Showing posts with label text. Show all posts
Showing posts with label text. Show all posts

Monday, March 26, 2012

Product Search question

I have a search box on my website which is used to search the products database.

I will be using the search text in an SQL stored procedure that uses LIKE statements. The search string could realistically contain any character.

How do I prevent SQL injection when any search string is reasonably feasible? .

supergriff:

How do I prevent SQL injection when any search string is reasonably feasible?

I recommend that you read the weblog entry by Microsoft's Bertrand Le Roy,Please, please, please, learn about injection attacks!|||

Great, so if i'm using stored procedures, rather than string concatenation, this inherently prevents SQL injection? My search function is below:

' Select all ProductsPublicFunction GetAllVisibleProductsBySearchString(ByVal SearchStringAsString)As DataTable
Dim connAs SqlConnection =New SqlConnection(_connectionString)Dim cmdStoredProcedureAsNew SqlCommand("dis_GetAllVisibleProductsBySearchString", conn)

cmdStoredProcedure.CommandType = CommandType.StoredProcedure

cmdStoredProcedure.Parameters.Add(

"@.SearchString", SqlDbType.VarChar, 250).Value = SearchStringDim daAs SqlDataAdapter =New SqlDataAdapter(cmdStoredProcedure)Dim dsAs DataSet =New DataSet()Try

conn.Open()

da.Fill(ds,

"Products")
Catch eAs SqlException
' Handle exception.Finally

conn.Close()

EndTryReturn ds.Tables("Products")EndFunction

Producing Text File

Hello all,
My sql skills are pretty poor, so please bear with me!

I need to take info from two tables (in Access db) and produce two txt files.

The data in the first table is listed as follows: OrderID, OrderDate, CustomerID, Total
The data in the second table is listed as follows: OrderID, Quantity, Discount, UnitPrice

The user has to be able to specify a time frame (start date and end date).

The major problem I'm having is with setting up the txt files. The header has to have the OrderID listed as "!!OrderID" (this is the way the fake company has their db set up apparently) Also, in the actual data in the txt files the OrderDate has to start w/ "#" and the CustomerID has to start w/ "&".

here's what I mean:

!!OrderID OrderDate CustomerID Total
--- --- ---- --
123456 #456789 &abcdef 987654

If you can help me at all, I'd much appreciate it!!! Thank you!Well, in MS Access you can't use "!" in column name, so you'll have to handle this using VBA coding and replace column name when writing into the text file. You didn't describe tables relationship.

SELECT
[OrderID],
"#" + [OrderDate] AS [OrderDate],
"&" + [CustomerID] AS [CustomerID],
[Total]
from
your_table;

store the result into some VBA object (I don't remember which one to use, it's long time since I used Access for last time). Open text file and read row by row from VBA object and write it into the file. Replace column name OrderID with !!OrderID|||Thanks for the help. The tables are linked through OrderID. Also, I found out that I don't have to use Access to do the project. MySQL is allowed as well. If that makes a difference w/ the !! problem, let me know.

Thanks again!

