Colin Angus Mackay wrote:

There is the possibility of a Second Order Attack. This is where supposedly clensed data that is already sitting in the database can be used to form an attack. All the data used is internal to the system at the time the SQL is formed, but the threat is just as real.

Another excellent bit of advice, yet again completely outside the context of the discussion. Neither the original question nor my response involved building a query from any external data. Without the inclusion of external text that may at some point have been entered by an end user of the program - SQL Injection attacks are not an issue.

Ron

Good advice, but it doesn't answer his question. *If* he is accepting user input to build the query, then SQL Injection attacks are an issue. If the entire query as written is part of his internal code, there is no danger.

Ron

Nevermind, I figured it out. The query tool I am using ( WinSQL - very handy tool ) has an option to "Parse Comments Locally" which was turned on - so it was removing the comments *before* sending the to SQL Server to save. :-)

Ron

I use a lot of comments in my stored procedures to document my code for future developers that might have to modify / debug it. However, when I view my stored procedure script or pick the "modify" option in SQL Server Management Studio the code comes up with blank lines where my comments are supposed to be. I see other stored procedures that have retained thier comments (although they are much smaller in size) using the same "--" single line comment that I use. Anyone know why that is happening? Thanks,

Ron

Hi Raj,

select
t2.col1,
t1.col2,
t2.col3
from
tab2 t2

LEFT OUTER JOIN tab1 t1
ON ( t1.col2 = ascii(t2.col3) - 96 )

Results:
col1 col2 col3

1 1 a
1 2 b
1 NULL c
1 NULL d

Pretty silly way to join data though, I hope it was part of a "puzzle" question and not a serious solution. :-)

Ron

Hi Mohsin, I don't think SQL syntax supports escape characters like that. To use an embedded single quote in a query like your example, you put two single quotes in the string: SELECT * FROM ClauseTranslations WHERE Clause LIKE 'trainee''s cost'

Ron