Help Im a Noob - Updating a database entry.

Ok, so I work with a certain program which has a wide open back door into it's data tables. As a program administrator i can go into the actual program and change details of other users etc. However here's what i need to do...

A certain users security level needs to be reduced from administrator to a lower level. If i do that within the program it will automatically require that i change that users password, which i don't know.

The user is not to know that their access level has changed.

Backdooring the database through MSQuery and hunting online a little i found how to update information...

UPDATE User
SET Security = 4
WHERE UserID = 4

This works fine, however the users password is then scrambled, until an administrator edits their password for them.

The password itself is encrypted within the database.
Appearing something like "99171821E244877B4201003E0519EEA7"
It appears to be hexadecimal, but hey, i'm no system engineer. Strange thing is. that encryption represents the password "bill". When i execute the change on security level, the password "bill" becomes invalid, yet the encrypted string remains exactly the same.

What i need if at all possible is a how to... on forcing the database to not change the password field when the security level is updated. Any other suggestions would be most welcome. And of course plain english with syntax explanations would be nice as i am very much a junior, this has been my first SQL code execution, aside from queries.

Cheers,
OostersUnfortunately for you, this seems to be an application issue.

If it were a DBMS problem, then I would assume you are not using ORACLE RDBMS; such problems only occur in mediocre DBMS like SQL Server and others.
:eek:|||Application problems seem pretty indiscriminant about what engines they affect to me. If an app uses SQL, and that SQL breaks, it breaks for any database that implements SQL at the same level. If an app uses database engine specific code (Oracle, Microsoft, DB2, etc), then that app will probably only run on its target database engine, but that is a failure in the application, not the database.

I think that the problem that Oosters has found is that multiple columns within the users table are used to derive (actually decrypt) the password. It would appear that the application designers wanted to prevent exactly the kind of change that Oosters is trying to make.

-PatP|||Unfortunately for you, this seems to be an application issue.

Indeed.

If it were a DBMS problem, then I would assume you are not using ORACLE RDBMS; such problems only occur in mediocre DBMS like SQL Server and others.
:eek:

And yet you felt it was imperative to squeeze that into your post regardless.

Quality.

Would you pretty pretty please proceed to regal me with unsolicited opinions and stories about how linux cured your stepdad's brother's cousin's dogs' nephew's sister's case of terminal cancer, or perhaps the one about Microsoft releasing OS's laced with mind control algorhythms that only appear at a particular resolution and refresh rate?|||In the midst of these response all i basically understood, was that the application designers didn't want me to do it. Why couldn't they just stop me backdooring the application in the first place.

Meanwhile I think i know what's happening with the password. I think instead of the database automatically changing the password when i update the security level of a user, there may be another field to lock the password when i update security level, and this will only unlock when another password is offered. I can't even get around it by feeding the database it's own encryption string, which should force it to recognise a password change. I'm off to hunt for a password locking field.

I could destroy the integrity of the entire database at the touch of a button, but i can't change a single users security level.|||In the midst of these response all i basically understood, was that the application designers didn't want me to do it. Why couldn't they just stop me backdooring the application in the first place.

Because controlling access to your database server probably isn't their job. Who is going to keep the database running if everybody is completely locked out of it?|||One of the really fundamental elements of good security design is to limit the damage that can be done without detection. A fundamental way to achieve this is to require some form of intervention from one or more of the affected parties whenever a change is made. The example you've got is when a security level is changed, make that change require a password change.

This has little to do with the database. It is a fundamental requisite for good security management.

While I'm sure that it frustrates you, I see it as a good thing in the larger context because it makes an otherwise unannounced change visible to the affected party. While it might not be politically expedient, you shouldn't be able (from a systemic point of view) to take away (or grant) administrative privledges without the knowledge of the user.

-PatP|||Yes, In an ideal world, in an ideal database i shouldn't be able to change user security levels without their knowledge. This being said...

