Wednesday, March 28, 2012
Replacement for xp_cmdshell in SQL2k
e
using “xp_cmdshell”.
xp_cmdshell is an extended stored procedure in Master database. This command
takes a string of dos commands and executes them in the DOS command shell.
Now the Client wants a replacement for this xp_cmdshell . i.e., I need some
other function or procedure or something which I can place instead of this
xp_cmdshell in the respective stored procedures using this xp_cmdshell.
Note: The Client doesn’t want to use this xp_cmdshell at all.The client probably heard that having xp_cmdShell enabled adds to your
security risk, and wants a safe way to do the same things they have been
doing.
What have they been doing with xp_cmdshell? There may be ways to replace
that functionality, there may not.
You could create jobs that execute cmdexec steps, and have the stored
procedures activate the jobs.
Please provide more info about what they do and why they want to discontinue
using xp_cmdshell.
David Lundell
Principal Consultant and Trainer
www.MutuallyBeneficial.com
David@.MutuallyBeneficial.com
"aizaz" <aizaz@.discussions.microsoft.com> wrote in message
news:AC38DE7E-AD41-4414-AC0C-A8BC3C377DC7@.microsoft.com...
> ISSUE (in SQL Server 2000): Some Client applications' stored procedures
> are
> using "xp_cmdshell".
> xp_cmdshell is an extended stored procedure in Master database. This
> command
> takes a string of dos commands and executes them in the DOS command shell.
> Now the Client wants a replacement for this xp_cmdshell . i.e., I need
> some
> other function or procedure or something which I can place instead of this
> xp_cmdshell in the respective stored procedures using this xp_cmdshell.
> Note: The Client doesn't want to use this xp_cmdshell at all.
>|||The solution depends on what you are executing via xp_cmdshell. One
approach is to create a new extended stored procedure to encapsulate the
needed functionality.
Another method is to move the processing out of SQL Server and into
application code, either on the client or on a server. It is likely that
this is the better approach if your client is concerned about security.
Hope this helps.
Dan Guzman
SQL Server MVP
"aizaz" <aizaz@.discussions.microsoft.com> wrote in message
news:AC38DE7E-AD41-4414-AC0C-A8BC3C377DC7@.microsoft.com...
> ISSUE (in SQL Server 2000): Some Client applications' stored procedures
> are
> using "xp_cmdshell".
> xp_cmdshell is an extended stored procedure in Master database. This
> command
> takes a string of dos commands and executes them in the DOS command shell.
> Now the Client wants a replacement for this xp_cmdshell . i.e., I need
> some
> other function or procedure or something which I can place instead of this
> xp_cmdshell in the respective stored procedures using this xp_cmdshell.
> Note: The Client doesn't want to use this xp_cmdshell at all.
>|||Thank You for your response.
It is because of some security reasons the Client does not want any non-DBA
to use "xp_cmdshell" command.
This command takes a string as input and executes the same in the DOS
command shell. The string is nothing but a valid DOS command.
Example: Exec xp_cmdshell 'dir *.*'
Similarly as above my requirement has FTP, move, jview, copy, del, bcp etc.,
DOS commands as inputs to this extended stored procedure in the form of a
string.
I hope I explained it more clearly to you now.
-Aizaz
"David Lundell" wrote:
> The client probably heard that having xp_cmdShell enabled adds to your
> security risk, and wants a safe way to do the same things they have been
> doing.
> What have they been doing with xp_cmdshell? There may be ways to replace
> that functionality, there may not.
> You could create jobs that execute cmdexec steps, and have the stored
> procedures activate the jobs.
> Please provide more info about what they do and why they want to discontin
ue
> using xp_cmdshell.
> --
> David Lundell
> Principal Consultant and Trainer
> www.MutuallyBeneficial.com
> David@.MutuallyBeneficial.com
> "aizaz" <aizaz@.discussions.microsoft.com> wrote in message
> news:AC38DE7E-AD41-4414-AC0C-A8BC3C377DC7@.microsoft.com...
