|
Be careful with both those approaches as they are weak points from which a SQL Injection attack could be launched. If you are selecting an existing table, then it is worthwhile checking that the table exists already with a proper parameterised query so you can be sure there isn't anything nasty injected into the tableName variable you are using.
My: Blog | Photos
WDevs.com - Open Source Code Hosting, Blogs, FTP, Mail and More
|
|
|
|
|
You are very much correct, and why I specifically asked for a parameterised query is for the same reason, to avoid Injection Attack. So can you explain how I can use a parameter to substitite for table name? I couldn't get it to work !!
|
|
|
|
|
csylesh wrote:
So can you explain how I can use a parameter to substitite for table name? I couldn't get it to work !!
You would have to use something like Javier suggested. You cannot have a table name as a parameter. However, table names are unlikely to have strange characters in them* so you can easily check it for non-alphanumeric characters and reject the name if it contains such things.
Also, if you are just checking for a tables existance, you can create a query such as
SELECT *
FROM INFORMATION_SCHEMA.TABLES
WHERE TABLE_NAME = @MyTableNameParameter
Does this help?
* Having said that, a table name, if I remember correctly, can be any unicode string upto 128 characters so it is still possible.
My: Blog | Photos
WDevs.com - Open Source Code Hosting, Blogs, FTP, Mail and More
|
|
|
|
|
Thanks, I just wanted to hear from somebody authoritatively that a parameter substitution is not possible for a table name.
Let me raise a new question for curiosity, how does parameter substitution actually prevents injection attack evenif it is a string datatype that is being substituted. Is it some magic with the quotes substitution or the like? Any ideas?? Thanks in advance.
|
|
|
|
|
Hello friends!!
In Execution plan please somebody help me to understand I am new to it.
If I run one select statement having Execution plan...
1.first of all what we will watch closely so that it will understand easily i.e related to costing....
2.Here I am seeing factors like 'SELECT' ,' TOP' , Hash Match/Left Anti Semi Join.
3.Index Scan : Physical Operation and Logical Operation
Here only I can see some factores like
Physical Operation And Logical Operation
a)Row Count =========== 26,795,748
b)Estimated Row Size ==== 132 (What this exactly means??)
c)I/O Cost ============ 209
d)CPU Cost ============ 29.5
e)Number Of Executes ==== 1
f)Cost ============== 238.884090(57%)
h)Subtree Cost ======== 417
i)Estimated Row Count==== 26,795,748
4.Computer Scalar:
5.Stram Aggregate/Aggregate
6.Table Scan
Like That........
Please somebody guide me in that I will be thankful.. (Please Give me detail description where i can judge all factors of execution plan so that i can reduce the cost of query if possible)
T.I.A
Shashank
|
|
|
|
|
|
1. The most important thing, generally, to look at is whether the operations being performed are what you think should be performed. Are any indexes being maintained that you think are unnecessary? Is an index being ignored? If there are multiple steps in a query (perhaps this was a batch of statements, or a stored procedure) look first at the one that consumed the most time - this is reported as a percentage. Concentrate your efforts on improving the subtrees that consumed the most time.
2. These are the operations being performed. The SELECT operator returns the rows returned by the operations to its right to the client - as such it doesn't add very much overhead at all. TOP guides the operations to the right to stop once the given number of rows are returned.
A Hash Match[^] is a way of performing a join, useful if there are a lot of join conditions. The server builds a hash table for both the left and right sides and compares the hash values to determine if there's a match. The Left Anti Semi Join[^] means that rows that are in the first but not in the second are returned - your query probably uses NOT IN, or similar.
Hash matches tend to be used if no suitable index was used. If a suitable index is available, and the number of rows to be returned is small, SQL Server will normally use nested loops with an index seek to find rows in the second table.
