SQL Injection

  • NotManyPoints (2/3/2009)


    Do they just come to this site and their job with their DBA (specifically categorised role) blinkers fully welded into place. Until the shift whistle blows and they sigh relief that they weren't called upon to (back something up, or no, not that 🙁 .... learn something new..)

    Please keep your comments polite and well-mannered. I'm not a moderator here, but personally I think this is starting to stray over the line of 'appropriate'

    Gail Shaw
    Microsoft Certified Master: SQL Server, MVP, M.Sc (Comp Sci)
    SQL In The Wild: Discussions on DB performance with occasional diversions into recoverability

    We walk in the dark places no others will enter
    We stand on the bridge and no one may pass
  • Taken out of centext of the rest or the thread and the post…. Yes.

    But what I'm saying is nothing which is not said here:

    http://qa.sqlservercentral.com/Forums/Topic604325-61-1.aspx

    If the question had been about not understanding something which had been explained or read it would not have been so bad. But it was just so…. (I’ll just not even bother to say)

    Probably not for this forum (you tell me), but something which interests me is how people have made use of Google to punish 100’000’s of websites with mass SQL injection, with very targeted injection hits.

    Anyway I will stop on my offensive.

  • Well, there is a difference. This site is really just the "water cooler". It provides a place for venting, in an appropriate manner (no foul language), and if you have taken the time to read all of it, you'd also find it has gone off on munerous tangents unrelated to its original post, though at times moves back.

  • It would also be nice if Paresh Prajapati would post back as well. I'd be curious to see if he has learned anything valuable from this post?

  • Now who's being rude. I've read every word, I've read the first post a few times to see if I was being harsh. But NO, still feel the same way.

    I was going to ask does anyone want to move this thread elsewhere as I was unsure about being offended by this:

    By the way, Are you a dba?

    Or if it was a worthy question/thread ‘are you a dba?’

    Then I had to laugh at this http://qa.sqlservercentral.com/articles/Miscellaneous/howdoyouspellsql/2020/

    Then to see what a dba is:

    http://qa.sqlservercentral.com/articles/Miscellaneous/2744/

    Yep I have to contend with all that.

    And as far back as 2001 dba's (in the classic sense) were being warned to keep up and role with the times.

    http://qa.sqlservercentral.com/articles/State+of+the+Business/deathoftheproductiondba/432/

    http://qa.sqlservercentral.com/articles/Administering/dbaroles/517/

    (but dba is not my job title)

    Also can anyone spot the link about my general feelings towards very blinkered job roles/titles and the avatar.

    And to whoever moved this towards SQLCLR not quite the same as something which has been written about and explained to death like SQL injection.

    What is SQLCLR (joke)

  • And to whoever moved this towards SQLCLR not quite the same as something which has been written about and explained to death like SQL injection.

    Actually, you did when your comments went back to basically saying a DBA needs to know something about everything in SQL Server.

    Our contention is NOT. If you work in an environment where SQL Injection is not a concern, you may not know anything about it, but you seem to think that this person, therefore, has no business being a DBA. Your own thoughts paraphrased.

    So, with that same logic, if you know nothing about SQLCLR, you have no business being a DBA. Well, guess I should not be a DBA then, as the only knowledge I have about SQLCLR is that it is there. I have never used it (though I would like to learn it), and may never get the opportunity where I work unless we find a need for using it (not likely at this time).

  • Oh, I may as well extend that I shouldn't be a DBA because I have no knowledge regarding replication. Yes, I set it up once years and years ago as an exercise, but I have never had to deal with it in a production or development environment. I know it exists, but that's about it. I would definately have a lot to learn if that changes.

  • Lynn Pettis (2/4/2009)


    Oh, I may as well extend that I shouldn't be a DBA because I have no knowledge regarding replication. Yes, I set it up once years and years ago as an exercise, but I have never had to deal with it in a production or development environment. I know it exists, but that's about it. I would definately have a lot to learn if that changes.

    After working with SQL Server for 9 years I have finally had to learn replication in a full on production environment. I would have put it on my resume in the past but had never really supported a large implementation of it. Now that I have, I can clearly say that I knew nothing about it and therefore I too Lynn am not a qualified DBA.

    Glad to be in your ranks!

    David

    @SQLTentmaker

    “He is no fool who gives what he cannot keep to gain that which he cannot lose” - Jim Elliot

  • Thankyou for paraphrasing my own thoughts, don't know what I would have done.

