Thank you Mr. Webb! That did it all right. So glad I posted here I would have never tried that 🙂

Now that the nature of the issue is...

declare @myParam int

set @myParam = 6 (or null)

select *

from entry

where

(entry.uid = @myParam OR @myParam is null)

No need to make the param zero. This worked as expected so that

when...

Not to be too lazy but do you have links to those other forum posts?

Thanks for the idea that does seem like an easy and performant way to write text files from SQL.

As you noted not very secure for public facing web apps. ...

Gosh I am not sure why this would be so funny I think this is exactly what MS is doing.

Isn't part of Windows server 2008 the fact that you can...

Pablo Emanuel (3/24/2008)

---

One more article that doesn't even mention the simpler way of avoiding SQL Injection using both ADO or ADO.Net. This one came closer when it suggested using sp_executesql...

I think that is a very good point. From what I have read an exists query is very cheap performance wise.

-least required priviliges

-least required data (collected or retrieved)

One thing that has not been mentioned is permission chaining. Each of my web apps uses its own SQL account and that account is ONLY given permission to run...

Just read back again and saw that this method was already mentioned...and its side effects.

Maybe I...

The best trick I learned for this involves NO dynamic SQL.

create procedure dbo.someproc

@fname varchar(50),

@lname varchar(50),

@title varchar(50)

as

select fname,lname,title from dbo.people where

fname = case when @fname is null then fname else...

The short answer is that the 'n' version supports 2 byte encoded unicode characters. Here is a short excerpt from SQL BOL.

---------

Use of nchar, nvarchar, and ntext is the...

I use sp_OACreate to employ an email sending COM object. Perhps you could do the same to use serverXMLHTTP

[ http://support.microsoft.com/default.aspx?scid=kb;en-us;Q290761 ]

In ASP I use this object to request...

Just curios but why do you not want the last column? Is it a 'text' field? I ask because if it is a smallish field you could just...

If your using .NET and this is a web app then you can access the file system directly without using iusr_

I found this out after writting a complex ASP webservice...

Couldn't you use a stored procedure to do all operations at once to a temp table or table variable?

In psuedo code.

Proc getFile

@fileSpec varchar(200)

set nocount on

1) create temp table with img...