Showing posts with label stored. Show all posts
Showing posts with label stored. Show all posts

Friday, March 30, 2012

How to execute a dynamic SQL with integer parameter for stored procedure?

I'm having problem on trying to execute a query in stored procedure that has parameters as a integer. The parameter with the integer is in the WHERE clause. If I take out the WHERE clause, it would work. If I take out the parameter and replace it with a value, it would work. I have try using the CONVERT function to convert it to an integer, still no luck.

Error: Unterminated String Constant.

What is the problem?

Set @.strSQL='Select *
From
(
SELECT Row_Number() Over(Order By '+ @.SortExpression+') as Row_Count,Rank() Over (Order By '+ @.SortExpression+') as TableInfo_ColumnSort,dbo.EVENT_LOGS.EVENTLOG_ID, dbo.USERS.USERNAME, dbo.EVENT_LOGS.ITEM_TYPE, dbo.EVENT_LOGS.SCREEN_ID,
dbo.EVENT_LOGS.CHANGE_TYPE, dbo.EVENT_LOGS.IP_ADDRESS, dbo.EVENT_LOGS.CREATE_DATE,dbo.USERS.FIRST_NAME,dbo.USERS.Last_NAME
FROM dbo.EVENT_LOGS INNER JOIN
dbo.USERS ON dbo.EVENT_LOGS.USER_UID = dbo.USERS.USERID
) as TableInfo
Where Row_Count Between '+@.startRowIndex+' and '+ @.maxRowIndex+' ';
Exec(@.strSQL);

Can you please try:

Where Row_Count Between ' +Convert(Varchar,@.startRowIndex)+' and '+Convert(Varchar,@.maxRowIndex)+''

|||

Try

Set @.strSQL='Select *
From
(
SELECT Row_Number() Over(Order By ' + @.SortExpression + ') as Row_Count,Rank() Over (Order By ' + @.SortExpression + ') as TableInfo_ColumnSort,dbo.EVENT_LOGS.EVENTLOG_ID, dbo.USERS.USERNAME, dbo.EVENT_LOGS.ITEM_TYPE, dbo.EVENT_LOGS.SCREEN_ID,
dbo.EVENT_LOGS.CHANGE_TYPE, dbo.EVENT_LOGS.IP_ADDRESS, dbo.EVENT_LOGS.CREATE_DATE,dbo.USERS.FIRST_NAME,dbo.USERS.Last_NAME
FROM dbo.EVENT_LOGS INNER JOIN
dbo.USERS ON dbo.EVENT_LOGS.USER_UID = dbo.USERS.USERID
) as TableInfo
Where Row_Count Between ' +CONVERT(VARCHAR(10),@.startRowIndex) -- the integer needs to be converted to varchar for the + to be a concatenate!
+ ' and ' +CONVERT(VARCHAR(10),@.maxRowIndex) + ' ';
PRINT @.strSQL -- Comment this out once the TSQL is generated correctly
Exec(@.strSQL);

|||

It works! I was converting it to an integer with the convert function. I didn't realized I had to convert it as a string..

How to execute a DTS Via a stored procedure

Hi I have created a DTS package, it runs well, but i would like to execute it in a storeprocedure

Is this possible and if so where do i start from, I have looked all over for it tho every where i look creates a DTS from a store procedure.

I need desperate help

Thanks in advanvcehere is an excellent solution for you

http://p2p.wrox.com/topic.asp?TOPIC_ID=16647

How to execute

I have a job that requires me to call and execute a SSIS package as the first step in a SQL2k5 Stored Procedure.

Can someone please give me a basic DTEXEC example?

Thanks in advance !Moving to the SSIS forum|||

cheers Louis.

