No, very minor check. Some checks are still needed, but even if you say

select * from mytable

v

select * from dbo.mytable, the permission check is...

I see that you can. I suspect that using db_ddladmin or db_dbowner is the same as dbo. Not sure I'd like a user role or app role, but haven't thought...

It will be more possible once we migrate platforms. We'll have more resources that can look at things like this.

Hadn't thought about that. Can a role own a schema? I thought schemas needed a person that owned them, but if a role can do it, without any issues, I'd...

If you are asking for help, we'd like to see what you've done, or what you think.

Also, which versions and what is the purpose of the requirement? This...

Are they at a  known office or random internet places? If the former, there are other solutions, including IP limitatons and/or IPSec at the networking layers. Similar to VPN, but...

If that's something that's a part of the new software, we can easily do it. If  it's not, likely this would be a low priority item. It's one of those...

Ah, it does appear some hidden characters are in there, hidden by HTML.

Edited the string to remove them.

What is the weirdness? The question contains information that explained a few things.

First, the length is 130 characters.  QUOTENAME() only supports 128 characters, which is the limit for...

FWIW, for both the vendor of this forum software (InstantASP) and the  few others we've talked to, this is the longest thread anyone has ever seen.

If you want driving, you want an API of some sort. Roads aren't easily calculated in SQL without lots of data. If you just have zip codes, you'll get straight...

have to be careful here Serveradmin gives you some stuff. Not sure to the extent they can get to xp_cmdshell, but if you can change the registry, you can really...

As Lynn mentioned, dynamic SQL is needed.

declare @cmd varchar(max)
-- set cursor
set @cmd = 'select ... from ' + @dbame + '.sys.objects'
-- stuff
exec(@cmd)