what is SQL injection?
96266
som web programmers implements authentication very poorly and its possible to bypass the authentication by providing some sql trick in username login fields, and this is called as SQL injection
696438
I'm missing something from your question.\n\nYou can always test your query in query analyzer.\n\nYour query looks fine but my confusion is in your where clause - if xxx is coming from the textbox then it sounds like you might generate the following query:\n\nselect * from table where bob like '%@bob'.\n\nWhen you probably want the following:\nselect * from table where COLUMNNAME like '%bob'\n\nnote:  I removed the @ symbol from your sql statement.\n\nAlthough you're better off creating a stored procedure that accepts a parameter using the field value as the parameter.\n\nIf you have any questions feel free to send me an email.
377667
heres some code from a old ASP.NET application I found (the database connection string should be 1 line)\n\nDim Public DBS as String = "PROVIDER=Microsoft.Jet.OLEDB.\n4.0; DATA Source=c:&#92;DataBase.mdb"\n\n\n\nDim myconnection as oleDbConnection = new oleDbconnection(DBS)\nmyConnection.open()\nDim myCommand as oleDbCommand = New OleDbCommand("Select * from Threads", myConnection)\nDim myDataReader as oleDbDataReader = myCommand.ExecuteReader()
68444
Stored Procedures (which are good for security as you call procedures with parameters and encapsulate your queries) as opposed to dynamically generating SQL, Triggers (which allow you to perform data 'massaging' or special logging based on values that change in the database, and Views, which allow you to perform SELECT statements as if they were being done on a table, but instead a view that can internally limit the subset of data that can be returned.\n\nViews are also good for security as you only allow access to specific fields and you can also boost performance by having your views limit the amount of data (for example, within a particular date range).\n\nAll of these database objects are well worth the move as they help increase security and productivity with regards to development of applications that take advantage of them.
254673
The best way to learn SQL is by using it. The four basic things you need to know are Select, Insert, Update, and Delete. \n\nSELECT [columns to select] FROM [table] [where] [order]\n\nINSERT INTO [table] ([names of fields to insert]) VALUES ([values to insert into respective fields])\n\nUPDATE [table] SET [field name 1]=[value 1], [field name 1]=[value 1] [where]\n\nDELETE FROM [table] [where]\n\n\n[table]-> the table you want to modify\n[field or column name]-> the column in the table you want to modify\n[where]-> tell which rows of the table to modify. Usually looks like "WHERE ID=1" or "WHERE ID like '%1%'" or "WHERE ID IN (1,2,3,4,5)"\n[order]-> the order by clause tells how the values should be ordered. "ORDER BY Create_Date" or "ORDER BY Create_Date DESC"\n\nThat should get you started. Then look at Joins, nesting, etc. Good luck!!
683017
"What is my problem in database connection?"\nThe three potential problems that come to mind are:\n1. You aren't using a password and the account has a password. You need to specify a password for your MySQL account when connecting.\n2. The user does not exist.\n3. Or that user is not permitted to access the database from 'localhost'.\n\nTry using the account 'accountname'@'%', to allow access from anywhere (this is not particularly secure, but it's useful for testing purposes).\n\n\nIf you don't know anything about MySQL or SQL, you are asking in the wrong place. Try a question like "Where can I find good resources for helping me learn SQL?".
578072
You should have several layers of security. First setup DB login accounts with different privilege levels and strong passwords. For example only having permission to do selects can be sufficient for a lot of Web interfaces. This helps insulate you from damage due to SQL injection or a compromised account. Second most industrial strength DBMS allow you to encrypt the contents of columns. Since it is at the DB level it can still index and enforce consistency constraints on the data. If you aren't able to trust the DB layer's security, then  you can also encrypt your data at the application layer, but then you lose some of the nice properties of a DB (constriant enforcement).
