Re: Speeding up in-line queries

Tech-Archive recommends: Fix windows errors by optimizing your registry

From: Bob Barrows [MVP] (reb01501_at_NOyahoo.SPAMcom)
Date: 06/18/04

  • Next message: Shawn: "Re: Problems connecting to SQL from ASP page" 
    Date: Fri, 18 Jun 2004 16:52:42 -0400

    Astra wrote:
    > Hi All
    >
    > I know this is a 'try it yourself' thing, but is it generally true
    > that in-line query (A):
    >
    > strSQLQuery = "update accounts set fred='" & strfred & "',bob='" &
    > strbob & "', etc
    >
    > is not pretty to read as one long string, BUT a lot faster to execute
    > than in-line query (B):
    >
    > strSQLQuery = "update accounts set "
    > strSQLQuery = strSQLQuery & "fred='" & strfred & "',"
    > strSQLQuery = strSQLQuery & "bob='" & strbob & "',
    > etc etc
    >
    > Yes?
    >

    It's faster, but not a LOT faster. You will only be able to notice the
    difference in a loop that's building a huge string.

    The real problem is the possibility of SQL Injection:
    http://www.sqlsecurity.com/DesktopDefault.aspx?tabid=23
    http://www.nextgenss.com/papers/advanced_sql_injection.pdf
    http://www.nextgenss.com/papers/more_advanced_sql_injection.pdf

    You should not be using dynamic sql. Stored procedures is the most secure
    methodology.

    Bob Barrows 

    -- 
Microsoft MVP - ASP/ASP.NET
Please reply to the newsgroup. This email account is my spam trap so I
don't check it very often. If you must reply off-line, then remove the
"NO SPAM"
  • Next message: Shawn: "Re: Problems connecting to SQL from ASP page"

    Relevant Pages

    • Re: Form login
      ... Aren't you only leaving yourself open for sql injection if you don't ... make sure that certain characters aren't in the string before you ... allow them into your sql string. ... This email account is my spam trap so I ...
      (microsoft.public.inetserver.asp.db)
    • Re: Protecting my app from get?
      ... > string in the URL to provide the page with appropriate data. ... the best protection against sql injection ... old posts about using saved parameter queries and stored ... This email account is my spam trap so I ...
      (microsoft.public.inetserver.asp.db)
    • Re: Regular Expression help C#
      ... I have a method that basically parses any string sent to it to ensure ... I have my pattern started, but I cannot seem to figure how to only ... you should never have to worry about SQL injection. ... the problem is, that there are more keywords that you could ever take into account, especially if you take database independency into account. ...
      (microsoft.public.dotnet.general)
    • Re: Another form of SQL injection
      ... It allows query parameters to be binded and ... $name = "tom' UNION blah blah blah" ... another form of SQL injection might in the form of... ... is as a string ... ...
      (comp.lang.php)
    • Re: Can you use dynamic data in a request form
      ... I am am trying to write some code to perform a INSERT in SQL ... > table using a loop. ... How that string is built is irrelevant. ... This email account is my spam trap so I ...
      (microsoft.public.inetserver.asp.general)