<RANT>
Considering the sensitivity of information as this is a financial database representing the business of the whole company, I shouldn't be permitted to backdoor and alter financial information, and yet as long as i make it balance, which can take a bit of figuring, the database security allows such changes.
</RANT>

No need to respond to this, thanks for the knowledge people.

regards,
Matt

Help designing tables

HI gurus,

I need help with database design. I am doing a bowling league program.
1. each bowling center has 1 or more leagues
2. each league has 2 or more teams
3. each team has 2 or more bowlers
4. each week each team bowls 3 games
5. summer leagues last ~13 weeks
winter leagues last ~36 weeks

Tables I have + is primary key FK is foreign key
BowlingCenter
+ CenterID
......

League
+ LeagueID
FK CenterID
.......

Team
+ TeamID
FK LeagueID

Bowler
+ BowlerID
FK TeamID

Here I am lost. How do I do the 3 games a week for 13 or 36 weeks AND associate the 3 games each week with each bowler?

Any help would be appreciated.

What about:

Bowling Center (PK CenterId
)

|

League (PK LeagueId) (PK CenterId
)

Team(PK TeamId)

TeamInLeagues (PK TeamId, PK LeagueId) (FK TeamId)(fK LeagueId) --In order to make the team available to other Leagues.

Bowler (PK BowlerId)

BowlerTeam (PK BowlerId, PK TeamId) (FK BowlerId) (FK TeamId)
--In order to assign a bowler to many teams

Games
(Weekid, BowlerTeam_PK) (FK BowlerTeam_PK)

Jens K. Suessmeyer.

http://www.sqlserver2005.de

|||

Thanks, I'll give it a try.

HELP Cant get connection to my server with SQLDMO

I am trying to learn SQLDMO for working with our SQL Server 2000
servers. I grabbed a demo program from:
http://www.csharphelp.com/archives2/archive342.html
called SQLDMO for C# from Kevin Goss
I built the program successfully in VS 2003
and it shows me a list of servers (mine being on the list)
but when I try and connect to it using the interface I get the
following messages:
Error
--
[Microsoft][SQL Native Client][SQL Server]Login failed for user
'CODE1\smoody'. Reason: Not associated with a trusted SQL Server
connection.
[Microsoft][SQL Native Client]Shared Memory Provider: The system cannot
open the file.
[Microsoft][SQL Native Client]Communication link failure
--
OK
--
The code where this is occurring is: (I didnt want to include the whole
program and I wasnt sure how much was needed for diagnosing the
problem) I can send more of the code if needs be, just tell me how much
you think you need.
SQLDMO.SQLServer srv = new SQLDMO.SQLServerClass();
srv.Connect(this.cboServers.SelectedItem.ToString(),this.txtUser.Text,this.t
xtPassword.Text);
I have confirmed that the user has access to the database as well as
setting up a DSN entry to access the database. But as of yet I still
can not get past the errors... Please HELP!!!!!
Thanks
-SteveSteve,
Ensure the SQL Server is running in Mixed Mode Authentition instead of
Windows Authentication only or change your connection string to use Windows
credentials.
HTH
Jerry
"SteveM" <steve.moody@.philips.com> wrote in message
news:1129926133.227261.243290@.g47g2000cwa.googlegroups.com...
>I am trying to learn SQLDMO for working with our SQL Server 2000
> servers. I grabbed a demo program from:
> http://www.csharphelp.com/archives2/archive342.html
> called SQLDMO for C# from Kevin Goss
> I built the program successfully in VS 2003
> and it shows me a list of servers (mine being on the list)
> but when I try and connect to it using the interface I get the
> following messages:
> --
> Error
> --
> [Microsoft][SQL Native Client][SQL Server]Login failed for user
> 'CODE1\smoody'. Reason: Not associated with a trusted SQL Server
> connection.
> [Microsoft][SQL Native Client]Shared Memory Provider: The system cannot
> open the file.
>
> [Microsoft][SQL Native Client]Communication link failure
> --
> OK
> --
>
>
> The code where this is occurring is: (I didnt want to include the whole
> program and I wasnt sure how much was needed for diagnosing the
> problem) I can send more of the code if needs be, just tell me how much
> you think you need.
>
> SQLDMO.SQLServer srv = new SQLDMO.SQLServerClass();
> srv.Connect(this.cboServers.SelectedItem.ToString(),this.txtUser.Text,this
.txtPassword.Text);
>
> I have confirmed that the user has access to the database as well as
> setting up a DSN entry to access the database. But as of yet I still
> can not get past the errors... Please HELP!!!!!
> Thanks
> -Steve
>|||I checked and indeed I was NOT running in mixed mode. I changed this and
will check to see if that was the problem. I think I may have found a
better way to do things however. A co-worker of mine showed me a
property called
srv.LoginSecure = true;
This uses my windows credentials without my having to record my userid
and password (even though I know I can encrypt it in a config file in
the project). This seems a better way to go, but I do want to learn to
do things the other way, so you advice will be very helpful. Thanks for
taking the time to respond I appreciate it
-Steve
*** Sent via Developersdex http://www.examnotes.net ***