1143344
yes this error is normal \nfor backup and restore you can not close sql connetion and you can not use bak/res command directly \nbefore starting you must checked database staus with sql extednded procedure if no body have luck status you can use this step \n  IF NOT ADOConnection1.InTransaction THEN\n   BEGIN\n     ADOConnection1.IsolationLevel := ilIsolated\n     YOUR CODE HERE ...\n   ADOConnection1.IsolationLevel := ilReadUncommitted\n   END;\n\nNOBODY CONNECT TO SQL BEFORE  THIS ADOon1.IsolationLevel := ilReadUncommitted\n\nFOR MORE INFO READ SQL DOCUMENT ABOUT CUNCURRNCY AND TRANSACTION \n\nBEST REGARD
1082818
Please note for any of this to work you have to have the project references include the Microsoft ActiveX Data Objects library\n\ndim conn as new ADODB.Connection\ndim rs as new ADODB.Recordset\n\n'Tell your connection what and how to connect\nconn.ConnectionString= "DSN=DSNname;UID=SqlServerUserID;pwd=SqlServerPassword"\n\n'open the connection\nconn.open\n\n'Run your SQL Query\nset rs = conn.Execute("Select * from datatable")\n\n'See if any records were returned we do this\n'by seeing if the recordset is simoultaneously reporting\n'that it is at the beginning and end of the record set\nif not rs.EOF and not rs.BOF then\n\n\n     'Get the field by field name\n      myValue=rs("fieldName")\n\n     'Get the field by position in the return set\n     'This is a zero baed index\n      mySecondValue= rs(3)\n\n     'Now I move to the next record. \n     rs.MoveNext\n\n     if not rs.EOF then\n          'Get another value\n           myValue=rs("FieldName")\n     end if\n\nend if\n\n'now close and clean up\n\nconn.Close\nset rs = nothing\nset conn=nothing
583831
Avoid using the CommandBuilder. Use parameters instead. The possible causes of the error can be :\n\n1. An error in the sqlstatement created by the commandBuilder.\n2. There can be a mapping error. The dataAdapter maps the columns in the dataset.table to the columns in the database.table . Any wrong mapping can also generate the exception.\n\nfix :\n1. Use parametrized queries. \n2. Add an explicit Data table mapping to the data adapter, so that it does not automatically create a mapping which may be erroneous.\n\neg. \n With daUsers\n                .MissingMappingAction = MissingMappingAction.Passthrough\n                .MissingSchemaAction = MissingSchemaAction.AddWithKey\n                .InsertCommand = New OleDb.OleDbCommand("INSERT INTO [Users] ([UserID], [Full Name]) Values ( ?, ?)", DbConnExclusive)\n                With .InsertCommand.Parameters\n                    .Add("UserID", OleDb.OleDbType.Integer, 0, "UserID")\n                    .Add("Full Name", OleDb.OleDbType.Integer, 0, "Full Name")\n                    End With\n                .UpdateCommand = New OleDb.OleDbCommand("UPDATE [Users] SET [Users].[Full Name] = ? WHERE [Users].[UserID] = ?", DbConnExclusive)\n                With .UpdateCommand.Parameters\n                    .Add("Full Name", OleDb.OleDbType.Integer, 0, "Full Name")\n                    .Add(New OleDb.OleDbParameter("UserID", OleDb.OleDbType.Integer, 0, ParameterDirection.Input, False, 0, 0, "UserID", DataRowVersion.Original, Nothing))\n                End With\n                .TableMappings.AddRange(New Data.Common.DataTableMapping() {New Data.Common.DataTableMapping("Users", "Users", New Data.Common.DataColumnMapping() {New Data.Common.DataColumnMapping("Full Name", "Full Name"), New Data.Common.DataColumnMapping("UserID", "UserID")})})\n            End With
993355
Hi, can you emphasize on the SQL Load Test Program. For instance what is your outcome to use such application.\n\nTo test if the sql connection is valid within an application, the drivers JDBC/ODBC/ADO which are the main ones 99% people use them.. already deal if the database connection method failed. If it failed it will return false.\n\nSo look into your api for the sql application your doing and see what the connect method returns.\n\nSorry if i answered your question differently, please clarify things :)
1054783
Dude... whoever said "use the connection wizard" just isn't creative at all...\n---------------------------------------------------------\n\nHere is code that helps you get started:\n\npublic DataTable listExistingForAdmin()\n{\n//a temporary table for storing the data into a dataset\nstring temptable = "yourTableNameHere";\n\n//prepare the SQL statement...\nstring sql = "EXEC df_groups_listExistingForAdmin"; //your SQL code here\n\n//open the connection - use your connection string!!!\nthis.con = new SqlConnection("packet size=4096;user id=dbuser;password=dbuser;data source=YourDbServerName;persist security info=False;initial catalog=yourDbName");\nthis.con.Open();\n\n//instantiate the command\nthis.com = new SqlCommand(sql, this.con);\nthis.com.CommandText = sql;\n\n//instantiate the data adapter\nSqlDataAdapter adapt = new SqlDataAdapter();\nadapt.SelectCommand = this.com;\n\n//instantiate the DataSet\nDataSet ds = new DataSet();\n\n//complete the transaction\nadapt.Fill(ds, temptable);\nDataTable dt = ds.Tables[temptable];\n\n//clean house\nadapt.Dispose();\nthis.com.Dispose();\nthis.con.Close();\n\nreturn dt;\n}//end ()\n\nHope this helps!!
