sql

Preventing SQL Injection in ASP.Net VB.Net

I have this code UPDATE OPENQUERY (db,'SELECT * FROM table WHERE ref = ''"+ Ref +"'' AND bookno = ''"+ Session("number") +"'' ') How would I prevent SQL Injections on this? Thanks Jamie UPDATE Here's what i'm trying SqlCommand cmd = new SqlCommand("Select * from Table where ref=@ref", con); cmd.Parameters.AddWithValue("@ref", 3...

oracle 10g sql with clause compilation error

The compilation error says "mm" and "cc" is invalid identifier! with m as ( select instructor, count(*) as c from class group by instructor), mm as ( select max(m.c) as cc from m) select m.instructor from m where m.c = mm.cc; ...

Bind text box of report to cell of the table in MS Access

Hi. In MS Access I need to bind text field to cell of the table (in report). How to do this? ...

SELECT INTO USING UNION QUERY

Hi, I want to create a new table in SQL Server with the following query. I am unable to understand why this query doesn't work. Query1: Works SELECT * FROM TABLE1 UNION SELECT * FROM TABLE2 Query2: Does not Work. Error: Msg 170, Level 15, State 1, Line 7 Line 7: Incorrect syntax near ')'. SELECT * INTO [NEW_TABLE] FROM ( SELECT *...

Get records whose count matches max(count) for a category

Given the following rows of course,section,grade,count of grades within course section: course SECTION grade gradeCount ----------------------------------- 1301 001 C 3 1301 001 C+ 3 1301 001 C- 4 1301 001 D 5 1301 001 D+ 3 1301 001 D- 2 1301 001 F ...

Are multiple sql querys a significant performance hit?

I am using MySql (and PHP). It's best if I give an example: I am making a query, say SELECT * FROM a_table WHERE type='visible' then returning the count. Then later I query again but WHERE type='hidden', etc. I may query again to get the full contents. All queries are unique, but are from the same table. I also query multiple other tabl...

SQL Server 2005: Attach database using sp_attach_db with full text catalog

Having issues attaching a Database and full text catalog from server A to server B with the "sp_attach_db" command in SQL Server 2005 SP3. All the database files (data, log, full-text catalog) have been copied from server A to server B. I am guessing that this is indeed possible and that my syntax is just incorrect, but I can't seem to f...

Complicated SQL Query--finding items matching multiple diferent foreign keys

So imagine that you have a table of Products (ID int, Name nvarchar(200)), and two other tables, ProductsCategories (ProductID int, CategoryID int) and InvoiceProducts (InvoiceID int, ProductID int). I need to write a query to produce a set of products that match a given set of invoice ids and category ids such that the list of produc...

search in a table

Hi! I have this website to search for books, there is only ONE text field, to search by words, title author, whatever it types. if the name of the book is hello goodbye, and the author is A. Jones if i type hello i get the result of the book (my query is using the like statement) i check if title like %string_introduced% or author ...

fetching rows without any filtered child row

The application manages (for the sake of simplicity) Topic and Messages posted to it by Users. Its structure is rather simple, and enforced by Foreign keys: There are 3 tables, Topics, Users and Messages. The Topic and User entities are linked through an (,) cardinality link embodied by the Message Entity. Message: (IdTopic,IdUser,Mes...

Column doesn't exist?

Was wondering if someone could help me out a little with this query: SELECT u1.id,count(DISTINCT u2.userstatus) as TEMPCOLUMN FROM users AS u1 JOIN friendssym ON u1.id = friendssym.user_id JOIN (SELECT * FROM users) as u2 ON friendssym.friend_id=u2.id WHERE TEMPCOLUMN=1 group by u1.id; I want to only have results where the count (whi...

Efficiently removing naughty words from users comments

I have an ASP.NET app that accepts users comments and them in a SQL database. I want to make sure that I weed out any "naughty" words so I can keep my app respectable. Problem is that I'm finding there are LOTS of these words. ;> My question is, what's the most efficient way to do this processing? Should I have a table in SQL and wri...

making simple self join more efficent

Hi, I have a table id|level|name level can be 1,2 or 3 what I want to get is: id|lvl1name|lvl2name|lvl3name I'm using the following query SELECT L1."name" as lvl1name, L2."name" as lvl2name, L3."name" as lvl3name, L1.id FROM table as L1 JOIN table as L2 ON L1.id = L2.id JOIN table as L3 ON L2.id = L3.id WHE...

Need to put @Index even when I marked with @Column(unique=true) ?

Hello, Need to put @Index even when I marked with @Column(unique=true) ? I have a property that will be used frequently to retrieve the entity and wanted to make it an index column on the database. So this property is already marked with @Column(unique=true), do I need to put @Index? thanks ...

Adding values in a table in SQL 2008

Hi all, Trying to get a basic understanding of T-SQL here in SQL Server 2008. Suppose I have a table named "Issues" with columns such as: Priority User 1 Foo 1 Foo 2 Foo 5 Foo 4 Bar 5 Bar 1 Bar 1 Fuz and I wish to display a count of the Priority for each User, along with a break...

concatenating string

Is there a way in SQL sever that can write the output as follow: select events from mytable original output events -------- 123456 894531 985233 829292 920202 392939 299223 desired output '123456', '894531','985233','829292','920202','392939','299223' select '' + CustomerID + ',' from dbo.Customers customerid ALFKI, ANATR, ANT...

How can I get a hash of an entire table in postgresql?

I would like a fairly efficient way to condense an entire table to a hash value. I have some tools that generate entire data tables, which can then be used to generate further tables, and so on. I'm trying to implement a simplistic build system to coordinate build runs and avoid repeating work. I want to be able to record hashes of the ...

single quotation in SQL Server

Possible Duplicate: concatenating string I posted a similar question earlier and asked about using SQL server to output the result with a single quote. Could someone edcuate me please? select ' ' + CustomerID + ',' from dbo.Customers customerid ------------ ALFKI, ANATR, ANTON, AROUT, BERGS, Would like to see the ...

SQL select statement question. Dive all numbers in a column.

How do I replace all numbers in a column of a table to divide my 0.6. Let's say the column reads: 1 2 3 I want it to become: 0.6 1.2 1.8 ...

Flexible search for customer SQL

Person | p_id | n_name | l_name | address | city | state | zip | Customer | p_id | reward_points| balance | Person_PhoneNum | ppn_id | p_id | number | Main issue is that I want to attempt making a Retrieve Stored Procedure that can search by any of Person's fields as well as phone number or p_id BUT I want it to be able to handle N...