Help (require code)

right im programming a database program and i need some code. (the database is in sql/msde)
This is what i am attempting to do:
I have a page with textboxes on it with buttons at the bottom
i need to program the database with the add function

this is the code that i have already
Imports system.data.sqlclient

'You need two objects

Dim conn as new sqlconnection
dim comm as new sqlcommand

conn.connectionstring = "Your UDL String here"
comm.text = "insert into books (isbn, title, author, publisher, description, price,)
'books is the name of the databse
values ( '1234' , 'Title', 'Author', 'Publisher' )
conn.open
comm.connection = conn
comm.executenonquery
comm.close
conn.close

now i think i need to insert this at the top of the page but im not 100% sure (btw i have the udl string)

so what do i need to add to this code to make the page submit data that has been enterd into textboxes into a database table(sql/msde) on the click of the button?

thanks for any help providedI think you need to read some very simple getting started tutorials. What you've asked is very, very easy and to be honest shows that you've not really got any kinda' grip on this stuff. The totorials on this forum should sort you out - it'll take you 30mins to learn this, honest. Sorry if this sounds a bit cruel by you'll get no where fast by cribbing blocks of code without understand it.

Help ! Nested Stored Procedure, is this the best way???

Hi all,
Excuse my lack of knowledge in this area but what I am trying to do is
1) The user requests that say 4 tickets are to be held
2) The VB program calls a sproc that executes and tries to update the
status of each ticket in turn
3) If 4 are available then all is dandy
4) If 4 are not then any updates are rolled back and the user notifed
Note this is a true multi user environment, the tickets don't have to
be locked in sequence, they are just places on an event
Tried this but got odd rollback messages like
Server: Msg 266, Level 16, State 2, Procedure BIP_Tickets, Line 23
Transaction count after EXECUTE indicates that a COMMIT or ROLLBACK
TRANSACTION statement is missing. Previous count = 6, current count =
7.
Line 23 is the return statement
SQL 2000 is the beast in use
HELP!! Ideas
Sproc is
CREATE PROCEDURE BIP_Tickets @.UserId Integer,
@.EventId Integer,
@.NumberReqd as Integer,
@.Resp Integer OUTPUT AS
SET NOCOUNT ON
Declare @.CurrentTicket Integer
Declare @.TicketRef Integer
SET @.CurrentTicket = 1
BEGIN TRAN BIP
WHILE @.CurrentTicket < @.NumberReqd
BEGIN
IF (SELECT COUNT(*) FROM [Event Tickets]
WHERE [Event Tickets].[Ticket Status]='0' AND [Event
Tickets].[Event Id] = @.EventId) < 1
ROLLBACK TRAN BIP
SET @.Resp = 1
RETURN
SET @.TicketRef = (SELECT TOP 1 [Ticket Ref]
FROM [Event Tickets]
WHERE [Event Tickets].[Ticket Status]='0' AND [Event
Tickets].[Event Id] = @.EventId)
UPDATE [Event Tickets]
SET [Ticket status] = 1,
