Are the posted questions getting worse?

Question

Post reply

Are the posted questions getting worse?

Viewing 15 posts - 10,906 through 10,920 (of 66,712 total)

You must be logged in to reply to this topic. Login to reply

spaghettidba SSC Guru Points: 105732 More actions · Answer 1

Alvin Ramard (1/28/2010)
...I almost added a comment about not paying for Gail's travel expenses.

So I guess you're not paying mine either.:crying:

-- Gianluca Sartori

Alvin Ramard SSC-Forever Points: 41190 More actions · Answer 2

Gianluca Sartori (1/28/2010)
Alvin Ramard (1/28/2010)
...I almost added a comment about not paying for Gail's travel expenses.
So I guess you're not paying mine either.:crying:

That's probably more than we could arrange at this time with our limited sponsorship.

I suppose I could check with INETA. :unsure:

Alvin Ramard
Memphis PASS Chapter[/url]

All my SSC forum answers come with a money back guarantee. If you didn't like the answer then I'll gladly refund what you paid for it.

For best practices on asking questions, please read the following article: Forum Etiquette: How to post data/code on a forum to get the best help[/url]

Gail Shaw SSC Guru Points: 1004504 More actions · Answer 3

Alvin Ramard (1/28/2010)
I almost added a comment about not paying for Gail's travel expenses.

and I was just about to make some snarky comments.... 😉

Gail Shaw
Microsoft Certified Master: SQL Server, MVP, M.Sc (Comp Sci)
SQL In The Wild: Discussions on DB performance with occasional diversions into recoverability

We walk in the dark places no others will enter
We stand on the bridge and no one may pass

Jack Corbett SSC Guru Points: 184394 More actions · Answer 4

Steve Jones - Editor (1/28/2010)
I think the biggest issue with SQL Injection is the front ends. It's not SQL. Even if I have a good proc, spDoSomethingCool, if I call it as
SETDim MySQL as string = "spDoSomethingCool '" + SomeVariable + "' "
Dim myConn As SqlConnection = New SqlConnection(ConfigurationSettings.AppSettings("YourAppSettings"))
Dim ds as DataSet=New DataSet()
Dim Cmd as New SQLDataAdapter(MySQL,MyConn)
And someone can input data into "SomeVariable", they could skip entering "1" and instead enter "1 ; shutdown"
The concatenation on the front end can be the issue if the developer doesn't properly send parameters through.

Some people would say the first problem with that code is that it is VB!:w00t:

Definitely the main issue with SQL Injection is improperly coding the front end, but as Gus pointed out, you need to be careful in your SQL as well, if you allow dynamic columns, tables, grouping, ordering as you can't use parameters for that, but need to concatenate.

Jack Corbett
Consultant - Straight Path Solutions
Check out these links on how to get faster and more accurate answers:
Forum Etiquette: How to post data/code on a forum to get the best help
Need an Answer? Actually, No ... You Need a Question

Alvin Ramard SSC-Forever Points: 41190 More actions · Answer 5

GilaMonster (1/28/2010)
Alvin Ramard (1/28/2010)
I almost added a comment about not paying for Gail's travel expenses.
and I was just about to make some snarky comments.... 😉

You can still make them. 😀

Alvin Ramard
Memphis PASS Chapter[/url]

All my SSC forum answers come with a money back guarantee. If you didn't like the answer then I'll gladly refund what you paid for it.

For best practices on asking questions, please read the following article: Forum Etiquette: How to post data/code on a forum to get the best help[/url]

Lynn Pettis SSC Guru Points: 442467 More actions · Answer 6

Lynn Pettis

SSC Guru

Points: 442467

January 28, 2010 at 8:40 am

#1110106

Oh ... No ... Halo tarnishing and slipping!

Gail Shaw SSC Guru Points: 1004504 More actions · Answer 7

Lynn Pettis (1/28/2010)
Oh ... No ... Halo tarnishing and slipping!

I think it's justified, especially with his last comment...

Gail Shaw
Microsoft Certified Master: SQL Server, MVP, M.Sc (Comp Sci)
SQL In The Wild: Discussions on DB performance with occasional diversions into recoverability

We walk in the dark places no others will enter
We stand on the bridge and no one may pass

Alvin Ramard SSC-Forever Points: 41190 More actions · Answer 8

GilaMonster (1/28/2010)
Lynn Pettis (1/28/2010)
Oh ... No ... Halo tarnishing and slipping!
I think it's justified, especially with his last comment...

