SQL Server - General

SQL Injection Attacks

Tara Kizer — Thu, 05 Jun 2008 21:33:47 GMT

There's a lot of information out there on how to avoid SQL injection attacks, but I wanted to point you to this blog due to the recent increase in such attacks.

Thank you, Buck Woody, for bringing this to our (SQL Server MVPs) attention.

Data Types of Parameters and Execution Plans

Tara Kizer — Fri, 16 Nov 2007 19:56:14 GMT

In a previous blog, I mentioned a performance problem that I've been working on for a few weeks. I can finally say that this issue has been resolved. The problem was that the database server (SQL Server 2005) was running at 95%-100% CPU utilization at all times.

Here is the query that was causing our problem (object names have been changed):

SELECT Table1Id
FROM Table1
WHERE Unit = ?

We were receiving a bad execution plan for this query due to nvarchar being used for the Unit parameter. The Unit column is defined as varchar(50) in the table. See the below demonstration for the table structure including constraints and indexes.

The application is written in Java and uses the JDBC driver for SQL Server from Inet software. The application does not specify the data types of the parameters in their queries and relies on the driver to do that for them. It turns out that the driver is choosing nvarchar(4000) for the Unit parameter. Once the application was modified to convert the parameter to varchar, CPU utilization dropped to below 5%.

Here is what the above query was changed to in the application:

SELECT Table1Id
FROM Table1
WHERE Unit = cast(? AS VARCHAR)

I am able to duplicate the issue with pure T-SQL. Please see below for a demonstration of the problem.

Setup the environment:

SET NOCOUNT ON 

CREATE TABLE Table1
(
    Table1Id int IDENTITY(1, 1) NOT NULL,
    Unit varchar(50) COLLATE SQL_Latin1_General_CP1_CI_AS NOT NULL,
    CONSTRAINT PK_Table1 PRIMARY KEY NONCLUSTERED (Table1Id),
    CONSTRAINT uniq_Unit UNIQUE CLUSTERED (Unit)
)

INSERT INTO Table1 (Unit) 
SELECT TOP 1000000 REPLACE(NEWID(), '-', '')
FROM SomeLargeTable

INSERT INTO Table1 (Unit) VALUES('abcdefghijklmnopqrstuvwxyz')

CREATE STATISTICS Stats1 ON Table1 (Table1Id) WITH FULLSCAN
CREATE STATISTICS Stats2 ON Table1 (Unit) WITH FULLSCAN

Turn on the option in SQL Server Management Studio to include the actual execution plan by hitting Ctrl+M or by selecting "Include Actual Execution Plan" in the Query menu.

Bad execution plan:

DECLARE @Unit1 nvarchar(50)
SET @Unit1 = 'abcdefghijklmnopqrstuvwxyz'

SELECT Table1Id
FROM Table1
WHERE Unit = @Unit1

Good execution plan:

DECLARE @Unit2 varchar(50)

SET @Unit2 = 'abcdefghijklmnopqrstuvwxyz'

SELECT Table1Id
FROM Table1
WHERE Unit = @Unit2

Here are the two execution plans together, ran as a batch to show cost (nvarchar/bad one is first):

Notice how the query that used nvarchar for the parameter costs 100% in the batch.

Cleanup the environment:

DROP TABLE Table1

This issue would have been avoided if the application used stored procedures or if it wasn't left up to the driver to determine what data type to use for the parameter.

Note: This occurs on the SQL collations only and not the Windows ones. Thanks Mladen for testing that out.

Microsoft MVP Award

Tara Kizer — Mon, 02 Jul 2007 16:46:10 GMT

I'm proud to announce that I have received the Microsoft MVP Award for my contributions to the SQL Server community.

I'd like to thank Ben Miller from Microsoft for the nomination. Thanks Ben!

SQL Server "Katmai"

Tara Kizer — Thu, 10 May 2007 23:18:26 GMT

Microsoft announced yesterday that the new version of SQL Server, code-named "Katmai", will be delivered in 2008.

Check this out for information on "Katmai".

32-bit/64-bit aliases

Tara Kizer — Tue, 10 Apr 2007 17:23:33 GMT

We don't use the default port for SQL Server for security reasons, so we usually have to explicitly tell the client how to connect to SQL Server by creating an alias on the client machine.

There are many ways to create an alias on a client machine. My favorite is via the registry as it allows me to save the values to a reg file so that we can quickly deploy them to other client machines.

Here is the location of these aliases:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSSQLServer\Client\ConnectTo

Yesterday I was configuring transactional replication between two databases on different servers. The servers are on different networks and are separated by at least one firewall. I first tried connecting to the subscriber by running Management Studio on the publisher. As expected, I wasn't able to connect successfully using ServerName\InstanceName. I then tried using this in Management Studio: ServerName.DomainName.com,PortNumber. This worked, however replication requires you to use the actual SQL Server name (ServerName\InstanceName).