[User Id] = @.UserId,
[Status Updated] = GetDate()
WHERE [Ticket Ref] = @.TicketRef
SET @.CurrentTicket = @.CurrentTicket + 1
END
COMMIT TRAN BIP
SET @.Resp = 0
GO
"Shaun" <shaunsizen@.msn.com> wrote in message
news:4a2f9143.0411020824.24ac7479@.posting.google.c om...
> Hi all,
> Excuse my lack of knowledge in this area but what I am trying to do is
> 1) The user requests that say 4 tickets are to be held
> 2) The VB program calls a sproc that executes and tries to update the
> status of each ticket in turn
> 3) If 4 are available then all is dandy
> 4) If 4 are not then any updates are rolled back and the user notifed
> Note this is a true multi user environment, the tickets don't have to
> be locked in sequence, they are just places on an event
> Tried this but got odd rollback messages like
> Server: Msg 266, Level 16, State 2, Procedure BIP_Tickets, Line 23
> Transaction count after EXECUTE indicates that a COMMIT or ROLLBACK
> TRANSACTION statement is missing. Previous count = 6, current count =
> 7.
> Line 23 is the return statement
> SQL 2000 is the beast in use
> HELP!! Ideas
> Sproc is
>
Your immediate problem is that TSQL's IF only affects the next statement.
You wrote
IF (SELECT COUNT(*) FROM [Event Tickets]
WHERE [Event Tickets].[Ticket Status]='0' AND [Event
Tickets].[Event Id] = @.EventId) < 1
ROLLBACK TRAN BIP
SET @.Resp = 1
RETURN
which is equivilent to
IF (SELECT COUNT(*) FROM [Event Tickets]
WHERE [Event Tickets].[Ticket Status]='0' AND [Event Tickets].[Event
Id] = @.EventId) < 1
BEGIN
ROLLBACK TRAN BIP
END
SET @.Resp = 1
RETURN
So you are always returning at line 23.
You probably have some more concurrency problems after fixing this, so test
and post again when you get deadlocks or double bookings.
David
|||Cheers David, good point, not used the IF too much and it was always
single statement before
I'll rework, give it a go and post back if necessary
Thanks again
Shaun
"David Browne" <davidbaxterbrowne no potted meat@.hotmail.com> wrote in message news:<OqHo#4PwEHA.3108@.TK2MSFTNGP14.phx.gbl>...
> "Shaun" <shaunsizen@.msn.com> wrote in message
> news:4a2f9143.0411020824.24ac7479@.posting.google.c om...
> Your immediate problem is that TSQL's IF only affects the next statement.
> You wrote
>
> IF (SELECT COUNT(*) FROM [Event Tickets]
> WHERE [Event Tickets].[Ticket Status]='0' AND [Event
> Tickets].[Event Id] = @.EventId) < 1
> ROLLBACK TRAN BIP
> SET @.Resp = 1
> RETURN
> which is equivilent to
>
> IF (SELECT COUNT(*) FROM [Event Tickets]
> WHERE [Event Tickets].[Ticket Status]='0' AND [Event Tickets].[Event
> Id] = @.EventId) < 1
> BEGIN
> ROLLBACK TRAN BIP
> END
> SET @.Resp = 1
> RETURN
> So you are always returning at line 23.
> You probably have some more concurrency problems after fixing this, so test
> and post again when you get deadlocks or double bookings.
> David

Help ! Nested Stored Procedure, is this the best way???

