Jeff Moden

Forum Replies Created

Viewing 15 posts - 27,136 through 27,150 (of 59,101 total)

RE: The Command Shell

peleg (3/29/2013)
why to use xp_cmdshell when you have the ability to write assembly it NET, more then that, that can be signed and give a higher level of security?
we are...
--Jeff Moden
RBAR is pronounced "ree-bar" and is a "Modenism" for Row-By-Agonizing-Row.
First step towards the paradigm shift of writing Set Based code:
________Stop thinking about what you want to do to a ROW... think, instead, of what you want to do to a COLUMN.
Change is inevitable... Change for the better is not.
Helpful Links:
How to post code problems
How to Post Performance Problems
Create a Tally Function (fnTally)

March 29, 2013 at 7:19 am

#1602004
RE: The Command Shell

Turning xp_CmdShell off is a useless and futile thing to do. Look at what Chuck.Hamilton wrote above. If an internal or external hacker gets in as "SA", they...
--Jeff Moden
RBAR is pronounced "ree-bar" and is a "Modenism" for Row-By-Agonizing-Row.
First step towards the paradigm shift of writing Set Based code:
________Stop thinking about what you want to do to a ROW... think, instead, of what you want to do to a COLUMN.
Change is inevitable... Change for the better is not.
Helpful Links:
How to post code problems
How to Post Performance Problems
Create a Tally Function (fnTally)

March 29, 2013 at 6:52 am

#1601994
RE: Split strings alternative to XML

MackF (3/27/2013)
I have got it...
create function Split_fnOK
(
@datavarchar(8000),
@deli_char varchar(3)
)
returns @list table
(
Idxint,
datavarchar(8000)
)
as
begin
declare @from_locint
declare @to_locint
if charindex(@deli_char,@data,0) <= 0
begin
insert into @list(Idx, data) values (1, @data)
return
end
if charindex(@deli_char,@data,0) > 0
begin
select @from_loc= 0
select...
--Jeff Moden
RBAR is pronounced "ree-bar" and is a "Modenism" for Row-By-Agonizing-Row.
First step towards the paradigm shift of writing Set Based code:
________Stop thinking about what you want to do to a ROW... think, instead, of what you want to do to a COLUMN.
Change is inevitable... Change for the better is not.
Helpful Links:
How to post code problems
How to Post Performance Problems
Create a Tally Function (fnTally)

March 28, 2013 at 8:05 pm

#1601927
RE: So How Do You do your mass Mailings?

OCTom (3/28/2013)
Where I work mass mailings are done using mail merge in MS Word. We set up a data source on the user PC pointing to the SQL table used...
--Jeff Moden
RBAR is pronounced "ree-bar" and is a "Modenism" for Row-By-Agonizing-Row.
First step towards the paradigm shift of writing Set Based code:
________Stop thinking about what you want to do to a ROW... think, instead, of what you want to do to a COLUMN.
Change is inevitable... Change for the better is not.
Helpful Links:
How to post code problems
How to Post Performance Problems
Create a Tally Function (fnTally)

March 28, 2013 at 8:02 pm

#1601926
RE: Forum Etiquette: How to post data/code on a forum to get the best help

churlbut (3/27/2013)
Seems like this article is like old news, not only do I see this mentioned quite often in forums when I have time to check questions, but now its...
--Jeff Moden
RBAR is pronounced "ree-bar" and is a "Modenism" for Row-By-Agonizing-Row.
First step towards the paradigm shift of writing Set Based code:
________Stop thinking about what you want to do to a ROW... think, instead, of what you want to do to a COLUMN.
Change is inevitable... Change for the better is not.
Helpful Links:
How to post code problems
How to Post Performance Problems
Create a Tally Function (fnTally)

March 27, 2013 at 9:49 pm

#1601444
RE: How to call a batch file to execute from an SP

Or, you could do what I've done. Work with the "team" to properly lock down the system and then use all of those tools as they were intended to...
--Jeff Moden
RBAR is pronounced "ree-bar" and is a "Modenism" for Row-By-Agonizing-Row.
First step towards the paradigm shift of writing Set Based code:
________Stop thinking about what you want to do to a ROW... think, instead, of what you want to do to a COLUMN.
Change is inevitable... Change for the better is not.
Helpful Links:
How to post code problems
How to Post Performance Problems
Create a Tally Function (fnTally)

March 27, 2013 at 1:22 pm

#1601338
RE: Forum Etiquette: How to post data/code on a forum to get the best help

I guess my take on such a thing as SQLFiddle is if we can't even get someone to cut and paste a CREATE TABLE statement, what makes us think they'll...
--Jeff Moden
RBAR is pronounced "ree-bar" and is a "Modenism" for Row-By-Agonizing-Row.
First step towards the paradigm shift of writing Set Based code:
________Stop thinking about what you want to do to a ROW... think, instead, of what you want to do to a COLUMN.
Change is inevitable... Change for the better is not.
Helpful Links:
How to post code problems
How to Post Performance Problems
Create a Tally Function (fnTally)

March 27, 2013 at 1:11 pm

#1601335
RE: Forum Etiquette: How to post data/code on a forum to get the best help

Guy Thiebaut (3/27/2013)
Nice article.
Only comment I would add is that I find your indentation makes the code difficult to read for me.
So with this:
FROM #MyTable v,
...
--Jeff Moden
RBAR is pronounced "ree-bar" and is a "Modenism" for Row-By-Agonizing-Row.
First step towards the paradigm shift of writing Set Based code:
________Stop thinking about what you want to do to a ROW... think, instead, of what you want to do to a COLUMN.
Change is inevitable... Change for the better is not.
Helpful Links:
How to post code problems
How to Post Performance Problems
Create a Tally Function (fnTally)