    I have not said a DBA should know everything (to the point of being proficient in every aspect) about SQL, but have an 'awareness'. :w00t:

    Simply getting the daily newsletters from this site helps.

    Every few days I look back over the current articles to see what is happening. Maybe I won’t immediately make use of something but that piece of info is their ready to be unleashed when needed.

    the only knowledge I have about SQLCLR is that it is there.

    'awareness'

    Repeat above and replace with posts about replication experience.

    So you don’t fall into any of this

    a) no idea about the particular topic of SQL injection (particularly this topic, as its so widely written about -which is not the same as acted upon before anyone comments on)

    b) no idea where to find information (not just post run).

    c) been using this website for more than a few weeks (which has covered the topic in many ways) and still has no idea.

    DBA: whatever that is these days, still no comments on my request to move this discussion. If there is anything more to say.

  • Lynn Pettis (2/4/2009)


    Well, guess I should not be a DBA then, as the only knowledge I have about SQLCLR is that it is there.

    Likewise, same with log shipping, and clustering, replication, SQL Agent, xml and several other areas.

    But then, I'm not a DBA

    Gail Shaw
    Microsoft Certified Master: SQL Server, MVP, M.Sc (Comp Sci)
    SQL In The Wild: Discussions on DB performance with occasional diversions into recoverability

    We walk in the dark places no others will enter
    We stand on the bridge and no one may pass
  • NotManyPoints (2/4/2009)


    Thankyou for paraphrasing my own thoughts, don't know what I would have done.

    I have not said a DBA should know everything (to the point of being proficient in every aspect) about SQL, but have an 'awareness'. :w00t:

    Simply getting the daily newsletters from this site helps.

    Every few days I look back over the current articles to see what is happening. Maybe I won’t immediately make use of something but that piece of info is their ready to be unleashed when needed.

    the only knowledge I have about SQLCLR is that it is there.

    'awareness'

    Repeat above and replace with posts about replication experience.

    So you don’t fall into any of this

    a) no idea about the particular topic of SQL injection (particularly this topic, as its so widely written about -which is not the same as acted upon before anyone comments on)

    b) no idea where to find information (not just post run).

    c) been using this website for more than a few weeks (which has covered the topic in many ways) and still has no idea.

    DBA: whatever that is these days, still no comments on my request to move this discussion. If there is anything more to say.

    I still don't buy your argument. I worked with with SQL Server for over 6 years before I even heard about SQL Injection. Does that mean for the first 6 years I wasn't a DBA? NOT.

  • NotManyPoints (2/4/2009)


    I have not said a DBA should know everything (to the point of being proficient in every aspect) about SQL, but have an 'awareness'. :w00t:

    So do you have an 'awareness' of every single aspect of SQL Server?

    I know I don't. I keep running across concepts that I'd never heard of before. Sometimes I'll investigate, sometimes I won't

    Gail Shaw
    Microsoft Certified Master: SQL Server, MVP, M.Sc (Comp Sci)
    SQL In The Wild: Discussions on DB performance with occasional diversions into recoverability

    We walk in the dark places no others will enter
    We stand on the bridge and no one may pass
  • Ok right, so we are staying here then.

    So I'm interested, for the first 6 years (can you give a rough time frame) so we can put that into context what were you duties which lead to the job title 'dba'.

    How did you keep up with current issues, information etc.

  • Oh, about moving this discussion elsewhere, why? This is the perfect thread to have this discussion.

    I'd still like to see if the OP has learned anything from this thread. I'd also like to assure him that we aren't impuning his skills or knowledge. There is NO such thing as a stupid question, except the one left unasked.

  • NotManyPoints (2/4/2009)


    Ok right, so we are staying here then.

    So I'm interested, for the first 6 years (can you give a rough time frame) so we can put that into context what were you duties which lead to the job title 'dba'.

    How did you keep up with current issues, information etc.

    Not really material to my being a DBA, but I built our SQL Server systems from the ground up at my last employer. Everything I learned initially was from learning OJT, trial and error. We had no Microsoft SQL Server expertise in our organization and I didn't even know about this site untill 2004. I didn't start getting SQL Server Magazine until 2005 (or there about).

Viewing 15 posts - 46 through 60 (of 121 total)

You must be logged in to reply to this topic. Login to reply