>
>|||Thank You for your response.
A string of DOS commands is the input "xp_cmdshell".
Example:- Exec xp_cmdshell 'copy file1.txt file2.txt'
Which means we need some way in which we can take a string (which is a valid
DOS command) and execute it in DOS command shell (which is the functionality
of xp_cmdshell)
"Dan Guzman" wrote:
> The solution depends on what you are executing via xp_cmdshell. One
> approach is to create a new extended stored procedure to encapsulate the
> needed functionality.
> Another method is to move the processing out of SQL Server and into
> application code, either on the client or on a server. It is likely that
> this is the better approach if your client is concerned about security.
>
> --
> Hope this helps.
> Dan Guzman
> SQL Server MVP
> "aizaz" <aizaz@.discussions.microsoft.com> wrote in message
> news:AC38DE7E-AD41-4414-AC0C-A8BC3C377DC7@.microsoft.com...
>
>|||> Example:- Exec xp_cmdshell 'copy file1.txt file2.txt'
So why are you using xp_cmdshell for this task? Is there some reason you
cannot perform file manipulation like this directly from you application
code?
Hope this helps.
Dan Guzman
SQL Server MVP
"aizaz" <aizaz@.discussions.microsoft.com> wrote in message
news:B6A188BB-55FD-48C7-9A0F-6451EC953F7F@.microsoft.com...[vbcol=seagreen]
> Thank You for your response.
> A string of DOS commands is the input "xp_cmdshell".
> Example:- Exec xp_cmdshell 'copy file1.txt file2.txt'
> Which means we need some way in which we can take a string (which is a
> valid
> DOS command) and execute it in DOS command shell (which is the
> functionality
> of xp_cmdshell)
> "Dan Guzman" wrote:
>|||There is some processing done in a stored procedure and this extended stored
procedure is called after that. Once the xp completes its job, some more
processing done in the original stored procedure.
Also there are many stored procedures which internally call xp for different
tasks like bulk copy etc. Most of these stored procedures are scheduled SQL
tasks and are not called from any application. So replacing this
functionality in application code can be ruled out.
Thanks for your inputs/suggestions...
"Dan Guzman" wrote:
> So why are you using xp_cmdshell for this task? Is there some reason you
> cannot perform file manipulation like this directly from you application
> code?
> --
> Hope this helps.
> Dan Guzman
> SQL Server MVP
> "aizaz" <aizaz@.discussions.microsoft.com> wrote in message
> news:B6A188BB-55FD-48C7-9A0F-6451EC953F7F@.microsoft.com...
>
>|||You might consider splitting the stored procedures that currently execute
xp_cmdshell into separate procs. This would allow you to replace
xp_cmdshell functionality with a CmdExec job step. For example:
1) Transact-SQL step: EXEC proc 1
2) CmdExec step: BCP
1) Transact-SQL step: EXEC proc 2
Your client might be more receptive to this method since the command runs
outside the SQL Server service process.
Hope this helps.
Dan Guzman
SQL Server MVP
"aizaz" <aizaz@.discussions.microsoft.com> wrote in message
news:0299E709-4A85-4158-B9A6-E62B1722765A@.microsoft.com...[vbcol=seagreen]
>
> There is some processing done in a stored procedure and this extended
> stored
> procedure is called after that. Once the xp completes its job, some more
> processing done in the original stored procedure.
> Also there are many stored procedures which internally call xp for
> different
> tasks like bulk copy etc. Most of these stored procedures are scheduled
> SQL
> tasks and are not called from any application. So replacing this
> functionality in application code can be ruled out.
> Thanks for your inputs/suggestions...
> "Dan Guzman" wrote:
>
Friday, March 23, 2012
Replace LoginName control with other data fields from aspnetdb.mdf
I currently have a LoginStatus and LoginName control on my asp.net 2.0 master page. When successfully logged in a message displays "You are logged in as" LoginName. Since I am using the user's e-mail address as the UserName the message will display as "You are logged in as johndoe@.foo.com".
