Database

<br />
CREATE PROCEDURE Bonus<br />
(<br />
@projectid as int,<br />
@BDate as smalldatetime,<br />
@BMonths as tinyint<br />
)<br />
As<br />
declare<br />
@days1 as tinyint<br />
begin<br />
<br />
<br />
SELECT dbo.tblEmployeeMaster.empId, dbo.tblEmployeeMaster.empName, dbo.tblEmployeeMaster.joinDate, <br />
(dbo.tblsalarydetails.BasSalary)+(dbo.tblsalarydetails.Hra)+(dbo.tblsalarydetails.Ca)+(dbo.tblsalarydetails.Ota)+<br />
(dbo.tblsalarydetails.Sha)+(dbo.tblsalarydetails.Allow1)+(dbo.tblsalarydetails.Allow2)+(dbo.tblsalarydetails.Allow3)+<br />
(dbo.tblsalarydetails.Allow4)+(dbo.tblsalarydetails.Allow5) as GTotal,<br />
datediff(Month,dbo.tblEmployeeMaster.joinDate,@BDate) as WMonths,<br />
(<br />
case when ( ((datediff(Month,dbo.tblEmployeeMaster.joinDate,@BDate))>=@BMonths) and <br />
((datediff(Month,dbo.tblEmployeeMaster.joinDate,@BDate))<12 ) <br />
)then<br />
(<br />
(<br />
(dbo.tblsalarydetails.BasSalary)+(dbo.tblsalarydetails.Hra)+(dbo.tblsalarydetails.Ca)+<br />
(dbo.tblsalarydetails.Ota)+(dbo.tblsalarydetails.Sha)+(dbo.tblsalarydetails.Allow1)+<br />
(dbo.tblsalarydetails.Allow2)+(dbo.tblsalarydetails.Allow3)+(dbo.tblsalarydetails.Allow4)+<br />
(dbo.tblsalarydetails.Allow5)<br />
)*datediff(Month,dbo.tblEmployeeMaster.joinDate,@BDate)<br />
)/12 <br />
when<br />
((datediff(Month,dbo.tblEmployeeMaster.joinDate,@BDate))>=12 )<br />
then <br />
<br />
(dbo.tblsalarydetails.BasSalary)+(dbo.tblsalarydetails.Hra)+(dbo.tblsalarydetails.Ca)+<br />
(dbo.tblsalarydetails.Ota)+(dbo.tblsalarydetails.Sha)+(dbo.tblsalarydetails.Allow1)+<br />
(dbo.tblsalarydetails.Allow2)+(dbo.tblsalarydetails.Allow3)+(dbo.tblsalarydetails.Allow4)+<br />
(dbo.tblsalarydetails.Allow5)<br />
else<br />
0 end<br />
) as Bonus FROM dbo.tblEmployeeMaster INNER JOIN dbo.tblsalarydetails ON <br />
dbo.tblEmployeeMaster.empId = dbo.tblsalarydetails.EmpId WHERE (dbo.tblEmployeeMaster.projectId = @projectid)<br />
<br />
end<br />
GO

Ron Savage wrote:

If the entire query as written is part of his internal code, there is no danger.

Colin Angus Mackay wrote:

There is the possibility of a Second Order Attack. This is where supposedly clensed data that is already sitting in the database can be used to form an attack. All the data used is internal to the system at the time the SQL is formed, but the threat is just as real.

Ron Savage wrote:

Another excellent bit of advice, yet again completely outside the context of the discussion.

Ron Savage wrote:

Neither the original question nor my response involved building a query from any external data.

Ron Savage wrote:

Without the inclusion of external text that may at some point have been entered by an end user of the program - SQL Injection attacks are not an issue.

pramodprakash2005 wrote:

How we can store the backup in SQL ?

mrkeivan wrote:

Could you give me a sample by any chance ?