3. An Index Scan is where SQL Server starts at the beginning of the index and reads every row, to the end, looking for rows that match. Compare this to an Index Seek, where SQL Server looks directly for a particular value by looking in the right place. It's the difference between looking for an entry in a phone book by starting at the beginning and looking at every page, and looking instead for the first letter, then the next letter, etc.
a) This is the number of rows that were actually returned by this operator.
b) This is how big each row was. If the source was an actual database table, this is the size of the row from the table. Multiplying this by the number of rows gives an indication of how much data needed to be transferred from disk or read from buffers. If the query plan includes a Spool operator, it indicates how much needed to be written out to the disk and re-read.
c) I/O cost - seconds spent waiting for data to be retrieved from disk
d) CPU Cost - seconds of CPU time spent
e) Number of executes - the number of times this operator was executed. If a child of a 'nested loops' operation, the larger data set will show as 1, while the smaller will be the number of rows returned from the larger set, typically (because for each entry in the data set, the execution engine performs the second operation to find rows that match).
f) Cost - total cost of this operation, which is I/O + CPU cost
h) Subtree cost - seconds of time spent executing this operation and the operations to the right of it
i) Estimated row count - number of rows that SQL Server estimated that this operation would produce, based on the statistics it keeps for indexes and optionally for other columns too.
4. Compute Scalar[^] simply calculates values from other values in the row. This seems to also appear if you have text, ntext or image type columns - an additional lookup has to occur to find the data if it's not stored in the row.
5. Stream Aggregate/Aggregate computes aggregate expressions such as SUM, AVG, COUNT, etc. The difference between Stream Aggregate and Aggregate is that Stream Aggregate requires that the data is already sorted into the correct groups.
6. Table Scan[^] reads the table from beginning to end to match rows.
Why would SQL Server choose an Index Scan rather than a Table Scan? It has to do with how the index is implemented. Basically, all the columns listed in the index definition are duplicated in the index data, plus the lookup key to correlate this entry in the index back into the main table. If the table has a clustered index, this lookup key is the data from the columns that make up the clustered index. If all the columns needed for the query are included in the index, SQL Server may decide to read the index rather than the table itself. Doing so will reduce the amount of data that needs to be read from disk, since the index row size is smaller than the table row size.
The first thing I'd do would be to try to turn your table scans and index scans into index seeks. To do that we have to make your existing indexes work better and perhaps add new indexes. First, ensure that you're not trying to optimise an operation that will occur very rarely - introducing new indexes to speed up this operation will normally slow down insert, update and delete operations as the indexes need to be maintained. Of course an index may also speed up write operations as the appropriate place for the record may be found faster.
Without seeing the data it's hard to say what could help. The Index Tuning Wizard will be able to offer some suggestions. Ensure you give it a decent amount of realistic trace data.
Stability. What an interesting concept. -- Chris Maunder
|
|
|
|
|
I have a store procedure that will insert two rows into two tables. I want my procedure either both two statements process sucessful or none of that (if the second insert statement fails, the first one will roll back). And how can we catch an error when it appears from the insert statement to raise our custom error (using the statement 'raise error')?
Thanks! 
|
|
|
|
|
Immediately after the INSERT statement you can do something like this:
SELECT @errorCode = @@error;
You must do this on the next statment as @@error returns the error code of the previous statement. The SELECT here is to capture the code so it can be used in multiple statements afterwards. Remember to DECLARE your variable before the INSERT statement.
My: Blog | Photos
WDevs.com - Open Source Code Hosting, Blogs, FTP, Mail and More
|
|
|
|
|
Thanks a lot!
|
|
|
|
|
Hai,
Can any body explain me how I can debug a dll file.
Thank you,
Deepa.N
|
|
|
|
|
If you don't want to go down to assembler level, you'll probably have to find the source code for the dll, set it to debug and recompile it. If you have the same version dll and project, you should be able to step through the code in debug mode without a problem. If you have no source code, you'll be in for a tough time.
Simplicity is the key to the universe
|
|
|
|
|
Hello friends!!
