|
Microsoft SQL server version 7.0
---------------------------------
I have to find out a way..where in the login id and passwords can be stored
in more secured way..
I browsed the netb and found out the following information..does this apply to sql server 7.0 ?
"
Passwords are stored in the sysxlogins table in encrypted form.SQL Server uses an undocumented function, pwdencrypt() to produce a hash of the user's password, which is stored in the sysxlogins table of the master database.
When a user attempts to authenticate to SQL Server several things happen to do this. Firstly SQL Server examines the password entry for this user in the database and extracts the "salt" - 84449305 - in the example. This is then appended to the password the user supplies when attempting to log in and a SHA hash is produced. This hash is compared with the hash in the database and if they match the user is authenticated - and of course if the compare fails then the login attempt fails.
The user's password is converted to it's UNICODE version if not already in this form.The salt is then appended to the end. This is then passed to the crypt functions in advapi32.dll to produce a hash using the secure hashing algorithm or SHA. The password is then converted to its upper case form, the salt tacked onto the end and another SHA hash is produced."
This methodos storing is adopted by SQL server..
in this method...hacking the passwords sounds so easy!
so..
Can someone suggest a better way for storing the passwords and the login information..
storing it in teh registry is also not safe .,I guess!
thank u..
ranjani
|
|
|
|
|
|
Unless someone has found a way of generating passwords from their salted hash value, I don't understand what the problem is....
Steve S
|
|
|
|
|
while i executed a sql string to insert a new record, one of the fileds of this record had a length of 500, this field in the ORCAL database had been design to have 1000 VARCHAR2(1000),i executed this command string in TOAD,it had no problem, but when i used ado execute method of command object, the function didn't return, and did't report any error, so ,what is the problem ?
the sql string is :
YW_SAVEFCXXWKJL ( '200311270004',10653.000000,500.000000,'hfghfghghhghfgherytrtyttrytryughfghjnnghbbghtyghvnbnghfghfghghhghfgherytrtyttrytryughfghjnnghbbghtyg','hfghfghghhghfgherytrtyttrytryughfghjnnghbbghtyghvnbngfghghfffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff444444444444444444444444444444444444444444442333333333333333333333333333333333333333333333333333333333333332222222222222222222222222222222222222222222222222222222222222222222222233333333333333333333333333333333333336666666666666666666666666666666666666666666666666666666666777777777777777777777777777777777777777774444444444444444444444777777779','','zy1','',TO_DATE('','yyyy-mm-dd')
|
|
|
|
|
|
I don't think you can change the sequence in the DataView. DataView "binds" to the DataTable and DataTable forms the columns based on the SQL string or stored procedure. You should change the order in you SQL string or stored procedure.
|
|
|
|
|
The following is the way i want to implement this.
that is..to check iff
permissiosn()&2=0x2....permissions()&32=0x20 and so on...
CREATE PROCEDURE balli
@ioparm int output,
@oparm int output AS
BEGIN
SET NOCOUNT ON
IF PERMISSIONS() &@ioparm=0x@oparm
SELECT 1
ELSE
SELECT 0
END
The above sql proc gives syntax error..how do i change it??
ranjani
|
|
|
|
|
A couple of problems: your parameters should not be specified as output, because you're passing the values into the stored procedure. The parameters are also badly named - indeed, I'm not sure you need two parameters, because you're just trying to see if a particular flag is set.
The syntax error is coming from 0x@oparm. The prefix 0x tells SQL Server that the following characters should be interpreted as a hexadecimal number literal. If you want to do that, specify hex when assigning a value to the parameter, don't include it in the query text. @ isn't a valid character in a hex literal, so SQL Server complains.
With that in mind, I would just SELECT PERMISSIONS() and perform the mask operation in client-side code. Testing each bit separately is a waste of network and server resources.
In Visual C++, you use the & operator to mask, then == to compare. == has a higher precedence than &, so you need to use brackets to ensure that the AND operation is done first. In VB, use And to mask and = to compare.
|
|
|
|
|
The following is the way i want to implement this.
that is..to check iff
permissiosn()&2=0x2....permissions()&32=0x20 and so on...