To the OP, perhaps this will help:

Online Beginner Resources
http://blogs.conchango.com/jamiethomson/archive/2007/01/30/SSIS_3A00_-Online-Beginner-Resources.aspx

-Jamie

How to exec stored proc dynamically

Hello
I have 2 procedures setup in master database, sp_RebuildIndexesMain and
sp_RebuildIndexesSub

The Sub just shows and execute DBCC commands for passed database
context

sp_RebuildIndexesSub(@.listOnly bit=0, @.maxfrag Decimal=30.0)

This runs fine if I do pubs..sp_RebuildIndexesSub
However when run thru. the Main proc, I get Incorrect syntax near
'pubs'.
The main proc is

Create Proc sp_RebuildIndexesMain(@.dbName sysname, @.listOnly bit=0,
@.maxFrag Decimal=30.0)
As
Begin
Set NOCOUNT ON

Declare crDbs CURSOR For
Select CATALOG_NAME From INFORMATION_SCHEMA.SCHEMATA
Where CATALOG_NAME NOT IN ('tempdb', 'master', 'msdb', 'model',
'distribution', 'Northwind', 'pubs')
And CATALOG_NAME Like @.dbName

Declare @.execstr nvarchar(2000)

Open crDbs
Fetch crDbs INTO @.dbName
If (@.@.FETCH_STATUS<>0) --Then no matching databases
Begin
Close crDbs
Deallocate CrDbs
Print 'No databases were found that match ''' + @.dbName + ''''
Return -1
End

While(@.@.FETCH_STATUS=0)
Begin
Print Char(13) + 'Rebuilding indexes on ' + @.dbName
Print Char(13)
Set @.execstr = @.dbName + '..sp_RebuildIndexesSub '
EXEC sp_executesql @.execstr, N'@.listOnly bit, @.maxFrag Decimal',
@.listOnly, @.maxFrag
Fetch crDbs INTO @.dbName
End
Close crDbs
Deallocate CrDbs
Return 0
End

thanks
Sunit
sunitjoshi@.netzero.comI believe if you change:
Set @.execstr = @.dbName + '..sp_RebuildIndexesSub '
to
Set @.execstr = '[' + @.dbName + '..sp_RebuildIndexesSub] '

it should work.

Personally, instead of creating sp_RebuildIndexesSub in each database,
you should just create it in the master database. Then run a job like
so:

sp_msforeachdb 'USE ? if db_id(''?'') > 4
BEGIN
Print Char(13) + 'Rebuilding indexes on ' + ?
exec sp_RebuildIndexesSub 0, 30.0
END'

Be sure not to run "exec master..sp_RebuildIndexesSub 0, 30.0" or else
it will only run the master database during each loop.

Modify to your heart's content.|||Now it says
Server: Msg 170, Level 15, State 1, Line 1
Line 1: Incorrect syntax near 'SPlant5_MODEL..sp_RebuildIndexesSub'.

The stored procedure are setup in the master db. That's why I'm using
the dbname..spname to change db context.

thanks
Sunit

*** Sent via Developersdex http://www.developersdex.com ***|||Don't use sp_executesql. The problem stems from you trying to run a
stored procedure through a stored procedure. So instead, build your
string first and run it by using EXEC(@.execstr).

SET @.execstr = 'USE ' + @.dbname + ' exec sp_RebuildIndexesSub ' +
RTRIM(@.listOnly) + ',' + RTRIM(@.maxFrag)
EXEC (@.execstr)|||Got it. Had to change to this

Set @.execstr = @.dbName + '..sp_RebuildIndexesSub'
Exec @.execstr @.listOnly, @.maxFrag

thanks
Sunit|||You are right. Your code is much cleaner :)

How to exec SQL user defined function?