What I want to do is have the message display as "You are logged in as " FirstName LastName. FirstName and LastName are two new fields that I added to the table, aspnet_Users.
What I have done is to use the FormView control to display FirstName and LastName; however this always displays the first record in the aspnetdb database.
Is there a cleaner way (than the FormView control) to display the requested data, using the currently logged in user? I have access to Microsoft Expression Web and Visual Studio 2005, but I prefer Expression Web.
Thank you in advance
Hi,
From your description, it seems that you want to get the FirstName and LastName field for the logon user, right?
If so, I think you can get the current user's name by using User.Identity.Name, and then, invoke the GetUser method of Membership with the current user's name, which can return a MembershipUser typed object. You can access the data filed in the membership tables.
Thanks.
Wednesday, March 21, 2012
Replace Function
In my Item Master table, the item column has values like 'printing' in more
than 1000 rows. This was a data entry error. Now my user want all the
instances of 'printing' to be replace by 'printed'. Is there any ways to
update the entire rows in one go, or I will have to change the name from VB
ror by row, or using cusror in SQL.
Please help.
Thanks & Regards,
PramodYou didn't provide much details, but assuming you have a column named "x" fo
r which some rows
currently have the string "printing" and you want to change that string to "
printed", then it is
dead simple:
UPDATE tblname
SET x = 'printed'
WHERE x = 'printing'
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://www.solidqualitylearning.com/
<pramod@.luxoroffice.com> wrote in message news:%235smP8lHFHA.3500@.TK2MSFTNGP14.phx.gbl...[c
olor=darkred]
> Dear All,
> In my Item Master table, the item column has values like 'printing' in mor
e
> than 1000 rows. This was a data entry error. Now my user want all the
> instances of 'printing' to be replace by 'printed'. Is there any ways to
> update the entire rows in one go, or I will have to change the name from V
B
> ror by row, or using cusror in SQL.
> Please help.
> Thanks & Regards,
> Pramod
>[/color]|||If when you say "values like 'printing'", you mean that
'printing' is not the entire column value, you may need
something like this.
update ItemMaster set
item = replace(item, 'printing', 'printed')
where item like '%printing%'
Steve Kass
Drew University
pramod@.luxoroffice.com wrote:
>Dear All,
>In my Item Master table, the item column has values like 'printing' in more
>than 1000 rows. This was a data entry error. Now my user want all the
>instances of 'printing' to be replace by 'printed'. Is there any ways to
>update the entire rows in one go, or I will have to change the name from VB
>ror by row, or using cusror in SQL.
>Please help.
>Thanks & Regards,
>Pramod
>
>|||try this:-
update <tablename>
set <fieldname> = replace(<fieldname>, 'Printing', 'Printed')
from table
steve
"Steve Kass" <skass@.drew.edu> wrote in message
news:%23d4ofZmHFHA.1392@.TK2MSFTNGP10.phx.gbl...
> If when you say "values like 'printing'", you mean that
> 'printing' is not the entire column value, you may need
> something like this.
> update ItemMaster set
> item = replace(item, 'printing', 'printed')
> where item like '%printing%'
> Steve Kass
> Drew University
> pramod@.luxoroffice.com wrote:
>|||Dear Steve,
My Problem is sloved by the query u provided:
UPDATE ItemMaster
SET ItemName = REPLACE(ItemName, 'Printing', 'Printed')
FROM ItemMaster
WHERE ItemName LIKE '%Printing%'
Thanks,
"Steven Richardson" <steve@.cheltenhamdirectory.com> wrote in message
news:Ocz9w2mHFHA.1860@.TK2MSFTNGP15.phx.gbl...
> try this:-
> update <tablename>
> set <fieldname> = replace(<fieldname>, 'Printing', 'Printed')
> from table
>
> steve
>
> "Steve Kass" <skass@.drew.edu> wrote in message
> news:%23d4ofZmHFHA.1392@.TK2MSFTNGP10.phx.gbl...
