In general, are there any pitfalls with updating data from a SSRS report?*
More specific, I'm talking about this context:
- SSRS 2008 (with the option to upgrade, if needed).
- MSSQL 2008 (with the option to upgrade, if needed).
- Web.forms ReportViewer 2010 in our own ASP.NET application.
I only need to do a minor DB update. The user can tick a checkbox parameter "I'm going to print this" which will do a small update or insert to mark the report has been run at a specific point in time. The report will only show items were added since the previous "print" run, so I filter in my WHERE clause based on that, giving the user only "new" items.
The reason I'm worried is because it doesn't "feel right" to do updates from a tool that's meant primarily for viewing data. On the other hand, with something as small as above it seems like the easiest solution.
Here are some specific concerns I have about which I'm seeking insight:
- Security: the report's connection will need to be run with a user that's allowed to do inserts, where a more sensible default would be to run it for a select-only user? Are there known sql-injection-like attacks for SSRS?
- Usability: I'd like to do the update depending on whether a user ticks a checkbox. I'm not sure how well this would play with refreshes, and if you can detect what the rendering format is while doing the queries (which would allow me to make the checkbox trigger updates only on -e.g.- a PDF export).
- Robustness: update statements seem more prone to exceptions (violating constraints, etc). Not sure if there's an elegant way to prevent, log, track, and debug that kind of problem.