473,888 Members | 1,708 Online
Bytes | Software Development & Data Engineering Community
+ Post

Home Posts Topics Members FAQ

SQL contains clause validation problem

Hi,

I'm writing a visual basic application which searches a database of e-mail
messages, based on certain criteria. I'm using dynamic SQL and an exec
sp_executesql statement on the dynamic sql string. I'm using full text
indexing, and a contains clause to search certain columns, and I'm trying to
figure out the best way to validate the input passed from visual basic to my
sql query. SQL has certain "noise" words that are ignored, and generate
errors in my program. The requirement for the validation is...
1. search strings cannot start with (and, or, not)
2. single search terms must be surrounded by quotes, and cannot be a noise
word.
3. phrases(two or more words separated by spaces) must be surrounded by
quotes, and may contain noise words, but all words within the phrase must
not be noise words.
I found trying to write something to validate this is quite a headache, and
I was wondering if anyone had thoughts on an efficient way to do this. A
list of noise words can be found at:
http://beinecke.library.yale.edu/SQLIgnoredWords.html

The part of the dynamic sql search looks like this:
IF @SubjectSearch IS NOT NULL
select @sql = @sql + ' AND CONTAINS(M.Subj ect, @xSubjectSearch )'

Thanks in advance.
-Matt
Nov 20 '05 #1
4 1654
I'm wondering why you need to filter out noise words when SQL Server
will do it for you? If you need to validate your input strings, use
regular expressions -- here's a link to the help topic:
ms-help://MS.VSCC.2003/MS.MSDNQTR.2004 APR.1033/cpguide/html/cpconCOMRegular Expressions.htm

Also, be aware that using sp_executesql to execute dynamic SQL is a
good way to leave your database open to SQL injection attacks and is
not recommended. There's a lot of good info available if you google
"sql injection SQL Server".

--Mary

On Thu, 29 Jul 2004 11:13:02 -0400, "matt" <bl******@blahb lah.com>
wrote:
Hi,

I'm writing a visual basic application which searches a database of e-mail
messages, based on certain criteria. I'm using dynamic SQL and an exec
sp_executesq l statement on the dynamic sql string. I'm using full text
indexing, and a contains clause to search certain columns, and I'm trying to
figure out the best way to validate the input passed from visual basic to my
sql query. SQL has certain "noise" words that are ignored, and generate
errors in my program. The requirement for the validation is...
1. search strings cannot start with (and, or, not)
2. single search terms must be surrounded by quotes, and cannot be a noise
word.
3. phrases(two or more words separated by spaces) must be surrounded by
quotes, and may contain noise words, but all words within the phrase must
not be noise words.
I found trying to write something to validate this is quite a headache, and
I was wondering if anyone had thoughts on an efficient way to do this. A
list of noise words can be found at:
http://beinecke.library.yale.edu/SQLIgnoredWords.html

The part of the dynamic sql search looks like this:
IF @SubjectSearch IS NOT NULL
select @sql = @sql + ' AND CONTAINS(M.Subj ect, @xSubjectSearch )'

Thanks in advance.
-Matt


Nov 20 '05 #2
Mary,

We're aware of the risks of dynamic SQL, but unfortunately until SQL Server
2005, we will have to deal with this issue. To do this query statically,
would require (permutation of the varying amount of parameters) queries, in
conditional statements.
-Matt
"Mary Chipman" <mc***@online.m icrosoft.com> wrote in message
news:a3******** *************** *********@4ax.c om...
I'm wondering why you need to filter out noise words when SQL Server
will do it for you? If you need to validate your input strings, use
regular expressions -- here's a link to the help topic:
ms-help://MS.VSCC.2003/MS.MSDNQTR.2004 APR.1033/cpguide/html/cpconCOMRegular E
xpressions.htm
Also, be aware that using sp_executesql to execute dynamic SQL is a
good way to leave your database open to SQL injection attacks and is
not recommended. There's a lot of good info available if you google
"sql injection SQL Server".

