|
Okay - Before I answer your question I am going to do my usual pointer to this article on SQL Injection Attacks and How to Prevent Them[^] whenever I see code that could potentially be attacked.
On to your question. What you need to do is take the statement you have already and use that as a subquery and have the table join onto itself via the subquery. It sounds more difficult than it is.
SELECT main.ActivityID, main.PercentComplete, main.WhenComplete
FROM Activity_Session_Summary AS main
INNER JOIN (SELECT ActivityID, MAX(WhenCompleted) AS WhenComplete
FROM Activity_Session_Summary
WHERE StudentID = %s AND ActivityID IN ( %s )
GROUP BY ActivityID) AS sub
ON main.ActivityID = sub.ActivityID AND main.WhenComplete = sub.WhenComplete
WHERE StudentID = '%s' AND ActivityID IN ( %s )
I've left your format placeholders even though they represent a potential security risk.
Your original query has now been made the subquery and as you can see, nothing has changed there except that I named the aggregate column so I could refer to it later.
The main query selects the data that you want and joins onto the subquery. You will notice from the join that it is joined on the result of the aggregate as well as the ActivityID (I'm guessing that is a foreign key onto another table). Finally, your where clause is repeated on the main query, although it may not be needed - I don't know enough about your data model to make that determination. If it isn't needed it won't do any harm.
Does this help?
My: Blog | Photos | Next SQL Presentation
WDevs.com - Open Source Code Hosting, Blogs, FTP, Mail and More
|
|
|
|
|
Hi Colin,
Wow! Thanks for such a rapid and comprehensive reply, I really appreciate it.
I also appreciate your warning re: injection attacks. However, this project is for internal use with hardcoded input values, and will not be accessible in any way outside the machine it's run on. Famous last words? Well, if our security is so screwed that someone can access the script and modify the SQL statement then I can think of many easier ways for them to accomplish their evil ends. But I appreciate your concern!
I think I understand the SQL you gave. I was hoping that there was a way to do this without subqueries (they make my head hurt a little at times), but suspected that they would be necessary.
I think that the StudentID /is/ necessary in the main query. It's theoretically possible that two rows in the result set don't differ in ActivityID or WhenCompleted, but only by StudentID. Not likely, as it would involve two students completing the same activity within a second of each other (or whatever the resolution of DateTime is in SQL Server), but possible none the less.
Again, thanks a lot Colin, you've really helped me out here, and hopefully helped me learn a little so I don't ask the same question in a different form in 2 months time!
Cheers,
Pete
|
|
|
|
|
moredip wrote:
I think that the StudentID /is/ necessary in the main query. It's theoretically possible that two rows in the result set don't differ in ActivityID or WhenCompleted, but only by StudentID. Not likely, as it would involve two students completing the same activity within a second of each other (or whatever the resolution of DateTime is in SQL Server), but possible none the less.
Best to leave it in then. If it is taken out then it can be a nasty time-consuming bug to track down if that condition does happen. I know, I spent two days tracking something similar, which was why I was cautious about removing it without knowing more about your data.
moredip wrote:
thanks a lot Colin, you've really helped me out
Your most welcome.
My: Blog | Photos | Next SQL Presentation
WDevs.com - Open Source Code Hosting, Blogs, FTP, Mail and More
|
|
|
|
|
Hi again Colin,
I modified the SQL you provided slightly from this:
Colin Angus Mackay wrote:
SELECT main.ActivityID, main.PercentComplete, main.WhenComplete
FROM Activity_Session_Summary AS main
INNER JOIN (SELECT ActivityID, MAX(WhenCompleted) AS WhenComplete
FROM Activity_Session_Summary
WHERE StudentID = %s AND ActivityID IN ( %s )
GROUP BY ActivityID) AS sub
ON main.ActivityID = sub.ActivityID AND main.WhenComplete = sub.WhenComplete
WHERE StudentID = '%s' AND ActivityID IN ( %s )
to this:
SELECT main.ActivityID, main.PercentCorrect
FROM Activity_Session_Summary AS main
INNER JOIN (SELECT ActivityID, MAX(WhenCompleted) AS WhenCompleted
FROM Activity_Session_Summary
WHERE StudentID = '%s' AND ActivityID IN ( %s )
GROUP BY ActivityID) AS sub
ON main.ActivityID = sub.ActivityID AND main.WhenCompleted = sub.WhenCompleted
WHERE main.StudentID = '%s'
I just wanted to confirm with you that removing the final AND ActivityID IN ( %s ) makes sense. It seems to me that it's redundant, since the main.ActivityID = sub.ActivityID join will ensure that only ActivityID's in the supplied ( %s ) list will be considered. Is that correct?
Cheers,
Pete
|
|
|
|
|
|
I have a table with two columns
ServiceDate(datetime) & Attendance(int)
I wish to add another column that calcs the attendance average. How do i write
the formulate for this column. Not for each record but for all the records in the table
everytime a new one is added. That sounds confusing. If anyone knows what to do i would
appreciate the help.
|
|
|
|
|
So, every time you insert, update or delete a row in the table you want a column that represents the average updated on every row?
On the assumtion that the answer to the previous question is "yes": Why not just use AVG(Attendance) in a select statement when you want that information? Is retrieving the information so time critical that you want to hurt the insert/update/delete performance by having those operations hit every row in the table?
My: Blog | Photos | Next SQL Presentation
WDevs.com - Open Source Code Hosting, Blogs, FTP, Mail and More
|
|
|
|
|
Here is my code, i am getting
ExecuteReader: Connection property has not been initialized.
message but this is how all my other connections are setup.