Can anybody tell me 'The meaning of this output'
I saw 6 columns , anybody tell me what they columns indicate
SELECT *
from master.dbo.spt_values
T.I.A
Shashank
|
|
|
|
|
Hi I need a list of triggers and their parent tables in a database. I have a script that does this very nicely. Problem is, i'm using system tables (frowned upon practice) to do it. Is there a nice way of doing this without using system tables directly or temp tables or the undocumented ms_foreachtable sp. ?
Here's what I have:
SELECT S.NAME AS TABLENAME, T.NAME AS TRIGGERNAME,
ObjectProperty( T.id, 'ExecIsUpdateTrigger') AS 'Update',
ObjectProperty( T.id, 'ExecIsDeleteTrigger') as 'Delete',
ObjectProperty( T.id, 'ExecIsInsertTrigger') as 'Insert',
ObjectProperty( T.id, 'ExecIsAfterTrigger') as 'After',
ObjectProperty( T.id, 'ExecIsInsteadOfTrigger') as 'Instead'
FROM SYSOBJECTS S
INNER JOIN SYSOBJECTS T ON
S.ID = T.PARENT_OBJ
WHERE T.XTYPE='TR'
ORDER BY TABLENAME
Simplicity is the key to the universe
|
|
|
|
|
I like using Dataset ...but there's a question in my mind that if you use dataset to modify your data in the table(example: Customers) and another user's using dataset to modify data on the table too...then what happend if another user deleted some row ,change primary key and SAVE to the database .... your data is now not the same to the database .......Can you explain me about DISCONECTED DATA...advantage and disadvantage..thanks you....I hope you understand my question ...(my English is not good)..
The man with nothing to lose
|
|
|
|
|
You can read about Optimistic Concurrency in the MSDN library which describes the scenario that you are referring to .
|
|
|
|
|
Where can I find the version info (on my laptop) for the version of the
Microsoft.JET.OLEDB that I am running? Is it 4.0 or 4.xx etc... I can't seem to find it in VS .NET or Access. I'm new to this stuff so please go easy.... thanks...
This is in regard to filling a DataGrid, on a Form1_Load event as in
"Provider=Microsoft.JET.OLEDB.??"
Wrote a C# Win Form. Included System.Data.OleDb etc..
Have Win XP Pro w/ Access 2002
|
|
|
|
|
Hi,
I try to make a page insert a record in a table but get the IConvertable.
Using a example out of the ASP.NET bible it puzzles me.
The complete code can be found at http://www.harry-arends.nl/addPeuter.aspx.txt and the error report looks like this
Object must implement IConvertible.
Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.
Exception Details: System.InvalidCastException: Object must implement IConvertible.
Source Error:
Line 61: 'De SQL-Verbinding openen, opdracht uitvoeren en verbinding sluiten
Line 62: KSComm.Connection.Open()
Line 63: KSComm.ExecuteNonQuery()
Line 64: lblMessage.Text = "Peuter met succes toegevoegd."
Line 65: KSComm.Connection.Close()
Source File: C:\Inetpub\KiddinSys\addPeuter.aspx Line: 63
Stack Trace:
[InvalidCastException: Object must implement IConvertible.]
System.Data.SqlClient.SqlCommand.ExecuteReader(CommandBehavior cmdBehavior, RunBehavior runBehavior, Boolean returnStream) +721
System.Data.SqlClient.SqlCommand.ExecuteNonQuery() +196
ASP.addPeuter_aspx.addPeuter_Click(Object Src, EventArgs e) in C:\Inetpub\KiddinSys\addPeuter.aspx:63
System.Web.UI.WebControls.Button.OnClick(EventArgs e) +108
System.Web.UI.WebControls.Button.System.Web.UI.IPostBackEventHandler.RaisePostBackEvent(String eventArgument) +57
System.Web.UI.Page.RaisePostBackEvent(IPostBackEventHandler sourceControl, String eventArgument) +18
System.Web.UI.Page.RaisePostBackEvent(NameValueCollection postData) +33
System.Web.UI.Page.ProcessRequestMain() +1277
--------------------------------------------------------------------------------
Version Information: Microsoft .NET Framework Version:1.1.4322.573; ASP.NET Version:1.1.4322.573
|
|
|
|
|
Hello,
Have you ever needed to create a Barcode but all you could find are
articles that use graphics or some font package?
