Francisco H Tapia
my.lists at verizon.net
Tue Jun 29 19:16:07 CDT 2004
Francis Harvey wrote On 6/29/2004 3:21 PM:
>Francisco,
>
>Give me a break. If you haven't done the research to find an actual
>example somebody would agree to as valid usage of dynamic SQL and then
>just start coming up with reasons why your sproc wouldn't be better as
>dynamic SQL, you aren't interested in actually debating its merits.
>You apparently prefer to debate your own version of dynamic SQL which
>is easily bested, thus suitably earning its title of straw man. I
>never claimed your sproc was suitable for dynamic SQL, and I
>certainly won't argue its merits on that inappropriate example.
>
>To my knowledge, you have posted nothing suggesting you have the
>experience to classify "every problem that people encounter where
>Dynamic SQL appears to be the only or best solution". Have you done
>the minimal research I suggested? If you won't do it, then I have
>already stated I am not a John Colby, willing to do the research for
>you. I hold up my side of the debate; you are responsible for yours.
>
>
Francis,
Of course you are,
>So, we can agree security is a balance? Thus, saying dynamic SQL means
>you must have an unsecured system is not strictly true depending on
>where you put the balance. For us, this database is accessed via only
>one application which codes the dynamic SQL according to specific user
>choices. For us, this is an acceptable security balance for the
>performance we get from dynamic SQL, and we consider this to be a
>secured system.
>
>
>
There are varying defenitions of security, so you can use whatever
guidelines.
>Again with the additive. I am starting to wonder whether you are
>reading my comments as you simply restate material that everybody
>involved: Arthur, you, myself; already knows. Fine, I'll agree not to
>object to the additive adjective if in future summaries everyone will
>agree to mention DENY as well if only in passing. Please, at the very
>least, don't feel required to requote BOL information again. Argh.
>
>
>Your experience means nothing to me as mine should mean nothing to you.
>I don't care if you've never had a use for a linked server, UDF, or
>anything else in SQL server. I have given you the terms to search for
>exactly because you seem to have had no experience with SQL that
>needs to be dynamic. For you to then complain that you haven't seen
>any examples is a bit disingenuous. Go look. Or don't. Whatever. Until
>then, enjoy beating up your straw man.
>
>
Only if you beat up yours first.
--
-Francisco