Database

Re: Please help me: need sp4

5-May-05 0:21

hhrafn wrote:
for example I'd like to make sure that numbers are actually numbers and username like "joe" isn't something like "'; DROP table;--"

Well, if you are using stored procedure this shouldn't be too much of a problem. You are passing the parameters to the stored procedures correctly, aren't you? I mean your code is something like this:

SqlCommand cmd = new SqlCommand("MyStoredProcName");
cmd.CommandType = CommandType.StoredProcedure;
cmd.Parameters.Add("@userNameParam", "joe");

If you add parameters in this way you are protected from a first order attack. If your command string is something like

EXEC MyStoredProcName @userNameParam = 'joe'

then you should replace it with code like the first example above.

In your stored procedure you can then have code like this

IF EXISTS (SELECT * FROM UsersTable WHERE UserName = @userNameParam)
BEGIN
    -- Do stuff based on the user existing
END
ELSE
BEGIN
    -- Do stuff based on this being an incorrect user
END

For more information see SQL Injection Attack and Tips on How to Prevent Them[^]

Does this help?

My: Blog | Photos | Next SQL Presentation
WDevs.com - Open Source Code Hosting, Blogs, FTP, Mail and More

Please help me: need sp4

Chak4-May-05 15:29

Chak

4-May-05 15:29

http://support.microsoft.com/default.aspx?scid=kb;en-us;814414

Error: Attempting to connect to server: <servername>; Unable to connect to the registry on the server (<servername>), or you are not a member of the OLAP Administrators group on this server.

Colin Angus Mackay4-May-05 19:37

4-May-05 19:37

There is no Service Pack 4.

If you follow the instructions in the section marked "Resolution" in the link you gave already (http://support.microsoft.com/default.aspx?scid=kb;en-us;814414[^]) then you should resolve your problem.

My: Blog | Photos | Next SQL Presentation
WDevs.com - Open Source Code Hosting, Blogs, FTP, Mail and More

Prob using Oracle 9i

vishalmishra4-May-05 11:46

vishalmishra

4-May-05 11:46

i used an ASP.NET Web Application as front end and used Oracle 8i as the backend..on Windows 2000 Advanced Server as OS...

the connectivity between the two was working properly.. but then.. i had to use another computer which had oracle 9i.. i created the same database in Oracle 9i.. but on debugging it showed error on the line

me.oledbconnection1.open()

and mess was that the networking components are not installed..

wat to do now

Re: Prob using Oracle 9i

Colin Angus Mackay4-May-05 12:00

4-May-05 12:00

vishalmishra wrote:
the networking components are not installed..

wat to do now

If you haven't installed the networking components then you should do that. If you have installed them then maybe the installation is damaged and you should try and install them again.

DISCLAIMER: I know nothing about Oracle, it just seems to me that the error message is fairly self explanitory.

My: Blog | Photos | Next SQL Presentation
WDevs.com - Open Source Code Hosting, Blogs, FTP, Mail and More

Re: Prob using Oracle 9i

vishalmishra4-May-05 12:14

vishalmishra

4-May-05 12:14

Actually wat networking components i need to install ..??? i could not get it...

the real errror was

Oracle client and networking components were not found. These components are supplied by Oracle Corporation and are part of the Oracle Version 7.3.3 or later client software installation. Provider is unable to function until these components are installed

and i went for Full Oracle 9i installation..

Newbie GROUP BY question

moredip4-May-05 11:01

moredip

4-May-05 11:01

Hi,

I'm currently working on some SQL stuff as part of a project I've been assigned to, and I have a newbie question regarding the GROUP BY clause in a SELECT statement.

I have a table, Activity_Session_Summary, that contains information about the results of the online quizzes that our product administers. Each tuple represents a summary of a user's results for a specific attempt at a specific quiz. Its columns include 'ActivityID', 'PercentCorrect' and 'WhenCompleted'.

