It's not sufficient. Consider this malicious parameter that has neither ;, nor --, nor any hex string at all.

declare @query varchar(max)

declare @parameter varchar(200)

set @parameter = '''' + CHAR(13) + CHAR(10)...

I wish!

I was thinking the super, ultimate, extremely awesome version. Why settle for second-best?

Did I say it was? It's an interesting trick.

I said dynamic SQL's the only way...

No. Truncate removes inactive log records but doesn't change the size of the file. Shrink...

Looks like a stale read or a lost write, usually caused by a mis-behaving disk cache. Check your hardware, see if there are any errors in any logs

I don't like...

baumgaertner (1/29/2009)

---

Unfortunately this doesn't work:

Here the code:

if (select nDbSubVersion from tblVersion) = 2

begin

alter table tblCustAttrDefValue add strHelpValue varchar(200) null

end

go

if (select nDbSubVersion from tblVersion) = 2

begin

...

The way you had it in your last post. Two ifs with a GO in between.

Yes. (or sp_executesql, same thing)

It's that, or break the batch using GO. Your choice.

Thought I remembered this: http://www.sqlservercentral.com/Forums/FindPost613599.aspx

Matt's advice (the last post of that thread) is good. Use dynamic SQL.

No.

Why do you have an if block that will never be executed in the first place? If...

You're confusing compile-time errors and run-time errors.

At compile time, the entire batch is checked for valid syntax and valid objects. If there's anything wrong, a syntax error is generated. This...

Yes. It's the REPAIR_REBUILD option. It only fixes things is all of the corruption...

Matt Cherwin (1/28/2009)

---

The one bright side to this is it helps support my position that all SQL Server instances in the firm should at least fall under my purview in...

You need to take shorter lunch breaks. 😀