--Mary

On Thu, 29 Jul 2004 11:13:02 -0400, "matt" <bl******@blahb lah.com>
wrote:
Hi,

I'm writing a visual basic application which searches a database of e-mailmessages, based on certain criteria. I'm using dynamic SQL and an exec
sp_executesq l statement on the dynamic sql string. I'm using full text
indexing, and a contains clause to search certain columns, and I'm trying tofigure out the best way to validate the input passed from visual basic to mysql query. SQL has certain "noise" words that are ignored, and generate
errors in my program. The requirement for the validation is...
1. search strings cannot start with (and, or, not)
2. single search terms must be surrounded by quotes, and cannot be a noiseword.
3. phrases(two or more words separated by spaces) must be surrounded by
quotes, and may contain noise words, but all words within the phrase must
not be noise words.
I found trying to write something to validate this is quite a headache, andI was wondering if anyone had thoughts on an efficient way to do this. A
list of noise words can be found at:
http://beinecke.library.yale.edu/SQLIgnoredWords.html

The part of the dynamic sql search looks like this:
IF @SubjectSearch IS NOT NULL
select @sql = @sql + ' AND CONTAINS(M.Subj ect, @xSubjectSearch )'

Thanks in advance.
-Matt

Nov 20 '05 #3
>We're aware of the risks of dynamic SQL, but unfortunately until SQL Server
2005, we will have to deal with this issue. To do this query statically,
would require (permutation of the varying amount of parameters) queries, in
conditional statements.


Just wanted to rule out the possibility that you didn't know what you
were doing in that regard :-)

--Mary
Nov 20 '05 #4
>We're aware of the risks of dynamic SQL, but unfortunately until SQL Server
2005, we will have to deal with this issue. To do this query statically,
would require (permutation of the varying amount of parameters) queries, in
conditional statements.


Just wanted to rule out the possibility that you didn't know what you
were doing in that regard :-)

--Mary
Nov 20 '05 #5

This thread has been closed and replies have been disabled. Please start a new discussion.