I know I shouldn't have done that, but I added my 3 cents worth.

Alvin Ramard
Memphis PASS Chapter[/url]

All my SSC forum answers come with a money back guarantee. If you didn't like the answer then I'll gladly refund what you paid for it.

For best practices on asking questions, please read the following article: Forum Etiquette: How to post data/code on a forum to get the best help[/url]

Grant Fritchey SSC Guru Points: 398890 More actions · Answer 9

No, that was some seriously scattered questions & responses. I think a bit of the old hickory was needed.

"The credit belongs to the man who is actually in the arena, whose face is marred by dust and sweat and blood"
- Theodore Roosevelt

Author of:
SQL Server Execution Plans
SQL Server Query Performance Tuning

Steve Jones - SSC Editor SSC Guru Points: 736270 More actions · Answer 10

Not sure what you can do with that guy except ignore him.

Alvin Ramard SSC-Forever Points: 41190 More actions · Answer 11

Actually his comment may have been much nicer than we thought, thanks to his poor English.

He may have meant that he has "read the books" and that is basically all he knows whereas others have "so much time on", meaning more time working with SQL or more experience, and are lucky that way.

I may be wrong.

Alvin Ramard
Memphis PASS Chapter[/url]

All my SSC forum answers come with a money back guarantee. If you didn't like the answer then I'll gladly refund what you paid for it.

For best practices on asking questions, please read the following article: Forum Etiquette: How to post data/code on a forum to get the best help[/url]

SQLRNNR SSC Guru Points: 281334 More actions · Answer 12

Alvin Ramard (1/28/2010)
Actually his comment may have been much nicer than we thought, thanks to his poor English.
He may have meant that he has "read the books" and that is basically all he knows whereas others have "so much time on", meaning more time working with SQL or more experience, and are lucky that way.
I may be wrong.

Do you have the crystal ball now?

Jason...AKA CirqueDeSQLeil
_______________________________________________
I have given a name to my pain...MCM SQL Server, MVP
SQL RNNR
Posting Performance Based Questions - Gail Shaw[/url]
Learn Extended Events

Alvin Ramard SSC-Forever Points: 41190 More actions · Answer 13

CirquedeSQLeil (1/28/2010)
Alvin Ramard (1/28/2010)
Actually his comment may have been much nicer than we thought, thanks to his poor English.
He may have meant that he has "read the books" and that is basically all he knows whereas others have "so much time on", meaning more time working with SQL or more experience, and are lucky that way.
I may be wrong.
Do you have the crystal ball now?

Not anymore. It rolled off the table and onto the floor. Then the poor crystal ball rolled right out the door.

😀

Alvin Ramard
Memphis PASS Chapter[/url]

All my SSC forum answers come with a money back guarantee. If you didn't like the answer then I'll gladly refund what you paid for it.

For best practices on asking questions, please read the following article: Forum Etiquette: How to post data/code on a forum to get the best help[/url]

Lynn Pettis SSC Guru Points: 442467 More actions · Answer 14

Rubberized crystal?? Must be, it keeps bouncing around the world! 😛

SQLRNNR SSC Guru Points: 281334 More actions · Answer 15

Alvin Ramard (1/28/2010)
Gianluca Sartori (1/28/2010)
Alvin Ramard (1/28/2010)
FYI, you're all invited to come to Memphis in April to continue this discussion on SQL Injection.
We normally meet on the 2nd Thursday of the month.
😀
Thanks Alvin, it's not exactly next door for me, but thank you for the invitation.:-)
Will you come to Venice in turn?
I understand your comment. No, I'm not ready to go to Venice.
When I wrote the invitation, I almost added a comment about not paying for Gail's travel expenses.

Today is a Thread Gone Wild day - and I am still catching up.

So will you pay for travel expenses of those denizens that are closer (Jack in Florida, Grant in New England?, Steve or Lynn from Colorado)?

Jason...AKA CirqueDeSQLeil
_______________________________________________
I have given a name to my pain...MCM SQL Server, MVP
SQL RNNR
Posting Performance Based Questions - Gail Shaw[/url]
Learn Extended Events