Coldfusion, MS SQL, Hash Best Practices,...

Hello,
I am trying trying to store hashed data (user password) in an
ms sql database; the datatype in the database is set to varbinary.
I get a datatype conflict when trying to insert the hashed data. It
works when the datatype in the database is set to varchar.
I understand that you can set your hash function with
arguments that will convert the data before sending to the
database, but I am not clear on how this is done. Now, along with
any assistance with the conversion, what exactly is the best
practice for storing the hash data? Should I store as varcahar or
varbinary? Of course, if varchar I won't have the problem, but I am
interested in best practices as well.
Thnx

brwright,
I suggest parameterizing your queries to add protecting from
injection.
http://livedocs.adobe.com/coldfusion/6.1/htmldocs/tags-b20.htm
hashing is best suited for passwords because the encryption
is one way, once encrypted using hash() it can't be decrypted.
Other fields that you might want to encrypt and still have the
ability to decrypt, you can use the encrypt() and decrypt()
functions.
http://livedocs.adobe.com/coldfusion/6.1/htmldocs/functi75.htm
I think there are also new encryption functions available in
coldfusion 8...

Similar Messages

SQL server Best Practice Analyzer output in .CSV

Hi Team, I ran SQL server Best practice analyzer on our SQL 2008 R2 server. I was trying to export scan result in .csv format but it is only giving me option to save it in .xml format. I have been looking for ways to export output in such a way
that it can be readable and I can send it to our clients but no luck.
How can I export SQL BPA output in .csv or any other user friendly format?
Thanks in Advance.

Hi MSRS27,
You can run Best Practices Analyzer (BPA) scans either from Server Manager, by using the BPA GUI, or by using cmdlets in Windows PowerShell. We can view or save BPA results from Windows PowerShell session in different format.
If you want to export BPA results to a comma-separated values (CSV) text file, run the following cmdlet, where Path represents the path and text file name to which you want to save the CSV results.
CSV results can be imported into Microsoft® Excel, or other programs that display data in spreadsheets or grids.
Get-BPAResultModel ID| Export-CSVPath
For more information, see: Run Best Practices Analyzer Scans and Manage Scan Results
http://technet.microsoft.com/en-us/library/hh831400.aspx
Regards,
Sofiya Li
Sofiya Li
TechNet Community Support

Sql backup best practice on vms that are backed up as a complete vm

hi,
apologies as i am sure this has been asked many times before but i cant really find an answer to my question. so my situation is this. I have two types of backups; agent based and snap based backups.
For the vm's that are being backed up by snapshots the process is: vmware does the snap, then the san takes a snap of the storage and then the backup is taken from the san. we then have full vm backups.
For the agent based backups, these are only backing up file level stuff. so we use this for our sql cluster and some other servers. these are not snaps/full vm backups, but simply backups of databases and files etc.
this works well, but there are a couple of servers that need to be in the full vm snap category and therefore cant have the backup agent installed on that vm as it is already being backed up by the snap technology. so what would be the best practice on these
snapped vms that have sql installed as well? should i configure a reoccurring backup in sql management studio (if this is possible??) which is done before the vm snap backup? or is there another way i should be backing up the dbs?
any suggestions would be very welcome.
thanks
aaron

Hello Aaron,
If I understand correctly, you perform a snapshot backup of the complete VM.
In that case you also need to create a SQL Server backup schedule to perform Full and Transaction Log backups.
(if you do a filelevel backup of the .mdf and .ldf files with an agent you also need to do this)
I would run a database backup before the VM snapshot (to a SAN location if possible), then perform the Snapshot backup.
You should set up the transaction log backups depending on business recovery needs.
For instance: if your company accepts a maximum of 30 minutes data loss make sure to perform a transaction log backup every 30 minutes.
In case of emergency you could revert to the VM Snapshot, restore the full database backup and restore transaction log backups till the point in time you need.