Producing several letters based on the results of a query

I have created a single page letter using a number of text boxes and one
table, which is populated with static text along with some data from a single
row results set. This works perfectly when the results set only contains one
row, but when there are multiple data rows, the report still only contains
one page, whereas I expected there to be a page for every row.
A simple way to reproduce this is to create a report with a single text box
containing the value of one column from a query that returns multiple rows.
This results in a one page report, rather than a page for each row returned.
I'd be grateful if someone can help with this - I'm hoping there's a simple
solution, like setting a 'repeating region' property.
By the way, I've tried creating a single column table in the hope I could
put the entire contents of the letter into a cell of the table and that the
table row (and therefore the letter) would then repeat for each row of data,
but it doesn't appear to be possible to fix the size of a table row and have
multiple text boxes (and a table) inside it.
Thanks in advance,
David.Hey David,
If I understand you correctly, your trying to make, basically, a form
letter, that populates the variables from a query. For example
This is my test letter to "DAVID".
Where "DAVID" is generated from column/row in your Dataset. Why can't you
make a single cell table with all the text as you want it, except insert the
Field references you need (instead of textboxes)? For Example, the cell
would look like:
= "This is my test letter to " & Fields!ContactName.Value & ". " &
Fields!ContactName.Value & " lives at " & Fields!ContactAddy.Value & "."
etc...
Once this is done, you choose the "Group" properties and place a page break
after each group (or row in this case). This creates a new letter, each on
its own pages, for each row returned.
Michael C
"David C" wrote:
> I have created a single page letter using a number of text boxes and one
> table, which is populated with static text along with some data from a single
> row results set. This works perfectly when the results set only contains one
> row, but when there are multiple data rows, the report still only contains
> one page, whereas I expected there to be a page for every row.
> A simple way to reproduce this is to create a report with a single text box
> containing the value of one column from a query that returns multiple rows.
> This results in a one page report, rather than a page for each row returned.
> I'd be grateful if someone can help with this - I'm hoping there's a simple
> solution, like setting a 'repeating region' property.
> By the way, I've tried creating a single column table in the hope I could
> put the entire contents of the letter into a cell of the table and that the
> table row (and therefore the letter) would then repeat for each row of data,
> but it doesn't appear to be possible to fix the size of a table row and have
> multiple text boxes (and a table) inside it.
> Thanks in advance,
> David.|||Thanks Michael - it was the grouping that I needed. I actually stumbled
across the same answer last night in a TechNet article
(http://technet.microsoft.com/en-us/library/ms155816.aspx).
I put a List in first and then added a single column Table to it. I then
created a group expression on the list in Properties - General - Edit Details
Group - General, as follows: -
=Ceiling(RowNumber(Nothing)/1)
I also set 'Page break at end'.
Is this what you meant?
My problem now is that I want to make some of the text bold and I thought
I'd be able to do this using the Format command - something like Format("some
text", "Bold"), but that doesn't seem to work. Have you any idea how I can do
that?
Thanks again.
David.
"Michael C" wrote:
> Hey David,
> If I understand you correctly, your trying to make, basically, a form
> letter, that populates the variables from a query. For example
> This is my test letter to "DAVID".
> Where "DAVID" is generated from column/row in your Dataset. Why can't you
> make a single cell table with all the text as you want it, except insert the
> Field references you need (instead of textboxes)? For Example, the cell
> would look like:
> = "This is my test letter to " & Fields!ContactName.Value & ". " &
> Fields!ContactName.Value & " lives at " & Fields!ContactAddy.Value & "."
> etc...
> Once this is done, you choose the "Group" properties and place a page break
> after each group (or row in this case). This creates a new letter, each on
> its own pages, for each row returned.
> Michael C
> "David C" wrote:
> > I have created a single page letter using a number of text boxes and one
> > table, which is populated with static text along with some data from a single
> > row results set. This works perfectly when the results set only contains one
> > row, but when there are multiple data rows, the report still only contains
> > one page, whereas I expected there to be a page for every row.
> >
> > A simple way to reproduce this is to create a report with a single text box
> > containing the value of one column from a query that returns multiple rows.
> > This results in a one page report, rather than a page for each row returned.
> >
> > I'd be grateful if someone can help with this - I'm hoping there's a simple
> > solution, like setting a 'repeating region' property.
> >
> > By the way, I've tried creating a single column table in the hope I could
> > put the entire contents of the letter into a cell of the table and that the
> > table row (and therefore the letter) would then repeat for each row of data,
> > but it doesn't appear to be possible to fix the size of a table row and have
> > multiple text boxes (and a table) inside it.
> >
> > Thanks in advance,
> >
> > David.|||Hey David,
Unfortunately I do not think there is a way, and if there i do not know
it. I had asked the forum recently about 2 fonts, 1 control but got no
responses.
You have done basically what I was describing. Glad it (sort of) worked for
you.
Michael
"David C" wrote:
> Thanks Michael - it was the grouping that I needed. I actually stumbled
> across the same answer last night in a TechNet article
> (http://technet.microsoft.com/en-us/library/ms155816.aspx).