Hi,
How to exec a SQL user defined function in query analyzer when it accepts parameters.. I know for a stored procedure we can write
EXEC nameofstored procedure abc (@.abc is the parameter passed).. But How to run a SQL function ?
Thanks

assume function GetUser takes ID as input parameter , write the following in query analyzer and execute

BEGIN
DECLARE @.ID int
set @.ID = 45
SELECT dbo.GetUser(@.ID) AS 'User Name'
END

|||You need to either use it in a stored procedure and then call thestored procedure, or use it in some other statement, such as a SELECTstatement:
SELECT MyFunc(someField) FROM MyTable
There's no way to call it directly as you want.
Don
sql

how to exec a stored procedure

hi,

how do I exec stored procedure that accept parameter and return a single value?

here is example of report

stu_id = ******

stu_name = ****

subject | marks

aa****** | call sp_mark and return student mark for that particular student id and subject

bb****** | call sp_mark and return student mark for that particular student id and subject

cc****** | call sp_mark and return student mark for that particular student id and subject

thks,

You cannot call a stored procedure per row if you mean that with your mentioned design, you would have to get all the information within one procedure to display it in the bound table.

Jens K. Suessmeyer.

http://www.sqlserver2005.de
|||

Hi Charles,

Have you tried using a user defined function in place of the stored procedure?

Simone

|||

A potentially better performing alternative to a user defined function would probably be a derived table containing the marks for each student by subject. You would then join on the table.

Something like

select stu_id, stu_name, subject, mark

from students s

left outer join (select stu_id, subject, marks from marks) m on m.stu_id = s.stu_id

Of course you would need to summarize the marks into a table...

cheers,

Andrew

How to exec a SQL in stored procedure?

For example,
I have a variable @.SQL = 'Select ''Hello World'''
How can I execute this @.SQL in stored procedure?
Sorry for newbie question =]
Thank you.EXEC (@.Sql)
However, be aware that "Hello World
"Cylix" <cylix2000@.gmail.com> wrote in message
news:1155862466.120172.203660@.i3g2000cwc.googlegroups.com...
> For example,
> I have a variable @.SQL = 'Select ''Hello World'''
> How can I execute this @.SQL in stored procedure?
> Sorry for newbie question =]
> Thank you.
>|||The exact same way. (Just a little issue with quotes...)
I suggest that you review this article before embarking into using dynamic S
QL.
http://www.sommarskog.se/dynamic_sql.html
Example:
CREATE PROCEDURE #MyTest
AS
BEGIN
DECLARE @.SQL nvarchar(100)
SET @.SQL = 'SELECT ''Hello, World.'''
EXECUTE sp_executesql @.SQL
END
GO
EXECUTE #MyTest
--
Arnie Rowland, Ph.D.
Westwood Consulting, Inc
Most good judgment comes from experience.
Most experience comes from bad judgment.
- Anonymous
"Cylix" <cylix2000@.gmail.com> wrote in message news:1155862466.120172.203660@.i3g2000cwc.goog
legroups.com...
> For example,
> I have a variable @.SQL = 'Select ''Hello World'''
> How can I execute this @.SQL in stored procedure?
>
> Sorry for newbie question =]
> Thank you.
>sql

How to exec a SQL in stored procedure?

For example,
I have a variable @.SQL = 'Select ''Hello World'''
How can I execute this @.SQL in stored procedure?
Sorry for newbie question =]
Thank you.EXEC (@.Sql)
However, be aware that "Hello World
"Cylix" <cylix2000@.gmail.com> wrote in message
news:1155862466.120172.203660@.i3g2000cwc.googlegroups.com...
> For example,
> I have a variable @.SQL = 'Select ''Hello World'''
> How can I execute this @.SQL in stored procedure?
> Sorry for newbie question =]
> Thank you.
>|||This is a multi-part message in MIME format.
--=_NextPart_000_0BBE_01C6C228.19951980
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
The exact same way. (Just a little issue with quotes...)
I suggest that you review this article before embarking into using =dynamic SQL.
http://www.sommarskog.se/dynamic_sql.html=20
Example:
CREATE PROCEDURE #MyTest
AS
BEGIN
DECLARE @.SQL nvarchar(100)
SET @.SQL =3D 'SELECT ''Hello, World.'''
EXECUTE sp_executesql @.SQL
END
GO
EXECUTE #MyTest
-- Arnie Rowland, Ph.D.
Westwood Consulting, Inc
Most good judgment comes from experience. Most experience comes from bad judgment. - Anonymous
"Cylix" <cylix2000@.gmail.com> wrote in message =news:1155862466.120172.203660@.i3g2000cwc.googlegroups.com...
> For example,
> I have a variable @.SQL =3D 'Select ''Hello World'''
> How can I execute this @.SQL in stored procedure?
> > Sorry for newbie question =3D]
> Thank you.
>
--=_NextPart_000_0BBE_01C6C228.19951980
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
&