>
Wednesday, March 7, 2012
Repairing a Database
Error 9003: The LSN(2768:609:1) passed to log scan in database 'master DB' is invalid.
Is there a repair tool, or something you can do in enterprise manager to repair the database.
Hi,
You may get this error while attaching the Database if the log file of the
database is corrupted.
If you have a clean backup, please restore the Database from the backup.
This is preferred method of recovering the database, because at this point
in time we will not be able to determine the impact of corrupted Log file.
If no clean backup is available, try this workaround, this is not
recommended, as you may have corrupted data.
Move the log file (.ldf) to a different location.
execute the following SP
sp_attach_single_file_db
Attaches a database having only one data file to the current server.
Syntax
sp_attach_single_file_db [ @.dbname = ] 'dbname'
, [ @.physname = ] 'physical_name'
Arguments
[@.dbname =] 'dbname'
Is the name of the database to be attached to the server. dbname is
sysname, with a default of NULL.
[@.physname =] 'phsyical_name'
Is the physical name, including path, of the database file. physical_name
is nvarchar(260), with a default of NULL.
This should be able to attach your database to the Server.
After attaching the database, execute DBCC CHECKDB without a repair clause
to
determine the extent of the corruption. DBCC CHECKDB may recommend a repair
clause
to use. Then, execute DBCC CHECKDB with the appropriate repair clause to
repair the
corruption.
CAUTION: If you are unsure what effect DBCC CHECKDB with a repair clause
has on your data, contact your primary support provider before executing
this
statement.
If running DBCC CHECKDB with one of the repair clauses does not correct the
problem, contact your primary support provider.
HTH
Ashish
This posting is provided "AS IS" with no warranties, and confers no rights.
Repair Master db
bigger issue. Of course, I was not smart enough to backup the db before
touching it...
I have a new instance of SQL Server 2000 running on a Windows 2003 machine.
I ran into some issues with logins and, following instructions from an
article I found, I was trying to delete a single row from the
master.sysxlogins table. Well, I failed to add "WHERE name = ''" to the
statement and ended up deleting everything in that table. Now I can't
connect at all.
Is there any solution besides reinstalling SQL Server?
Thank You,
Jason Williard
Read up on rebuildm.exe in Books Online.
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://www.solidqualitylearning.com/
"Jason Williard" <jason@.pcsafe.net> wrote in message news:6KKdnVSBcNmIjLnfRVn-tA@.comcast.com...
> Today, while working on repairing another issue, I managed to cause an even bigger issue. Of
> course, I was not smart enough to backup the db before touching it...
> I have a new instance of SQL Server 2000 running on a Windows 2003 machine. I ran into some issues
> with logins and, following instructions from an article I found, I was trying to delete a single
> row from the master.sysxlogins table. Well, I failed to add "WHERE name = ''" to the statement
> and ended up deleting everything in that table. Now I can't connect at all.
> Is there any solution besides reinstalling SQL Server?
> Thank You,
> Jason Williard
>
|||You can run Rebuildm.exe in the \80\tools\binn to rebuild master database.
-oj
"Jason Williard" <jason@.pcsafe.net> wrote in message
news:6KKdnVSBcNmIjLnfRVn-tA@.comcast.com...
> Today, while working on repairing another issue, I managed to cause an
> even bigger issue. Of course, I was not smart enough to backup the db
> before touching it...
> I have a new instance of SQL Server 2000 running on a Windows 2003
> machine. I ran into some issues with logins and, following instructions
> from an article I found, I was trying to delete a single row from the
> master.sysxlogins table. Well, I failed to add "WHERE name = ''" to the
> statement and ended up deleting everything in that table. Now I can't
> connect at all.
> Is there any solution besides reinstalling SQL Server?
> Thank You,
> Jason Williard
>
Repair Master db
bigger issue. Of course, I was not smart enough to backup the db before
touching it...
I have a new instance of SQL Server 2000 running on a Windows 2003 machine.
