Defensive Database Programming - Red Gate Software

Chapter 1: Basic Defensive Database Programming Techniques'Used it on my vacation' ;GO-- must return two rowsEXEC dbo.SelectMessagesBySubjectBeginning@SubjectBeginning = '[OT]' ;SubjectBody------------------------------ -------------------Listing 1-3: Our procedure fails to return "off-topic" messages.Our procedure fails to return the expected messages. In fact, by loading one more message,as shown in Listing 1-4, we can demonstrate that this procedure can also returnincorrect data.INSERT INTO dbo.Messages( Subject ,Body)SELECT 'Ordered new water cooler' ,'Ordered new water cooler' ;EXEC dbo.SelectMessagesBySubjectBeginning@SubjectBeginning = '[OT]' ;SubjectBody------------------------------ -------------------Ordered new water cooler Ordered new water coolerListing 1-4: Our procedure returns the wrong messages when the search patterncontains [OT].When using the LIKE keyword, square brackets ("[" and "]"), are treated as wildcardcharacters, denoting a single character within a given range or set. As a result, while thesearch was intended to be one for off-topic posts, it in fact searched for "any messageswhose subject starts with O or T." Therefore Listing 1-3 returns no rows, since no suchmessages existed at that point, whereas Listing 1-4 "unexpectedly" returns the messagestarting with "O," rather than the off-topic messages.25