SAP Business One 2007 - SQL Security best practice

I have a client with a large user base running SAP Business One 2007.
We are concerned over the use of the sql sa user and the ability to change the password of this ID from the logon of SAP Business One.
We therefore want to move to use Windows Authentication (ie Trusted Connection) from the SAP BO logon. It appears however that this can only work by granting the window IDs (of the SAP users) sysadmin access in SQL.
Does anyone have a better method of securing SAP Business One or is there a recommended best practice. Any help would be appreciated.
Damian

See Administrators Guide for best practise.
U can use SQL Authentication mode Don't tick Remember password.
Also check this thread
SQL Authentication Mode
Edited by: Jeyakanthan A on Aug 28, 2009 3:57 PM

SQL Server Best Practices Architecture UCS and FAS3270

Hey thereWe are moving from EMC SAN and physical servers to NetApp fas3270 and virtual environment on Cisco UCS B200 M3.Traditionally - Best Practices for SQL Server Datbases are to separate the following files on spearate LUN's and/or VolumesDatabase Data filesTransaction Log filesTempDB Data filesAlso I have seen additional separations for...
System Data files (Master, Model, MSDB, Distribution, Resource DB etc...)IndexesDepending on the size of the database and I/O requirements you can add multiple files for databases. The goal is provide optimal performance. The method of choice is to separate Reads & Writes, (Random and Sequential activities)If you have 30 Disks, is it better to separate them? Or is better to leave the files in one continous pool? 12 Drives RAID 10 (Data files)10 Drives RAID 10 (Log files)8 Drives RAID 10 (TempDB)Please don't get too caught up on the numbers used in the example, but place focus on whether or not (using FAS3270) it is better practice to spearate or consolidate drives/volumes for SQL Server DatabasesThanks!

Hi Michael,It's a completely different world with NetApp! As a rule of thumb, you don't need separate spindles for different workloads (like SQL databases & logs) - you just put them into separate flexible volumes, which can share the same aggregate (i.e. a grouping of physical disks).For more detailed info about SQL on NetApp have a look at this doc:http://www.netapp.com/us/system/pdf-reader.aspx?pdfuri=tcm:10-61005-16&m=tr-4003.pdfRegards,Radek

PL/SQL Design: Best Practice

Hello everybody,
I'm trying to improve myself acquiring compentence in PL/SQL design. At now I am (or I wish to be) a good practitioner but I have to complain myself for lackings in designing architecture.
I mean, for example, how to organize procedure and functions in a package, how to use pattern architecture, logging and testing practices...
Do you know where I can find resources for these arguments? Which books do you suggest to start with?
Thank you very much.
Nicola

The best practices are the very same fundamentals that apply to all other languages and have existed for since the dawn of programming.
The single biggest fundamental principle is to modularise your design and code. A well designed program consists of building blocks. Different languages have different names for these - procedures, functions, units, packages, methods, routines, etc.
A program lives or dies by how well it is modularised.
If you only get that right, you can claim to be a Programmer and not a mere two bit developer.

SQL 2012 Best Practice Analyzer issue with nothing available in pulldown on Microsoft Baseline Configuration Analyzer V2.0

We have tried using both a Windows 7 and a Windows 8 machine and still cannot see any items available in the pulldown (ie. no sql 2012 or anything) Is this a known issue and BPA does not work for SQL 2012? Any suggestions? I've seen several
posts with the same issue but, no resolution.
Laura

Hi Laura,
I installed Microsoft Baseline Configuration Analyzer 2.0 successfully. I can select a product: SQL Server 2012 BPA. Do you mean this?
Thanks.
If you have any feedback on our support, please click
here.
Maggie Luo
TechNet Community Support

Sql connection best practices

Can someone discuss the pros and cons of setting your db connection in the web.xml and then using the following in a jsp;
<sql:query var="myQuery">
SELECT * FROM mytable
</sql:query>I find that it is quick and easy, but would I want to give this kind of code to my supervisor? From 20,000 ft up. :)
Edited by: Reme on Aug 2, 2008 5:12 AM

[http://java.sun.com/javaee/5/docs/tutorial/doc/bnald.html]
The JSTL SQL tags for accessing databases listed in Table 7-7 are designed for quick prototyping and simple applications. For production applications, database operations are normally encapsulated in JavaBeans components.I wouldn't use it. Layer your application properly. Make use of a DAO class.

JDBC / SQL Update Best Practice

My application updates a database table whenever a user modifies their profile.
I have two questions on this...
1. I've chosen to use PreparedStatements purely because it means I don't have to worry about special characters (e.g. '%"? in my data), and not because I re-use the statements. Is this a respected approach?
2. Is it worth dynamcially building the update SQL and adding paramaters because in most cases only a subset of the possible fields will be modified? (e.g. avoid setting col1="test" if col1 already equals "test"). Is there an acknowledged pattern / algorithm / library that does this?
Thanks,
Steve