The exact same way. (Just a little =issue with quotes...)
I suggest that you review this article =before embarking into using dynamic SQL.
http://www.sommarskog.se/dynamic_sql.html">http://www.sommarskog.=se/dynamic_sql.html
Example:
CREATE PROCEDURE #MyTestAS BEGIN
=DECLARE @.SQL nvarchar(100)
=SET @.SQL =3D 'SELECT ''Hello, World.'''
=EXECUTE sp_executesql @.SQL
=ENDGO
EXECUTE #MyTest
-- Arnie Rowland, =Ph.D.Westwood Consulting, Inc
Most good judgment comes from =experience. Most experience comes from bad judgment. - Anonymous
"Cylix" =wrote in message news:1155862466.120172.203660@.i3g2000cwc.googlegroups.com=...> =For example,> I have a variable @.SQL =3D 'Select ''Hello =World'''> How can I execute this @.SQL in stored procedure?> > Sorry for =newbie question =3D]> Thank you.>

--=_NextPart_000_0BBE_01C6C228.19951980--

Wednesday, March 28, 2012

How to eval() a variable to get a column name?

OK.. I've got a stored procedure I'm writing, which accepts an argument called @.statfield... let's say I want to use this variable as a literal part of a SQL statement, example:

select * from table1 where @.statfield = @.value

I want to do basically an eval(@.statfield) so if @.statfield is "key_id", then the select statement comes out:

select * from table1 where key_id = @.value

How can I do this?

Thanks!Originally posted by MDesigner
OK.. I've got a stored procedure I'm writing, which accepts an argument called @.statfield... let's say I want to use this variable as a literal part of a SQL statement, example:

select * from table1 where @.statfield = @.value

I want to do basically an eval(@.statfield) so if @.statfield is "key_id", then the select statement comes out:

select * from table1 where key_id = @.value

How can I do this?

Thanks!

One way would be to build dynamic sql and execute it

I copy/pasted the following from SQL Server help

Building Statements at Run Time

DECLARE @.SQLString NVARCHAR(500)

/* Set column list. CHAR(13) is a carriage return, line feed.*/
SET @.SQLString = N'SELECT FirstName, LastName, Title' + CHAR(13)

/* Set FROM clause with carriage return, line feed. */
SET @.SQLString = @.SQLString + N'FROM Employees' + CHAR(13)

/* Set WHERE clause. */
SET @.SQLString = @.SQLString + N'WHERE LastName LIKE ''D%'''

EXEC sp_executesql @.SQLString|||One problem:

my sql statement is:

select distinct @.stat = packing_shipping from cp_elements where campaign_id = 10

however, if I use execlsql to execute that, @.stat is in some kind of local scope...and is asking to be declared, even though it already is.

How do I get my @.stat return value?? I can't do

select @.stat = exec sp_executesql @.sql

nor this:

exec @.stat = sp_executesql @.sql

help!|||declare @.stat <data type>
exec sp_executesql @.sql, N'@.stat <data type> out', @.stat out

print @.stat|||Hm, that didn't work for some reason..

declare @.stat int

....

set @.sql = N'select distinct ' + @.statfield + N' from cp_elements where campaign_id = ' + convert(nvarchar, @.campaign_id)
exec sp_executesql @.sql, N'@.stat int out', @.stat out
set @.rc = @.@.rowcount
select @.stat

@.stat shows up as NULL for some reason. did I do something wrong here?|||nevermind. altered the SQL and it worked:

set @.sql = N'select distinct @.stat = ' + @.statfield + N' from cp_elements where campaign_id = ' + convert(nvarchar, @.campaign_id)

How to enumerate all tables, views, stored procs in a database....