Dim conn As SqlConnection
Dim cmd As SqlCommand
Dim str As String
Dim reader As SqlDataReader
conn = New SqlConnection(ConfigurationSettings.AppSettings("connstring"))
conn.Open()
cmd = New SqlCommand("SELECT AVG(Attendance) FROM tblAttendance")
str = cmd.ExecuteReader().ToString()
|
|
|
|
|
also notice i am reading my connection string from my Appconfig file but i know its not the config file becuase i tested it with the connection string.
|
|
|
|
|
You need to also tell the command about the connection. At the moment the command doesn't know what connection to use. Use:
cmd = New SqlCommand("SELECT AVG(Attendance) FROM tblAttendance", conn)
Also, the next problem you are going to have is this line:
str = cmd.ExecuteReader().ToString() That line will not return the result that you want. You should use the following instead:
str = cmd.ExecuteScalar().ToString();
Does this help?
My: Blog | Photos | Next SQL Presentation
WDevs.com - Open Source Code Hosting, Blogs, FTP, Mail and More
|
|
|
|
|
That helps alot actually. It is working now. I really appreciate the help.
I am about as begginer as they come.
|
|
|
|
|
Hi
I need some help, I have created a datagrid using sql connection and data adapter and when I press a button I fill the data grid with contacts, however I want to be able type a name in a text box and get contacts with that name only. I cant get it to work i am pulling my hair out. It is probably something simple but I cant see how to do it for looking
|
|
|
|
|
If I understand your problem correctly, I think what you want to do is make a new adapter with a query something like the following (use you immagination since I don't know your schema) select x,y,z from mytable where x = someNameHere
In otherwords, use a different adapter when you want to pull up just specific info.
Probably too vague on my part but I need more specifics from you.
|
|
|
|
|
I orignally posted this in the VB/VB .Net area, but am now thinking this may have been the more appropriate location...
I have several dataset tables that I want to export directly into my sql server as tables (or as inserts to tables).
Assumptions:
I have the dataset tables populated (I do)
I have a valid (open) connection to SQL Server (I do)
In order to transfer/export/update the sql db tables do I need to bind this dataset to a vb.data grid control, or data adapter, etc?
Or is there an easy (relative) command that I can utilize within the System.Data.SQL Client (or other namespace) that I can use to get these tables to populate in my SQL Environment?
Thanks,
mtognetti
|
|
|
|
|
To transfer/export/update ur data u could use SqlDataAdapter , witch is viable for small opeartions. If u plan to transport/export large number of rows u have 2 options :
1. u can create a dts on ur sql server who use as entry data a txt file separated with tabs. This file u can create from ur app and then call ur dts
(use DTS - namespace, u must add msdts.dll ( i think ) as ref )
2. use bulk insert with a user with rights to bulk insert on sql server , using as data source a txt file. ( use SqlCommand and bulk insert from T-Sql)
If sql server is on other machine, u will need a way to transfer ur files to that machine.
Hope that helps.
|
|
|
|
|
I migrate the microsoft class : SqlHelper to OracleHelper, i used in this class ODP .NET 10..
I need some person to do the test. if there is someone who is interested by this this request ,please send me an email
at nizar@myway.com and i will response him.
thnx
ENSI TUNISIA
|
|
|
|
|
Ok. In C++ I have code that passed coded in SQL statements that update data/time fields like so:
"UPDATE mytable SET f_date1='05/04/2005 12:01:02'". So the obvious problem is that if windows set to anything (or close to anything) other than USA region the date gets reversed in the DB itself. So when I query this field again it's '04/05/2005'. So is there an easy way to go around this? Or do I have to reformat SQL statement for each region?
Urgent!!! Please help!!!
Thanks a lot in advance!
|
|
|
|
|
|
How could i create a table with a passed parameter,
something like that
CREATE PROCEDURE TaoBang
@TenBang char(10)
AS
CREATE TABLE @TenBang
(
ID char(10) primary key
subname char(10)
)
Thank you so much
if i've got a better way to do that, please show me
|
|
|
|
|
You need to create a string that represents the SQL you want to run, and then pass it to exec.
Christian Graus - Microsoft MVP - C++
|
|
|
|
|
CREATE PROCEDURE TaoBang<br />
@TenBang char(10)<br />
AS<br />
<br />
declare @sql varchar(100)<br />
set @sql= 'CREATE TABLE ' + @TenBang + '<br />
(<br />
ID char(10) primary key,<br />
subname char(10) <br />
)'<br />
exec (@sql)
<italic>Work hard, Work effectively.
|
|
|
|
|
I have the following:
SELECT * FROM Article, Member, Album
LEFT JOIN
( SELECT *
FROM
linkArticleAlbum, Photo, Album
WHERE
linkArticleAlbum.Album = Photo.Album AND
linkArticleAlbum.Album = Album.ID AND
Photo.IsIcon = true ) As AlbumLink
ON AlbumLink.linkArticleAlbum.Article = Article.ID
WHERE
Article.Author = Member.ID AND
Article.Team = 1
ORDER BY Article.DateCreated DESC, Article.Title
How can I do this in Access 2002? You see that I need to get the photo that represents the icon for the album on every occasion where the article is linked with an album.
I'm stumped. I'm also a bit of a newb when it comes to subqueries and the way things are referenced.
--------
to die is gain
|
|
|
|
|
why don't you try creating the subquery and saviong as a view - then simply join the table to the query (by name) and use QBE window. Keep it simple!
|
|
|
|
|
|
i want to create a data base that include the informations of bussines centers of one city such as shopp stores and ...
what tables this database include?
what fields each table include?
i now this is not good question but please reply me?
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