1077460
The SQL used by MS Access by default is called TransactSQL (sometimes shortened to t-SQL) \n\nSQL is an ANSI (American National Standards Institute) standard computer language for accessing and manipulating database systems. SQL statements are used to retrieve and update data in a database. SQL works with database programs like MS Access, DB2, Informix, MS SQL Server, Oracle, Sybase, etc.\n\nUnfortunately, there are many different versions of the SQL language, but to be in compliance with the ANSI standard, they must support the same major keywords in a similar manner (such as SELECT, UPDATE, DELETE, INSERT, WHERE, and others).\n\nNote: Most of the SQL database programs also have their own proprietary extensions in addition to the SQL standard!
112568
refer these urls..\n\nhttp://msdn.microsoft.com/library/default.asp?url=/library/en-us/architec/8_ar_da_5b1v.asp\n\njust surf through the bookmark on left hand side..\nhttp://msdn.microsoft.com/library/default.asp?url=/library/en-us/createdb/cm_8_des_05_30s5.asp\n\n\nalso refer this one..simple n straight forward\nhttp://www.1keydata.com/sql/sql-create-index.html
463607
I know Transact-SQL, PL/SQL and MySQL, and none of them use WITH as a predicate or condition.\n\nThat said, in some programming languages, WITH is a way to add parameters to a given variable:\n\nDim objMail As New CDONTS.NewMail()\nWith objMail\n.To = "Someone@somewhere.com"\n.From = "me@myserver.com"\n.Subject = "Hello!"\n.BodyText = "Hi there!"\n.Send()\nEnd With
660500
This is not a problem with quote escaping. magic_quotes only affects data (strings) coming from $_GET, $_POST or $_COOKIE.\n\nYou have a syntax error on this line:\nmysql_select_db ('db2;);\n\nIt should be:\nmysql_select_db ('db2');\n\nAlso, you have numerous errors in the CREATE TABLE statement.\n\n1) prov ENUM NOT NULL: you have to give ENUM a set of values, such as ENUM('ca', 'wa', 'az', 'ny')\n\n2) style TEXT NOT NULL AUTO_INCREMENT: column type TEXT cannot use AUTO_INCREMENT. Only integer column types (int, mediumint, tinyint, etc) can use AUTO_INCREMENT\n\n3) webs VARCHAR( 225 ) DEFAULT 'http://' NOT NULL , *****ERROR: remove *****ERROR\n\n4) photo VARCHAR( 225 ) DEFAULT 'nopic.jpg' NOT NULL , ***ERROR: remove *** ERROR\n\nYour final SQL statement should read:\nCREATE TABLE members (\n\nid INT( 10 ) UNSIGNED NOT NULL AUTO_INCREMENT ,\nusername VARCHAR( 15 ) NOT NULL ,\nencryptpass VARCHAR( 225 ) NOT NULL ,\npassword VARCHAR( 15 ) NOT NULL ,\nname VARCHAR( 225 ) NOT NULL ,\nprov ENUM('ca', 'wa', 'az', 'ny') NOT NULL ,\nstyle TEXT NOT NULL,\nhist TEXT NOT NULL ,\nopen TEXT NOT NULL ,\nwebs VARCHAR( 225 ) DEFAULT 'http://' NOT NULL ,\nemail VARCHAR( 225 ) NOT NULL ,\nphoto VARCHAR( 225 ) DEFAULT 'nopic.jpg' NOT NULL ,\nsignupdate DATETIME DEFAULT 'now()' NOT NULL ,\nPRIMARY KEY ( `id` ) ,\nUNIQUE (`username`)\n) TYPE = MyISAM;
1002503
I hate the darn things. I have one in my name and it's a real pain.\n\nApplications written in SQL have a real problem with them too and usually error out if you include one.\n\n\nOther than that it's just plain lazy.