> I put a List in first and then added a single column Table to it. I then
> created a group expression on the list in Properties - General - Edit Details
> Group - General, as follows: -
> =Ceiling(RowNumber(Nothing)/1)
> I also set 'Page break at end'.
> Is this what you meant?
> My problem now is that I want to make some of the text bold and I thought
> I'd be able to do this using the Format command - something like Format("some
> text", "Bold"), but that doesn't seem to work. Have you any idea how I can do
> that?
> Thanks again.
> David.
>
> "Michael C" wrote:
> > Hey David,
> > If I understand you correctly, your trying to make, basically, a form
> > letter, that populates the variables from a query. For example
> >
> > This is my test letter to "DAVID".
> >
> > Where "DAVID" is generated from column/row in your Dataset. Why can't you
> > make a single cell table with all the text as you want it, except insert the
> > Field references you need (instead of textboxes)? For Example, the cell
> > would look like:
> >
> > = "This is my test letter to " & Fields!ContactName.Value & ". " &
> > Fields!ContactName.Value & " lives at " & Fields!ContactAddy.Value & "."
> > etc...
> >
> > Once this is done, you choose the "Group" properties and place a page break
> > after each group (or row in this case). This creates a new letter, each on
> > its own pages, for each row returned.
> >
> > Michael C
> >
> > "David C" wrote:
> >
> > > I have created a single page letter using a number of text boxes and one
> > > table, which is populated with static text along with some data from a single
> > > row results set. This works perfectly when the results set only contains one
> > > row, but when there are multiple data rows, the report still only contains
> > > one page, whereas I expected there to be a page for every row.
> > >
> > > A simple way to reproduce this is to create a report with a single text box
> > > containing the value of one column from a query that returns multiple rows.
> > > This results in a one page report, rather than a page for each row returned.
> > >
> > > I'd be grateful if someone can help with this - I'm hoping there's a simple
> > > solution, like setting a 'repeating region' property.
> > >
> > > By the way, I've tried creating a single column table in the hope I could
> > > put the entire contents of the letter into a cell of the table and that the
> > > table row (and therefore the letter) would then repeat for each row of data,
> > > but it doesn't appear to be possible to fix the size of a table row and have
> > > multiple text boxes (and a table) inside it.
> > >
> > > Thanks in advance,
> > >
> > > David.|||Hi Michael,
The text I wanted to be in bold was on a separate line, so in the end I just
put in a separate row in the table and set the row to bold. This worked fine,
presumably because the List control was handling the grouping.
Thanks again for your help.
David.
"Michael C" wrote:
> Hey David,
> Unfortunately I do not think there is a way, and if there i do not know
> it. I had asked the forum recently about 2 fonts, 1 control but got no
> responses.
> You have done basically what I was describing. Glad it (sort of) worked for
> you.
> Michael
> "David C" wrote:
> > Thanks Michael - it was the grouping that I needed. I actually stumbled
> > across the same answer last night in a TechNet article
> > (http://technet.microsoft.com/en-us/library/ms155816.aspx).
> >
> > I put a List in first and then added a single column Table to it. I then
> > created a group expression on the list in Properties - General - Edit Details
> > Group - General, as follows: -
> >
> > =Ceiling(RowNumber(Nothing)/1)
> >
> > I also set 'Page break at end'.
> >
> > Is this what you meant?
> >
> > My problem now is that I want to make some of the text bold and I thought
> > I'd be able to do this using the Format command - something like Format("some
> > text", "Bold"), but that doesn't seem to work. Have you any idea how I can do
> > that?
> >
> > Thanks again.
> >
> > David.
> >
> >
> >
> > "Michael C" wrote:
> >
> > > Hey David,
> > > If I understand you correctly, your trying to make, basically, a form
> > > letter, that populates the variables from a query. For example
> > >
> > > This is my test letter to "DAVID".
> > >
> > > Where "DAVID" is generated from column/row in your Dataset. Why can't you
> > > make a single cell table with all the text as you want it, except insert the
> > > Field references you need (instead of textboxes)? For Example, the cell
> > > would look like:
> > >
> > > = "This is my test letter to " & Fields!ContactName.Value & ". " &
> > > Fields!ContactName.Value & " lives at " & Fields!ContactAddy.Value & "."
> > > etc...
> > >
> > > Once this is done, you choose the "Group" properties and place a page break
> > > after each group (or row in this case). This creates a new letter, each on
> > > its own pages, for each row returned.
> > >
> > > Michael C
> > >
> > > "David C" wrote:
> > >
> > > > I have created a single page letter using a number of text boxes and one
> > > > table, which is populated with static text along with some data from a single
> > > > row results set. This works perfectly when the results set only contains one
> > > > row, but when there are multiple data rows, the report still only contains
> > > > one page, whereas I expected there to be a page for every row.
> > > >
> > > > A simple way to reproduce this is to create a report with a single text box
> > > > containing the value of one column from a query that returns multiple rows.
> > > > This results in a one page report, rather than a page for each row returned.
> > > >
> > > > I'd be grateful if someone can help with this - I'm hoping there's a simple
> > > > solution, like setting a 'repeating region' property.
> > > >
> > > > By the way, I've tried creating a single column table in the hope I could
> > > > put the entire contents of the letter into a cell of the table and that the
> > > > table row (and therefore the letter) would then repeat for each row of data,
> > > > but it doesn't appear to be possible to fix the size of a table row and have
> > > > multiple text boxes (and a table) inside it.
> > > >
> > > > Thanks in advance,
> > > >
> > > > David.

