Click here to Skip to main content
15,902,447 members
Home / Discussions / Database
   

Database

 
GeneralRe: Row Terminator not working: Pin
Shahzad.Aslam21-May-08 4:40
Shahzad.Aslam21-May-08 4:40 
GeneralRe: Row Terminator not working: Pin
Ashfield21-May-08 21:19
Ashfield21-May-08 21:19 
GeneralRe: Row Terminator not working: Pin
Shahzad.Aslam21-May-08 21:41
Shahzad.Aslam21-May-08 21:41 
GeneralRe: Row Terminator not working: Pin
Ashfield21-May-08 22:28
Ashfield21-May-08 22:28 
QuestionSql Stored Procedure Pin
senthilsstil20-May-08 23:58
senthilsstil20-May-08 23:58 
Questionhow to retrive the value of the sp output through execute immediate Pin
lakshmichawala20-May-08 23:08
lakshmichawala20-May-08 23:08 
Questionsql query Pin
Unknown Ajanabi20-May-08 23:02
Unknown Ajanabi20-May-08 23:02 
AnswerRe: sql query Pin
Colin Angus Mackay21-May-08 1:01
Colin Angus Mackay21-May-08 1:01 
Dyamic SQL - Something you have to be very careful in constructing because it is so easy to make a mistake and punch a big massive security hole in your database.

The way you have constructed the SQL make SQL Server interpret @key as a column name. You have to pass @key as a parameter. Actually, you should look up sp_executesql as it provides more protection against attack.

Now, as a further defence against attack you must check that @city relates to a real table first. You can do this by checking against INFORMATION_SCHEMA.TABLES like this:

IF EXISTS (SELECT * FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_NAME = @city)
BEGIN
    -- The table exists, we can run the dynamic SQL
END
ELSE
BEGIN
    -- The table does not exist. Perform error processing.
END



AnswerRe: sql query Pin
Michael Potter21-May-08 10:23
Michael Potter21-May-08 10:23 
Questionproblem with SQLparameter? Pin
Mr.Kode20-May-08 22:20
Mr.Kode20-May-08 22:20 
AnswerRe: problem with SQLparameter? Pin
Unknown Ajanabi20-May-08 23:17
Unknown Ajanabi20-May-08 23:17 
GeneralRe: problem with SQLparameter? Pin
Mr.Kode20-May-08 23:20
Mr.Kode20-May-08 23:20 
GeneralRe: problem with SQLparameter? Pin
Unknown Ajanabi20-May-08 23:50
Unknown Ajanabi20-May-08 23:50 
AnswerCP Ignore Pin
leckey21-May-08 3:20
leckey21-May-08 3:20 
Questiondistinct? Pin
laserbaronen20-May-08 21:40
laserbaronen20-May-08 21:40 
AnswerRe: distinct? Pin
Blue_Boy20-May-08 22:47
Blue_Boy20-May-08 22:47 
QuestionRe: distinct? Pin
laserbaronen20-May-08 22:51
laserbaronen20-May-08 22:51 
AnswerRe: distinct? Pin
Blue_Boy20-May-08 22:53
Blue_Boy20-May-08 22:53 
GeneralRe: distinct? Pin
laserbaronen20-May-08 23:02
laserbaronen20-May-08 23:02 
GeneralRe: distinct? Pin
Blue_Boy20-May-08 23:19
Blue_Boy20-May-08 23:19 
GeneralRe: distinct? Pin
laserbaronen20-May-08 23:31
laserbaronen20-May-08 23:31 
GeneralRe: distinct? Pin
Blue_Boy20-May-08 23:32
Blue_Boy20-May-08 23:32 
QuestionPrimary Keys Pin
MAW3020-May-08 16:50
MAW3020-May-08 16:50 
AnswerRe: Primary Keys Pin
ChandraRam20-May-08 21:00
ChandraRam20-May-08 21:00 
QuestionInner Join to match multiple rows in lookup table Pin
redivider20-May-08 10:59
redivider20-May-08 10:59 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.