Showing posts with label stored. Show all posts
Showing posts with label stored. Show all posts

Thursday, March 29, 2012

Backing up Stored procedures

Is there an easy simple way to backup all my personal Stored Procedures.

In the stored procedures collection, my stored procedures start with "DEF".

I would like to have the stored procedures places as text files in a personal backup folder.

Is this possible?

I have the query to get my SP's:

SELECT

*

FROM

SYSOBJECTS

WHERE

xtype='p'AND NameLIKE'DEF%'

ORDER

BY NAME

Next step is how to get the code inside each stored procedure to be exported to a .txt file.

How can I do this?

|||

You should do it at design time if possible.

You can try to send your stored procedure code as attachments in e-mail and next save this attachments or you can get stored procedure code using system stored procedure and save result to flat file output using SSIS package, You can also try to use Bulk copy?. You cannot save to file directly from T-SQL

Thanks

|||

You should do it at design time if possible.

You can try to send your stored procedure code as attachments in e-mail and next save this attachments or you can get stored procedure code using system stored procedure and save result to flat file output using SSIS package, You can also try to use Bulk copy?. You cannot save to file directly from T-SQL except if it will be CLR stored procedure which is probably best way to do it.

Thanks

|||What do you mean by CLR stored procedure ?|||

CLR stored procedure is new for SQL 2005 and allow you to create stored procedure or function in .net language, so you can access database and any available .net stuff, and good thing is that you can run it on SQL serer as standard SQL stored procedure (in the past you had extended stored procedures created in C++).

Thanks

|||

(1) You can also generate the scripts from the DB, Right click on DB -> All Tasks -> Generate Scripts.

(2) You can get the text for a stored proc from syscomments.

(3) You can probably write some application to get the text from syscomments and save it to a file.

|||

With the following query, I get all my SP and the text in the query result.

=====

USE

PDSNT

SELECT

name,text

FROM

sysobjects

INNER

JOINsyscomments

ON

sysobjects.id=syscomments.id

WHERE

xtype='p'AND NameLIKE'DEF%'

ORDER

BY NAME

=====

Next step would be to export them to .xml or .txt file.

Anyone can help?

Backing Up Stored Procedures

How do I Backup stored procedures?Backup the database which contains the stored procedures.
You backup everything in the database when you do a backup.
Not sure if you mean you want the stored procedures separate
from everything else or not but you could script out the
stored procedures if you need something along those lines.
-Sue
On Mon, 22 Mar 2004 10:34:36 -0800, "barb"
<anonymous@.discussions.microsoft.com> wrote:

>How do I Backup stored procedures?|||We do not need some of the default stored procedures.
Security docs say to drop. I want to backup before I drop
in case I need to add back at later date. How do I "script
out" the stored procedures? Thank you.

>--Original Message--
>Backup the database which contains the stored procedures.
>You backup everything in the database when you do a
backup.
>Not sure if you mean you want the stored procedures
separate
>from everything else or not but you could script out the
>stored procedures if you need something along those lines.
>-Sue
>On Mon, 22 Mar 2004 10:34:36 -0800, "barb"
><anonymous@.discussions.microsoft.com> wrote:
>
>.
>|||Right click on the db in Enterprise Manager and choose All Tasks - Generate
SQL Script. Here you can script them all or just selected ones.
Andrew J. Kelly SQL MVP
"barb" <anonymous@.discussions.microsoft.com> wrote in message
news:1198d01c4106d$70603750$a401280a@.phx
.gbl...
> We do not need some of the default stored procedures.
> Security docs say to drop. I want to backup before I drop
> in case I need to add back at later date. How do I "script
> out" the stored procedures? Thank you.
>
>
>
> backup.
> separate|||Thank You.
-- Andrew J. Kelly wrote: --
Right click on the db in Enterprise Manager and choose All Tasks - Generate
SQL Script. Here you can script them all or just selected ones.
Andrew J. Kelly SQL MVP
"barb" <anonymous@.discussions.microsoft.com> wrote in message
news:1198d01c4106d$70603750$a401280a@.phx
.gbl...
> We do not need some of the default stored procedures.
> Security docs say to drop. I want to backup before I drop
> in case I need to add back at later date. How do I "script
> out" the stored procedures? Thank you.
> backup.
> separate

Backing up Stored Procedure

Hi,
I am using the Backup Wizard with following statement to backup entire DB
from Development Server.
BACKUP DATABASE [Dev_DB] TO [Dev_DB_Backup] WITH INIT , NOUNLOAD ,
NAME = N'Dev_DB Backup',
SKIP , STATS = 10,
NOFORMAT
It doesnot backup the stored procedures developed.
Is there a way to backup the stored procedures as well through scheduled
task or some script to be run at specific time.
TIA
KayAre you sure, the command above store all the data and the object
definitions (which is actually data stored in the system tables) ?
Please make sure and confirm this.
HTH, jens Suessmeyer.|||Systems table data is not required for the time being. But yes it is.
"Jens" <Jens@.sqlserver2005.de> wrote in message
news:1132850534.307481.196070@.g49g2000cwa.googlegroups.com...
> Are you sure, the command above store all the data and the object
> definitions (which is actually data stored in the system tables) ?
> Please make sure and confirm this.
> HTH, jens Suessmeyer.
>sql

Backing up Stored Procedure

Hi,
I am using the Backup Wizard with following statement to backup entire DB
from Development Server.
BACKUP DATABASE [Dev_DB] TO [Dev_DB_Backup] WITH INIT , NOUNLOAD ,
NAME = N'Dev_DB Backup',
SKIP , STATS = 10,
NOFORMAT
It doesnot backup the stored procedures developed.
Is there a way to backup the stored procedures as well through scheduled
task or some script to be run at specific time.
TIA
KayAre you sure, the command above store all the data and the object
definitions (which is actually data stored in the system tables) ?
Please make sure and confirm this.
HTH, jens Suessmeyer.|||Systems table data is not required for the time being. But yes it is.
"Jens" <Jens@.sqlserver2005.de> wrote in message
news:1132850534.307481.196070@.g49g2000cwa.googlegroups.com...
> Are you sure, the command above store all the data and the object
> definitions (which is actually data stored in the system tables) ?
> Please make sure and confirm this.
> HTH, jens Suessmeyer.
>

Backing up Stored Procedure

Hi,
I am using the Backup Wizard with following statement to backup entire DB
from Development Server.
BACKUP DATABASE [Dev_DB] TO [Dev_DB_Backup] WITH INIT , NOUNLOAD ,
NAME = N'Dev_DB Backup',
SKIP , STATS = 10,
NOFORMAT
It doesnot backup the stored procedures developed.
Is there a way to backup the stored procedures as well through scheduled
task or some script to be run at specific time.
TIA
Kay
Are you sure, the command above store all the data and the object
definitions (which is actually data stored in the system tables) ?
Please make sure and confirm this.
HTH, jens Suessmeyer.
|||Systems table data is not required for the time being. But yes it is.
"Jens" <Jens@.sqlserver2005.de> wrote in message
news:1132850534.307481.196070@.g49g2000cwa.googlegr oups.com...
> Are you sure, the command above store all the data and the object
> definitions (which is actually data stored in the system tables) ?
> Please make sure and confirm this.
> HTH, jens Suessmeyer.
>

Sunday, March 25, 2012

backing up DTS packages stored on a SQL Server

How do I do that?
Then how do I restored them?
Thanks!
DanutThis is a multi-part message in MIME format.
--=_NextPart_000_0332_01C35132.9804EC60
Content-Type: text/plain;
charset="Windows-1252"
Content-Transfer-Encoding: quoted-printable
They are stored in the msdb database. Backing it up backs up the =packages. Restore it and you restore the packages.
-- Tom
---
Thomas A. Moreau, BSc, PhD, MCSE, MCDBA
SQL Server MVP
Columnist, SQL Server Professional
Toronto, ON Canada
www.pinnaclepublishing.com/sql
"Danut" <danutzp1@.hotmail.com> wrote in message =news:OKvB1LVUDHA.2020@.TK2MSFTNGP11.phx.gbl...
How do I do that?
Then how do I restored them?
Thanks!
Danut
--=_NextPart_000_0332_01C35132.9804EC60
Content-Type: text/html;
charset="Windows-1252"
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
&