I then added the following alias to the previously mentioned key:
String value: ServerName\InstanceName
Data: DBMSSOCN,ServerName.DomainName.com,PortNumber

I was unable to connect using this alias. This should be no different that using ServerName.DomainName.com,PortNumber. After scratching my head for a while, I finally figured out what the problem was.

The publisher server is a 64-bit machine. When you are using 32-bit applications on a 64-bit machine, it uses the Wow6432Node key in the registry to present a separate view of HKEY_LOCAL_MACHINE\SOFTWARE.

Once I added the alias to the following key, I was able to connect successfully to the subscriber using Management Studio:
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\MSSQLServer\Client\ConnectTo

Check this out for more details on Wow6432Node.

Note: SQL Server Configuration Manager allows you to create both 32-bit and 64-bit aliases when the client is 64-bit. I hadn't noticed this until after I found Wow6432Node in the registry.

SQL Server 2005 - Best Practices

Tara Kizer — Wed, 13 Dec 2006 21:06:31 GMT

Check out this article for white papers, scripts, and tools on SQL Server 2005 best practices.

Management Studio slowness

Tara Kizer — Thu, 05 Oct 2006 17:47:20 GMT

We've been having performance problems on a new 64-bit SQL Server 2005 cluster in our test environment. We opened a ticket with Microsoft to assist us with this.

After modifying several things, the only thing that was slow was Management Studio. On both nodes of this cluster, it would take about 3-5 minutes to load Management Studio. The first MS engineer suggested that we add the nosplash switch to the Management Studio shortcut, like this:

This did not increase performance at all on either node. The second MS engineer suggested that we uncheck two options in Internet Explorer's Advanced Security settings. The two options are "Check for publisher's certificate revocation" and "Check for server certificate revocation".

After restarting both nodes in the cluster, Management Studio took about 15 seconds to load the first time and 1-2 seconds for each subsequent load!

So if you are experiencing similar Management Studio slowness, I'd suggest trying these out.

Generating SQL Scripts in SQL Server 2005

Tara Kizer — Wed, 20 Sep 2006 23:47:13 GMT

In SQL Server 2000, you could generate a SQL script easily using the Generate SQL Script wizard. You could get to it from pretty much anywhere from within Enterprise Manager. For instance, you can get to it by right clicking on any object in the database, then selecting All Tasks, and then selecting Generate SQL Script.

In SQL Server 2005, it is now called Generate Scripts. The only place that I can find where you can get to it is if you right click on the database, then selecting Tasks, and then selecting Generate Scripts. The 2005 wizard does not resemble the 2000 wizard, so you have to use it a few times before you are comfortable with it.

The most annoying thing with the new 2005 scripting wizard is that you can not generate both CREATE and DROP statements together like you could in the 2000 scripting wizard. When you select the Script Behavior field, it indicates that this is possible. However, it is not! Check this out:

Notice in the description that it says you can do either CREATE, DROP, or DROP followed by CREATE. However, when you look at the dropdown options, only DROP or CREATE is available.

I am running SQL Server 2005 service pack 1 already. Let's hope they fix this in the next service pack.

Commenting Blocks of Code in SQL Server 2005

Tara Kizer — Wed, 13 Sep 2006 23:57:00 GMT

In Query Analyzer, we could easily comment blocks of code using Ctrl+Shift+C and uncomment blocks of code using Ctrl+Shift+R.

These keyboard shortcuts do not work in Management Studio unless you switch the keyboard scheme to SQL Server 2000.

In Management Studio, you can comment blocks of code using Ctrl+K, Ctrl+C and uncomment blocks of code using Ctrl+K, Ctrl+U. These are the same keyboard shortcuts that you would use to comment blocks of code in Visual Studio .NET, so I'm sure that's why Microsoft decided to switch the shortcuts.

To see other keyboard shortcuts for T-SQL code in Management Studio, open a query window by clicking the New Query button. Click on the Edit menu then Advanced. You must be in a query window for the Advanced item to appear in the Edit menu.

Red Gate Software

Tara Kizer — Tue, 20 Jun 2006 23:02:00 GMT

Last week, I received a new laptop. For the past few days, I've been installing all of the applications that I need. Today, I decided to tackle Red Gate's SQL Compare. On my old laptop, I was running version 3. I hadn't kept a copy of the installation, so I went to their site to see if I could download it. I couldn't find version 3, so I decided to download the new version to see if my serial number would work as I wasn't sure if we had renewed our support contract. My serial number didn't work in version 5. I e-mailed them to find out if I could get version 3 anywhere. I had a response within 25 minutes! They sent me the link to download version 3 on their ftp site.

I was amazed at how fast they replied to my e-mail and that they helped me out even though we did not have a current support contract. I have always recommended their products in the past, now I can attest to their excellent customer support.