New answers tagged t-sql
0
votes
Is there any (hidden) built-in function on MS-SQL to unquote object names?
Wrote this function in the past:
create or alter function dbo.UNQUOTENAME(@fragment varchar(1000), @unquote varchar(16) = '()[]{}""')
returns varchar(1000)
as
begin
declare @...
0
votes
Is this SQL Procedure "injection proof"?
Further to the answers above indicating that how one calls the procedure is what is most important, you can make this procedure more secure against SQL injection by:
make all tables and views no ...
- 101
3
votes
Is this SQL Procedure "injection proof"?
The procedure itself is fine, it would only be vulnerable if you were doing some kind of sql generation and execution inside it. You are however correct that you are doing the attack incorrectly, ...
- 408
7
votes
Is this SQL Procedure "injection proof"?
It's not enough that just the stored procedure is injection-proof. The code that calls the sproc must be secure too.
As a trivial counterexample, consider the following C# code that calls your sproc:
...
- 2,796
2
votes
Is this SQL Procedure "injection proof"?
No.
Injection can only happen with dynamic sql.
Dynamic SQL uses one of those 2 statements:
exec @querystring
sp_executesql ....
Your proc has none of these, it is thus not dynamic, it is thus not ...
- 435
14
votes
Accepted
Is this SQL Procedure "injection proof"?
SQL injection requires that the malicious content be added to (injected into) an SQL query string, which is then parsed by the database engine and executed. As a result, anything that looks like a ...
- 23.8k
4
votes
Is this SQL Procedure "injection proof"?
With dynamic SQL, you first build the SQL statements and then execute them in a later step. But in this case, you are passing parameters to your query. When you execute this statement "EXEC test @...
- 149
0
votes
Join on a date column?
When I use your fiddle, and combine it with the CTE above, it works (after changing some column names). Or is this not what you would like to achieve?
CREATE TABLE Employees
(
id INT,
name ...
- 1,523
1
vote
Accepted
Finding where a row changes for one column based on a list of matching words
I would start with finding actual rows that contain the changes:
SELECT
*
, changed = IIF(
pcpProvType NOT IN ('', 'NO PROVIDER TYPE') AND
COALESCE(LAG(pcpProvType, 1, pcpProvType) OVER (...
- 22.3k
0
votes
Is there a best practice for resolving dependencies of SQL objects for build during development?
The generic term you're looking for is migrations / migration scripts.
A Database Project (as per David Browne) is one tool to help manage migrations.
EF Core Migrations is another tool to manage ...
- 30.4k
1
vote
What is the transaction isolation level for SP_EXECUTE_REMOTE
The isolation level can be different according to your setting and actions. You can directly check the information by using SP_EXECUTE_REMOTE and run a query to check it.
To check the Connection ...
- 491
1
vote
How do I restore multiple transaction log backups after restoring a full backup SQLSERVER 2019
I just wanted to mention that there's an excellent script from Brent Ozar that allows restoring backups made with Ola's scripts (MIT licensed).
You could create the transaction logs with Ola's scripts ...
- 145
3
votes
Accepted
Does a select within a where clause affect performance?
No, the same principle doesn't apply in the example you gave. The optimizer will generally try to convert that type of predicate against a derived table into a set-based construct like a JOIN or ...
- 28.5k
Top 50 recent answers are included