Heh... poor ol' dynamic SQL... nobody loves it anymore.
--Jeff Moden
Change is inevitable... Change for the better is not.
Jeff Moden (2/26/2010)
Heh... poor ol' dynamic SQL... nobody loves it anymore.
It's sad, when the cure is worse than the disease.
Oh well, I'll be killing swine and birds all weekend for the CDC...
[font="Times New Roman"]-- RBarryYoung[/font], [font="Times New Roman"] (302)375-0451[/font] blog: MovingSQL.com, Twitter: @RBarryYoung[font="Arial Black"]
Proactive Performance Solutions, Inc. [/font][font="Verdana"] "Performance is our middle name."[/font]
emily:
Why do you want to cram two different functional tasks into one procedure? Thats been bad design in software development for over forty years. This obviously belongs in two different routines and that's how you should write it.
[font="Times New Roman"]-- RBarryYoung[/font], [font="Times New Roman"] (302)375-0451[/font] blog: MovingSQL.com, Twitter: @RBarryYoung[font="Arial Black"]
Proactive Performance Solutions, Inc. [/font][font="Verdana"] "Performance is our middle name."[/font]
...
For better, quicker answers on T-SQL questions, click on the following...
http://www.sqlservercentral.com/articles/Best+Practices/61537/
For better answers on performance questions, click on the following...
http://www.sqlservercentral.com/articles/SQLServerCentral/66909/
Welsh Corgi (2/26/2010)
I agree with the distinguished Forum Members with respect to the use of Dynamic SQL.There are many reasons to avoid this. If you want SQL Injection and put your Business at risk then SQL Injection is for you.
This practice is reckless and any responsible DBA would not allow it.:w00t:
Only if you're silly about it. SQL Injection is very easy to avoid. Responsible DBA's know how to get all the benefits of dynamic SQL without the risks.
--Jeff Moden
Change is inevitable... Change for the better is not.
Jeff Moden (2/26/2010)
Welsh Corgi (2/26/2010)
I agree with the distinguished Forum Members with respect to the use of Dynamic SQL.There are many reasons to avoid this. If you want SQL Injection and put your Business at risk then SQL Injection is for you.
This practice is reckless and any responsible DBA would not allow it.:w00t:
Only if you're silly about it. SQL Injection is very easy to avoid. Responsible DBA's know how to get all the benefits of dynamic SQL without the risks.
dang! Ya beat me to it Jeff.
[font="Times New Roman"]-- RBarryYoung[/font], [font="Times New Roman"] (302)375-0451[/font] blog: MovingSQL.com, Twitter: @RBarryYoung[font="Arial Black"]
Proactive Performance Solutions, Inc. [/font][font="Verdana"] "Performance is our middle name."[/font]
...
For better, quicker answers on T-SQL questions, click on the following...
http://www.sqlservercentral.com/articles/Best+Practices/61537/
For better answers on performance questions, click on the following...
http://www.sqlservercentral.com/articles/SQLServerCentral/66909/
Welsh Corgi (2/26/2010)
I accept your critisisim.There are many ways to exploit Dynamic SQL and this is well documented.
In my humble;e opinion you have to take steps to minimize the risk whether it be in SQL Server or Oracle.
But if you could please provide you solution to this security risk it would be greatly appreciated.
You have to be careful when you use Dynamic SQL but I appreciate your criticism but consider of offering a solution or recommendation when doing so.
Perhaps you could provide a document that outlines the do's and dont's with respect to the security risk associated with dynamic SQL?
Do you have any white papers on this subject material? If so please share when you criticize.
I appreciate a positive constructive dialogue.
I did not intend to be negative.
The comment that you could not wait to jump in suggest that your motives are not positive;but who am I to judge.
Thank you for your feedback and providing your perspective on this issue:-)
Regards,
WC
It wasn't a criticism of you nor was I trying to be negative. And a simple Google search on the subject will give you much more than I could write in a single post.
Don't throw away a perfectly good tool just because you get sparks in your eyes... wear goggles.
--Jeff Moden
Change is inevitable... Change for the better is not.
...
For better, quicker answers on T-SQL questions, click on the following...
http://www.sqlservercentral.com/articles/Best+Practices/61537/
For better answers on performance questions, click on the following...
http://www.sqlservercentral.com/articles/SQLServerCentral/66909/
...
For better, quicker answers on T-SQL questions, click on the following...
http://www.sqlservercentral.com/articles/Best+Practices/61537/
For better answers on performance questions, click on the following...
http://www.sqlservercentral.com/articles/SQLServerCentral/66909/
Welsh Corgi (2/26/2010)
OK, Jeff & Barry you point iswell taken. I appreciate critisism but when you present a problem you should provide a solution...
I'm good at using goggle but there is a lot of misinformation out there what do you recommend?
What are your best practices?
I have used Dynamic SQL and if you take precautions you can protect yourself from vulnerabilities from using Dynamic SQL?
Please share with me you wealth of knowledge on this subject matter.
Regards,
WC
You didn't provide any links to white papers and the like when you first said the use of dynamic SQL was "reckless". Google it like anyone else would. You've already found all the negative stuff... now look for the postive stuff.
--Jeff Moden
Change is inevitable... Change for the better is not.
RBarryYoung (2/26/2010)
Jeff Moden (2/26/2010)
Welsh Corgi (2/26/2010)
I agree with the distinguished Forum Members with respect to the use of Dynamic SQL.There are many reasons to avoid this. If you want SQL Injection and put your Business at risk then SQL Injection is for you.
This practice is reckless and any responsible DBA would not allow it.:w00t:
Only if you're silly about it. SQL Injection is very easy to avoid. Responsible DBA's know how to get all the benefits of dynamic SQL without the risks.
dang! Ya beat me to it Jeff.
Heh... for a change... :hehe:
--Jeff Moden
Change is inevitable... Change for the better is not.
Viewing 15 posts - 1 through 15 (of 79 total)
You must be logged in to reply to this topic. Login to reply