Is this default behavior?

Hello all,
I'm having difficulties understanding why something is not going the way I
want it (sounds familiar?). I'm testing SQL injection on my own PC, based on
the article at http://aspalliance.com/articleViewer...Id=385&pId=-1.
when I enter only my credentials in the user field, like
administrator';use master exec xp_cmdshell 'dir c:\*.*'--
I get the resultant string
SELECT strusername, strpassword FROM tUser WHERE strusername = 'beheerder';
use master exec xp_cmdshell 'dir c:\*.*' --' AND strpassword = ''
Now the output of "Response.write objrso.Fields.count" is 2. A closer look
gives me 'administrator' and 'password'. Not the C:\ drive listing, which
does show up in SQL Query Analyzer! Is this by any means possible with the
code
Set objConn = Server.CreateObject("ADODB.Connection")
Set objrso = Server.CreateObject("ADODB.Recordset")
sql = "SELECT strusername, strpassword FROM tUser WHERE strusername = '" +
username & _
"' AND strpassword = '" + password & _
"'"
objConn.Open cn
objrso.open sql, cn
If not, how should I change this code? Any hints would be highly welcome.
Best regards,
Carl.
Hi Carl,
Since you have two different SQL statements, separated by semicolon, then
provider executes them separately and returns two resultsets (recordsets).
When you open objrso recordset, then it points to the first one. To be able
to get information from the subsequent recordsets, you need to call
NextRecordset method of the opened recordset
Set objrso=objrso.NextRecordset
If provider returns another resultset, then you will see it after this call
Val Mazur
Microsoft MVP
"Carl Matthews" <ecvaneersel@.nospam.hotmail.com> wrote in message
news:ecJmrkjIEHA.1140@.tk2msftngp13.phx.gbl...
> Hello all,
> I'm having difficulties understanding why something is not going the way I
> want it (sounds familiar?). I'm testing SQL injection on my own PC, based
> on
> the article at http://aspalliance.com/articleViewer...Id=385&pId=-1.
> when I enter only my credentials in the user field, like
> administrator';use master exec xp_cmdshell 'dir c:\*.*'--
> I get the resultant string
> SELECT strusername, strpassword FROM tUser WHERE strusername =
> 'beheerder';
> use master exec xp_cmdshell 'dir c:\*.*' --' AND strpassword = ''
>
> Now the output of "Response.write objrso.Fields.count" is 2. A closer look
> gives me 'administrator' and 'password'. Not the C:\ drive listing, which
> does show up in SQL Query Analyzer! Is this by any means possible with the
> code
> Set objConn = Server.CreateObject("ADODB.Connection")
> Set objrso = Server.CreateObject("ADODB.Recordset")
> sql = "SELECT strusername, strpassword FROM tUser WHERE strusername = '" +
> username & _
> "' AND strpassword = '" + password & _
> "'"
> objConn.Open cn
> objrso.open sql, cn
> If not, how should I change this code? Any hints would be highly welcome.
> Best regards,
> Carl.
>

Is this default behavior?

Hello all,
I'm having difficulties understanding why something is not going the way I
want it (sounds familiar?). I'm testing SQL injection on my own PC, based on
the article at http://aspalliance.com/articleViewe...aId=385&pId=-1.
when I enter only my credentials in the user field, like
administrator';use master exec xp_cmdshell 'dir c:\*.*'--
I get the resultant string
SELECT strusername, strpassword FROM tUser WHERE strusername = 'beheerder';
use master exec xp_cmdshell 'dir c:\*.*' --' AND strpassword = ''
Now the output of "Response.write objrso.Fields.count" is 2. A closer look
gives me 'administrator' and 'password'. Not the C:\ drive listing, which
does show up in SQL Query Analyzer! Is this by any means possible with the
code
Set objConn = Server.CreateObject("ADODB.Connection")
Set objrso = Server.CreateObject("ADODB.Recordset")
sql = "SELECT strusername, strpassword FROM tUser WHERE strusername = '" +
username & _
"' AND strpassword = '" + password & _
"'"
objConn.Open cn
objrso.open sql, cn
If not, how should I change this code? Any hints would be highly welcome.
Best regards,
Carl.Hi Carl,
Since you have two different SQL statements, separated by semicolon, then
provider executes them separately and returns two resultsets (recordsets).
When you open objrso recordset, then it points to the first one. To be able
to get information from the subsequent recordsets, you need to call
NextRecordset method of the opened recordset
Set objrso=objrso.NextRecordset
If provider returns another resultset, then you will see it after this call
Val Mazur
Microsoft MVP
"Carl Matthews" <ecvaneersel@.nospam.hotmail.com> wrote in message
news:ecJmrkjIEHA.1140@.tk2msftngp13.phx.gbl...
> Hello all,
> I'm having difficulties understanding why something is not going the way I
> want it (sounds familiar?). I'm testing SQL injection on my own PC, based
> on
> the article at http://aspalliance.com/articleViewe...aId=385&pId=-1.
> when I enter only my credentials in the user field, like
> administrator';use master exec xp_cmdshell 'dir c:\*.*'--
> I get the resultant string
> SELECT strusername, strpassword FROM tUser WHERE strusername =
> 'beheerder';
> use master exec xp_cmdshell 'dir c:\*.*' --' AND strpassword = ''
>
> Now the output of "Response.write objrso.Fields.count" is 2. A closer look
> gives me 'administrator' and 'password'. Not the C:\ drive listing, which
> does show up in SQL Query Analyzer! Is this by any means possible with the
> code
> Set objConn = Server.CreateObject("ADODB.Connection")
> Set objrso = Server.CreateObject("ADODB.Recordset")
> sql = "SELECT strusername, strpassword FROM tUser WHERE strusername = '" +
> username & _
> "' AND strpassword = '" + password & _
> "'"
> objConn.Open cn
> objrso.open sql, cn
> If not, how should I change this code? Any hints would be highly welcome.
> Best regards,
> Carl.
>sql