They are stored in the msdb =database. Backing it up backs up the packages. Restore it and you restore =the packages.
-- Tom
---T=homas A. Moreau, BSc, PhD, MCSE, MCDBASQL Server MVPColumnist, SQL =Server ProfessionalToronto, ON Canadahttp://www.pinnaclepublishing.com/sql">www.pinnaclepublishing.com=/sql
"Danut" wrote =in message news:OKvB1LVUDHA.2020=@.TK2MSFTNGP11.phx.gbl...How do I do that?Then how do I restored them?Thanks!Danut

--=_NextPart_000_0332_01C35132.9804EC60--|||Danut,
See
Backing Up Packages
http://www.sqldts.com/default.aspx?6,105,202,0,1
--
Dinesh.
SQL Server FAQ at
http://www.tkdinesh.com
"Danut" <danutzp1@.hotmail.com> wrote in message
news:OKvB1LVUDHA.2020@.TK2MSFTNGP11.phx.gbl...
> How do I do that?
> Then how do I restored them?
> Thanks!
> Danut
>|||Thanks Tom!
Thanks Dinesh!
Danut
"Danut" <danutzp1@.hotmail.com> wrote in message
news:OKvB1LVUDHA.2020@.TK2MSFTNGP11.phx.gbl...
> How do I do that?
> Then how do I restored them?
> Thanks!
> Danut
>

Backing Up DTS packages

I am looking for a way to back up local DTS packages. Are they stored in
msdb? Has anyone dealt with the backup issue for DTS packages?
Larry Menzin
American Techsystems Corp.
I save them out to disk as .dts file and store them in Visual Source Safe.
Greg Jackson
PDX, Oregon
|||Hi,
All the DTS packages will be stored in MSDB. So backing up the MSDB database
will be enough.
See the below link for more info:-
http://www.databasejournal.com/featu...le.php/1462601
Thanks
Hari
SQL Server MVP
"Larry Menzin" <LarryMenzin@.discussions.microsoft.com> wrote in message
news:75673569-040D-458F-B62D-1AB1EA76D285@.microsoft.com...
>I am looking for a way to back up local DTS packages. Are they stored in
> msdb? Has anyone dealt with the backup issue for DTS packages?
> --
> Larry Menzin
> American Techsystems Corp.
|||Yes, packages are in msdb. So just make sure you have backup of your msdb database.
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://www.solidqualitylearning.com/
Blog: http://solidqualitylearning.com/blogs/tibor/
"Larry Menzin" <LarryMenzin@.discussions.microsoft.com> wrote in message
news:75673569-040D-458F-B62D-1AB1EA76D285@.microsoft.com...
>I am looking for a way to back up local DTS packages. Are they stored in
> msdb? Has anyone dealt with the backup issue for DTS packages?
> --
> Larry Menzin
> American Techsystems Corp.
|||Also have a look at DTSBackup 2000
http://www.sqldts.com/default.aspx?242
HTH
Jasper Smith (SQL Server MVP)
http://www.sqldbatips.com
I support PASS - the definitive, global
community for SQL Server professionals -
http://www.sqlpass.org
"Larry Menzin" <LarryMenzin@.discussions.microsoft.com> wrote in message
news:75673569-040D-458F-B62D-1AB1EA76D285@.microsoft.com...
>I am looking for a way to back up local DTS packages. Are they stored in
> msdb? Has anyone dealt with the backup issue for DTS packages?
> --
> Larry Menzin
> American Techsystems Corp.

Backing Up DTS packages

I am looking for a way to back up local DTS packages. Are they stored in
msdb? Has anyone dealt with the backup issue for DTS packages?
Larry Menzin
American Techsystems Corp.I save them out to disk as .dts file and store them in Visual Source Safe.
Greg Jackson
PDX, Oregon|||Hi,
All the DTS packages will be stored in MSDB. So backing up the MSDB database
will be enough.
See the below link for more info:-
http://www.databasejournal.com/feat...cle.php/1462601
Thanks
Hari
SQL Server MVP
"Larry Menzin" <LarryMenzin@.discussions.microsoft.com> wrote in message
news:75673569-040D-458F-B62D-1AB1EA76D285@.microsoft.com...
>I am looking for a way to back up local DTS packages. Are they stored in
> msdb? Has anyone dealt with the backup issue for DTS packages?
> --
> Larry Menzin
> American Techsystems Corp.|||Yes, packages are in msdb. So just make sure you have backup of your msdb da
tabase.
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://www.solidqualitylearning.com/
Blog: http://solidqualitylearning.com/blogs/tibor/
"Larry Menzin" <LarryMenzin@.discussions.microsoft.com> wrote in message
news:75673569-040D-458F-B62D-1AB1EA76D285@.microsoft.com...
>I am looking for a way to back up local DTS packages. Are they stored in
> msdb? Has anyone dealt with the backup issue for DTS packages?
> --
> Larry Menzin
> American Techsystems Corp.|||Also have a look at DTSBackup 2000
http://www.sqldts.com/default.aspx?242
HTH
Jasper Smith (SQL Server MVP)
http://www.sqldbatips.com
I support PASS - the definitive, global
community for SQL Server professionals -
http://www.sqlpass.org
"Larry Menzin" <LarryMenzin@.discussions.microsoft.com> wrote in message
news:75673569-040D-458F-B62D-1AB1EA76D285@.microsoft.com...
>I am looking for a way to back up local DTS packages. Are they stored in
> msdb? Has anyone dealt with the backup issue for DTS packages?
> --
> Larry Menzin
> American Techsystems Corp.

Backing Up DTS packages

I am looking for a way to back up local DTS packages. Are they stored in
msdb? Has anyone dealt with the backup issue for DTS packages?
--
Larry Menzin
American Techsystems Corp.I save them out to disk as .dts file and store them in Visual Source Safe.
Greg Jackson
PDX, Oregon|||Hi,
All the DTS packages will be stored in MSDB. So backing up the MSDB database
will be enough.
See the below link for more info:-
http://www.databasejournal.com/features/mssql/article.php/1462601
Thanks
Hari
SQL Server MVP
"Larry Menzin" <LarryMenzin@.discussions.microsoft.com> wrote in message
news:75673569-040D-458F-B62D-1AB1EA76D285@.microsoft.com...
>I am looking for a way to back up local DTS packages. Are they stored in
> msdb? Has anyone dealt with the backup issue for DTS packages?
> --
> Larry Menzin
> American Techsystems Corp.|||Yes, packages are in msdb. So just make sure you have backup of your msdb database.
--
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://www.solidqualitylearning.com/
Blog: http://solidqualitylearning.com/blogs/tibor/
"Larry Menzin" <LarryMenzin@.discussions.microsoft.com> wrote in message
news:75673569-040D-458F-B62D-1AB1EA76D285@.microsoft.com...
>I am looking for a way to back up local DTS packages. Are they stored in
> msdb? Has anyone dealt with the backup issue for DTS packages?
> --
> Larry Menzin
> American Techsystems Corp.|||Also have a look at DTSBackup 2000
http://www.sqldts.com/default.aspx?242
--
HTH
Jasper Smith (SQL Server MVP)
http://www.sqldbatips.com
I support PASS - the definitive, global
community for SQL Server professionals -
http://www.sqlpass.org
"Larry Menzin" <LarryMenzin@.discussions.microsoft.com> wrote in message
news:75673569-040D-458F-B62D-1AB1EA76D285@.microsoft.com...
>I am looking for a way to back up local DTS packages. Are they stored in
> msdb? Has anyone dealt with the backup issue for DTS packages?
> --
> Larry Menzin
> American Techsystems Corp.

Backing up DTS and SQL jobs....

