Software Engineering for Internet Applications - Student Community

select 227, 891, 'algorithm', current_timestampwhere 0 = (select count(*)from km_object_viewswhere user_id = 227and object_id = 891and datediff(hour, view_time,current_timestamp) < 24)There are minor syntatic differences from the Oracle statementabove, but the structure is the same. A new row is inserted only if nomatching rows are found within the last 24 hours.SQL Server achieves the same isolation level as Oracle ("ReadCommitted"), but in a different way. Instead of creating virtualversions of the database, SQL Server holds exclusive locks duringdata-modification operations. In the example above, Session B'sINSERT cannot begin until Session A's INSERT has completed.Once it is allowed to begin, Session B will see the result of SessionA's insert, and will therefore not insert a duplicate row.More: See the "Understanding Locking in SQL Server" chapter ofSQL Server Books Online.Whenever you are performing logging it is considerate to do it on theserver's time, not the user's. In many Web developmentenvironments you can do this by calling an API procedure that willclose the TCP connection to the user, which stops the upper-rightbrowser corner icon from spinning/waving. Meanwhile your thread(IIS, AOLserver, Apache 2) or process (Apache 1.x) is still alive onthe server and can run whatever code is necessary to perform thelogging. Many Web servers allow you to define filters that run afterthe delivery of a page to the user.Help with date/time arithmetic: seehttp://philip.greenspun.com/sql/dates.15.11 Exercise 7: Gather More StatisticsModify object-view-one to add a "I reused this knowledge"button. This should link to object-mark-reused, a page thatupdates the reuse_p flag of the most recent relevant row inkm_object_views. The page should raise an error if it can't find arow to update.txtQuotation.Text.Replace("'", "''") + "')";UpdateDB(cmd); // ship that big string to//SQL ServerThere are several minor things wrong with this approach, whichmixes SQL and string literals obtained from the user:• the programmer must remember to escape any single quotecharacters in the uploaded string, replacing ' with '' [theseare two single quotes, not one double quote]• the statement might become too long for some RDBMSSQL parsers to handle and/or the string literals mightexceed limits (Oracle 9.x imposes a 4000-character limit onstring literals) if the user is waxing expansive at the browser• repeated invocations of this script will result in the RDBMSbeing fed versions of this SQL statement that aremorphologically the same but differ in actual text; dependingon how the RDBMS is implemented this might prevent thequery plan from being reusedMuch more serious, however, is the possibility that a malicious usercould craft a form submission that would result in destruction of dataor violation of privacy. For example, consider the following code:string EventQuery = "select *from eventswhere event_id = " +EventIDfromBrowser;Expecting a numeric event ID and knowing that numbers do not needto be wrapped in quotes like a string literal, the programmer does noprocessing on EventIDfromBrowser, a variable read from theopen Internet.Suppose that an evil-minded person submits a form withEventIDfromBrowser set to "42; select * fromuser_passwords"? The semicolon near the beginning of this stringcould potentially terminate the first SELECT and the unauthorized"select * from user_passwords" query might then be executed. If theunauthorized query is well-crafted the information resulting from itmight be presented in a browser window. Another scary constructwould be "42; delete from customers".28267