Well Here is a script that will allow you to use SQL Server and HTML
to create the BarCode. You will not need anything special other then
the ability to render the HTML.
--------------------------------------------------
SQL CODE
<br />
--<br />
-- Create the Function first<br />
--<br />
CREATE FUNCTION F_TranslateToCode39(@StringToTranslate CHAR(1))<br />
<br />
RETURNS VARCHAR(2000)<br />
AS<br />
<br />
BEGIN<br />
<br />
DECLARE<br />
@ReturnString VARCHAR(2000)<br />
,@RawCode VARCHAR(12)<br />
,@Counter INT<br />
--<br />
-- First get the Raw representation of the character<br />
-- this will tell us what color the lines need to be<br />
-- for more references on this please refer to the following<br />
-- XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX<br />
-- http:
-- XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX<br />
SET @RawCode = (CASE UPPER(@StringToTranslate)<br />
WHEN '0' THEN '101001101101'<br />
WHEN '1' THEN '110100101011'<br />
WHEN '2' THEN '101100101011'<br />
WHEN '3' THEN '110110010101'<br />
WHEN '4' THEN '101001101011'<br />
WHEN '5' THEN '110100110101'<br />
WHEN '6' THEN '101100110101'<br />
WHEN '7' THEN '101001011011'<br />
WHEN '8' THEN '110100101101'<br />
WHEN '9' THEN '101100101101'<br />
WHEN 'A' THEN '110101001011'<br />
WHEN 'B' THEN '101101001011'<br />
WHEN 'C' THEN '110110100101'<br />
WHEN 'D' THEN '101011001011'<br />
WHEN 'E' THEN '110101100101'<br />
WHEN 'F' THEN '101101100101'<br />
WHEN 'G' THEN '101010011011'<br />
WHEN 'H' THEN '110101001101'<br />
WHEN 'I' THEN '101101001101'<br />
WHEN 'J' THEN '101011001101'<br />
WHEN 'K' THEN '110101010011'<br />
WHEN 'L' THEN '101101010011'<br />
WHEN 'M' THEN '110110101001'<br />
WHEN 'N' THEN '101011010011'<br />
WHEN 'O' THEN '110101101001'<br />
WHEN 'P' THEN '101101101001'<br />
WHEN 'Q' THEN '101010110011'<br />
WHEN 'R' THEN '110101011001'<br />
WHEN 'S' THEN '101101011001'<br />
WHEN 'T' THEN '101011011001'<br />
WHEN 'U' THEN '110010101011'<br />
WHEN 'V' THEN '100110101011'<br />
WHEN 'W' THEN '110011010101'<br />
WHEN 'X' THEN '100101101011'<br />
WHEN 'Y' THEN '110010110101'<br />
WHEN 'Z' THEN '100110110101'<br />
WHEN ' ' THEN '100110101101'<br />
WHEN '*' THEN '100101101101'<br />
WHEN '%' THEN '101001001001'<br />
WHEN '-' THEN '100101011011'<br />
ELSE '' END)<br />
<br />
<br />
--<br />
-- Now that we have the Raw data check it<br />
--<br />
SELECT @Counter = 0<br />
,@ReturnString = ''<br />
--<br />
-- Test each character for color<br />
-- <br />
WHILE @Counter < LEN(@RawCode)+1 BEGIN<br />
--<br />
-- <br />
--<br />
IF (SUBSTRING(@RawCode,@Counter,1) = '0') BEGIN<br />
