jwcolby
jwcolby at colbyconsulting.com
Fri Mar 28 14:01:14 CDT 2008
I know that dynamic SQL is frowned upon for obvious reasons. Please phrase your responses understanding the following: 1) I work by myself, there are no other DB users. 2) My network is connected through a "consumer grade" router / firewall to the internet. 3) I run Avs, software firewalls and the newer "zero day" malware detectors such as Counterspy and Threatfire. 4) I have never (to my knowledge) been infected by any viruses, key loggers, Trojans or other such malware. 5) There ARE other computers in the house that also connect to the internet, specifically my wife's laptop and my son's laptop. Both of them run Avs and software firewalls. I am trying to build SPs and such to perform functionality such as Delete * from tblTemp Bulk Insert 'SomeDbName.SomeTblName' from 'SomeFilePath' Obviously if I am going to use this to process files in my many different databases then I will need a way to pass in SomeDbName, SomeTblName, and SomeFileName. ATM I am doing this by using dynamic SQL, i.e. building up SQL strings and then Executing those strings. It all seems to be working. I am SPECIFICALLY ASKING for "best practices" couched within the situation that I work in. I am not using a database that directly faces the internet or is ever touched (to my knowledge) by any outsiders. Even considering my situation, if the "better way" is actually attainable (by ME, and you already know what THAT means) I will do things the better way. 1) Is there another way besides the dynamic SQL? 2) Is this "other way" generic, can it be applied to all of my databases, or would I need to store the same SP in each db and use local table names. Or would I need to do something else entirely. Please please do not respond with how to handle this for an internet company taking orders from the internet or an IBM with 6 thousand direct users of the database. But please do let me know if or why I should take the same precautions anyway and what those precautions would be IF I really need to be doing more. I am asking for all opinions, and yet I am still asking you to consider my circumstances and offer your opinions based around that. Obviously I want to be as secure as I can be while accepting the fact that it is just lonely me with no dedicated security guru. Thanks, John W. Colby Colby Consulting www.ColbyConsulting.com