I posted this a short while ago
I have three main database files on a SQL 2000 server. Each database has
about 200 tables, views, stored procs, etc. I need to be quckly able to run
something in SQL Query Analyzer that will enumerate all teh tables, or all
the views, or all the Stored Procs in a db, so I can then use that output to
run a Grant or deny statement. I don't want to use roles, but instead want to
write a query that will allow me to do this.
Thank you.
S
I posted a piece of T-SQL within your other post that allows you retrieve a
list of user tables. Here is that piece of sql once again:
SELECT TABLE_NAME
FROM INFORMATION_SCHEMA.TABLES
WHERE OBJECTPROPERTY(object_id(TABLE_NAME), 'IsUserTable') = 1
I am curious. Have you thought of using stored procedures to access your
tables instead of direct table access?
Keith
"Sam" <Sam@.discussions.microsoft.com> wrote in message
news:152C1771-FD5C-4229-A8B3-4E856D246247@.microsoft.com...
> I posted this a short while ago
> I have three main database files on a SQL 2000 server. Each database has
> about 200 tables, views, stored procs, etc. I need to be quckly able to
run
> something in SQL Query Analyzer that will enumerate all teh tables, or all
> the views, or all the Stored Procs in a db, so I can then use that output
to
> run a Grant or deny statement. I don't want to use roles, but instead want
to
> write a query that will allow me to do this.
> Thank you.
> S
>
sql

How to enumerate all tables, views, stored procs in a database....

I posted this a short while ago
I have three main database files on a SQL 2000 server. Each database has
about 200 tables, views, stored procs, etc. I need to be quckly able to run
something in SQL Query Analyzer that will enumerate all teh tables, or all
the views, or all the Stored Procs in a db, so I can then use that output to
run a Grant or deny statement. I don't want to use roles, but instead want t
o
write a query that will allow me to do this.
Thank you.
SI posted a piece of T-SQL within your other post that allows you retrieve a
list of user tables. Here is that piece of sql once again:
SELECT TABLE_NAME
FROM INFORMATION_SCHEMA.TABLES
WHERE OBJECTPROPERTY(object_id(TABLE_NAME), 'IsUserTable') = 1
I am curious. Have you thought of using stored procedures to access your
tables instead of direct table access?
Keith
"Sam" <Sam@.discussions.microsoft.com> wrote in message
news:152C1771-FD5C-4229-A8B3-4E856D246247@.microsoft.com...
> I posted this a short while ago
> I have three main database files on a SQL 2000 server. Each database has
> about 200 tables, views, stored procs, etc. I need to be quckly able to
run
> something in SQL Query Analyzer that will enumerate all teh tables, or all
> the views, or all the Stored Procs in a db, so I can then use that output
to
> run a Grant or deny statement. I don't want to use roles, but instead want
to
> write a query that will allow me to do this.
> Thank you.
> S
>

How to enumerate all tables, views, stored procs in a database....

I posted this a short while ago
I have three main database files on a SQL 2000 server. Each database has
about 200 tables, views, stored procs, etc. I need to be quckly able to run
something in SQL Query Analyzer that will enumerate all teh tables, or all
the views, or all the Stored Procs in a db, so I can then use that output to
run a Grant or deny statement. I don't want to use roles, but instead want to
write a query that will allow me to do this.
Thank you.
SI posted a piece of T-SQL within your other post that allows you retrieve a
list of user tables. Here is that piece of sql once again:
SELECT TABLE_NAME
FROM INFORMATION_SCHEMA.TABLES
WHERE OBJECTPROPERTY(object_id(TABLE_NAME), 'IsUserTable') = 1
I am curious. Have you thought of using stored procedures to access your
tables instead of direct table access?
--
Keith
"Sam" <Sam@.discussions.microsoft.com> wrote in message
news:152C1771-FD5C-4229-A8B3-4E856D246247@.microsoft.com...
> I posted this a short while ago
> I have three main database files on a SQL 2000 server. Each database has
> about 200 tables, views, stored procs, etc. I need to be quckly able to
run
> something in SQL Query Analyzer that will enumerate all teh tables, or all
> the views, or all the Stored Procs in a db, so I can then use that output
to
> run a Grant or deny statement. I don't want to use roles, but instead want
to
> write a query that will allow me to do this.
> Thank you.
> S
>