I ran into some issues with logins and, following instructions from an
article I found, I was trying to delete a single row from the
master.sysxlogins table. Well, I failed to add "WHERE name = ''" to the
statement and ended up deleting everything in that table. Now I can't
connect at all.
Is there any solution besides reinstalling SQL Server?
Thank You,
Jason WilliardRead up on rebuildm.exe in Books Online.
--
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://www.solidqualitylearning.com/
"Jason Williard" <jason@.pcsafe.net> wrote in message news:6KKdnVSBcNmIjLnfRVn-tA@.comcast.com...
> Today, while working on repairing another issue, I managed to cause an even bigger issue. Of
> course, I was not smart enough to backup the db before touching it...
> I have a new instance of SQL Server 2000 running on a Windows 2003 machine. I ran into some issues
> with logins and, following instructions from an article I found, I was trying to delete a single
> row from the master.sysxlogins table. Well, I failed to add "WHERE name = ''" to the statement
> and ended up deleting everything in that table. Now I can't connect at all.
> Is there any solution besides reinstalling SQL Server?
> Thank You,
> Jason Williard
>|||You can run Rebuildm.exe in the \80\tools\binn to rebuild master database.
--
-oj
"Jason Williard" <jason@.pcsafe.net> wrote in message
news:6KKdnVSBcNmIjLnfRVn-tA@.comcast.com...
> Today, while working on repairing another issue, I managed to cause an
> even bigger issue. Of course, I was not smart enough to backup the db
> before touching it...
> I have a new instance of SQL Server 2000 running on a Windows 2003
> machine. I ran into some issues with logins and, following instructions
> from an article I found, I was trying to delete a single row from the
> master.sysxlogins table. Well, I failed to add "WHERE name = ''" to the
> statement and ended up deleting everything in that table. Now I can't
> connect at all.
> Is there any solution besides reinstalling SQL Server?
> Thank You,
> Jason Williard
>
Repair Master db
bigger issue. Of course, I was not smart enough to backup the db before
touching it...
I have a new instance of SQL Server 2000 running on a Windows 2003 machine.
I ran into some issues with logins and, following instructions from an
article I found, I was trying to delete a single row from the
master.sysxlogins table. Well, I failed to add "WHERE name = ''" to the
statement and ended up deleting everything in that table. Now I can't
connect at all.
Is there any solution besides reinstalling SQL Server?
Thank You,
Jason WilliardRead up on rebuildm.exe in Books Online.
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://www.solidqualitylearning.com/
"Jason Williard" <jason@.pcsafe.net> wrote in message news:6KKdnVSBcNmIjLnfRVn-tA@.comcast.com
..
> Today, while working on repairing another issue, I managed to cause an eve
n bigger issue. Of
> course, I was not smart enough to backup the db before touching it...
> I have a new instance of SQL Server 2000 running on a Windows 2003 machine
. I ran into some issues
> with logins and, following instructions from an article I found, I was try
ing to delete a single
> row from the master.sysxlogins table. Well, I failed to add "WHERE name =
''" to the statement
> and ended up deleting everything in that table. Now I can't connect at al
l.
> Is there any solution besides reinstalling SQL Server?
> Thank You,
> Jason Williard
>|||You can run Rebuildm.exe in the \80\tools\binn to rebuild master database.
-oj
"Jason Williard" <jason@.pcsafe.net> wrote in message
news:6KKdnVSBcNmIjLnfRVn-tA@.comcast.com...
> Today, while working on repairing another issue, I managed to cause an
> even bigger issue. Of course, I was not smart enough to backup the db
> before touching it...
> I have a new instance of SQL Server 2000 running on a Windows 2003
> machine. I ran into some issues with logins and, following instructions
> from an article I found, I was trying to delete a single row from the
> master.sysxlogins table. Well, I failed to add "WHERE name = ''" to the
> statement and ended up deleting everything in that table. Now I can't
> connect at all.
> Is there any solution besides reinstalling SQL Server?
> Thank You,
> Jason Williard
>