|
Hi all .
I am going to consult you about a security concept .
In my database I have a set of tables (eg. City , Country , ...)
and I have a corresponding View for each Table (eg. V_City , V_Country , ...)
and There are a set of Add/Delete/Update/List stored procedures for each object , the user which logs on to database has only EXECUTE Privilege on defined stored procedures and does not have any kind of access to any other object in database , In your opinion , Can Inserting into/Updating Views instead of Inserting into/Updating Tables cause any problem?and Is this model help improve security? Not that I access SQL Server Database from a .Net App.
Thanks in advance.
|
|
|
|
|
DotNetWWW wrote: the user which logs on to database has only EXECUTE Privilege on defined stored procedures and does not have any kind of access to any other object in database , In your opinion , Can Inserting into/Updating Views instead of Inserting into/Updating Tables cause any problem?and Is this model help improve security?
Adding the rights to the views increases your attack surface. The attack surface is the amount of your system that is potentially open to abuse.
You also say that you have tables, and corresponding views. If the view is defined as SELECT * FROM CorrespondingTable then I don't see any advantage in that.
My personal opinion is that the best solution in most cases is to allow access only to the stored procedures that are required. That way SQL Server has the ability to verify the data before modifying the database, it can also veto and request for information. Whereas access to tables and views gives much wider scope for an application to abuse the database.
DotNetWWW wrote: Not that I access SQL Server Database from a .Net App.
I wouldn't think the type of application would make much difference.
|
|
|
|
|
Hi,
I am using VB in MS ACCESS and is not able to update a date field in the database, I am taking the value from a textbox in the form.
This is the query I have been using...
s = "Update Table1 set DOB = """ + Text2.Value + """ where name = """ + Text0.Value + """ "
DoCmd.RunSQL (s)
It is showing the type mismatch error.
Can somebody please help me with this.
Thanks
|
|
|
|
|
try to use formating if the field is DateTime type
example:
Update Table1 set format('dd.mm.yyyy',DOB) = '" + Text2.Value+"' where [Name]='"+Text0.Value+"'"
I Love SQL
|
|
|
|
|
Hi All the Following Statement in SQL gives me an Error, the Primary_ID is the Primary key for both tables
Ambiguous column name 'Primary_ID'.
<br />
select E1.Primary_ID, E2.Primary_ID,<br />
IsNull(E1.Lis_key, E2.Lis_key) AS Liskey, <br />
IsNull(E1.Attrib_code, E2.Attrib_code) AS Attributecode<br />
from Property_Mass E1<br />
full outer join Property_Home_Match E2<br />
on E1.Lis_key = E2.Lis_key<br />
and E1.Attrib_code = E2.Attrib_code<br />
where (E1.Primary_ID is null or Primary_ID is null)<br />
Thanks
Vuyiswa Maseko,
Sorrow is Better than Laughter, it may Sudden your Face, but It sharpens your Understanding
VB.NET/SQL7/2000/2005
http://vuyiswamb.007ihost.com
http://Ecadre.007ihost.com
vuyiswam@tshwane.gov.za
|
|
|
|
|
This is because Primary_ID is contained in Property_Home_Match and Property_Mass.
You need to prefix Primary_ID with E1 or E2 to make it clear which Primary_ID you are referring to.
You always pass failure on the way to success.
|
|
|
|
|
In your WHERE clause you reference Primary_ID twice but don't say which table it comes from the second time. Since it exists in more than one table it is ambiguous.
|
|
|
|
|
Ohh
Sorry Guys, my mistake, it will never happen again.
Am Sorry
Thanks
Vuyiswa Maseko,
Sorrow is Better than Laughter, it may Sudden your Face, but It sharpens your Understanding
VB.NET/SQL7/2000/2005
http://vuyiswamb.007ihost.com
http://Ecadre.007ihost.com
vuyiswam@tshwane.gov.za
|
|
|
|
|
Don't worry about it. About 10-15 years ago I once sat for two hours trying to figure out why my C++ application wouldn't compile. I'd missed a semi-colon but the compiler had thrown up 100 completely unrelated errors.
|
|
|
|
|
what is the basic difference between @a and @@a type parameter?
Soniagupta1@yahoo.co.in
Yahoo Messenger Id = soniagupta1
|
|
|
|
|
You may like to make a quick reference from here[^]
|
|
|
|
|
thanQ
Soniagupta1@yahoo.co.in
Yahoo Messenger Id = soniagupta1
|
|
|
|
|
Sonia - will you please buy some books? And will you start off by learning to use google? This information is readily available with a simple search.