I know If I store the DTS packages in SQL Server it will be stored in the
msdb database.
Also all the job scheduling information is stored in the msdb database.
Even though I am taking backup of system databases, I would like to know if
is there any way I can export all the DTS packages and jobs in any different
way. This is only an additional extra precaution incase If I am not able to
restore the system database in the event of disaster.
I am able to open the DTS packages individually and store as .dts file. It
is a time consuming process.
I am using SQL 2K.
Thanks,
J Smith
For DTS backup, I use a neat little program called, "DTS Backup 2000." It's
freeware.
"Jessy Martin" <Jessy_Smith79@.hotmail.com> wrote in message
news:uMDTg4gZFHA.3048@.TK2MSFTNGP14.phx.gbl...
>I know If I store the DTS packages in SQL Server it will be stored in the
> msdb database.
> Also all the job scheduling information is stored in the msdb database.
> Even though I am taking backup of system databases, I would like to know
> if
> is there any way I can export all the DTS packages and jobs in any
> different
> way. This is only an additional extra precaution incase If I am not able
> to
> restore the system database in the event of disaster.
> I am able to open the DTS packages individually and store as .dts file. It
> is a time consuming process.
> I am using SQL 2K.
> Thanks,
> J Smith
>
|||Free Backup Software from Darren Green is available at www.sqldts.com
Wayne Snyder, MCDBA, SQL Server MVP
Mariner, Charlotte, NC
www.mariner-usa.com
(Please respond only to the newsgroups.)
I support the Professional Association of SQL Server (PASS) and it's
community of SQL Server professionals.
www.sqlpass.org
"Jessy Martin" <Jessy_Smith79@.hotmail.com> wrote in message
news:uMDTg4gZFHA.3048@.TK2MSFTNGP14.phx.gbl...
>I know If I store the DTS packages in SQL Server it will be stored in the
> msdb database.
> Also all the job scheduling information is stored in the msdb database.
> Even though I am taking backup of system databases, I would like to know
> if
> is there any way I can export all the DTS packages and jobs in any
> different
> way. This is only an additional extra precaution incase If I am not able
> to
> restore the system database in the event of disaster.
> I am able to open the DTS packages individually and store as .dts file. It
> is a time consuming process.
> I am using SQL 2K.
> Thanks,
> J Smith
>
sql

Backing up DTS and SQL jobs....

I know If I store the DTS packages in SQL Server it will be stored in the
msdb database.
Also all the job scheduling information is stored in the msdb database.
Even though I am taking backup of system databases, I would like to know if
is there any way I can export all the DTS packages and jobs in any different
way. This is only an additional extra precaution incase If I am not able to
restore the system database in the event of disaster.
I am able to open the DTS packages individually and store as .dts file. It
is a time consuming process.
I am using SQL 2K.
Thanks,
J SmithFor DTS backup, I use a neat little program called, "DTS Backup 2000." It's
freeware.
"Jessy Martin" <Jessy_Smith79@.hotmail.com> wrote in message
news:uMDTg4gZFHA.3048@.TK2MSFTNGP14.phx.gbl...
>I know If I store the DTS packages in SQL Server it will be stored in the
> msdb database.
> Also all the job scheduling information is stored in the msdb database.
> Even though I am taking backup of system databases, I would like to know
> if
> is there any way I can export all the DTS packages and jobs in any
> different
> way. This is only an additional extra precaution incase If I am not able
> to
> restore the system database in the event of disaster.
> I am able to open the DTS packages individually and store as .dts file. It
> is a time consuming process.
> I am using SQL 2K.
> Thanks,
> J Smith
>|||Free Backup Software from Darren Green is available at www.sqldts.com
--
Wayne Snyder, MCDBA, SQL Server MVP
Mariner, Charlotte, NC
www.mariner-usa.com
(Please respond only to the newsgroups.)
I support the Professional Association of SQL Server (PASS) and it's
community of SQL Server professionals.
www.sqlpass.org
"Jessy Martin" <Jessy_Smith79@.hotmail.com> wrote in message
news:uMDTg4gZFHA.3048@.TK2MSFTNGP14.phx.gbl...
>I know If I store the DTS packages in SQL Server it will be stored in the
> msdb database.
> Also all the job scheduling information is stored in the msdb database.
> Even though I am taking backup of system databases, I would like to know
> if
> is there any way I can export all the DTS packages and jobs in any
> different
> way. This is only an additional extra precaution incase If I am not able
> to
> restore the system database in the event of disaster.
> I am able to open the DTS packages individually and store as .dts file. It
> is a time consuming process.
> I am using SQL 2K.
> Thanks,
> J Smith
>

Backing up DTS and SQL jobs....

I know If I store the DTS packages in SQL Server it will be stored in the
msdb database.
Also all the job scheduling information is stored in the msdb database.
Even though I am taking backup of system databases, I would like to know if
is there any way I can export all the DTS packages and jobs in any different
way. This is only an additional extra precaution incase If I am not able to
restore the system database in the event of disaster.
I am able to open the DTS packages individually and store as .dts file. It
is a time consuming process.
I am using SQL 2K.
Thanks,
J SmithFor DTS backup, I use a neat little program called, "DTS Backup 2000." It's
freeware.
"Jessy Martin" <Jessy_Smith79@.hotmail.com> wrote in message
news:uMDTg4gZFHA.3048@.TK2MSFTNGP14.phx.gbl...
>I know If I store the DTS packages in SQL Server it will be stored in the
> msdb database.
> Also all the job scheduling information is stored in the msdb database.
> Even though I am taking backup of system databases, I would like to know
> if
> is there any way I can export all the DTS packages and jobs in any
> different
> way. This is only an additional extra precaution incase If I am not able
> to
> restore the system database in the event of disaster.
> I am able to open the DTS packages individually and store as .dts file. It
> is a time consuming process.
> I am using SQL 2K.
> Thanks,
> J Smith
>|||Free Backup Software from Darren Green is available at www.sqldts.com
Wayne Snyder, MCDBA, SQL Server MVP
Mariner, Charlotte, NC
www.mariner-usa.com
(Please respond only to the newsgroups.)
I support the Professional Association of SQL Server (PASS) and it's
community of SQL Server professionals.
www.sqlpass.org
"Jessy Martin" <Jessy_Smith79@.hotmail.com> wrote in message
news:uMDTg4gZFHA.3048@.TK2MSFTNGP14.phx.gbl...
>I know If I store the DTS packages in SQL Server it will be stored in the
> msdb database.
> Also all the job scheduling information is stored in the msdb database.
> Even though I am taking backup of system databases, I would like to know
> if
> is there any way I can export all the DTS packages and jobs in any
> different
> way. This is only an additional extra precaution incase If I am not able
> to
> restore the system database in the event of disaster.
> I am able to open the DTS packages individually and store as .dts file. It
> is a time consuming process.
> I am using SQL 2K.
> Thanks,
> J Smith
>

Saturday, February 25, 2012

Avoiding truncate error

There is some option in Sql Server 2000 to set of avoid errors when a text
larger than destination field is stored in it ?
For example i must do an INSERT INTO NAMES
and NAMES have a field of size 10
if i store a field of size 20 in it the server give me an error
can i avoid this error and store only the firsts 10 bytes in the destination
field?
thanks a lot.Look in BOL for SET ANSI_WARNINGS with the example
"Romano Benedetto" <RomanBe@.tin.it> schrieb im Newsbeitrag
news:UYtee.1336790$35.49871941@.news4.tin.it...
> There is some option in Sql Server 2000 to set of avoid errors when a text
> larger than destination field is stored in it ?
> For example i must do an INSERT INTO NAMES
> and NAMES have a field of size 10
> if i store a field of size 20 in it the server give me an error
> can i avoid this error and store only the firsts 10 bytes in the
> destination field?
> thanks a lot.
>|||Look in BOL for SET ANSI_WARNINGS with the example
PRINT 'Testing String Overflow in INSERT'
GO
INSERT INTO T1 VALUES (4, 4, 'Text string longer than 20 characters')
GO
HTH, Jens Suessmeyer.
http://www.sqlserver2005.de
--
"Romano Benedetto" <RomanBe@.tin.it> schrieb im Newsbeitrag
news:UYtee.1336790$35.49871941@.news4.tin.it...
> There is some option in Sql Server 2000 to set of avoid errors when a text
> larger than destination field is stored in it ?
> For example i must do an INSERT INTO NAMES
> and NAMES have a field of size 10
> if i store a field of size 20 in it the server give me an error
> can i avoid this error and store only the firsts 10 bytes in the
> destination field?
> thanks a lot.
>

Avoiding SQL Injection with Dynamic SQL

I am exclusively using Stored Procedures to access the database, i.e. there are no Ad-Hoc SQL statements anywhere in the C# code. However, one thing I need to be able to do is to allow filtering for data grids on my ASP.NET page. I want to do the filtering in the Stored Procedure using Dynamic SQL to set the WHERE clause. However, one fear of mine is SQL injection from the client. How can I avoid arbitrary SQL injection, yet still allow for a dynamic WHERE clause to be passed into the stored procedure?

