Product Search question

I have a search box on my website which is used to search the products database.

I will be using the search text in an SQL stored procedure that uses LIKE statements. The search string could realistically contain any character.

How do I prevent SQL injection when any search string is reasonably feasible? .

supergriff:

How do I prevent SQL injection when any search string is reasonably feasible?

I recommend that you read the weblog entry by Microsoft's Bertrand Le Roy,Please, please, please, learn about injection attacks!|||

Great, so if i'm using stored procedures, rather than string concatenation, this inherently prevents SQL injection? My search function is below:

' Select all ProductsPublicFunction GetAllVisibleProductsBySearchString(ByVal SearchStringAsString)As DataTable

Dim connAs SqlConnection =New SqlConnection(_connectionString)Dim cmdStoredProcedureAsNew SqlCommand("dis_GetAllVisibleProductsBySearchString", conn)

cmdStoredProcedure.CommandType = CommandType.StoredProcedure

cmdStoredProcedure.Parameters.Add(

"@.SearchString", SqlDbType.VarChar, 250).Value = SearchStringDim daAs SqlDataAdapter =New SqlDataAdapter(cmdStoredProcedure)Dim dsAs DataSet =New DataSet()Try

conn.Open()

da.Fill(ds,

"Products")

Catch eAs SqlException

' Handle exception.Finally

conn.Close()

EndTryReturn ds.Tables("Products")EndFunction

Product Dimension

I have a parent-child product dimension.
It is parent-child because it is unbalanced - some products have more
levels than others.
This dimension has the product members for the entire Group.
However, because different products have different relevant dimensions
I have a number of cubes - i.e. I don't want to put all measures & all
dimensions of all products into just one cube.
If I were to use this product dimension in all cubes I have two
problems:
1. The end user sees numerous 'irrelevant' product members when
exploring the dimension
2. More seriously, because the seperate cubes will only have facts for
the appropriate products the aggregation up to 'All' (Group) will be
misleading.
It would seem that I should have a centrally maintained product table &
from this create a number of subset product dimensions.
Is this the best approach?
Many thanks.Why don't try perspective for your first requirement to show different
product for different user.
I don't think No.2 is a real issue, for fact records are linked to their
product in the star schema tables.
"Statsman" wrote:

> I have a parent-child product dimension.
> It is parent-child because it is unbalanced - some products have more
> levels than others.
> This dimension has the product members for the entire Group.
> However, because different products have different relevant dimensions
> I have a number of cubes - i.e. I don't want to put all measures & all
> dimensions of all products into just one cube.
> If I were to use this product dimension in all cubes I have two
> problems:
> 1. The end user sees numerous 'irrelevant' product members when
> exploring the dimension
> 2. More seriously, because the seperate cubes will only have facts for
> the appropriate products the aggregation up to 'All' (Group) will be
> misleading.
> It would seem that I should have a centrally maintained product table &
> from this create a number of subset product dimensions.
>
> Is this the best approach?
>
> Many thanks.
>|||Why don't try perspective for your first requirement to show different
product for different user.
I don't think No.2 is a real issue, for fact records are linked to their
product in the star schema tables.
"Statsman" wrote:

> I have a parent-child product dimension.
> It is parent-child because it is unbalanced - some products have more
> levels than others.
> This dimension has the product members for the entire Group.
> However, because different products have different relevant dimensions
> I have a number of cubes - i.e. I don't want to put all measures & all
> dimensions of all products into just one cube.
> If I were to use this product dimension in all cubes I have two
> problems:
> 1. The end user sees numerous 'irrelevant' product members when
> exploring the dimension
> 2. More seriously, because the seperate cubes will only have facts for
> the appropriate products the aggregation up to 'All' (Group) will be
> misleading.
> It would seem that I should have a centrally maintained product table &
> from this create a number of subset product dimensions.
>
> Is this the best approach?
>
> Many thanks.
>

ProClarity and Dundas

Will these two products (ProClarity and Dundas) be incorporated in some way into SSRS, and how they will be used?

will there in katmai be the barcodes from dundas?

regards

andreas

|||

Dundas will be integrated into Reporting Services Katmai. We are working on getting all of the components integrated but chart will be there for sure.

ProClarity is getting integrated into PerformancePoint (see http://office.microsoft.com/en-us/performancepoint/FX101680481033.aspx).

|||

I hate to ask, but I HOPE I can use this feature. Will Dundas be enabled for SQL Server 2005/2008 Express and with Visual Studio Express?

Thanks,

Michael

|||

I'd still like an answer on this one.

Thanks!

Michael

ProClarity and Dundas

Will these two products (ProClarity and Dundas) be incorporated in some way into SSRS, and how they will be used?

will there in katmai be the barcodes from dundas?

regards

andreas

|||

Dundas will be integrated into Reporting Services Katmai. We are working on getting all of the components integrated but chart will be there for sure.

ProClarity is getting integrated into PerformancePoint (see http://office.microsoft.com/en-us/performancepoint/FX101680481033.aspx).

|||

I hate to ask, but I HOPE I can use this feature. Will Dundas be enabled for SQL Server 2005/2008 Express and with Visual Studio Express?

Thanks,

Michael

|||

I'd still like an answer on this one.

Thanks!

Michael

sql

ProClarity and Dundas

Will these two products (ProClarity and Dundas) be incorporated in some way into SSRS, and how they will be used?

will there in katmai be the barcodes from dundas?

regards

andreas

|||

Dundas will be integrated into Reporting Services Katmai. We are working on getting all of the components integrated but chart will be there for sure.

ProClarity is getting integrated into PerformancePoint (see http://office.microsoft.com/en-us/performancepoint/FX101680481033.aspx).

|||

I hate to ask, but I HOPE I can use this feature. Will Dundas be enabled for SQL Server 2005/2008 Express and with Visual Studio Express?

Thanks,

Michael

|||

I'd still like an answer on this one.

Thanks!

Michael