Monday, March 26, 2012

How to Encrypt the Stored Procedures in SQL 2005 Express

Dear All,

I am using SQL 2005 Express, and i need to Encrypt all my Stored Procedure while deploying in my Production Server.

Help me out to do.

Hi,

specify the procedure command with WITH ENCRYPTION and SQL Server will create the procedures encrypted.

HTH, Jens K. Suessmeyer.

http://www.sqlserver2005.de

how to encrypt the password field in SQL table

Hi,

I have a login table with username and password as attributes. I need to encrypt the password using stored procedure and then save it in the database. And also while retrieving the password, decrypt using the same stored procedure and get the original text.

I dont know how to do it in SQL server 2000.

Please help me on this. Its urgent.

Thanks and Regards

Unfortunately, this is not an easy task with SQL 2000.

You will have an easier time if you use the VS.NET's encryption library to encrypt the password, and store the encrypted (hashed) value.

Then retrieve the encrypted value, use the encryption library at the application level to encrypt and match to the stored value.

Otherwise, you will be passing the password as clear text across the 'wires' -which isn't very secure.

|||

ok thanks for the suggestion.

I need to confirm whether the same can be done in SQL server 2005.

If can how to do it?

thanks and regards

|||

SQL Server 2005 has rich encryption capabilities.

However, there are two issues you need to consider about encryption.

Data at rest Data in Transit|||If you cannot rely on the client functionality for en/decrypting the information you will have to buy a third party product for SQL Server 2000 which is in common a extended procedures being able to use cryptographic libraries.

Jens K. Suessmeyer.

http://www.sqlserver2005.de

How to encrypt sp

We have a product which uses a lot of stored procedures as our business
logic layer.we don't want our customers see the boday of the stored
procedures or probably change it.I know that we can encrypt the sps but I
also know that there is a very easy method to decrypt it as well.Is there a
better way to protect our sps from being viewed and changed?
Is there any new thing in Yokun version in this regards?
ThanksHi
See today's thread "Encryption problem" in
microsoft.public.sqlserver.programming
Nothing new in SQL Server 2005.
Reards
--
Mike Epprecht, Microsoft SQL Server MVP
Zurich, Switzerland
IM: mike@.epprecht.net
MVP Program: http://www.microsoft.com/mvp
Blog: http://www.msmvps.com/epprecht/
"Ray5531" <RayAll@.microsft.com> wrote in message
news:ufEfqX0SFHA.3556@.TK2MSFTNGP10.phx.gbl...
> We have a product which uses a lot of stored procedures as our business
> logic layer.we don't want our customers see the boday of the stored
> procedures or probably change it.I know that we can encrypt the sps but I
> also know that there is a very easy method to decrypt it as well.Is there
> a better way to protect our sps from being viewed and changed?
> Is there any new thing in Yokun version in this regards?
> Thanks
>

How to encrypt and decrypt stored procedures?

I encrypt my procedures using with encryption clause, but I do not how to decrypt again.

Is there a command or utility for encrypt and decrypt in Sql 2000? How about Sql 2005?

Thanks

Haydee

Decryption is weak and can be cracked by searching on google for the specific algorithms, there was a thread sometime ago, which might be useful to you:

http://groups.google.de/group/comp.databases.ms-sqlserver/browse_frm/thread/34b309b76ba574b4

HTH, Jens Suessmeyer.

http://www.sqlserver2005.de

|||

Jens is right, the procedure encryption is actually referred to as obfuscation in Books Online. Also, there is no SQL Server command for decrypting it back.

