I have a form into which the visitor can enter data, and I want to store this data in a mysql database via the $_POST variable. What do I need to prevent sql injection?
I know a little about SQL injections and URL decode, but can someone who's more of an expert than me on this matter take a look at the following string and tell me what exactly it's trying to do?
Some kid from Beijing a couple weeks ago tried a number of injections like the one below.
%27%20and%20char(124)%2Buser%2Bchar(124)=0%20and%20%27%27=%27
Is it possible to do something like this:
INSERT INTO table(col1, col2) VALUES(something_from_another_table, value);
With something_from_another_table being a SQL command? Like, is there something I can do that's equivelant to:
INSERT INTO table(col1, col2) VALUES((SELECT value FROM table2 WHERE id = 3), value);
Hi. I'm trying to pivot some data in SQL Server 2000, but the user that runs the application only have read/write permissions. I've looked the solutions posted here, but all involving create/destroy temporary tables.
I'm working on a mock exam paper at the moment, however I have no set of correct answers and I'm not sure what the correct answer of this SQL query is.
Given a table:
foo, bar
a , 1
b , 3
a , 2
c , 1
and the query:
SELECT foo, sum(bar)
FROM table
GROUP BY foo
The two ways I can see this going are either:
a 3
a 3
b 3
c 1
or
a 3
b 3
c 1
Thanks.
I have a question regarding the Sql Joins.
whenever we join two different tables on some fields.
what will happen exactly inside oracle which will result in the query output.
will there be a temporary table created just for presenting the query output.
Hi,
what is index in sql can u explain or any reference to understand clearly. where should i use the index. I search in stackoverflow but it is not clear for me. thank you
How would one go about converting this into a UDF? I'll pass the product_id to the UDF.
Running SQL 2k5
SELECT
sum(qty) as qty,
product_id
FROM vProductQuantity
WHERE
product_id = @product_id
GROUP BY product_id
I have a SQL table it has more than 1000000 rows, and I need to select with the query as you can see below:
SELECT DISTINCT TOP (200) COUNT(1) AS COUNT, KEYWORD
FROM QUERIES WITH(NOLOCK)
WHERE KEYWORD LIKE '%Something%'
GROUP BY KEYWORD ORDER BY 'COUNT' DESC
Could you please tell me how can I optimize it to speed up the execution process? Thank you for useful answers.
Hi,
I would like to select a random line in my database. I saw this solution on a website:
SELECT column FROM table
ORDER BY RAND()
LIMIT 1
This SQL query run but someone said me that it was a non performant query. Is there another solution ?
Thx
I have some doubt as follows
We are UPDATING a field in SQL and ALTER the row also.After giving the COMMIT command the system is crashed.Wat will happen to the commands given,whether it will UPDATE and ALTER the table r not?
Does closing a java.sql.Connection also close all the statements, prepared statements, etc. obtained from that connection? Or is there going to be memory leak if I close the connection but leave the statements, etc. unclosed?
Hello,
We have observed that there seems to be a maximum number of ids/variables which one can pass in the IN clause of SQL as comma seperated values. To avoid this we are storing all the ids in a table and doing a SELECT within the IN clause. This however means extra database operations to store and retrieve ids. Is there any other way to use IN without SELECT?
regards
Sameer
thanks for yout time helping on this ;)
I'm new toSQL and wish to solve somethign in just one query and i dont know how to do it.-
Basically I've a table of products, a table of users and a table of comments, linked by products.id - comments.pid and user.id - comments.uid ,
i wish to know what is the best practice to create just 1 query and get all products with child comments, including username.
How to find out the last date and timestamp of schema updation in SQL Server database. I could locate the database created and last back up date from properties. But, couldn't find the last schema updated date. Is there a way to find this out?
I was wondering if it's possible to do something like this (which doesn't work):
select cast( (exists(select * from theTable where theColumn like 'theValue%') as bit)
Seems like it should be doable, but lots of things that should work in SQL don't ;) I've seen workarounds for this (SELECT 1 where... Exists...) but it seems like I should be able to just cast the result of the exists function as a bit and be done with it.
hi
i have 4000 records, and i need to pick randomize 500 records.
i need that 500 records will insert to GoodTable
and the rest 3500 records will insert to BadTable
how to do it using sql-server 2008 query ?
thank's in advance
I'm learning how to use SQL Server Management Studio and can't figure out how to insert a new row into a table.
Table Structure:
ID,
Field1,
Field2
Query:
INSERT INTO Table (Field1,Field2) VALUES(1,2)
Error:
Major Error 0x80040E14, Minor Error 25503
I'm probably missing something very noobie like. Any help would be appreciated.
Hi
I am creating a stored procedure to which i want to pass as variable a comma delimited list of Ids
I want to use the Ids into a select statement
something like
Create Procedure up_TEST
@Ids VARCHAR(MAX)
AS
SELECT * FROM ATable a
WHERE a.Id IN(@Ids)
Obviously i get the error that @Ids is a varchar and not an INT but how can i convert the comma delimited list
I am using SQL Server 2008
Thanks
Hi I've got some SQL ...
SELECT
AdviceNo,
Registration
FROM tblSalesDetail
that produces something like ...
ADV00001, ABC123
ADV00001, CDE564
ADV00002, FGE432
ADV00003, HUY789
ADV00003, MJS532
ADV00003, JFY428
Can anyone tell me how I'd adjust it to see the following please?
ADV00001, ABC123, 1
ADV00001, CDE564, 2
ADV00002, FGE432, 1
ADV00003, HUY789, 1
ADV00003, MJS532, 2
ADV00003, JFY428, 3
I am trying to output a long XML result from SMSS.
When I right click on the results and 'save results as...', I can only get a 2mb file?
I have changed the settings in SMSS via Tools - Options - Query Results - SQL Server - Results to Grid, for XML data to be unlimited.
Forever, it still seems to be truncating my XML results?
So, how can I bypass this problem and output my XML result to a file?
Thanks
how to
compare the values of same table(say for eg: Order table) each and every time the record get inserted ,
if the record with same values get inserted already in same table i should not insert the new record with same values. how to do that exactly in sql server 2008
E.g.
Declare @str varchar2(20)
Set @str = 'A Student'
Select Reverse(@str)
Output:
tnedutS A
Expected being:
Student A
The output(using Reverse) is as expected. But my requirement is the one described.
Help needed with SET BASED.
I am using SQL Server 2005