Jason PachecoFrom herehttp://www.microsoft.com/technet/prodtechnol/sql/2000/maintain/sp3sec03.mspx

Preventing SQL Injection

So long as injected SQL code is syntactically correct, it will be impossible to programmatically detect tampering on the server side. You must therefore validate all user input on the client side, and force server-side type checking by calling parameterized stored procedures. Always validate user input by testing type, length, format, and range. Untested input can cause program errors, and may be used by hackers as a point of entry into your system. When implementing precautions against malicious input, consider the architecture and deployment scenarios of your application. Remember that programs designed to run in a secure environment can be copied to an insecure environment.

Validate All Input

The following suggestions should be considered best practices:
- Make no assumptions about the size, type, or content of the data received by your application. For example, evaluate:
- How will your application behave if an errant, or malicious, user enters a 10-megabyte MPEG file where your application expects a postal code?
- How will your application behave if a DROP TABLE statement is embedded in a text field?
- Test the size and data type of input, and enforce appropriate limits. This can help prevent deliberate buffer overruns.
- Test the content of string variables and accept only expected values. Reject entries containing binary data, escape sequences, and comment characters. This can help prevent script injection and can protect against some buffer overrun exploits.
- When working with XML documents, validate all data against its schema as it is entered.
- Never build Transact-SQL statements directly from user input.
- Use stored procedures to validate user input.
- In multi-tiered environments, all data should be validated before admission to the trusted zone. Data that does not pass the validation process should be rejected, and an error returned to the previous tier.
- Implement multiple layers of validation. Precautions you take against casually malicious users may be ineffective against expert hackers. The best practice is to validate input in the user interface, and then at all subsequent points at which it crosses a trust boundary.

For example, data validation in a client-side application may prevent simple script injection; however, if the next tier assumes that its input has already been validated, any hacker capable of bypassing your client can have unrestricted access to your system.
- Never concatenate user input that is not validated. String concatenation is the primary point of entry for script injection.
- Do not accept the following strings in fields from which file names may be constructed: AUX, CLOCK$, COM1 through COM8, CON, CONFIG$, LPT1 through LPT8, NUL, and PRN.

When possible, reject input that contains the following potentially dangerous characters.
Input characterMeaning in Transact-SQL

; Query delimiter

' Character data string delimiter

-- Comment delimiter

/* ... */ Comment delimiters. Text between /* and */ is not evaluated by the server.

Xp_ Begins the name of catalog extended stored procedures such as xp_cmdshell.

Use Type-Safe SQL Parameters

The Parameters collection in SQL Server provides type checking and length validation. If you use the Parameters collection, input is treated as a literal value rather than executable code. An additional benefit of using the Parameters collection is that you can enforce type and length checks. Values outside of the range will trigger an exception. The following code fragment illustrates using the Parameters collection:

SqlDataAdapter myCommand = new SqlDataAdapter("AuthorLogin", conn);
myCommand.SelectCommand.CommandType = CommandType.StoredProcedure;
SqlParameter parm = myCommand.SelectCommand.Parameters.Add(
"@.au_id", SqlDbType.VarChar, 11);
parm.Value = Login.Text;

In this example, the @.au_id parameter is treated as a literal value rather than executable code. This value is checked for type and length. If the value of @.au_id does not conform to the specified type and length constraints, an exception will be thrown.

Use Parameterized Input with Stored Procedures

Stored procedures may be susceptible to SQL injection if they use unfiltered input. For example, the following code is vulnerable:

SqlDataAdapter myCommand =
new SqlDataAdapter("LoginStoredProcedure '" +
Login.Text + "'", conn);

If you use stored procedures, you should use parameters as their input.

Use the Parameters Collection with Dynamic SQL

If you cannot use stored procedures, you can still use parameters, as shown below.

SqlDataAdapter myCommand = new SqlDataAdapter(
"SELECT au_lname, au_fname FROM Authors WHERE au_id = @.au_id", conn);
SQLParameter parm = myCommand.SelectCommand.Parameters.Add("@.au_id",
SqlDbType.VarChar, 11);
Parm.Value = Login.Text;

Filtering Input

Filtering input may also be helpful in protecting against SQL injection by removing escape characters, but due to the large number of characters that may pose problems it is not a reliable defense. The following snippet searches for the character string delimiter.

private string SafeSqlLiteral(string inputSQL)
{
return inputSQL.Replace("'", "''");
}

LIKE Clauses

Note that if you are using a LIKE clause, wildcard characters still need to be escaped:

s = s.Replace("[", "[[]");
s = s.Replace("%", "[%]");
s = s.Replace("_", "[_]");|||

Many thanks to you DarrellNorton,

Very helpfull information.
this was my posthttp://forums.asp.net/926297/ShowPost.aspx

BR

Friday, February 24, 2012

Avoiding deadlock

I have a stored procedure spUpdateClient, which takes as params a number of properties of a client application that wants to register its existence with the database. The sp just needs to add a new row or update an existing row with this data.

I tried to accomplish this with code somethign like this. (The table I'm updating is called Client, and its primary key is ClientId, which is a value passed into the sp from the client.)

IF (SELECT COUNT(ClientId) FROM Clients WHERE ClientId=@.ClientId) = 0
BEGIN
-- client not found, create it
INSERT INTO Clients (ClientId, Hostname, Etc)
VALUES (@.ClientId, @.Hostname, @.Etc)
END

ELSE

BEGIN
-- client was found, update it
UPDATE Clients
SET Hostname=@.Hostname, Etc=@.Etc
WHERE ClientId=@.ClientId
END

But the client apps call this every second or so, so soon enough I started getting primary key violations. It looks like one client would make two calls nearly at the same time, both would get a 0 value on the SELECT line, so both would try to insert a new row with the same ClientId. No good.

So then I added

SET TRANSACTION ISOLATION LEVEL SERIALIZABLE
BEGIN TRANSACTION

at the top, and a COMMIT at the bottom. I thought the first one in would get to run the whole sp, and the next one in would have to wait for the first to be done.

Instead I'm now getting deadlock errors.

If I understand the docs right, that's because the exclusive lock is not placed on the Clients table until the INSERT happens, not at the SELECT. So when two calls to the sp happen at nearly the same time (call them A and B), A does the SELECT and that locks Clients so nobody else can update it. Then B does the SELECT, locking Clients so nobody else (including A) can update it. Now A needs to exclusively lock Clients to do its INSERT, but B still has that read lock on it, and they're deadlocked.

I could catch the deadlock in my client app after SQL Server kills one of the transactions, but it seems to me there should be some way to set a lock at the top of the sp that says "nobody else can enter this sp until I exit it". Any such thing?

Thanks.

Nate Hekman

You can change your code to the following:

BEGIN TRANSACTION
IF NOT EXISTS(SELECT * FROM Clients WITH(SERIALIZABLE, XLOCK)

WHERE ClientId=@.ClientId)
BEGIN
-- client not found, create it
INSERT INTO Clients (ClientId, Hostname, Etc)
VALUES (@.ClientId, @.Hostname, @.Etc)
END

ELSE

BEGIN
-- client was found, update it
UPDATE Clients
SET Hostname=@.Hostname, Etc=@.Etc
WHERE ClientId=@.ClientId
END

COMMIT

The XLOCK hint in the SELECT statement will ensure that if the rows exists you lock it exclusively so the update will work fine. And the SERIALIZABLE hint will ensure that if the row doesn't exist you lock the key range for the new row. This will prevent the deadlock from happening.

