Posts

Showing posts with the label stored-procedures

Azure SQL DB causing connection time out for stored procedures

Azure SQL DB causing connection time out for stored procedures We have hosted our database in Azure and are running stored procedures on this DB. The stored procedures had been running fine till last week but suddenly started giving error connection timeout. Our database size is 14 GB and the stored procedures in general return 2k to 20k records and we are using the S3 pricing tier (50 DTU) of Azure DB. What I found interesting was the first time the stored procedure is executed, it takes a lot of time 2 - 3 mins and this is causing the timeout. The later executions are fast (maybe it caches the execution plan). Also when I run on the same DB with the same number of records on a machine with the config of 8gb ram, Win10 it runs in 15 seconds . This is my stored procedure: CREATE PROCEDURE [dbo].[PRSP] @CompanyID INT, @fromDate DATETIME, @toDate DATETIME, @ListMailboxId as MailboxIds Readonly, @ListConversationType as ConversationTypes Readonly AS BEGIN ...

MySQL dynamic where clause with security focus

MySQL dynamic where clause with security focus I want to make a fully dynamic where clause as viewset. The where clause is fully implemented by the user and stored in a table. To get this working is easy but if have alook at security with this solution it's a big problem. This should be implemented as a stored procedure I have 2 tables: Table: Viewset (where clause stored): ID | Viewset<br> 1 | (a > 5) OR REGEX(...) etc. And a datatable. In the stored procedure it's working like this: This is ofc, fully vulnerable for SQL injections etc. Now I want to get this secure. I had 2 ideas. First: Just try to get any possible 'AND' and 'OR' connection and using a prepared statement at the end => Problem: I have around 100 possible combinations. Second idea: where clause through a whitelist of words and the values through prepared statements. Problem again: MySQL doesn't allow arrays and string splits etc. that makes this very hard to implement. Maybe th...