<br />
SELECT @ReturnString = @ReturnString + '<TD style="background-color:White;height:7mm;width:0.3mm;"></TD>'<br />
GOTO COUNT_IT<br />
END <br />
IF (SUBSTRING(@RawCode,@Counter,1) = '1') BEGIN<br />
<br />
SELECT @ReturnString = @ReturnString + '<TD style="background-color:Black;height:7mm;width:0.3mm;"></TD>'<br />
GOTO COUNT_IT<br />
END<br />
--<br />
--<br />
COUNT_IT:<br />
SET @Counter = @Counter + 1<br />
--<br />
--<br />
END<br />
--<br />
-- Add Character Seperator REQUIRED!<br />
--<br />
SELECT @ReturnString = @ReturnString + '<TD style="background-color:White;height:7mm;width:0.4mm;"></TD>'<br />
--<br />
RETURN @ReturnString<br />
END<br />
GO<br />
--<br />
-- Now for the procedure that makes it all happen<br />
--<br />
CREATE PROCEDURE spGenerateHTMLBarCodeString<br />
@StringToEncode VARCHAR(50)<br />
,@ResultMessage VARCHAR(200) = '' OUTPUT<br />
AS<br />
DECLARE<br />
@ReturnCode INT<br />
,@Counter INT<br />
,@CompleteString VARCHAR(60)<br />
--<br />
DECLARE @BarcodeTable TABLE<br />
(BarcodeHTML VARCHAR(2000) NOT NULL DEFAULT '')<br />
--<br />
SET NOCOUNT ON<br />
--<br />
SELECT @CompleteString = '*' + LTRIM(RTRIM(@StringToEncode)) + '*'<br />
,@Counter = 1<br />
--<br />
INSERT INTO @BarcodeTable<br />
(BarcodeHTML)<br />
VALUES<br />
('<TABLE CELLPADDING="0" CELLSPACING="0"><TR>')<br />
--<br />
-- trim the string<br />
SET @CompleteString = LTRIM(RTRIM(@CompleteString))<br />
--<br />
WHILE @Counter < LEN(@CompleteString)+1 BEGIN<br />
--<br />
--<br />
INSERT INTO @BarcodeTable<br />
(BarcodeHTML)<br />
SELECT dbo.F_TranslateToCode39(SUBSTRING(@CompleteString,@Counter,1))<br />
--<br />
--<br />
SET @Counter = @Counter + 1<br />
--<br />
--<br />
END<br />
--<br />
INSERT INTO @BarcodeTable<br />
(BarcodeHTML)<br />
VALUES<br />
('</TR></TABLE>')<br />
--<br />
--<br />
SELECT BarcodeHTML FROM @BarcodeTable<br />
<br />
IF (@@ERROR != 0) BEGIN<br />
SET @ReturnCode = 1<br />
GOTO END_PROCEDURE<br />
END<br />
<br />
SET @ReturnCode = 0<br />
<br />
END_PROCEDURE:<br />
SET @ResultMessage = (CASE @ReturnCode<br />
WHEN 0 THEN 'OK'<br />
WHEN 1 THEN 'An error occured generating the Barcode you requested' +<br />
'.Please contact Information Systems (1).'<br />
ELSE<br />
'An unexpected error has occured, Error Number ' +<br />
CAST(@ReturnCode AS VARCHAR(5)) + '.'<br />
END)<br />
<br />
RETURN @ReturnCode<br />
GO<br />
--------------------------------------------------
Now here is the C# Code for the Web Form
You will need a Textbox, Button, Table and a
connection to the Database where you have created
the above procedure.