Is this a 'dirty read'?

Hello,

trying to understand the concepts of isolation levels not understanding it completely this is my question:

Client A and client B both are querying the same database.
Situation:
- client B starts a transactional operation
- client A executes a non-transactional read operation
- client B rolls back his transactional operation

Is the non-transactional read operation executed by client A called
a 'dirty read'? Or do isolation levels always apply to at least two
clients executing BOTH transactional operations?

regards,
HenkProbably not...depending on if you are using the READUNCOMMITTED isolation level. A dirty read occurs when transactionA starts, updates data, and TransactionB issues a read against a what transactionA is modifiying and transactionB does not issue shared locks against that table when reading it. If transA rolls it work back, transB has read dirty data. Here is an example:

TransA:
BEGIN TRAN
INSERT INTO TableA VALUES('A')

TransB:
SELECT * FROM TableA WITH(NOLOCK)

TransA:
ROLLBACK TRAN

TransB will have read the row that was rolled back from the database, and thus a dirty read.

Hope this helps,
Tim

Is there any difference between Integrity and Constraint ?

For an EDMS application, there are two separate tasks for maintaining Data
Integrity and Constraint for the DB.
From my understanding, the Constraint is already includes the Referential
Integrity, is there any other meaning for Data Integrity ?
Your advice is sought.Hi,
You are correct; The data integrity itself is maintained using contraints.
Take a look into the below URL.
http://www.utexas.edu/its/windows/d...ing/rm/rm5.html
Thanks
Hari
SQL Server MVP
"John" <John@.discussions.microsoft.com> wrote in message
news:OL3Ha9OyGHA.1340@.TK2MSFTNGP05.phx.gbl...
> For an EDMS application, there are two separate tasks for maintaining Data
> Integrity and Constraint for the DB.
> From my understanding, the Constraint is already includes the Referential
> Integrity, is there any other meaning for Data Integrity ?
> Your advice is sought.
>
>|||Data integrity is a broad concept, being a desirable characteristic of
any database. It relates to the consistency, accuracy and validity of
the data.
Referential integrity is only one aspect of integrity. Referential
integrity is usually enforced using foreign key constraints, but can
also be enforced (with less performance and/or safety) using triggers
or other mechanisms (for example on the application side).
The constraints are rules or restrictions that are enforced at the
database level. There are several types of constraints:
- primary key constraints (that ensure entity integrity)
- foreign key constraints (that ensure referential integrity)
- check constraints (that ensure domain integrity and some simple
business rules)
More complex business rules are usually enforced using triggers.
For more informations, see:
http://msdn2.microsoft.com/en-us/library/ms184276.aspx
https://www.cs.tcd.ie/courses/baict...s/integrity.pdf
Razvan
John wrote:
> For an EDMS application, there are two separate tasks for maintaining Data
> Integrity and Constraint for the DB.
> From my understanding, the Constraint is already includes the Referential
> Integrity, is there any other meaning for Data Integrity ?
> Your advice is sought.|||Dear Razvan,
In other words, Data Integrity test may be testing of whether the data is
valid (for instance, within the valid range) .... while constraints test
may be checking the referential integrity ?
Thanks
"Razvan Socol" <rsocol@.gmail.com> wrote in message
news:1156605409.337915.44370@.75g2000cwc.googlegroups.com...
> Data integrity is a broad concept, being a desirable characteristic of
> any database. It relates to the consistency, accuracy and validity of
> the data.
> Referential integrity is only one aspect of integrity. Referential
> integrity is usually enforced using foreign key constraints, but can
> also be enforced (with less performance and/or safety) using triggers
> or other mechanisms (for example on the application side).
> The constraints are rules or restrictions that are enforced at the
> database level. There are several types of constraints:
> - primary key constraints (that ensure entity integrity)
> - foreign key constraints (that ensure referential integrity)
> - check constraints (that ensure domain integrity and some simple
> business rules)
> More complex business rules are usually enforced using triggers.
> For more informations, see:
> http://msdn2.microsoft.com/en-us/library/ms184276.aspx
> https://www.cs.tcd.ie/courses/baict...s/integrity.pdf
> Razvan
> John wrote:
>|||The particular meanings of the terms "Data integrity test" and
"Constraints test" in a particular software may be different of what we
think about them. Please consult the user manual of that software or
contact the product support to get specific information.
Razvan
John wrote:
> Dear Razvan,
> In other words, Data Integrity test may be testing of whether the data is
> valid (for instance, within the valid range) .... while constraints test
> may be checking the referential integrity ?
> Thanks