CREATE PROCEDURE balli
@ioparm int output,
@oparm int output AS
BEGIN
SET NOCOUNT ON
IF PERMISSIONS() &@ioparm=0x*@oparm
SELECT 1
ELSE
SELECT 0
END
The above sql proc gives syntax error..how do i change it??
ranjani
|
|
|
|
|
I have a field called validfrom and validto inside my Table I want a user to be able to enter two dates and then my page pulls back all the data where there dates fall inside the dates in the DB.
something like
SELECT * from table where form.date1 and form.date2 fall between "VALIDDFROM" and "VALIDTO"
So I have a validfrom date January and a validto date of december in the db in same record
but my user types in feb to march
as
feb to march falls inside the jan - dec period
that result is pulled to the broweser?
Working with MsAccess and ASP
Thanks
- Michael Fasani
www.michaelfasani.com
|
|
|
|
|
does the command...
EXEC sp_helprotect NULL, 'dbo'
display the user dbo's permission list??
or..how should i change the above syntax so that the user permissions are displayed??
is there any other stored procedure that doesthis job?
ranjani
|
|
|
|
|
I am trying to write a query against a view to return a recordset to a webpage and can't get my where and and's to work right. Any suggestions would be greatly appreciated.
SELECT *
FROM sde.view_projects
WHERE Docu_Title AND Docu_Type AND Docu_Date AND Docu_Author LIKE '%VAR%'
What do you think? It does not want to take the AND, I am looking for contain's from any/all of these fields.
This is from and ASP Page talking to SQL 2000!
Thanks for your time!
David E.Wright - URS Corporation
|
|
|
|
|
As a general rule I like to stack my AND clauses so that they are additive: (Docu_Title LIKE someTitle) AND (Docu_Type LIKE someType) AND ... well, you get the idea. I'm no expert, but I really think you need to recast this query in a more explicit form. You're asking for an awful lot from a fairly simple inference engine. Each LIKE clause should stand alone, and be joined by AND clauses.
"Your village called -
They're missing their idiot."
|
|
|
|
|
|
Not sure how to word this, or maybe my brain just isn't working today:
I need to add records to a table. I know how to do this if I SELECT a set of data prior to adding a new record, but I would like to do it without having to do a SELECT first.
Or, how do I open an empty recordset for a table? I am trying to avoid the delay of SELECT searching a large table only to come up empty.
Apologies if this doesn't make sense or is ridiculously simple (see line 1).
>>>-----> MikeO
|
|
|
|
|
Ok, brain kicked into gear.
SELECT TOP 0 * FROM tablename
>>>-----> MikeO
|
|
|
|
|
select * from tablename where 1=2
|
|
|
|
|
Honestly Im not very sure of what language Im working with here. The file is called upload.asp and it is called upon by a javascript in an HTML file
pretty much what it does is recieve some variables to upload a file. But what I need is to delete the same file... I'll send the info of the folder, the file name and path so that I can delete it.
------------------------------------------
var doc = new ActiveXObject( 'Msxml2.DomDocument' );
doc.load( Request );
var elt = doc.selectSingleNode( 'root/file' );
var href = elt.getAttribute( 'href' );
href = href.replace( /.*[\\\/](.*)/, '$1' );
var folder = '/images/';
//folder += elt.getAttribute( 'folder' );
var name = elt.getAttribute( 'name' );
var path = elt.getAttribute( 'path' );
var all = path + folder + href
var str = new ActiveXObject( 'Adodb.Stream' );
str.type = 1;
str.open();
str.write( elt.nodeTypedValue );
str.saveToFile( all, 2 );
str.close();
Response.contentType = 'text/xml';
Response.write( '<root><file href="..' + folder + href + '">' );
str = null;
doc = null;
------------------------------------------
HELP!
Jon
X-ZD Designs
|
|
|
|
|
Not sure what your question is. If you are asking what language that is, then it is JScript on the server side.
regards,
Paul Watson
Bluegrass
South Africa
Brian Welsch wrote:
"blah blah blah, maybe a potato?" while translating my Afrikaans.