Tuesday, March 20, 2012

Processing the TEXT datatype with TSQL

Hi;

I have a table with a TEXT datatype.
Its a comment field.

Right now the users who put in singlequotes are killing the web front
end.

The programmer responsible is fixing this issue but it might be a few
weeks until we get the patch.

I would like to write a trigger that whenever this field is updated it
will scan the text for single quotes ( and hard returns \r ) and
extract them.

I found some nice string functions in HELP.

Will these string functions work with the TEXT datatype in a TSQL
script/trigger?

Thanks in advance

SteveI handle quotes with the REPLACE function. All languages that I work with
has it.

Two single quotes in a row signify an escape sequence from the normal
interpretation of the single quote character. When two single quotes appear
together, they are interpreted by SQL as one literal single quote. All we
need do, then, is replace any single quote with two single quotes in strings
that we want interpreted literally by SQL.

This won't work on a Text datatype, however it does work on varchars and
stuff. Check your max len() on that field and see if it actually is using
more than the capacity of other datatypes and see about changing it to
varchar or something. This t-sql replaces one quote with two and would save
your web person endless hours of javascript'ing validation code!!

Select REPLACE(testColumn, char(39), char(39) + char(39)) as texta from
myTable

After all, quotes are valid characters too!!!

Good luck!

--
Jerry Boone
Analytical Technologies, Inc.
http://www.antech.biz

"Steve" <stevesusenet@.yahoo.com> wrote in message
news:6f8cb8c9.0311140657.59346a15@.posting.google.c om...
> Hi;
> I have a table with a TEXT datatype.
> Its a comment field.
> Right now the users who put in singlequotes are killing the web front
> end.
> The programmer responsible is fixing this issue but it might be a few
> weeks until we get the patch.
> I would like to write a trigger that whenever this field is updated it
> will scan the text for single quotes ( and hard returns \r ) and
> extract them.
> I found some nice string functions in HELP.
> Will these string functions work with the TEXT datatype in a TSQL
> script/trigger?
> Thanks in advance
> Steve

Monday, February 20, 2012

Process 53 generated fatal exception

Is anyone having problems with text columns once SP3A is installed?
I have a stored procedure that simply updates a text column with changes and
I'm getting what looks like a fatal error in SQL Server. It shows up with
this error posted through JDBC:
53 generated fatal exception c0000005 EXCEPTION_ACCESS_VIOLATION. SQL Server
is terminating this process.
I didn't see anything in the MS knowledge base. If we remove sp3a and put o
n sp3, it doesn't happen.Amy,
I would raise a call with Microsoft support. You may be encountering a bug.
--
Mark Allison, SQL Server MVP
http://www.markallison.co.uk
Looking for a SQL Server replication book?
http://www.nwsu.com/0974973602.html
Amy Thropp wrote:
> Is anyone having problems with text columns once SP3A is installed?
> I have a stored procedure that simply updates a text column with changes a
nd I'm getting what looks like a fatal error in SQL Server. It shows up wit
h this error posted through JDBC:
> 53 generated fatal exception c0000005 EXCEPTION_ACCESS_VIOLATION. SQL Serv
er is terminating this process.
> I didn't see anything in the MS knowledge base. If we remove sp3a and put on sp3,
it doesn't happen.|||If the KB articles on this issue don't apply to your environment, consider
opening a case with Microsoft PSS. You won't be charged if this is a bug,
which is likely with an AV.
Hope this helps.
Dan Guzman
SQL Server MVP
"Amy Thropp" <AmyThropp@.discussions.microsoft.com> wrote in message
news:8E65B0E2-73CD-472D-8947-03ED80BA3F85@.microsoft.com...
> Is anyone having problems with text columns once SP3A is installed?
> I have a stored procedure that simply updates a text column with changes
and I'm getting what looks like a fatal error in SQL Server. It shows up
with this error posted through JDBC:
> 53 generated fatal exception c0000005 EXCEPTION_ACCESS_VIOLATION. SQL
Server is terminating this process.
> I didn't see anything in the MS knowledge base. If we remove sp3a and put
on sp3, it doesn't happen.

