 (12/9/2010)
(
@StartDate...
Gail Shaw
Microsoft Certified Master: SQL Server, MVP, M.Sc (Comp Sci)
SQL In The Wild: Discussions on DB performance with occasional diversions into recoverability
December 9, 2010 at 2:00 pm
Craig Farrell (12/9/2010)
Gail, sadly, I know. I didn't say it was pretty, just easy to maintain and is 'good enough' against smaller recordsets.
As long as they stay small....
Gail Shaw
Microsoft Certified Master: SQL Server, MVP, M.Sc (Comp Sci)
SQL In The Wild: Discussions on DB performance with occasional diversions into recoverability
December 9, 2010 at 1:55 pm
Craig Farrell (12/8/2010)
The quick and dirty solution is this:
The quick, dirty and generally non-performent solution.
http://sqlinthewild.co.za/index.php/2009/03/19/catch-all-queries/
Edit: Just note that MC's version is vulnerable to SQL Injection. The version I have in...
Gail Shaw
Microsoft Certified Master: SQL Server, MVP, M.Sc (Comp Sci)
SQL In The Wild: Discussions on DB performance with occasional diversions into recoverability
December 9, 2010 at 1:03 pm
It's unlikely to change anything. Varchar data type is variable length - it is only as large as the data in it (plus 2 bytes), so a Varchar(50) that contains...
Gail Shaw
Microsoft Certified Master: SQL Server, MVP, M.Sc (Comp Sci)
SQL In The Wild: Discussions on DB performance with occasional diversions into recoverability
December 9, 2010 at 9:31 am
GCeaser@aol.com (12/9/2010)
1. Full Recovery Mode in SQL Server 2008
Why full recovery if you never need to run log backups?
3. With each backup (full or incremental) we truncate the transaction...
Gail Shaw
Microsoft Certified Master: SQL Server, MVP, M.Sc (Comp Sci)
SQL In The Wild: Discussions on DB performance with occasional diversions into recoverability
December 9, 2010 at 9:28 am
zahidshah (12/9/2010)
Restore database Databasenamefrom disk='c:\backup\testbackup.bak'
with norecovery
You ran it exactly like that? You ran no other restore commands prior to the log restore? No one else ran a 'restore database with...
Gail Shaw
Microsoft Certified Master: SQL Server, MVP, M.Sc (Comp Sci)
SQL In The Wild: Discussions on DB performance with occasional diversions into recoverability
December 9, 2010 at 9:15 am
stevemc (12/8/2010)
[font="Courier New"]create nonclustered index x2 on t1...
Gail Shaw
Microsoft Certified Master: SQL Server, MVP, M.Sc (Comp Sci)
SQL In The Wild: Discussions on DB performance with occasional diversions into recoverability
December 8, 2010 at 10:46 pm
dlam 18073 (12/8/2010)
e.g.nvarchar(max)
"hello world" is 11 Bytes,
"hello" is 5 Bytes,
varchar(max)
"hello world" is 22 Bytes,
"hello" is 10 Bytes,
am i right?
No. Wrong way around.
Datalength of a varchar(max) with 'Ben'...
Gail Shaw
Microsoft Certified Master: SQL Server, MVP, M.Sc (Comp Sci)
SQL In The Wild: Discussions on DB performance with occasional diversions into recoverability
December 8, 2010 at 10:28 pm
http://www.google.com/search?q=%22SQL+Server%22+unicode
Gail Shaw
Microsoft Certified Master: SQL Server, MVP, M.Sc (Comp Sci)
SQL In The Wild: Discussions on DB performance with occasional diversions into recoverability
December 8, 2010 at 3:31 pm
Viewing 15 posts - 28,951 through 28,965 (of 49,552 total)