17.07.2015 Views

Defensive Database Programming - Red Gate Software

Defensive Database Programming - Red Gate Software

Defensive Database Programming - Red Gate Software

SHOW MORE
SHOW LESS

Create successful ePaper yourself

Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.

Chapter 2: Code Vulnerabilities due to SQL Server Misconceptions-- they are skipped to keep the example shortSenderID INT NOT NULL ,ReceiverID INT NOT NULL ,MessageDateAsVarcharColumn VARCHAR(30) NULL ,SomeMoreData CHAR(200) NULL) ;GOINSERT INTO dbo.Messages( MessageID ,SenderID ,ReceiverID ,MessageDateAsVarcharColumn ,SomeMoreData)SELECT n ,n % 1000 ,n / 1000 ,'Wrong Date' ,'SomeMoreData'FROM dbo.Numbers ;GO-- after the insert all the messages have wrong datesUPDATE dbo.MessagesSET MessageDateAsVarcharColumn = '20090707'WHERE SenderID = 123AND ReceiverID = 456 ;-- after the update exactly one message has a valid dateListing 2-2: Creating the helper Numbers table and Messages table.Given that almost all the rows in this table have invalid DATETIME values, attempting toconvert such invalid values to DATETIME leads to conversion errors, such as shown inListing 2-3.60

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!