My application updates a database table whenever a
user modifies their profile.
I have two questions on this...
1. I've chosen to use PreparedStatements purely
because it means I don't have to worry about special
characters (e.g. '%"? in my data), and not because I
re-use the statements. Is this a respected approach?Yes.
>
2. Is it worth dynamcially building the update SQL
and adding paramaters because in most cases only a
subset of the possible fields will be modified? Probably not. The only time this is going to matter is if there is a significantly sized field (like a blob) that often does not get updated. In that case you would probably want to exclude that.
(e.g. avoid setting col1="test" if col1 already equals
"test"). Is there an acknowledged pattern / algorithm
/ library that does this?Officially not as far as I know.
There are several patterns that I have used.
1. A modified flag for each field. If the set method is called then the flag is set to true.
2. A modified flag for each field. If the set method is called then the new value is compared to the old and the flag is set depending on the outcome.
3. The database layer holds (or retrieves) the previous data. It compares the two, noting the fields that have changed.
In the above note that primary keys must be dealt with. Usually the primary key is either set or not set. If not set then it is a new record. If set then it is an update.

Best Practice to fetch SQL Server data and Insert into Oracle Tables

Hello,
I want to read sqlserver data everry half an hour and write into oracle tables ( in two different databases). What is the best practice for doing this?
We do not have any database dblinks from oracle to sqlserver and vice versa.
Any help is highly appreciable?
Thanks

Well, that's easy:
use a TimerTask to do the following every half an hour:
- open a connection to sql server
- open two connections to the oracle databases
- for each row you read from the sql server, do the inserts into the oracle databases
- commit
- close all connections

Best practice to define length for varchar field of table in sql server

What is best practice to define length for a varchar field in table
where field suppose Remarks By Person varchar(max) or varchar(4000)
Could it affect on optimization in future????
experts Reply Must ...
Dilip Patil..

Hi Dilip,
Varchar(n/max) is a variable-length, non-unicode character data. N defines the string length and can be a value from 1 through 8,000. Max indicates that the maximum storage size is 2^31-1 bytes (2 GB). The storage size is the actual length of the data entered
+ 2 bytes. We always use varchar when the sizes of the column data entries vary considerably. While if the filed data size might exceed 8,000 bytes in some way, we should use varchar(max).
So the conclusion is just like Uri said, use varchar(max) or varchar(4000) is depends on how much characters we are going to store.
The following document about varchar in SQL Server is for your reference:
http://technet.microsoft.com/en-us/library/ms176089.aspx
Thanks,
Katherine Xiong
Katherine Xiong
TechNet Community Support

SQL Server 2012 Infrastructure Best Practice

Hi,
I would welcome some pointers (direct advice or pointers to good web sites) on setting up a hosted infrastructure for SQL Server 2012. I am limited to using VMs on a hosted site. I currently have a single 2012 instance with DB, SSIS, SSAS on the same server.
I currently RDP onto another server which holds the BI Tools (VS2012, SSMS, TFS etc), and from here I can create projects and connect to SQL Server.
Up to now, I have been heavily restricted by the (shared tenancy) host environment due to security issues, and have had to use various local accounts on each server. I need to put forward a preferred environment that we can strive towards, which is relatively
scalable and allows me to separate Dev/Test/Live operations and utilise Windows Authentication throughout.
Any help in creating a straw man would be appreciated.
Some of the things I have been thinking through are:
1. Separate server for Live Database, and another server for Dev/Test databases
2. Separate server for SSIS (for all 3 environments)
3. Separate server for SSAS (not currently using cubes, but this is a future requirement. Perhaps do not need dedicated server?)
4. Separate server for Development (holding VS2012, TFS2012,SSMS etc). Is it worth having local SQL Server DB on this machine. I was unsure where SQL Server Agent Jobs are best run from i.e. from Live Db only, from another SQL Server Instance, or to
utilise SQL ServerAgent on all (Live, Test and Dev) SQL Server DB instances. Running from one place would allow me to have everything executable from one place, with centralised package reporting etc. I would also benefit from some license cost
reductions (Kingsway tools)
5. Separate server to hold SSRS, Tableau Server and SharePoint?
6. Separate Terminal Server or integrated onto Development Server?
7. I need server to hold file (import and extract) folders for use by SSIS packages which will be accessible by different users
I know (and apologise that) I have given little info about the requirement. I have an opportunity to put forward my requirement for x months into the future, and there is a mass of info out there which is not distilled in a way I can utilise. It would
be helpful to know what I should aim for, in terms of separate servers for the different services and/or environments (Live/Test/Live), and specifically best practice for where SQL Server Agent jobs should be run from , and perhaps a little info on how to
best control deployment/change control . (Note my main interest is not in application development, it is in setting up packages to load/refresh data marts fro reporting purposes).
Many thanks,
Ken

