Re: re:Why use data adaptor functionality ?

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

From: William Ryan eMVP (dotnetguru_at_comcast.nospam.net)
Date: 06/08/04 

Date: Tue, 8 Jun 2004 10:32:01 -0400

How did your IT guys secure your internal network against pissed off
employees? I almost thought that was a joke but realized it wasn't. I was
at a TechNet conference in Atlanta a few months ago and one of the people I
was talking with had a whole table wiped out (on their secure internal
network) by an intern who was playing around. He was a CS major and had
read about Injection attacks. He wanted to test it to see if it was really
possible and thought he was going against the test server. Seems he wasn't.
A mere three hours later, all was well.

I'd encourage you to take a step back at this point and look into the
adapter a bit mroe if you're going to use it. AcceptChanges will do nothing
of use in the context you described except ensure that nothing gets updated
in the db. The adapter loops through the rows in a table when you call
Update and checks the rowstate of each row. From there it maps the rowstate
to a command object (provided you have one) and ideally maps the column
values back to parameters. AcceptChanges changes to rowstate to each row to
unchanged and if any rows are marked deleted, it actually gets rid of them.
I show it in depth here
http://www.knowdotnet.com/articles/efficient_pt4.html Anyway if the dataset
doesn't ahve changes, calling update until the Y10K crisis won't do anything
in the way of updating the db. And calling acceptchanges will make sure
the dataset doesn't have any changes. 

-- 
W.G. Ryan, eMVP
http://forums.devbuzz.com/
http://www.knowdotnet.com/williamryan.html
http://www.msmvps.com/WilliamRyan/
http://www.devbuzz.com/content/zinc_personal_media_center_pg1.asp
"HaggardPete" <peter_callaghan@ukls-dot-net.no-spam.invalid> wrote in
message news:40c5bda9$1_2@Usenet.com...
> Thanks for the input. I guess by injection attack you refer to
> interception of the SQL string and insertion of other values - I
> could be totally wrong.  In any event, probably  crucial in some
> applications but on a secure corporate network - well I can think of
> many more immediate risks.
>
> Its when you come to  sucess / failure of the update that my concerns
> really started. It seems that if the update command is invalid the
> data adaptor accepts the CommandString but does not  report a failure
> when the AcceptChanges method is called. Bizzare !
>
>
>  Posted Via Usenet.com Premium Usenet Newsgroup Services
> ----------------------------------------------------------
>     ** SPEED ** RETENTION ** COMPLETION ** ANONYMITY **
> ---------------------------------------------------------- 
>                 http://www.usenet.com

Relevant Pages

  • Re: Pakistan to ban encryption software
    ... network you have access to (and of course, ... capture, which is illegal without said permission). ... But the point remains that general email is at least as secure as a letter, and that greater security than that is not generally warranted. ... card details are sold in batches as quickly as possible. ...
    (uk.legal)
  • Re: What security package for SBS?
    ... I have a secure Windows network. ... I also have a secure MacMini and on occasion a secure Ubuntu. ... With a business class firewall stripping crap off all incoming traffic and properly implemented security policies in addition to giving your users absolutely no admin rights, there is no reason to believe you can't create a secure Microsoft Network. ...
    (microsoft.public.windows.server.sbs)
  • Re: Wifi Security
    ... Then add in good practices and secure those endpoints! ... I have changed the security to WPA2 with a 128bit ... and attempt to break into her wireless internet connection. ... part of her network cannot do WPA2 but you actually want her network to ...
    (microsoft.public.security)
  • RE: One computer two different networks
    ... Internet connection and one an internal secure connection tempts one ... You have a private network with no Internet for the reason that you ... in Information Security. ...
    (Security-Basics)
  • RE: Home wireless free hotspot
    ... Those and the fact that as it is your connection, you're responsible for what T&C breaches happen from people using your open and/or shared Wi-Fi. ... I have a home wireless network that I'd like to make available to ... Would it make more sense for my secure network to be subservient to the ... install and use a thawte Digital Certificate on your Apache web server. ...
    (Security-Basics)