Process 53 generated fatal exception

Is anyone having problems with text columns once SP3A is installed?
I have a stored procedure that simply updates a text column with changes and I'm getting what looks like a fatal error in SQL Server. It shows up with this error posted through JDBC:
53 generated fatal exception c0000005 EXCEPTION_ACCESS_VIOLATION. SQL Server is terminating this process.
I didn't see anything in the MS knowledge base. If we remove sp3a and put on sp3, it doesn't happen.Amy,
I would raise a call with Microsoft support. You may be encountering a bug.
--
Mark Allison, SQL Server MVP
http://www.markallison.co.uk
Looking for a SQL Server replication book?
http://www.nwsu.com/0974973602.html
Amy Thropp wrote:
> Is anyone having problems with text columns once SP3A is installed?
> I have a stored procedure that simply updates a text column with changes and I'm getting what looks like a fatal error in SQL Server. It shows up with this error posted through JDBC:
> 53 generated fatal exception c0000005 EXCEPTION_ACCESS_VIOLATION. SQL Server is terminating this process.
> I didn't see anything in the MS knowledge base. If we remove sp3a and put on sp3, it doesn't happen.|||If the KB articles on this issue don't apply to your environment, consider
opening a case with Microsoft PSS. You won't be charged if this is a bug,
which is likely with an AV.
--
Hope this helps.
Dan Guzman
SQL Server MVP
"Amy Thropp" <AmyThropp@.discussions.microsoft.com> wrote in message
news:8E65B0E2-73CD-472D-8947-03ED80BA3F85@.microsoft.com...
> Is anyone having problems with text columns once SP3A is installed?
> I have a stored procedure that simply updates a text column with changes
and I'm getting what looks like a fatal error in SQL Server. It shows up
with this error posted through JDBC:
> 53 generated fatal exception c0000005 EXCEPTION_ACCESS_VIOLATION. SQL
Server is terminating this process.
> I didn't see anything in the MS knowledge base. If we remove sp3a and put
on sp3, it doesn't happen.

Process 53 generated fatal exception

Is anyone having problems with text columns once SP3A is installed?
I have a stored procedure that simply updates a text column with changes and I'm getting what looks like a fatal error in SQL Server. It shows up with this error posted through JDBC:
53 generated fatal exception c0000005 EXCEPTION_ACCESS_VIOLATION. SQL Server is terminating this process.
I didn't see anything in the MS knowledge base. If we remove sp3a and put on sp3, it doesn't happen.
Amy,
I would raise a call with Microsoft support. You may be encountering a bug.
Mark Allison, SQL Server MVP
http://www.markallison.co.uk
Looking for a SQL Server replication book?
http://www.nwsu.com/0974973602.html
Amy Thropp wrote:
> Is anyone having problems with text columns once SP3A is installed?
> I have a stored procedure that simply updates a text column with changes and I'm getting what looks like a fatal error in SQL Server. It shows up with this error posted through JDBC:
> 53 generated fatal exception c0000005 EXCEPTION_ACCESS_VIOLATION. SQL Server is terminating this process.
> I didn't see anything in the MS knowledge base. If we remove sp3a and put on sp3, it doesn't happen.
|||If the KB articles on this issue don't apply to your environment, consider
opening a case with Microsoft PSS. You won't be charged if this is a bug,
which is likely with an AV.
Hope this helps.
Dan Guzman
SQL Server MVP
"Amy Thropp" <AmyThropp@.discussions.microsoft.com> wrote in message
news:8E65B0E2-73CD-472D-8947-03ED80BA3F85@.microsoft.com...
> Is anyone having problems with text columns once SP3A is installed?
> I have a stored procedure that simply updates a text column with changes
and I'm getting what looks like a fatal error in SQL Server. It shows up
with this error posted through JDBC:
> 53 generated fatal exception c0000005 EXCEPTION_ACCESS_VIOLATION. SQL
Server is terminating this process.
> I didn't see anything in the MS knowledge base. If we remove sp3a and put
on sp3, it doesn't happen.

Procedures Information

Hi all
In Oracle if we want to get the procedures,functions or packages information we can write the stmt like this

select text from user_source where name='' and type=''

In sqlserver is it possible to get the information. I know that we are having a stored procedure sp_procedures but i don't know how to get the information from that because of its structure

Baba

Use the following query..

Code Snippet

Exec sp_helptext 'Your Sp Name'

|||If you're using SQL2005 you can use

SELECT OBJECT_DEFINITION(OBJECT_ID('sp_yourproc'))

|||

Note:

OBJECT_DEFINITION wont return the full soruce of you sp if you suffix the numbers (grouped stored procedures).

Code Snippet

Create Proc #Test

as

Begin

Select 1

End

Go

Create Proc #Test;2

as

Begin

Select 2

End

Go

Create Proc #Test;3

as

Begin

Select 3

End

Exec tempdb..sp_helptext '#Test' --Correct; Better to use on any version

SELECT OBJECT_DEFINITION(OBJECT_ID('tempdb..#Test')) --Only Fetch the first sp group 2 & 3 missing

|||

Thanks for pointing that out- have never used grouped stored procedures before. Is there a common scenario when you may wish to go this route?

Cheers

Rich