Another approach is to do the following:

BEGIN TRANSACTION
UPDATE Clients WITH(SERIALIZABLE)
SET Hostname=@.Hostname, Etc=@.Etc
WHERE ClientId=@.ClientId
IF @.@.ROWCOUNT = 0

BEGIN
-- client not found, create it
INSERT INTO Clients (ClientId, Hostname, Etc)
VALUES (@.ClientId, @.Hostname, @.Etc)
END

COMMIT

|||

This is a very good understanding of why you are getting a deadlock :) You can cause it to single thread by adding an LOCK hint to the existence check. Also, change from using a count to exists, it will be better as it just needs to see a single row, rather than counting them all. No need for serializable here now, but make sure ClientId is indexed right (and if it is the declare primary key that should be fine)

BEGIN TRANSACTION

IF EXISTS (SELECT 1
FROM Clients WITH (XLOCK)
WHERE ClientId=@.ClientId)
BEGIN
-- client not found, create it
INSERT INTO Clients (ClientId, Hostname, Etc)
VALUES (@.ClientId, @.Hostname, @.Etc)
END
ELSE
BEGIN
-- client was found, update it
UPDATE Clients
SET Hostname=@.Hostname, Etc=@.Etc
WHERE ClientId=@.ClientId
END

COMMIT TRANSACTION

An alternative is to just ignore the deadlock as you know why it occurs, and since you are only keeping a single copy, it is just as good and will be fast enough...

Another alternative would be to switch to an insert only methodology and just pump rows into a table. It would give you counts of visits, actual times of visits, etc. You could also glean the same information as you have now with no locking problems at all.

--clientId, visitDate would be the likely UNIQUE constraint
--if they are > .003 seconds apart, which I don't know based on your needs

create table clientVisit
(
clientVisitId int identity primary key,
clientId guid,
visitDate datetime default (getdate()),
hostName varchar(?),
etc varchar(?)
)

then just insert... It will take more disk space, but it should be just as fast. You could then pull the data off periodically and get the same information, plus some.

|||

I didn't think that:

BEGIN TRANSACTION
IF NOT EXISTS(SELECT * FROM Clients WITH(SERIALIZABLE, UPDLOCK)
WHERE ClientId=@.ClientId)

Would suffice since a SHARED lock compatible with an UPDATE lock? In this case, the second could still read there to be no rows.

(I did overlook that you need to increase the isolation level just in case READ_COMMITTED_SNAPSHOT is enabled. And I didn't realize you could put lock hints on UPDATE statements :)

Thanks!

|||You are right. This should be XLOCK instead.|||

Wow, thanks for the excellent replies everyone! I'm very new at T-SQL so all this locking stuff is a lot to mull over. But you've given me several good approaches that I think will work just great.

Thanks again.

Nate

|||

IF (SELECT COUNT(ClientId) FROM Clients WHERE ClientId=@.ClientId) = 0
BEGIN
-- client not found, create it
INSERT INTO Clients (ClientId, Hostname, Etc)
VALUES (@.ClientId, @.Hostname, @.Etc)
END

ELSE

BEGIN
-- client was found, update it
UPDATE Clients
SET Hostname=@.Hostname, Etc=@.Etc
WHERE ClientId=@.ClientId
END

|||

This problem's interesting and I'm sure lots of people have encountered before.

There are some things I still don't understand.
If we set the isolation level as Serializable and use XLOCK for the SELECT as follows:


SET TRANSACTION ISOLATION LEVEL SERIALIZABLE
BEGIN TRANSACTION

IF (SELECT COUNT(ClientId) FROM Clients (WITH XLOCK) WHERE ClientId=@.ClientId) = 0
BEGIN
-- client not found, create it
INSERT INTO Clients (ClientId, Hostname, Etc)
VALUES (@.ClientId, @.Hostname, @.Etc)
END

ELSE

BEGIN
-- client was found, update it
UPDATE Clients
SET Hostname=@.Hostname, Etc=@.Etc
WHERE ClientId=@.ClientId
END

COMMIT TRANSACTION


As Nate Hekman first wrote:
If I understand the docs right, that's because the exclusive lock is not placed on the Clients table until the INSERT happens, not at the SELECT. So when two calls to the sp happen at nearly the same time (call them A and B), A does the SELECT and that locks Clients so nobody else can update it. Then B does the SELECT, locking Clients so nobody else (including A) can update it. Now A needs to exclusively lock Clients to do its INSERT, but B still has that read lock on it, and they're deadlocked.

Question 1>
If the row doesn't exist, does the process go like this:
process1 executes SELECT ... WITH XLOCK and holds an exclusive lock on Clients.
Because isolation level Serializable is used, other processes can't insert new rows or update rows within the defined range. Also, because an exclusive lock is held, other processes can't even read until process1 finishes?

Question 2>
How does it solve the deadlock problem?

|||

Question 1:
When a transaction holds Exclusive locks on a range of rows, other transaction cannot read those rows, unless the second transaction's isolation level is not READ UNCOMMITTED. As Nate uses the same sp for inserts, yes, the select command blocks all readers.

Question2:
Deadlocks do not occur because a transaction that executes its select command is guaranteed to be granted all the locks it will needs further, that is, it cannot be blocked, so a deadlock can never occur. This is a sort of pre-declaration of locks, or pessimistic locking. When transaction A executes its select command, the other ones (say trans. B)cannot read. If transaction A takes a long time to commit, B might be eventually aborted. But this will not happen-the insert transaction is a short one, and it will need milliseconds to commit, after that transaction B(or other waiting transaction) will be granted the lock. In this scenario, aborts are very unlikely to occur unless the workload is high.

Avoiding deadlock

I have a stored procedure spUpdateClient, which takes as params a number of properties of a client application that wants to register its existence with the database. The sp just needs to add a new row or update an existing row with this data.

I tried to accomplish this with code somethign like this. (The table I'm updating is called Client, and its primary key is ClientId, which is a value passed into the sp from the client.)

IF (SELECT COUNT(ClientId) FROM Clients WHERE ClientId=@.ClientId) = 0
BEGIN
-- client not found, create it
INSERT INTO Clients (ClientId, Hostname, Etc)
VALUES (@.ClientId, @.Hostname, @.Etc)
END

ELSE

BEGIN
-- client was found, update it
UPDATE Clients
SET Hostname=@.Hostname, Etc=@.Etc
WHERE ClientId=@.ClientId
END

But the client apps call this every second or so, so soon enough I started getting primary key violations. It looks like one client would make two calls nearly at the same time, both would get a 0 value on the SELECT line, so both would try to insert a new row with the same ClientId. No good.

So then I added

SET TRANSACTION ISOLATION LEVEL SERIALIZABLE
BEGIN TRANSACTION

at the top, and a COMMIT at the bottom. I thought the first one in would get to run the whole sp, and the next one in would have to wait for the first to be done.

Instead I'm now getting deadlock errors.

If I understand the docs right, that's because the exclusive lock is not placed on the Clients table until the INSERT happens, not at the SELECT. So when two calls to the sp happen at nearly the same time (call them A and B), A does the SELECT and that locks Clients so nobody else can update it. Then B does the SELECT, locking Clients so nobody else (including A) can update it. Now A needs to exclusively lock Clients to do its INSERT, but B still has that read lock on it, and they're deadlocked.

I could catch the deadlock in my client app after SQL Server kills one of the transactions, but it seems to me there should be some way to set a lock at the top of the sp that says "nobody else can enter this sp until I exit it". Any such thing?

Thanks.

Nate Hekman

You can change your code to the following:

BEGIN TRANSACTION
IF NOT EXISTS(SELECT * FROM Clients WITH(SERIALIZABLE, XLOCK)

WHERE ClientId=@.ClientId)
BEGIN
-- client not found, create it
INSERT INTO Clients (ClientId, Hostname, Etc)
VALUES (@.ClientId, @.Hostname, @.Etc)
END

ELSE

BEGIN
-- client was found, update it
UPDATE Clients
SET Hostname=@.Hostname, Etc=@.Etc
WHERE ClientId=@.ClientId
END

COMMIT

The XLOCK hint in the SELECT statement will ensure that if the rows exists you lock it exclusively so the update will work fine. And the SERIALIZABLE hint will ensure that if the row doesn't exist you lock the key range for the new row. This will prevent the deadlock from happening.