What I need is a SELECT statement that returns the PercentCorrect value for the most receently completed quiz attempt, for each activity. So far I have

SELECT ActivityID, MAX(WhenCompleted) FROM Activity_Session_Summary
WHERE StudentID = '%s' AND ActivityID IN ( %s )
GROUP BY ActivityID

where the %s's are format placeholders.

This statement almost does what I need, but obviously doesn't give me the PercentCorrect. However I can't just add PercentCorrect to the SELECT's column list, because SQL Server politely tells me

"'PercentCorrect' is invalid in the select list because it is not contained in either an aggregate function or the GROUP BY clause.'

Can anyone point out what I need to do to get this to work as required?

Colin Angus Mackay4-May-05 11:36

4-May-05 11:36

Okay - Before I answer your question I am going to do my usual pointer to this article on SQL Injection Attacks and How to Prevent Them[^] whenever I see code that could potentially be attacked.

On to your question. What you need to do is take the statement you have already and use that as a subquery and have the table join onto itself via the subquery. It sounds more difficult than it is.

SELECT main.ActivityID, main.PercentComplete, main.WhenComplete
FROM Activity_Session_Summary AS main
INNER JOIN (SELECT ActivityID, MAX(WhenCompleted) AS WhenComplete
            FROM Activity_Session_Summary
            WHERE StudentID = %s AND ActivityID IN ( %s )
            GROUP BY ActivityID) AS sub
ON main.ActivityID = sub.ActivityID AND main.WhenComplete = sub.WhenComplete
WHERE StudentID = '%s' AND ActivityID IN ( %s )

I've left your format placeholders even though they represent a potential security risk.

Your original query has now been made the subquery and as you can see, nothing has changed there except that I named the aggregate column so I could refer to it later.

The main query selects the data that you want and joins onto the subquery. You will notice from the join that it is joined on the result of the aggregate as well as the ActivityID (I'm guessing that is a foreign key onto another table). Finally, your where clause is repeated on the main query, although it may not be needed - I don't know enough about your data model to make that determination. If it isn't needed it won't do any harm.

Does this help?

My: Blog | Photos | Next SQL Presentation
WDevs.com - Open Source Code Hosting, Blogs, FTP, Mail and More

moredip4-May-05 11:50

moredip

4-May-05 11:50

Hi Colin,

Wow! Thanks for such a rapid and comprehensive reply, I really appreciate it.

I also appreciate your warning re: injection attacks. However, this project is for internal use with hardcoded input values, and will not be accessible in any way outside the machine it's run on. Famous last words? Well, if our security is so screwed that someone can access the script and modify the SQL statement then I can think of many easier ways for them to accomplish their evil ends. But I appreciate your concern!

I think I understand the SQL you gave. I was hoping that there was a way to do this without subqueries (they make my head hurt a little at times), but suspected that they would be necessary.

I think that the StudentID /is/ necessary in the main query. It's theoretically possible that two rows in the result set don't differ in ActivityID or WhenCompleted, but only by StudentID. Not likely, as it would involve two students completing the same activity within a second of each other (or whatever the resolution of DateTime is in SQL Server), but possible none the less.

Again, thanks a lot Colin, you've really helped me out here, and hopefully helped me learn a little so I don't ask the same question in a different form in 2 months time!

Cheers,

Pete

Colin Angus Mackay4-May-05 11:57

4-May-05 11:57

moredip wrote:
I think that the StudentID /is/ necessary in the main query. It's theoretically possible that two rows in the result set don't differ in ActivityID or WhenCompleted, but only by StudentID. Not likely, as it would involve two students completing the same activity within a second of each other (or whatever the resolution of DateTime is in SQL Server), but possible none the less.

Best to leave it in then. If it is taken out then it can be a nasty time-consuming bug to track down if that condition does happen. I know, I spent two days tracking something similar, which was why I was cautious about removing it without knowing more about your data.

moredip wrote:
thanks a lot Colin, you've really helped me out

Your most welcome.

