The Danger of xp_cmdshell

• joeroshan

  SSChampion

  Points: 10377

  More actions

  September 21, 2016 at 3:12 am

  #1902096

  I don't think cmdshell is evil and it was very useful many times to solve problems at work as a DBA while I started automating my tasks.

  However when I design a long term solution I would consider all other alternatives as SSIS, Powershell etc since I understand reducing surface area of attack would be one among the top priority for a DBA .

  ----------------------------------------------------------------------------------------------------------------------------------------------------
  Roshan Joe

  Jeff Moden -Forum Etiquette: How to post data/code on a forum to get the best help[/url]

• Ed Wagner

  SSC Guru

  Points: 287026

  More actions

  September 21, 2016 at 5:24 am

  #1902122

  It's all about picking the right tool for the job. The more tools you have in your toolbox, the more options you have available. If you only have a hammer, then everything looks like a nail, no matter if it has a slotted head or phillips head. As you get more tools, you start to see better solutions.

  Unless, of course, you heard about your friend who whacked his thumb with a hammer 10 years ago. Having developed an irrational fear of hammers, you won't even allow one in your toolbox.

  Tally Tables - Performance Personified
  String Splitting with True Performance
  Best practices on how to ask questions

• Jeff Moden

  SSC Guru

  Points: 1004324

  More actions

  September 21, 2016 at 6:21 am

  #1902133

  Ed Wagner (9/21/2016)

  ---

  It's all about picking the right tool for the job. The more tools you have in your toolbox, the more options you have available. If you only have a hammer, then everything looks like a nail, no matter if it has a slotted head or phillips head. As you get more tools, you start to see better solutions.

  Unless, of course, you heard about your friend who whacked his thumb with a hammer 10 years ago. Having developed an irrational fear of hammers, you won't even allow one in your toolbox.

  By the same token, if all you're trying to do is pound nails, a hammer works out to be just fine provided that you don't try to use a sledge hammer to tap in a brad, or a brad hammer to drive a railroad spike. 😀 Using the correct size hammer will help prevent banging your thumbs, as well. :w00t:

  You DO have to get over the fear of using a hammer, though. The only way to do that is to learn how to use the hammer(s) properly.

  --Jeff Moden

  ---

  RBAR is pronounced "ree-bar" and is a "Modenism" for Row-By-Agonizing-Row.
  First step towards the paradigm shift of writing Set Based code:
  ________Stop thinking about what you want to do to a ROW... think, instead, of what you want to do to a COLUMN.

  Change is inevitable... Change for the better is not.
  

  ---

  Helpful Links:
  How to post code problems
  How to Post Performance Problems
  Create a Tally Function (fnTally)