Hello,
On all cases, consider that having a separate server may increase licensing or hosting costs.
Please allow to recommend you Windows Azure for cloud services.
Answers.
This is always a best practice.
Having SSIS on a separate server allows you isolate import/export packages, but may increase network traffic between servers. I don’t know if your provider charges
money for incoming traffic or outgoing traffic.
SSAS on a separate server certainly a best practice too.
It contributes to better performance and scalability.
SQL Server Developer Edition cost about $50 dollars only. Are you talking about centralizing job scheduling on an on-premises computer than having jobs enable on a
cloud service? Consider PowerShell to automate tasks.
If you will use Reporting Services on SharePoint integrated mode you should install Reporting Services on the same server where SharePoint is located.
SQL Server can coexist with Terminal Services with the exception of clustered environments.
SSIS packages may be competing with users for accessing to files. Maybe copying them to a disk resource available for the SSIS server may be a better solution.
A few more things to consider:
Performance storage subsystem on the cloud service.
How Many cores? How much RAM?
Creating a Domain Controller or using active directory services.
These resources may be useful.
http://www.iis.net/learn/web-hosting/configuring-servers-in-the-windows-web-platform/sql-2008-for-hosters
http://azure.microsoft.com/blog/2013/02/14/choosing-between-sql-server-in-windows-azure-vm-windows-azure-sql-database/
Hope this helps.
Regards,
Alberto Morillo
SQLCoffee.com

Best practice for saving data in SQL server

Hi all
Hoping for a little help on this question.
If i have a list of fields ex. (name,address,postal,phone etc.). Then i create a webform/task
to gather some of theese fields (name, postal), then i make another webform/task to gather some other fields (address, phone).
What is best practice in the SQL server for storing returning values.
Is it:
1. to make a table with all the fields in the list + taskid. Theese fields could be in
correct format (number, date etc.). And all answers to all tasks is inserted into this table.
2. Make a value table for each field with the correct type + task id. So all name values
are stored in the "name value table" with the task id.
How would i select values from a certain task from this kind of setup?
3. ??
Best regards
Bo

Hi Atul
Thanks for your reply, can you elaborate a bit further on this, since i am still a little confused.
Let me try to explain my scenario at bit more:
Say instead that it is 50 fields in a table with their own unique ID, maybe an answer table
would look like this:
taskid | field_1 | field_2 | field_3 | field 4 | field_n
So no matter which fields the user fillsout it will can be stored in one table.
QUestion is, is this a good way to do it? and how do i select from this table using a join
As far as i know you cant name columns in a table with just numbers, which would have been
great, giving the columnnames the field_id.
OR
Would you have 50 tables each with a field_id and a value (of correct type) ?
And could you give me an example of how to bind and select from this kind of structure ?
Also inserting into 50 tables on a save.... is that the right way to go? :)
Best regards
Bo

License type of SQL Server 2005 Best Practices Analyzer

Hi everybody.
I need to install in my organization the software "SQL Server 2005 Best Practices Analyzer" but I need to know if this application it's free licensing. I have seen on several web sites about this tool it's free but not in official microsoft
web page. So, where can I find the official microsoft information about the type of licensing of "SQL Server 2005 Best Practices Analyzer" ?
Thanks of your support