Thanks
Laurentiu

|||

Thanks for your comments

and is there a tool in Sql Server 2005 in order to protect the code? What can I do? I need to install a project in the customer, and I would like to protect it.

Thanks again for your help.

Haydee

|||You could use third party components to accomplish this, there sure can be found some by searching in google for them.

HTH, Jens Suessmeyer.

http://www.sqlserver2005.de
|||

HI,

I am using MSDE 2000 and I will be deploying it with my software application. I have invested a good bit into my database schema and I don't want it to be viewed by others.

I can not see why some user can not take the .mdf (multiple mdf's actually) and sp_AttachDB or attach them to their instanced SQL server using EM. I of course do not want this.

Maybe someone can clear up the limitations and types of SQL security that can assure no one can simply attach the MDF to see the structure, let alone the data.

As far as I can see there is Network security as to authentication for a live/instanced SQL server and this has no ability to prevent an MDF from being re-attached and viewed/queried.

I also see EncryptByPassPhrase which I can use prior to executing a query (if I understand this process which is data remains in encrypted state until its about to be used, then decrypted in memory (I presume ? otherwise someone could grab a snapshot of the mdf while it's in decrypted state ? {or SQL server has a temp region when using encryption where it places the decrypted data I take it}) and then I have to encrypt it again after processing.

Neither of these look like they can obfuscate or lock the db schema information, such as table names, structures, fields, field types/attributes etc.

Sooooooo.....

How can I prevent a user from seeing the underlying table structures and does anyone know if column encryption will cost me 10 years off my life time wise on large data sets ?

Thanks

|||

See this recent thread for a discussion of this topic:

http://forums.microsoft.com/MSDN/ShowPost.aspx?PostID=371562&SiteID=1

Thanks
Laurentiu

|||

The only feature for protecting code in SQL Server is the WITH ENCRYPTION clause that we discussed so far. It is weak not necessarily because the encryption is weak (it uses RC4), but because the encryption key can be easily found. An attacker will focus on finding the encryption key rather than breaking the encryption algorithm in such a solution. This is a general problem and for any solution you consider, you should look at how easy it is for someone to find the encryption key.

This is basically a DRM solution, and I have talked about the difficulty of creating an unbreakable DRM solution on other threads, more recently in:

http://forums.microsoft.com/MSDN/ShowPost.aspx?PostID=371562&SiteID=1

Thanks
Laurentiu

How to encrypt all existing stored procedure?

I know that we can CREATE PROCEDURE procedure_name WITH ENCRYPTION.

But how about if I want encrypt existing stored procedures?

Which command should I use ?

how about scripting them all off, and using the following:

IF EXISTS (SELECT name
FROM sysobjects
WHERE name = N'<procedure_name, sysname, proc_test>'
AND type = 'P')
DROP PROCEDURE <procedure_name, sysname, proc_test>
GO

add your encryption, and you're all set......

|||There is no easy way. You have to script out the SQL modules (Create or Alter) and then add the WITH ENCRYPTION option to the definitions. There is no DDL to just encrypt SQL modules without specifying the definition. Why do you want to encrypt your code? The encryption mechanism is really obfuscation and it is a reversible encryption. So it is possible to get the original code from the encrypted content. If you want to protect your code then you should look at legal binding terms and copyright mechanisms.|||As of now, I mark this thread as no answer.

how to encrypt a single field like a password field

without writing code in my application? Does SQL Server have stored procedure to do it?
Any help is appreciated.
Thanks.SQL Server 2005 has support for encryption, but you have to manage keys, and write your own stored procedures that use the encrypt and decrypt functions. SQL 2000 does not have native support for encryption, I believe.|||Attached is function that is suitable for encrypting passwords.|||naaahh. any encryption formula you put together just is not going to do the job the public-key encryption is going to do.|||Attached is function that is suitable for encrypting passwords.
I have downloaded the code and will take a look at it.|||Theres an inbuilt function in SQL2000:

column type must be:
Declare PWCol varbinary(256)

to insert/update use:

...CONVERT(varbinary(256), PWDENCRYPT('THEPASSWORD'))

and to compare a password...