--------------------------------------------------
private void Button1_Click(object sender, System.EventArgs e)
{
TableRow ANewRow = new TableRow();
TableCell BarcodeCell = new TableCell();
//
Label BarCodeLabel = new Label();
//
BarCodeLabel.Text = this.GenerateBarCode(this.txtboxStringToConvert.Text);
BarcodeCell.Controls.Add(BarCodeLabel);
//
ANewRow.Cells.Add(BarcodeCell);
this.tblBarcodeTable.Rows.Add(ANewRow);
}
private string GenerateBarCode(string StringToTest)
{
string returnValue = "";
this.spGenerateHTMLBarCodeString.Parameters["@StringToEncode"].Value = StringToTest;
SqlDataReader BarCodeReader = this.spGenerateHTMLBarCodeString.ExecuteReader();
if (BarCodeReader.HasRows)
{
while (BarCodeReader.Read())
{
returnValue += BarCodeReader["BarcodeHTML"].ToString();
}
}
BarCodeReader.Close();
BarCodeReader = null;
return returnValue;
}
--------------------------------------------------
Well that's it. Now you should be able to generate Barcodes.
Please let me know if you have found this interesting or have
any changes to add that would make it better.
Thanks
William O'Malley
|
|
|
|
|
|
Who the heck voted this 4?
Um, it's very nice, and shows technical aptitude, but I would strongly recommend doing the conversion in C# on the client. Doing heavy string manipulation on the database server wastes processor time that would be better spent on data manipulations - work that cannot be done on the client.
It's particularly pointless doing this work in the database server if the client is providing the data to convert. You're wasting a round-trip to the database server - not cheap even if client and server are on the same machine and you're using the Shared Memory network library.
Stability. What an interesting concept. -- Chris Maunder
|
|
|
|
|
Thank you for the comments.
This script is part of a much bigger application where we barcode
steps in the planning so they can be scanned on the floor.
I just wanted to show a quick and dirty way to use it. If your only purpose was to use the textbox and not barcode information dynamically then yes it should be done on the client. The purpose of this script was to allow someone to use the function in a select statement to barcode information that will be presented on the screen.
Again thank you for the comments.
A 4 WOW... thank you!
William O'Malley
|
|
|
|
|
I've got a comment: this implementation is rubbish. I've seen an implementation of web-based barcode displays written by a tenth-rate Visual Basic programmer that was better than this.
Why is this written in T-SQL when a database isn't needed at all for this particular routine? The only thing you could justifiably use a database for here is the lookup from character to light/dark sequence, and you haven't done it.
Where's the separation between representation and display?
A C# function to return the sequence of light and dark bars (as and array of bools or just a string) for a given string, followed by a separate C# (or ASP.NET) rendering routine that takes a light/dark sequence, would be significantly more useful, easier to maintain, and wouldn't require a call to a database each time!
Even if your original string comes from a database, chucking a short string over makes much more sense than chucking over a wodge of HTML.
The rendering of a barcode should be done in an ASP.NET web control (or if you aren't using ASP.NET, the functional equivalent). That way, if you later on need to render a barcode in a Windows application, you've got one routine written already to work out the light/dark sequence, and all you need to do is write a GDI renderer that accepts it. With care, this could be extended to support any barcode symbology.
Ian Darling
The world is a thing of utter inordinate complexity ... that such complexity can arise ... out of such simplicity ... is the most fabulous extraordinary idea ... once you get some kind of inkling of how that might have happened - it's just wonderful ... the opportunity to spend 70 or 80 years of your life in such a universe is time well spent as far as I am concerned - Douglas Adams
|
|
|
|
|
I have a comment.
You try to post code for an example and expect people to read reply's
QUOTE:
I've got a comment: this implementation is rubbish.
Then write something better. I explained why I posted this the way I did.
QUOTE:
I've seen an implementation of web-based barcode displays written by a tenth-rate Visual Basic programmer that was better than this.
I could really care less.
QUOTE:
A C# function to return the sequence of light and dark bars (as and array of bools or just a string) for a given string, followed by a separate C# (or ASP.NET) rendering routine that takes a light/dark sequence, would be significantly more useful, easier to maintain, and wouldn't require a call to a database each time!
PLEASE READ THE ABOVE COMMENT!
Well thanks for the thoughts but when you have nothing of value to add then dont.
Will
|
|
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