My: Blog | Photos | Next SQL Presentation
WDevs.com - Open Source Code Hosting, Blogs, FTP, Mail and More

moredip4-May-05 12:11

moredip

4-May-05 12:11

Hi again Colin,

I modified the SQL you provided slightly from this:

Colin Angus Mackay wrote:

SELECT main.ActivityID, main.PercentComplete, main.WhenComplete
FROM Activity_Session_Summary AS main
INNER JOIN (SELECT ActivityID, MAX(WhenCompleted) AS WhenComplete
FROM Activity_Session_Summary
WHERE StudentID = %s AND ActivityID IN ( %s )
GROUP BY ActivityID) AS sub
ON main.ActivityID = sub.ActivityID AND main.WhenComplete = sub.WhenComplete
WHERE StudentID = '%s' AND ActivityID IN ( %s )

to this:

SELECT main.ActivityID, main.PercentCorrect
        FROM Activity_Session_Summary AS main
        INNER JOIN (SELECT ActivityID, MAX(WhenCompleted) AS WhenCompleted
                    FROM Activity_Session_Summary
                    WHERE StudentID = '%s' AND ActivityID IN ( %s )
                    GROUP BY ActivityID) AS sub
        ON main.ActivityID = sub.ActivityID AND main.WhenCompleted = sub.WhenCompleted
        WHERE main.StudentID = '%s'

I just wanted to confirm with you that removing the final AND ActivityID IN ( %s ) makes sense. It seems to me that it's redundant, since the main.ActivityID = sub.ActivityID join will ensure that only ActivityID's in the supplied ( %s ) list will be considered. Is that correct?

Cheers,

Pete

Colin Angus Mackay4-May-05 12:13

Average formula with SQL table

4-May-05 12:13

moredip wrote:
Is that correct?

Yes, you are quite right. Since it is on the join already, it is redundant in the WHERE clause.

My: Blog | Photos | Next SQL Presentation
WDevs.com - Open Source Code Hosting, Blogs, FTP, Mail and More

Joey Picerno4-May-05 10:20

4-May-05 10:20

I have a table with two columns
ServiceDate(datetime) & Attendance(int)

I wish to add another column that calcs the attendance average. How do i write
the formulate for this column. Not for each record but for all the records in the table
everytime a new one is added. That sounds confusing. If anyone knows what to do i would
appreciate the help.

Colin Angus Mackay4-May-05 11:42

4-May-05 11:42

So, every time you insert, update or delete a row in the table you want a column that represents the average updated on every row?

On the assumtion that the answer to the previous question is "yes": Why not just use AVG(Attendance) in a select statement when you want that information? Is retrieving the information so time critical that you want to hurt the insert/update/delete performance by having those operations hit every row in the table?

My: Blog | Photos | Next SQL Presentation
WDevs.com - Open Source Code Hosting, Blogs, FTP, Mail and More

Joey Picerno4-May-05 15:33

4-May-05 15:33

Here is my code, i am getting
ExecuteReader: Connection property has not been initialized.
message but this is how all my other connections are setup.

Dim conn As SqlConnection
Dim cmd As SqlCommand
Dim str As String
Dim reader As SqlDataReader

conn = New SqlConnection(ConfigurationSettings.AppSettings("connstring"))
conn.Open()

cmd = New SqlCommand("SELECT AVG(Attendance) FROM tblAttendance")
str = cmd.ExecuteReader().ToString()

Joey Picerno4-May-05 15:45

4-May-05 15:45

also notice i am reading my connection string from my Appconfig file but i know its not the config file becuase i tested it with the connection string.

Colin Angus Mackay4-May-05 19:33

4-May-05 19:33

You need to also tell the command about the connection. At the moment the command doesn't know what connection to use. Use:

cmd = New SqlCommand("SELECT AVG(Attendance) FROM tblAttendance", conn)

Also, the next problem you are going to have is this line:

str = cmd.ExecuteReader().ToString()

That line will not return the result that you want. You should use the following instead:

str = cmd.ExecuteScalar().ToString();

Does this help?

My: Blog | Photos | Next SQL Presentation
WDevs.com - Open Source Code Hosting, Blogs, FTP, Mail and More

Joey Picerno5-May-05 3:51