...where PWDCOMPARE('thepassword', PWCol) = 1

Cheers,
Phil
--
Always remember that you're unique, just like everyone else.|||a quick google search on this undocumented function gives you results on how to hack it. PUBLIC KEY ENCRYPTION is the safest bet. It's been a while since I have done this (4 years?) but I used the RSA cypher.|||naaahh. any encryption formula you put together just is not going to do the job the public-key encryption is going to do.
Not true. The encryption algorithm I gave is a "one-way" algorithm. It cannot be unencrypted, and thus is only suitable in limited situations such as password encryption. It is relatively easy to make secure one-way encryption schemes.
The challenge is to make a secure "two-way" encryption algorithm. SQL Server's built-in encryption is "two-way" but is not secure and was hacked years ago, and the decryption method is readily available on the web.|||Duplicate post.|||a quick google search on this undocumented function gives you results on how to hack it.

Blimey you boys do love to p!$$ on someones fire.

It's only hackable if your front end code is crap and you don't parse throu before SQL.
If you're stupid enough to leave your SQL server open to access then the fact you can hack a password in a table is pretty irrelevant when you can get control of the whole box.

Right, I'm off to sulk in the corner.

...

To err is human, to forgive is not our Policy.|||Whoa, Mr. Sensitive! You're gonna need thicker skin than that!

And no sulking, either. If you think we're full-o-crap, then just say so (but without throwing all tact to the wind...).

P!$$!ng on someone's fire: allowed.
Sulking in the corner: frowned upon.
P!$$!ing in the corner: well, when ya gotta go...|||Well at least I now know why my sulking corner is starting to smell so bad.|||We generally do our sulking and grousing in the Yak Corral. You can join us there:
http://www.dbforums.com/showthread.php?t=989246&page=289|||Wy not to use the in-built function encrypt() ?|||It is an undocumented function which may not be supported, or may use a different algorithm in future releases.

The algorithm has changed through releases in the past, rendering whole databases inaccessible for applications that relied upon it.

Wednesday, March 21, 2012

how to empty a stored procedure in ms sql server management studio express

hi everyone,

I have a db based on the Tracking_Schema.sql / Tracking_Logic.sql (find in &windir%/Microsoft.NET/Framework/v3.0/Windows Workflow Foundation/SQL/EN), so after executing both of them I get several stored procedures, especially dbo.GetWorkflows. And I have a solution in VS05 which when executed is filling this stored procedure with Instance-Id′s. My question is: how is the working command (like exec, truncate,..) to empty my st.procedure, not to drop/delete it?

Thanks in advance, best regards

bg

hi bg,

stored procedures can only be executed and not "filled" like "tables"... so they can not be emptied (is that english? )

so what are you trying to do? if you want to empty a specific table, you can open SQL Server Management Studio Express, select the table, access the "Open table" feature, select all rows and delete them (if not referenced in foreign key constraint) or do the same in a query window executing

TRUNCATE TABLE schema_name.table_name

or

DELETE FROM schema_name.table_name WHERE filter_criterion..

regards

sql

Monday, March 19, 2012

How to edit Stored Procedures ?

I have two questions:

1) Is it possible to rename a SQL table –or- copy the content of a table into a new table ?

2) How to replace the renamed or replaced table name inside the code of Stored Procedures that references it ?

1.

Copy only schema
Select * into NewTable from table1 where 1=2;

Copy schema with data
Select * into NewTable from table1;

2.

use "sp_rename" stored procedure
http://doc.ddart.net/mssql/sql70/sp_ra-rz_11.htm

|||Thank you very much,Girijesh.