Another approach is to do the following:

BEGIN TRANSACTION
UPDATE Clients WITH(SERIALIZABLE)
SET Hostname=@.Hostname, Etc=@.Etc
WHERE ClientId=@.ClientId
IF @.@.ROWCOUNT = 0

BEGIN
-- client not found, create it
INSERT INTO Clients (ClientId, Hostname, Etc)
VALUES (@.ClientId, @.Hostname, @.Etc)
END

COMMIT

|||

This is a very good understanding of why you are getting a deadlock :) You can cause it to single thread by adding an LOCK hint to the existence check. Also, change from using a count to exists, it will be better as it just needs to see a single row, rather than counting them all. No need for serializable here now, but make sure ClientId is indexed right (and if it is the declare primary key that should be fine)

BEGIN TRANSACTION

IF EXISTS (SELECT 1
FROM Clients WITH (XLOCK)
WHERE ClientId=@.ClientId)
BEGIN
-- client not found, create it
INSERT INTO Clients (ClientId, Hostname, Etc)
VALUES (@.ClientId, @.Hostname, @.Etc)
END
ELSE
BEGIN
-- client was found, update it
UPDATE Clients
SET Hostname=@.Hostname, Etc=@.Etc
WHERE ClientId=@.ClientId
END

COMMIT TRANSACTION

An alternative is to just ignore the deadlock as you know why it occurs, and since you are only keeping a single copy, it is just as good and will be fast enough...

Another alternative would be to switch to an insert only methodology and just pump rows into a table. It would give you counts of visits, actual times of visits, etc. You could also glean the same information as you have now with no locking problems at all.

--clientId, visitDate would be the likely UNIQUE constraint
--if they are > .003 seconds apart, which I don't know based on your needs

create table clientVisit
(
clientVisitId int identity primary key,
clientId guid,
visitDate datetime default (getdate()),
hostName varchar(?),
etc varchar(?)
)

then just insert... It will take more disk space, but it should be just as fast. You could then pull the data off periodically and get the same information, plus some.

|||

I didn't think that:

BEGIN TRANSACTION
IF NOT EXISTS(SELECT * FROM Clients WITH(SERIALIZABLE, UPDLOCK)
WHERE ClientId=@.ClientId)

Would suffice since a SHARED lock compatible with an UPDATE lock? In this case, the second could still read there to be no rows.

(I did overlook that you need to increase the isolation level just in case READ_COMMITTED_SNAPSHOT is enabled. And I didn't realize you could put lock hints on UPDATE statements :)

Thanks!

|||You are right. This should be XLOCK instead.|||

Wow, thanks for the excellent replies everyone! I'm very new at T-SQL so all this locking stuff is a lot to mull over. But you've given me several good approaches that I think will work just great.

Thanks again.

Nate

|||

IF (SELECT COUNT(ClientId) FROM Clients WHERE ClientId=@.ClientId) = 0
BEGIN
-- client not found, create it
INSERT INTO Clients (ClientId, Hostname, Etc)
VALUES (@.ClientId, @.Hostname, @.Etc)
END

ELSE

BEGIN
-- client was found, update it
UPDATE Clients
SET Hostname=@.Hostname, Etc=@.Etc
WHERE ClientId=@.ClientId
END

|||

This problem's interesting and I'm sure lots of people have encountered before.

There are some things I still don't understand.
If we set the isolation level as Serializable and use XLOCK for the SELECT as follows:


SET TRANSACTION ISOLATION LEVEL SERIALIZABLE
BEGIN TRANSACTION

IF (SELECT COUNT(ClientId) FROM Clients (WITH XLOCK) WHERE ClientId=@.ClientId) = 0
BEGIN
-- client not found, create it
INSERT INTO Clients (ClientId, Hostname, Etc)
VALUES (@.ClientId, @.Hostname, @.Etc)
END

ELSE

BEGIN
-- client was found, update it
UPDATE Clients
SET Hostname=@.Hostname, Etc=@.Etc
WHERE ClientId=@.ClientId
END

COMMIT TRANSACTION


As Nate Hekman first wrote:
If I understand the docs right, that's because the exclusive lock is not placed on the Clients table until the INSERT happens, not at the SELECT. So when two calls to the sp happen at nearly the same time (call them A and B), A does the SELECT and that locks Clients so nobody else can update it. Then B does the SELECT, locking Clients so nobody else (including A) can update it. Now A needs to exclusively lock Clients to do its INSERT, but B still has that read lock on it, and they're deadlocked.

Question 1>
If the row doesn't exist, does the process go like this:
process1 executes SELECT ... WITH XLOCK and holds an exclusive lock on Clients.
Because isolation level Serializable is used, other processes can't insert new rows or update rows within the defined range. Also, because an exclusive lock is held, other processes can't even read until process1 finishes?

Question 2>
How does it solve the deadlock problem?

|||

Question 1:
When a transaction holds Exclusive locks on a range of rows, other transaction cannot read those rows, unless the second transaction's isolation level is not READ UNCOMMITTED. As Nate uses the same sp for inserts, yes, the select command blocks all readers.

Question2:
Deadlocks do not occur because a transaction that executes its select command is guaranteed to be granted all the locks it will needs further, that is, it cannot be blocked, so a deadlock can never occur. This is a sort of pre-declaration of locks, or pessimistic locking. When transaction A executes its select command, the other ones (say trans. B)cannot read. If transaction A takes a long time to commit, B might be eventually aborted. But this will not happen-the insert transaction is a short one, and it will need milliseconds to commit, after that transaction B(or other waiting transaction) will be granted the lock. In this scenario, aborts are very unlikely to occur unless the workload is high.

avoiding cursors how to do this?

OK say I want to execute the following stored procedure for every order that
matches specific criteria
EXECUTE @.RC = dbo.sprPassUpline @.lngOrder
If my set of orders to process is returned by this query:
select lngOrderID from tblOrders where intstatus=3
Is there any way to do this without resorting to a cursor?"Tim Greenwood" <tim_greenwood A-T yahoo D-O-T com> wrote in message
news:%23RYZxTnXGHA.1196@.TK2MSFTNGP03.phx.gbl...
>
> OK say I want to execute the following stored procedure for every order
> that matches specific criteria
>
> EXECUTE @.RC = dbo.sprPassUpline @.lngOrder
>
> If my set of orders to process is returned by this query:
> select lngOrderID from tblOrders where intstatus=3
>
> Is there any way to do this without resorting to a cursor?
>
No. And cursors aren't _that_ slow. Executing the procedure for each row
would not be noticably better without a cursor.
The potential performance problem is that you are executing the logic of the
procedure on a row-wise basis, instead of a set-wise basis. The only way to
avoid the row-wise processing would be to unwrap the guts of
dbo.sprPassUpline and create a version which operated over the entire set of
rows. Something like
EXECUTE @.RC = dbo.sprPassUplineByStatus 3
David|||declare @.loop int
declare @.rowcount int
declare @.lngOrder int
declare @.RC int
create table #OrderList (
ROW_ID int identity ,
lngOrder int not null )
insert into #OrderList ( lngOrder ) select lngOrderID from tblOrders where
intStatus = 3
declare @.loop = min(ROW_ID), @.rowcount = max(ROW_ID) from #OrderList
while @.loop <= @.rowcount
begin
select @.lngOrder = lngOrder from #OrderList where ROW_ID = @.loop
exec @.RC = dbo.sprPassUpline @.lngOrder
if @.RC <>
begin
-- do whatever
end
select @.loop = @.loop + 1
-- or the below method if you delete any rows from the #OrderList table
for any reason
-- select @.loop= min(ROW_ID) from #OrderList where ROW_ID > @.loop
end
drop table #OrderList
"Tim Greenwood" <tim_greenwood A-T yahoo D-O-T com> wrote in message
news:%23RYZxTnXGHA.1196@.TK2MSFTNGP03.phx.gbl...
>
> OK say I want to execute the following stored procedure for every order
> that matches specific criteria
>
> EXECUTE @.RC = dbo.sprPassUpline @.lngOrder
>
> If my set of orders to process is returned by this query:
> select lngOrderID from tblOrders where intstatus=3
>
> Is there any way to do this without resorting to a cursor?
>|||"Ben Rum" <bundyrum75@.yahoo.com> wrote in message
news:O8e%f.18404$ic1.16436@.newsfe5-win.ntli.net...
> declare @.loop int
> declare @.rowcount int
> declare @.lngOrder int
> declare @.RC int
> create table #OrderList (
> ROW_ID int identity ,
> lngOrder int not null )
> insert into #OrderList ( lngOrder ) select lngOrderID from tblOrders where
> intStatus = 3
> declare @.loop = min(ROW_ID), @.rowcount = max(ROW_ID) from #OrderList
> while @.loop <= @.rowcount
> begin
> select @.lngOrder = lngOrder from #OrderList where ROW_ID = @.loop
> exec @.RC = dbo.sprPassUpline @.lngOrder
> if @.RC <>
> begin
> -- do whatever
> end
> select @.loop = @.loop + 1
> -- or the below method if you delete any rows from the #OrderList table
> for any reason
> -- select @.loop= min(ROW_ID) from #OrderList where ROW_ID > @.loop
> end
> drop table #OrderList
>
OK, that is tecnically what the OP asked for, but in what possible way is
that better than using a cursor?
declare cOrders cursor local static for
select lngOrderID from tblOrders
where intStatus = 3
declare @.lngOrder int,
@.RC int
open cOrders
fetch next from cOrders into @.lngOrder
while @.@.fetch_status = 0
begin
exec @.RC = dbo.sprPassUpline @.lngOrder
if @.RC <> 0
begin
raiserror('sprPassUpline failed returning %d',16,1,@.RC)
end
fetch next from cOrders into @.lngOrder
end
close cOrders
?
Davud|||> Is there any way to do this without resorting to a cursor?
Possibly, but since you haven't told us what the SP does we can't tell you.
The question is not "How do I do X once for each row without a cursor?"
The question is "How do I do X for the whole set INSTEAD OF once for each
row?"
--
David Portas, SQL Server MVP
Whenever possible please post enough code to reproduce your problem.
Including CREATE TABLE and INSERT statements usually helps.
State what version of SQL Server you are using and specify the content
of any error messages.
SQL Server Books Online:
http://msdn2.microsoft.com/library/ms130214(en-US,SQL.90).aspx
--|||Well actually in normal day to day business this SP is only called for one
row at a time when that order enters a given state. But when initializing
new systems it must be called for everything on import. Guess that is a
good enough reason to redo the SP and just make it set based so it'll handle
one or more. We never had this requirement before so it was never an issue.
Thanks for jumping in everybody.
"David Portas" <REMOVE_BEFORE_REPLYING_dportas@.acm.org> wrote in message
news:uvSpxznXGHA.5012@.TK2MSFTNGP05.phx.gbl...
>> Is there any way to do this without resorting to a cursor?
> Possibly, but since you haven't told us what the SP does we can't tell
> you.
> The question is not "How do I do X once for each row without a cursor?"
> The question is "How do I do X for the whole set INSTEAD OF once for each
> row?"
> --
> David Portas, SQL Server MVP
> Whenever possible please post enough code to reproduce your problem.
> Including CREATE TABLE and INSERT statements usually helps.
> State what version of SQL Server you are using and specify the content
> of any error messages.
> SQL Server Books Online:
> http://msdn2.microsoft.com/library/ms130214(en-US,SQL.90).aspx
> --
>