Deja View - the feeling that you've seen this post before.
|
|
|
|
|
@ parameter are defined by user they are local variables in Sql. but @@ variables are global and defined by system only....
|
|
|
|
|
CREATE FUNCTION [dbo].[waste] ()
RETURNS table
AS
declare @a int
declare @b int
BEGIN
declare cur cursor for select a1,a2 from a
open cur
fetch next from a into @a,@b
while @@FETCH_STATUS =0
BEGIN
SELECT @a as a1 , @b as a2
fetch next from a into @a , @b
END
close cur
deallocate cur
return
END
where is the bug lying?
Soniagupta1@yahoo.co.in
Yahoo Messenger Id = soniagupta1
|
|
|
|
|
1. remove BEGINafter the Decleration of A & B
2. and include before before A & B
Regards
KP
|
|
|
|
|
CREATE FUNCTION [dbo].[waste] ()
RETURNS table
AS
declare @a int
declare @b int
declare cur cursor for select a1,a2 from a
open cur
fetch next from a into @a,@b
while @@FETCH_STATUS =0
BEGIN
SELECT @a as a1 , @b as a2
fetch next from a into @a , @b
END
close cur
deallocate cur
return
GO
Now it is saying
incorect syntax near the keyword declare.
return statement statement i scalar valued function must include an argument
Soniagupta1@yahoo.co.in
Yahoo Messenger Id = soniagupta1
|
|
|
|
|
youre declaring that the fn will return a table and look at the last line
Sonia Gupta wrote: return
GO
whats happening here??
Rocky
You can't climb up a ladder with your hands in your pockets.
|
|
|
|
|
You have not specified that which type of function you want to create means scalar valued function or table valued function.
I suppose that you want to create table valued function. For that your code is wrong in the starting line.
Look at the below code. Hope it will guide you.
CREATE FUNCTION [dbo].[waste]()
RETURNS @student1 TABLE
(
student_rec int,
St_name nchar(10)
)
AS
Begin
declare @a int
declare @b nchar(10)
declare cur cursor for select Id,name from student
open cur
fetch next from cur into @a,@b
while @@FETCH_STATUS =0
BEGIN
INSERT @student1 values(@a,@b)
--SELECT @a as a1 , @b as a2
fetch next from cur into @a , @b
END
close cur
deallocate cur
RETURN
end
Neeraj Gupta
IndiaNIC Infotech Ltd.
|
|
|
|
|
hi all,
i m ganesh new to code project....
i jus want to know all information about CORBA and MSP for database connection. Is anyone to help me out? n the details needed asap...thnks in advance...
GANESH
|
|
|
|
|
hellogany wrote: i jus want to know all information about CORBA and MSP for database connection
I think if we were to tell you ALL the information about that then we'd exceed the forum guidelines for length of post. Have you tried google?
|
|
|
|
|
hellogany wrote: want to know all information about CORBA
It is a very big topic and not one that can have all parts covered in a post. You are best to start researching...
"Find it your bloody self - immediately!" - Dave Kreskowiak
|
|
|
|
|
hi all
i have a table called Employee and Employees. i want to see if these tables have a same value on the following Fields "EmployeeName","Lastname", all this tables have the a Primary key called "Primary_KEY", how can i check if there is any record that is not the same and Display it. thanks
Thanks
Vuyiswa Maseko,
Sorrow is Better than Laughter, it may Sudden your Face, but It sharpens your Understanding
VB.NET/SQL7/2000/2005
http://vuyiswamb.007ihost.com
http://Ecadre.007ihost.com
vuyiswam@tshwane.gov.za
|
|
|
|
|
For SQL-Server:
select E1.Primary_Key, E2.Primary_Key,
IsNull(E1.EmployeeName, E2.EmployeeName) AS EmployeeName,
IsNull(E1.LastName, E2.LastName) AS LastName
from Employee E1
full outer join Employees E2
on E1.EmployeeName = E2.EmployeeName
and E1.LastName = E2.LastName
where (E1.Primary_Key is null or E2.Primary_Key is null) Regards
Andy
If you want to thank me for my help, please vote my message by clicking one of numbers beside "Rate this message".
|
|
|
|
|
Thanks and Rate for your Reply
I will try it
Rated
Vuyiswa Maseko,
Sorrow is Better than Laughter, it may Sudden your Face, but It sharpens your Understanding
VB.NET/SQL7/2000/2005
http://vuyiswamb.007ihost.com
http://Ecadre.007ihost.com
vuyiswam@tshwane.gov.za
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