Crikey! ain't life grand?
|
|
|
|
|
Hello,
I have a problem with .NET. I have to load a xls-File in .NET. That’s no problem with the OleDbConnection, the DataAdapter and the DataSet. Now I would like to insert all this data in a Database.
I tried to do that with SqlConnection, the SqlCommand,
MyCommand.Connection.Open() and MyCommand.ExecuteNonQuery()
MyCommand.Connection.Close().
Unfortunately that doesn't work.
Also I tried to put the SQLInsertCommand in a loop for each row in the DataSet, but then I got an error, that my valuevariables are already set.
Then I tried to do it with the upload statement. But that doesn't work as well. This is just for all these rows which are changed in some way.
May be you can help me and give me another way to insert a hole DataSet into a Database or how to insert the Excel-data into the database using ASP/VB .NET ?! 
Thanks a lot,
Doerte
ps: don't blame me for my English. Actually I'm from Germany and just for an programming internship in Australia 
|
|
|
|
|
dataadapter.update(dataset, "table name")
|
|
|
|
|
Hi everyone,
I am developing an application that needs to do multiple writes many tables in the database. I will explain the structure of the tables and what I am doing:
Right now, I make an entry for every new data. There could easily be more than 40,000 entries for each application run. I would have liked to store the entries in memory (in an array) and would like flush them out in one stored procedure. The only glitch is that I do not know if stored procedures can handle C++ arrays.
I saw many articles on the web about using comma seperated strings etc and passing it to the stored procedure. However, I am always wary of strings, especially hige concatenations. I was wondering if someone has any experience regarding this and what would be the best course of action. The performance of the application right now is almost unacceptable and I would like to optimize it before it grows out of bounds.
Thanks a lot.
Pankaj
Without struggle, there is no progress
|
|
|
|
|
Do you have to the insert in a single batch?
How much data is in each insert? i.e. what data types are the fields?
Cheers,
Simon
sig ::
"Don't try to be like Jackie. There is only one Jackie.... Study computers instead.", Jackie Chan on career choices.
article :: animation mechanics in SVG blog:: brokenkeyboards
|
|
|
|
|
I have to get the user's acces permission for a specified database!
For that I use the command...PERMISSIONS()
I use ADO for establishing a connection to the database..my code is something like this now..
void main(void)
{
ADODB::_ConnectionPtr m_pConnection = NULL;
ADODB::_RecordsetPtr pRecordset = NULL;
VARIANT *vRecordsAffected = NULL;
char ConStr[500];
char str1[50];
BOOL m_bIsConnectionOpen;
// Create an instance of _Connection
HRESULT hr ;
hr = m_pConnection.CreateInstance(__uuidof(ADODB::Connection));
try
{
if (SUCCEEDED(hr))
{
//Open a connectionConStr[0] = '\0';
strcat(ConStr, "Provider=sqloledb;Server=ie10DT2KCO1473;Initial Catalog=Shree;");
strcat(ConStr,"User Id=sa;Password= ;");
m_pConnection->Open(ConStr, "", "", 0);
//If database opened successfully then set IsConnectionOpen to TRUE
if (SUCCEEDED(hr)) m_bIsConnectionOpen = TRUE;
}
/* sprintf(str1,"PERMISSIONS ( OBJECT_ID('TABLE1') )");
pRecordset = m_pConnection->Execute(str1, vRecordsAffected, 1);
}
..
and then the catch function !
Now..
How do i display the return value of the PERMISSIONS function??
kindly help me in this regard!!
ranjani
|
|
|
|
|
I was playing with this right now and in SQL Query Analyzer I had to use it like this (This is from Northwind):
USE Northwind<br />
GO<br />
SELECT PERMISSIONS(OBJECT_ID('Customers'))
This would return a value of 1881108543. This means that in your code you forgot to add SELECT before PERMISSIONS funtion in order to get the result back. Now you have to AND this value with certain other values in order to get the appropriate permission level. For this and the AND values, check the PERMISSIONS function in SQL Books On-Line.
Regards,
Husein
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