avoiding cursors how to do this?

OK say I want to execute the following stored procedure for every order that
matches specific criteria
EXECUTE @.RC = dbo.sprPassUpline @.lngOrder
If my set of orders to process is returned by this query:
select lngOrderID from tblOrders where intstatus=3
Is there any way to do this without resorting to a cursor?"Tim Greenwood" <tim_greenwood A-T yahoo D-O-T com> wrote in message
news:%23RYZxTnXGHA.1196@.TK2MSFTNGP03.phx.gbl...
>
> OK say I want to execute the following stored procedure for every order
> that matches specific criteria
>
> EXECUTE @.RC = dbo.sprPassUpline @.lngOrder
>
> If my set of orders to process is returned by this query:
> select lngOrderID from tblOrders where intstatus=3
>
> Is there any way to do this without resorting to a cursor?
>
No. And cursors aren't _that_ slow. Executing the procedure for each row
would not be noticably better without a cursor.
The potential performance problem is that you are executing the logic of the
procedure on a row-wise basis, instead of a set-wise basis. The only way to
avoid the row-wise processing would be to unwrap the guts of
dbo.sprPassUpline and create a version which operated over the entire set of
rows. Something like
EXECUTE @.RC = dbo.sprPassUplineByStatus 3
David|||declare @.loop int
declare @.rowcount int
declare @.lngOrder int
declare @.RC int
create table #OrderList (
ROW_ID int identity ,
lngOrder int not null )
insert into #OrderList ( lngOrder ) select lngOrderID from tblOrders where
intStatus = 3
declare @.loop = min(ROW_ID), @.rowcount = max(ROW_ID) from #OrderList
while @.loop <= @.rowcount
begin
select @.lngOrder = lngOrder from #OrderList where ROW_ID = @.loop
exec @.RC = dbo.sprPassUpline @.lngOrder
if @.RC <>
begin
-- do whatever
end
select @.loop = @.loop + 1
-- or the below method if you delete any rows from the #OrderList table
for any reason
-- select @.loop= min(ROW_ID) from #OrderList where ROW_ID > @.loop
end
drop table #OrderList
"Tim Greenwood" <tim_greenwood A-T yahoo D-O-T com> wrote in message
news:%23RYZxTnXGHA.1196@.TK2MSFTNGP03.phx.gbl...
>
> OK say I want to execute the following stored procedure for every order
> that matches specific criteria
>
> EXECUTE @.RC = dbo.sprPassUpline @.lngOrder
>
> If my set of orders to process is returned by this query:
> select lngOrderID from tblOrders where intstatus=3
>
> Is there any way to do this without resorting to a cursor?
>|||"Ben Rum" <bundyrum75@.yahoo.com> wrote in message
news:O8e%f.18404$ic1.16436@.newsfe5-win.ntli.net...
> declare @.loop int
> declare @.rowcount int
> declare @.lngOrder int
> declare @.RC int
> create table #OrderList (
> ROW_ID int identity ,
> lngOrder int not null )
> insert into #OrderList ( lngOrder ) select lngOrderID from tblOrders where
> intStatus = 3
> declare @.loop = min(ROW_ID), @.rowcount = max(ROW_ID) from #OrderList
> while @.loop <= @.rowcount
> begin
> select @.lngOrder = lngOrder from #OrderList where ROW_ID = @.loop
> exec @.RC = dbo.sprPassUpline @.lngOrder
> if @.RC <>
> begin
> -- do whatever
> end
> select @.loop = @.loop + 1
> -- or the below method if you delete any rows from the #OrderList table
> for any reason
> -- select @.loop= min(ROW_ID) from #OrderList where ROW_ID > @.loop
> end
> drop table #OrderList
>
OK, that is tecnically what the OP asked for, but in what possible way is
that better than using a cursor?
declare cOrders cursor local static for
select lngOrderID from tblOrders
where intStatus = 3
declare @.lngOrder int,
@.RC int
open cOrders
fetch next from cOrders into @.lngOrder
while @.@.fetch_status = 0
begin
exec @.RC = dbo.sprPassUpline @.lngOrder
if @.RC <> 0
begin
raiserror('sprPassUpline failed returning %d',16,1,@.RC)
end
fetch next from cOrders into @.lngOrder
end
close cOrders
?
Davud|||> Is there any way to do this without resorting to a cursor?
Possibly, but since you haven't told us what the SP does we can't tell you.
The question is not "How do I do X once for each row without a cursor?"
The question is "How do I do X for the whole set INSTEAD OF once for each
row?"
David Portas, SQL Server MVP
Whenever possible please post enough code to reproduce your problem.
Including CREATE TABLE and INSERT statements usually helps.
State what version of SQL Server you are using and specify the content
of any error messages.
SQL Server Books Online:
http://msdn2.microsoft.com/library/ms130214(en-US,SQL.90).aspx
--|||Well actually in normal day to day business this SP is only called for one
row at a time when that order enters a given state. But when initializing
new systems it must be called for everything on import. Guess that is a
good enough reason to redo the SP and just make it set based so it'll handle
one or more. We never had this requirement before so it was never an issue.
Thanks for jumping in everybody.
"David Portas" <REMOVE_BEFORE_REPLYING_dportas@.acm.org> wrote in message
news:uvSpxznXGHA.5012@.TK2MSFTNGP05.phx.gbl...
> Possibly, but since you haven't told us what the SP does we can't tell
> you.
> The question is not "How do I do X once for each row without a cursor?"
> The question is "How do I do X for the whole set INSTEAD OF once for each
> row?"
> --
> David Portas, SQL Server MVP
> Whenever possible please post enough code to reproduce your problem.
> Including CREATE TABLE and INSERT statements usually helps.
> State what version of SQL Server you are using and specify the content
> of any error messages.
> SQL Server Books Online:
> http://msdn2.microsoft.com/library/ms130214(en-US,SQL.90).aspx
> --
>

Avoiding compilation

Using small stored procs or sp_executesql dramatically reduces the number of
recompiles and increases the reuse of execution plans. This is evident from
both the usecount in syscacheobjects, perfmon, and profiler. However I'm at
a loss to determine what causes a compilation. Under rare circumstances the
usecount for Compiled Plan does not increase as statements are run. Seems
to correspond to when there is no execution plan. It would seem to me that
compilation is a resource intensive task that if possible (data and schema
are not changing) should be held to a minimum.