March 27, 2013 at 7:59 am

#1601159
RE: How to call a batch file to execute from an SP

mister.magoo (3/26/2013)
How do we all feel about SQL Agent Jobs and the ability to run operating system commands from them?
(I know the user running the job will have been configured...
--Jeff Moden
RBAR is pronounced "ree-bar" and is a "Modenism" for Row-By-Agonizing-Row.
First step towards the paradigm shift of writing Set Based code:
________Stop thinking about what you want to do to a ROW... think, instead, of what you want to do to a COLUMN.
Change is inevitable... Change for the better is not.
Helpful Links:
How to post code problems
How to Post Performance Problems
Create a Tally Function (fnTally)

March 26, 2013 at 10:52 pm

#1601025
RE: How to call a batch file to execute from an SP

opc.three (3/26/2013)
Sergiy (3/26/2013)
opc.three (3/26/2013)
Securing SQL Server by Denny Cherry:
- page 153 recommends to "disable xp_cmdshell"
- page 161 recommends "removing the extended stored proc xp_cmdshell" but goes on to say that...
--Jeff Moden
RBAR is pronounced "ree-bar" and is a "Modenism" for Row-By-Agonizing-Row.
First step towards the paradigm shift of writing Set Based code:
________Stop thinking about what you want to do to a ROW... think, instead, of what you want to do to a COLUMN.
Change is inevitable... Change for the better is not.
Helpful Links:
How to post code problems
How to Post Performance Problems
Create a Tally Function (fnTally)

March 26, 2013 at 9:53 pm

#1601018
RE: How to call a batch file to execute from an SP

opc.three (3/26/2013)
Jeff, I respect your position, however vehemently I might disagree with it. You make valid points but for me, xp_cmdshell is not and never will be cast in a...
--Jeff Moden
RBAR is pronounced "ree-bar" and is a "Modenism" for Row-By-Agonizing-Row.
First step towards the paradigm shift of writing Set Based code:
________Stop thinking about what you want to do to a ROW... think, instead, of what you want to do to a COLUMN.
Change is inevitable... Change for the better is not.
Helpful Links:
How to post code problems
How to Post Performance Problems
Create a Tally Function (fnTally)

March 26, 2013 at 9:45 pm

#1601017
RE: How to call a batch file to execute from an SP

opc.three (3/26/2013)
Here is Erland Sommarskog saying to Microsoft "The first thought at hand is to use xp_cmdshell to run a DEL command, but xp_cmdshell is best disabled."
https://connect.microsoft.com/SQLServer/feedback/details/470000/make-it-possible-to-copy-certificiates-between-databases-without-the-file-system
If you have any...
--Jeff Moden
RBAR is pronounced "ree-bar" and is a "Modenism" for Row-By-Agonizing-Row.
First step towards the paradigm shift of writing Set Based code:
________Stop thinking about what you want to do to a ROW... think, instead, of what you want to do to a COLUMN.
Change is inevitable... Change for the better is not.
Helpful Links:
How to post code problems
How to Post Performance Problems
Create a Tally Function (fnTally)

March 26, 2013 at 9:26 pm

#1601013
RE: How to call a batch file to execute from an SP

opc.three (3/26/2013)
Jeff Moden (3/26/2013)
opc.three (3/25/2013)
Jeff Moden (3/25/2013)
opc.three (3/24/2013)
You're still hung up on 'external attackers.' The point is, xp_cmdshell is a blunt tool that cannot be audited and allows people to...
--Jeff Moden
RBAR is pronounced "ree-bar" and is a "Modenism" for Row-By-Agonizing-Row.
First step towards the paradigm shift of writing Set Based code:
________Stop thinking about what you want to do to a ROW... think, instead, of what you want to do to a COLUMN.
Change is inevitable... Change for the better is not.
Helpful Links:
How to post code problems
How to Post Performance Problems
Create a Tally Function (fnTally)

March 26, 2013 at 9:20 pm

#1601012
RE: How to call a batch file to execute from an SP

Michael L John (3/26/2013)
Wow. I started a war.
Do all of you realize that you are saying the same things, but in different contexts?
Security is not something simple, and to...
--Jeff Moden
RBAR is pronounced "ree-bar" and is a "Modenism" for Row-By-Agonizing-Row.
First step towards the paradigm shift of writing Set Based code:
________Stop thinking about what you want to do to a ROW... think, instead, of what you want to do to a COLUMN.
Change is inevitable... Change for the better is not.
Helpful Links:
How to post code problems
How to Post Performance Problems
Create a Tally Function (fnTally)

March 26, 2013 at 7:51 am

#1600795
RE: How to call a batch file to execute from an SP

opc.three (3/25/2013)
Jeff Moden (3/25/2013)
opc.three (3/24/2013)
You're still hung up on 'external attackers.' The point is, xp_cmdshell is a blunt tool that cannot be audited and allows people to run commands as...
--Jeff Moden
RBAR is pronounced "ree-bar" and is a "Modenism" for Row-By-Agonizing-Row.
First step towards the paradigm shift of writing Set Based code:
________Stop thinking about what you want to do to a ROW... think, instead, of what you want to do to a COLUMN.
Change is inevitable... Change for the better is not.
Helpful Links:
How to post code problems
How to Post Performance Problems
Create a Tally Function (fnTally)

March 26, 2013 at 6:21 am

#1600745

Viewing 15 posts - 27,136 through 27,150 (of 59,101 total)