Re: SQL Injection Code Help

A parameter used in a TOP statement must be in parantheses.

DECLARE @n INT
SET @n = 2
SELECT TOP(@n) * From #tbl


Dan

jbiros wrote:

Agreed, but it seems a lot more difficult to write reusable code to
execute the sql when you parameterize your queries. Can you still
use, for example, a single function, ExecuteSQL(argSQL) to execute
ANY statement if you parameterize your queries? You don't want to
have to write a ton of unique code for every single SQL statement,
especially if you have a large system with thousands of SQL
statements.

Jeremy

Quite the opposite, it gets easier to write resuable code, however the
exact implementation differs depending on what you use.

Unfortunately there are two situations where you cannot use
parameters, the first one is if you want to do a TOP statement, for
some incomprehensable reason you cannot use a parameter in a TOP
statement.

The second is a IN LIST statement since there is no array or vector
type in SQL server, however this one can be solved by creating a
function that splits a a value and creates a table or you could use
the new XML datatype instead.

PL.



.

Relevant Pages

  • Re: Opinions on approach, please...
    ... Create a data layer program per table, ... number of bind variable tokens in your dynamic SQL. ... then simply EXECUTE that without passing it any parameters? ... Hard code WHERE clauses. ...
    (comp.lang.cobol)
  • Re: SQL Injection- Bypassing magic_quotes
    ... Because i was trying to execute: ... Don't terminate the query and you most ... Or try something like bobcat or one of the other SQL injection tools out ... Chief Information Security Officer ...
    (Pen-Test)
  • Re: Opinions on approach, please...
    ... Create a data layer program per table, ... number of bind variable tokens in your dynamic SQL. ... then simply EXECUTE that without passing it any parameters? ... explicitly code dummy words as bind variable placekeepers, put the host variables on the ...
    (comp.lang.cobol)
  • Re: Poor performance when executing stored procedure
    ... > Generally I would write stored procedures to do only one job. ... If SQL Server ... > which is even worse those sps can execute each other. ... > then executed spOrders which is executed in spCustomers and then got stuck ...
    (microsoft.public.sqlserver.programming)
  • Re: UPDATE query in Access 2003 raising error
    ... string into a variable strSQL but create the qrydef from a string strSQLx (I ... Runtime error 3066 Query must have at least one destination field. ... The SQL works fine if I use it in the QBF Design mode. ... Elsewhere in the code I use the same technique to execute an SQL ...
    (microsoft.public.access.formscoding)