Hello Erland.
I followed your advice and I have read the terms of use of this software. I stop at point 3 (which I highlighted). Based on this point, I doubt it is about using this application. Furthermore nowhere says that this software is free to use.
Would appreciate if someone can clarify this to me.
=============================================================
MICROSOFT SOFTWARE LICENSE TERMS
MICROSOFT SQL SERVER 2005 BEST PRACTICES ANALYZER:
These license terms are an agreement between Microsoft Corporation (or based on where you live, one of its affiliates) and you.
Please read them. They apply to the software named above, which includes the media on which you received it, if any.
The terms also apply to any Microsoft
* updates,
* supplements,
* Internet-based services, and
* support services
for this software, unless other terms accompany those items.
If so, those terms apply.
BY USING THE SOFTWARE, YOU ACCEPT THESE TERMS.
IF YOU DO NOT ACCEPT THEM, DO NOT USE THE SOFTWARE.
If you comply with these license terms, you have the rights below.
1.
INSTALLATION AND USE RIGHTS. You may install and use any number of copies of the software on your devices.
2.
INTERNET-BASED SERVICES. Microsoft provides Internet-based services with the software.
It may change or cancel them at any time.
3.
SCOPE OF LICENSE. The software is licensed, not sold. This agreement only gives you some rights to use the software.
Microsoft reserves all other rights.
Unless applicable law gives you more rights despite this limitation, you may use the software only as expressly permitted in this agreement.
In doing so, you must comply with any technical limitations in the software that only allow you to use it in certain ways.
You may not
* work around any technical limitations in the software;
* reverse engineer, decompile or disassemble the software, except and only to the extent that applicable law expressly permits, despite this limitation;
* make more copies of the software than specified in this agreement or allowed by applicable law, despite this limitation;
* publish the software for others to copy;
* rent, lease or lend the software;
* transfer the software or this agreement to any third party; or
* use the software for commercial software hosting services.
4.
BACKUP COPY. You may make one backup copy of the software.
You may use it only to reinstall the software.
5.
DOCUMENTATION. Any person that has valid access to your computer or internal network may copy and use the documentation for your internal, reference purposes.
6.
EXPORT RESTRICTIONS. The software is subject to United States export laws and regulations.
You must comply with all domestic and international export laws and regulations that apply to the software.
These laws include restrictions on destinations, end users and end use.
For additional information, see www.microsoft.com/exporting.
7.
SUPPORT SERVICES. Because this software is "as is," we may not provide support services for it.
8.
ENTIRE AGREEMENT. This agreement, and the terms for supplements, updates, Internet-based services and support services that you use, are the entire agreement for the software and support services.
9.
APPLICABLE LAW.
a. United States. If you acquired the software in the United States, Washington state law governs the interpretation of this agreement and applies to claims for breach of it, regardless of conflict of laws principles.
The laws of the state where you live govern all other claims, including claims under state consumer protection laws, unfair competition laws, and in tort.
b. Outside the United States. If you acquired the software in any other country, the laws of that country apply.
10.
LEGAL EFFECT. This agreement describes certain legal rights.
You may have other rights under the laws of your country.
You may also have rights with respect to the party from whom you acquired the software.
This agreement does not change your rights under the laws of your country if the laws of your country do not permit it to do so.
11.
DISCLAIMER OF WARRANTY. THE SOFTWARE IS LICENSED "AS-IS."
YOU BEAR THE RISK OF USING IT. MICROSOFT GIVES NO EXPRESS WARRANTIES, GUARANTEES OR CONDITIONS.
YOU MAY HAVE ADDITIONAL CONSUMER RIGHTS UNDER YOUR LOCAL LAWS WHICH THIS AGREEMENT CANNOT CHANGE.
TO THE EXTENT PERMITTED UNDER YOUR LOCAL LAWS, MICROSOFT EXCLUDES THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT.
12.
LIMITATION ON AND EXCLUSION OF REMEDIES AND DAMAGES. YOU CAN RECOVER FROM MICROSOFT AND ITS SUPPLIERS ONLY DIRECT DAMAGES UP TO U.S. $5.00.
YOU CANNOT RECOVER ANY OTHER DAMAGES, INCLUDING CONSEQUENTIAL, LOST PROFITS, SPECIAL, INDIRECT OR INCIDENTAL DAMAGES.
This limitation applies to
* anything related to the software, services, content (including code) on third party Internet sites, or third party programs; and
* claims for breach of contract, breach of warranty, guarantee or condition, strict liability, negligence, or other tort to the extent permitted by applicable law.
It also applies even if Microsoft knew or should have known about the possibility of the damages.
The above limitation or exclusion may not apply to you because your country may not allow the exclusion or limitation of incidental, consequential or other damages.
Please note: As this software is distributed in Quebec, Canada, some of the clauses in this agreement are provided below in French.

SQL Server 2008 / 2012 - Best practices document

Hello Everyone
Can anybody share SQL Server 2008 / 2012 - Best practices.
Regards
Prashanth
SharePoint Administrator

Take a look here:
http://channel9.msdn.com/Series/Tuning-SQL-Server-2012-for-SharePoint-2013/Tuning-SQL-Server-2012-for-SharePoint-2013-01-Key-SQL-Server-and-SharePoint-Server-Integration-Conce (4 part video series)
https://technet.microsoft.com/en-us/library/hh292622.aspx
Trevor Seward
Follow or contact me at...
&nbsp&nbsp
This post is my own opinion and does not necessarily reflect the opinion or view of Microsoft, its employees, or other MVPs.

Coldfusion, MS SQL, Hash Best Practices,...

Similar Messages

Maybe you are looking for