Is there any difference between Integrity and Constraint ?

For an EDMS application, there are two separate tasks for maintaining Data
Integrity and Constraint for the DB.
From my understanding, the Constraint is already includes the Referential
Integrity, is there any other meaning for Data Integrity ?
Your advice is sought.Hi,
You are correct; The data integrity itself is maintained using contraints.
Take a look into the below URL.
http://www.utexas.edu/its/windows/database/datamodeling/rm/rm5.html
Thanks
Hari
SQL Server MVP
"John" <John@.discussions.microsoft.com> wrote in message
news:OL3Ha9OyGHA.1340@.TK2MSFTNGP05.phx.gbl...
> For an EDMS application, there are two separate tasks for maintaining Data
> Integrity and Constraint for the DB.
> From my understanding, the Constraint is already includes the Referential
> Integrity, is there any other meaning for Data Integrity ?
> Your advice is sought.
>
>|||Data integrity is a broad concept, being a desirable characteristic of
any database. It relates to the consistency, accuracy and validity of
the data.
Referential integrity is only one aspect of integrity. Referential
integrity is usually enforced using foreign key constraints, but can
also be enforced (with less performance and/or safety) using triggers
or other mechanisms (for example on the application side).
The constraints are rules or restrictions that are enforced at the
database level. There are several types of constraints:
- primary key constraints (that ensure entity integrity)
- foreign key constraints (that ensure referential integrity)
- check constraints (that ensure domain integrity and some simple
business rules)
More complex business rules are usually enforced using triggers.
For more informations, see:
http://msdn2.microsoft.com/en-us/library/ms184276.aspx
https://www.cs.tcd.ie/courses/baict/baim/js/dbms/integrity.pdf
Razvan
John wrote:
> For an EDMS application, there are two separate tasks for maintaining Data
> Integrity and Constraint for the DB.
> From my understanding, the Constraint is already includes the Referential
> Integrity, is there any other meaning for Data Integrity ?
> Your advice is sought.|||Dear Razvan,
In other words, Data Integrity test may be testing of whether the data is
valid (for instance, within the valid range) .... while constraints test
may be checking the referential integrity ?
Thanks
"Razvan Socol" <rsocol@.gmail.com> wrote in message
news:1156605409.337915.44370@.75g2000cwc.googlegroups.com...
> Data integrity is a broad concept, being a desirable characteristic of
> any database. It relates to the consistency, accuracy and validity of
> the data.
> Referential integrity is only one aspect of integrity. Referential
> integrity is usually enforced using foreign key constraints, but can
> also be enforced (with less performance and/or safety) using triggers
> or other mechanisms (for example on the application side).
> The constraints are rules or restrictions that are enforced at the
> database level. There are several types of constraints:
> - primary key constraints (that ensure entity integrity)
> - foreign key constraints (that ensure referential integrity)
> - check constraints (that ensure domain integrity and some simple
> business rules)
> More complex business rules are usually enforced using triggers.
> For more informations, see:
> http://msdn2.microsoft.com/en-us/library/ms184276.aspx
> https://www.cs.tcd.ie/courses/baict/baim/js/dbms/integrity.pdf
> Razvan
> John wrote:
>> For an EDMS application, there are two separate tasks for maintaining
>> Data
>> Integrity and Constraint for the DB.
>> From my understanding, the Constraint is already includes the Referential
>> Integrity, is there any other meaning for Data Integrity ?
>> Your advice is sought.
>|||The particular meanings of the terms "Data integrity test" and
"Constraints test" in a particular software may be different of what we
think about them. Please consult the user manual of that software or
contact the product support to get specific information.
Razvan
John wrote:
> Dear Razvan,
> In other words, Data Integrity test may be testing of whether the data is
> valid (for instance, within the valid range) .... while constraints test
> may be checking the referential integrity ?
> Thanks