How does one encourage the reuse of compile plans?
Is this the same as minimizing compilation?

Looks like some of this behavior is changing in SQL 2005...

Thanks,
DannyI am not privy to all the internals, there are better guys out there for
that .. but my $.02

When enough has changed in the data and table statistics where SQL Server
thinks it could get a better query plan it will do a recompile.

I know you can force a recompile by adding a parm to the proc create
statement, but don't know how to have it NOT recompile, or if you'd really
want to (I'd like to continue to use this crappy query plan please)..

Some thing that almost guarantees a recompile is the creation of #Temp
Tables in the proc.
Substitute a table variable to get around that.

"Danny" <istdrs@.flash.net> wrote in message
news:59Rrd.1559$nE7.982@.newssvr17.news.prodigy.com ...
> Using small stored procs or sp_executesql dramatically reduces the number
> of recompiles and increases the reuse of execution plans. This is evident
> from both the usecount in syscacheobjects, perfmon, and profiler. However
> I'm at a loss to determine what causes a compilation. Under rare
> circumstances the usecount for Compiled Plan does not increase as
> statements are run. Seems to correspond to when there is no execution
> plan. It would seem to me that compilation is a resource intensive task
> that if possible (data and schema are not changing) should be held to a
> minimum.
> How does one encourage the reuse of compile plans?
> Is this the same as minimizing compilation?
> Looks like some of this behavior is changing in SQL 2005...
> Thanks,
> Danny|||David,

In general on a DSS, recompiles I can avoid. Although I've always heard
that using table variables instead or temp tables in procs reduces the
chance of recompile. But in simple testing of temp tables in procs (see
sample code below), I'm not seeing any indication of a recompile either in
syscacheobjects, perfmon, or profiler.

Any know if this is true and why?

Danny

use northwind
go

Create proc TestRecompile (@.X int)
As
set nocount on

-- create temp table
create table #testtable (col1 int not null)
insert into #testtable values (@.X)

--do something else
select * from northwind.dbo.[order details] o
join #testtable t on o.orderid = t.col1

go

dbcc FREEPROCCACHE

exec TestRecompile 10248

select bucketid, cacheobjtype, objid, usecounts from
master..syscacheobjects where objtype = 'Proc' and sql = 'TestRecompile'
-- recompile on first run

exec TestRecompile 10255
-- Perfmon shows compilation
-- usecounts increases to 2 for Compiled Plan no corresponding Executable
plan

select bucketid, cacheobjtype, objid, usecounts from
master..syscacheobjects where objtype = 'Proc' and sql = 'TestRecompile'

--drop proc TestRecompile

"David Rawheiser" <rawhide58@.hotmail.com> wrote in message
news:xsRrd.1020236$Gx4.172215@.bgtnsc04-news.ops.worldnet.att.net...
>I am not privy to all the internals, there are better guys out there for
>that .. but my $.02
> When enough has changed in the data and table statistics where SQL Server
> thinks it could get a better query plan it will do a recompile.
> I know you can force a recompile by adding a parm to the proc create
> statement, but don't know how to have it NOT recompile, or if you'd really
> want to (I'd like to continue to use this crappy query plan please)..
> Some thing that almost guarantees a recompile is the creation of #Temp
> Tables in the proc.
> Substitute a table variable to get around that.
> "Danny" <istdrs@.flash.net> wrote in message
> news:59Rrd.1559$nE7.982@.newssvr17.news.prodigy.com ...
>> Using small stored procs or sp_executesql dramatically reduces the number
>> of recompiles and increases the reuse of execution plans. This is
>> evident from both the usecount in syscacheobjects, perfmon, and profiler.
>> However I'm at a loss to determine what causes a compilation. Under rare
>> circumstances the usecount for Compiled Plan does not increase as
>> statements are run. Seems to correspond to when there is no execution
>> plan. It would seem to me that compilation is a resource intensive task
>> that if possible (data and schema are not changing) should be held to a
>> minimum.
>>
>> How does one encourage the reuse of compile plans?
>> Is this the same as minimizing compilation?
>>
>> Looks like some of this behavior is changing in SQL 2005...
>>
>> Thanks,
>> Danny
>>|||Danny (istdrs@.flash.net) writes:
> In general on a DSS, recompiles I can avoid. Although I've always heard
> that using table variables instead or temp tables in procs reduces the
> chance of recompile. But in simple testing of temp tables in procs (see
> sample code below), I'm not seeing any indication of a recompile either in
> syscacheobjects, perfmon, or profiler.
> Any know if this is true and why?

It's not that simple that if you have a temp table you get a recompile.
But if you create a temp table, fill it with quite some data, you are
likely to see a recompile in the next operation. Also, if you create a
temp table in the middle of a stored procedure, the bets for a reompile
are good.

Note that sometimes recompilations are bad, and sometimes they are heaven-
sent, all depending on the nature of the stored procedure.

Rather than discussing the topic in detail myself, I refer you to this white
paper: http://www.microsoft.com/technet/pr...005/recomp.mspx.
While it is written for SQL 2005, it gives plenty of details that applies
to SQL 2000 as well. The biggest difference between the two, is that
SQL2005 adds statement recompilation which is not in SQL 2000.

--
Erland Sommarskog, SQL Server MVP, esquel@.sommarskog.se

Books Online for SQL Server SP3 at
http://www.microsoft.com/sql/techin.../2000/books.asp

avoid warning

We use a script in our build process to create a database. A single
script creates entire database, including stored procedures. We
occasionally
get a warning message "cannot create entry in sysdepends as .....
the procedure will still be created". I believe this is a harmless
warning
and happens because of the order of creation of stord procedure. Is
there a way to disable this warning.
See "set ansi_warnings" in BOL.
use northwind
go
set ansi_warnings off
go
create procedure proc1
as
select * from t1
go
set ansi_warnings on
go
drop procedure proc1
go
AMB
"Data Cruncher" wrote:

> We use a script in our build process to create a database. A single
> script creates entire database, including stored procedures. We
> occasionally
> get a warning message "cannot create entry in sysdepends as .....
> the procedure will still be created". I believe this is a harmless
> warning
> and happens because of the order of creation of stord procedure. Is
> there a way to disable this warning.
>
|||Sorry,
It seems that this option does not help.
AMB
"Alejandro Mesa" wrote:
[vbcol=seagreen]
> See "set ansi_warnings" in BOL.
> use northwind
> go
> set ansi_warnings off
> go
> create procedure proc1
> as
> select * from t1
> go
> set ansi_warnings on
> go
> drop procedure proc1
> go
>
> AMB
> "Data Cruncher" wrote:
|||I don't think there's a way to shut off the warning outside of
creating your script with sub procs being compiled before the
calling procs.
For all intents and purposes, it's harmless for the reason
you stated. Of course, it's not harmless if the main procedure,
in fact, doesn't get created!
"Data Cruncher" <dcruncher4@.netscape.net> wrote in message
news:1116249702.395329.63480@.g47g2000cwa.googlegro ups.com...
> We use a script in our build process to create a database. A single
> script creates entire database, including stored procedures. We
> occasionally
> get a warning message "cannot create entry in sysdepends as .....
> the procedure will still be created". I believe this is a harmless
> warning
> and happens because of the order of creation of stord procedure. Is
> there a way to disable this warning.
>