Similar topics

4
11479
by: Rob Wahmann | last post by:
Hello - I'm using the following syntax: WHERE pages.ParentID=0 AND CONTAINS(pages.regionID,'#request.thisRegion#') ....and I get the folowing error: Execution of a full-text operation failed. A clause of the query contained only ignored words. I'm trying to see if a simple column which contains comma delimited numbers
22
3508
by: Phil Powell | last post by:
<script> <!-- function isValidAlert() { for (var i = 0; i < document.alertForm.length; i++) { with (document.alertForm.elements) { if (.name == "text" || .name == "password" || .name == "textarea") { if (.value == "") { alert("Please enter a " + .name); focus();
3
2835
by: john morales | last post by:
Hi guys, I have a problem and i know there must be a solution for this as it is such a basic common practice in asp.net development. Scenario: i have many webforms in a site, most with two different custom controls, one is a login module, the other is a generic data entry module. When there are no validation controls on the page there is no problem. But when the the data entry module has validation controls, the login module triggers...
9
3193
by: Bill Long | last post by:
I have a control that simply displays a list of links. Following one of the links doesn't post back or redirect to another page, it simply hides the current panel and shows the one you selected... So the behavour is similar to a tab control. The user is expected to fill out required data on each of the panels before pressing a submit button which is visible from all panels. Problem I have is validating the data entered by the user. I...
2
1524
by: Jon | last post by:
Hello all. I have a collection class that holds a number of clauses. One particular type of clause has a member variable called type - this is an enum. How do I check this collection class to see if it has a clause of a particular type? I know I'll have to implement a contains (or similar) method, but I'm after code examples.
1
13412
by: djamilabouzid | last post by:
Hi, I have a question about MS SQL Server 2005: I have a table in the database that contains 70 fields. I must perform full-text search in about 60 fields. I use for that the full-text searching "CONTAINS" like that: SELECT ProductName FROM Products
9
19164
by: Emin | last post by:
Dear Experts, I have a fairly simple query in which adding a where clause slows things down by at least a factor of 100. The following is the slow version of the query ------------------------- SELECT * FROM ( Select x.event_date From x FULL OUTER JOIN y ON x.event_date = y.event_date
3
4911
by: garrettm | last post by:
What if you want to search using FTS with AND logic using the FORMSOF(inflectional,...) inside the CONTAINS() clause??? if my search phrase is "light hearted" I can easily do an OR search using the following in my where clause: CONTAINS(Colname,'formsof(INFLECTIONAL,light,hearted). but the and is far more tricky.... does anyone know how to do this without having multiple Contains statements (which greatly increases overhead)? I know...
4
549
by: BeSharp | last post by:
I recently stumbled across a pretty interesting LINQ to SQL question and wonder, whether anybody might have an answer. (I'm doing quite some increasing LINQ evangelism down here in Germany.). Assume I want to select rows from a database and check whether a specific column contains keywords from a list of keywords. The following works just fine: List<stringsearchTerms = new List<string>() { "Maria", "Pedro" };
0
9959
marktang
by: marktang | last post by:
ONU (Optical Network Unit) is one of the key components for providing high-speed Internet services. Its primary function is to act as an endpoint device located at the user's premises. However, people are often confused as to whether an ONU can Work As a Router. In this blog post, we’ll explore What is ONU, What Is Router, ONU & Router’s main usage, and What is the difference between ONU and Router. Let’s take a closer look ! Part I. Meaning of...
0
11176
Oralloy
by: Oralloy | last post by:
Hello folks, I am unable to find appropriate documentation on the type promotion of bit-fields when using the generalised comparison operator "<=>". The problem is that using the GNU compilers, it seems that the internal comparison operator "<=>" tries to promote arguments from unsigned to signed. This is as boiled down as I can make it. Here is my compilation command: g++-12 -std=c++20 -Wnarrowing bit_field.cpp Here is the code in...
0
10772
jinu1996
by: jinu1996 | last post by:
In today's digital age, having a compelling online presence is paramount for businesses aiming to thrive in a competitive landscape. At the heart of this digital strategy lies an intricately woven tapestry of website design and digital marketing. It's not merely about having a website; it's about crafting an immersive digital experience that captivates audiences and drives business growth. The Art of Business Website Design Your website is...
1
10880
by: Hystou | last post by:
Overview: Windows 11 and 10 have less user interface control over operating system update behaviour than previous versions of Windows. In Windows 11 and 10, there is no way to turn off the Windows Update option using the Control Panel or Settings app; it automatically checks for updates and installs any it finds, whether you like it or not. For most users, this new feature is actually very convenient. If you want to control the update process,...
0
10434
tracyyun
by: tracyyun | last post by:
Dear forum friends, With the development of smart home technology, a variety of wireless communication protocols have appeared on the market, such as Zigbee, Z-Wave, Wi-Fi, Bluetooth, etc. Each protocol has its own unique characteristics and advantages, but as a user who is planning to build a smart home system, I am a bit confused by the choice of these technologies. I'm particularly interested in Zigbee because I've heard it does some...
0
9593
agi2029
by: agi2029 | last post by:
Let's talk about the concept of autonomous AI software engineers and no-code agents. These AIs are designed to manage the entire lifecycle of a software development project—planning, coding, testing, and deployment—without human intervention. Imagine an AI that can take a project description, break it down, write the code, debug it, and then launch it, all on its own.... Now, this would greatly impact the work of software developers. The idea...
0
7144
by: conductexam | last post by:
I have .net C# application in which I am extracting data from word file and save it in database particularly. To store word all data as it is I am converting the whole word file firstly in HTML and then checking html paragraph one by one. At the time of converting from word file to html my equations which are in the word document file was convert into image. Globals.ThisAddIn.Application.ActiveDocument.Select();...
0
5812
by: TSSRALBI | last post by:
Hello I'm a network technician in training and I need your help. I am currently learning how to create and manage the different types of VPNs and I have a question about LAN-to-LAN VPNs. The last exercise I practiced was to create a LAN-to-LAN VPN between two Pfsense firewalls, by using IPSEC protocols. I succeeded, with both firewalls in the same network. But I'm wondering if it's possible to do the same thing, with 2 Pfsense firewalls...
0
6012
by: adsilva | last post by:
A Windows Forms form does not have the event Unload, like VB6. What one acts like?

By using Bytes.com and it's services, you agree to our Privacy Policy and Terms of Use.

To disable or enable advertisements and analytics tracking please visit the manage ads & tracking page.