Hi all,
Excuse my lack of knowledge in this area but what I am trying to do is
1) The user requests that say 4 tickets are to be held
2) The VB program calls a sproc that executes and tries to update the
status of each ticket in turn
3) If 4 are available then all is dandy
4) If 4 are not then any updates are rolled back and the user notifed
Note this is a true multi user environment, the tickets don't have to
be locked in sequence, they are just places on an event
Tried this but got odd rollback messages like
Server: Msg 266, Level 16, State 2, Procedure BIP_Tickets, Line 23
Transaction count after EXECUTE indicates that a COMMIT or ROLLBACK
TRANSACTION statement is missing. Previous count = 6, current count =
7.
Line 23 is the return statement
SQL 2000 is the beast in use
HELP!! Ideas
Sproc is
CREATE PROCEDURE BIP_Tickets @.UserId Integer,
@.EventId Integer,
@.NumberReqd as Integer,
@.Resp Integer OUTPUT AS
SET NOCOUNT ON
Declare @.CurrentTicket Integer
Declare @.TicketRef Integer
SET @.CurrentTicket = 1
BEGIN TRAN BIP
WHILE @.CurrentTicket < @.NumberReqd
BEGIN
IF (SELECT COUNT(*) FROM [Event Tickets]
WHERE [Event Tickets].[Ticket Status]='0' AND [Event
Tickets].[Event Id] = @.EventId) < 1
ROLLBACK TRAN BIP
SET @.Resp = 1
RETURN
SET @.TicketRef = (SELECT TOP 1 [Ticket Ref]
FROM [Event Tickets]
WHERE [Event Tickets].[Ticket Status]='0' AND [Event
Tickets].[Event Id] = @.EventId)
UPDATE [Event Tickets]
SET [Ticket status] = 1,
[User Id] = @.UserId,
[Status Updated] = GetDate()
WHERE [Ticket Ref] = @.TicketRef
SET @.CurrentTicket = @.CurrentTicket + 1
END
COMMIT TRAN BIP
SET @.Resp = 0
GO"Shaun" <shaunsizen@.msn.com> wrote in message
news:4a2f9143.0411020824.24ac7479@.posting.google.com...
> Hi all,
> Excuse my lack of knowledge in this area but what I am trying to do is
> 1) The user requests that say 4 tickets are to be held
> 2) The VB program calls a sproc that executes and tries to update the
> status of each ticket in turn
> 3) If 4 are available then all is dandy
> 4) If 4 are not then any updates are rolled back and the user notifed
> Note this is a true multi user environment, the tickets don't have to
> be locked in sequence, they are just places on an event
> Tried this but got odd rollback messages like
> Server: Msg 266, Level 16, State 2, Procedure BIP_Tickets, Line 23
> Transaction count after EXECUTE indicates that a COMMIT or ROLLBACK
> TRANSACTION statement is missing. Previous count = 6, current count =
> 7.
> Line 23 is the return statement
> SQL 2000 is the beast in use
> HELP!! Ideas
> Sproc is
>
Your immediate problem is that TSQL's IF only affects the next statement.
You wrote
IF (SELECT COUNT(*) FROM [Event Tickets]
WHERE [Event Tickets].[Ticket Status]='0' AND [Event
Tickets].[Event Id] = @.EventId) < 1
ROLLBACK TRAN BIP
SET @.Resp = 1
RETURN
which is equivilent to
IF (SELECT COUNT(*) FROM [Event Tickets]
WHERE [Event Tickets].[Ticket Status]='0' AND [Event Tickets].&#
91;Event
Id] = @.EventId) < 1
BEGIN
ROLLBACK TRAN BIP
END
SET @.Resp = 1
RETURN
So you are always returning at line 23.
You probably have some more concurrency problems after fixing this, so test
and post again when you get deadlocks or double bookings.
David|||Cheers David, good point, not used the IF too much and it was always
single statement before
I'll rework, give it a go and post back if necessary
Thanks again
Shaun
"David Browne" <davidbaxterbrowne no potted meat@.hotmail.com> wrote in message news:<OqHo#4P
wEHA.3108@.TK2MSFTNGP14.phx.gbl>...
> "Shaun" <shaunsizen@.msn.com> wrote in message
> news:4a2f9143.0411020824.24ac7479@.posting.google.com...
> Your immediate problem is that TSQL's IF only affects the next statement.
> You wrote
>
> IF (SELECT COUNT(*) FROM [Event Tickets]
> WHERE [Event Tickets].[Ticket Status]='0' AND [Event
> Tickets].[Event Id] = @.EventId) < 1
> ROLLBACK TRAN BIP
> SET @.Resp = 1
> RETURN
> which is equivilent to
>
> IF (SELECT COUNT(*) FROM [Event Tickets]
> WHERE [Event Tickets].[Ticket Status]='0' AND [Event Tick
ets].[Event
> Id] = @.EventId) < 1
> BEGIN
> ROLLBACK TRAN BIP
> END
> SET @.Resp = 1
> RETURN
> So you are always returning at line 23.
> You probably have some more concurrency problems after fixing this, so tes
t
> and post again when you get deadlocks or double bookings.
> David

HELP - Slow Connection establishment on Windows XP

Hi All,

Just bought a new laptop, everything fine EXCEPT when a java program I have written tries to get a connection to an SQL server database. It gets the connection no problem but its about three times slower than on my desktop machine to the same server.

The laptop is running windows XP Home, and I am connecting to an SQL server database.

I have absolutely no IDEA why it takes three times longer on a machine which is 10 times faster than my desktop. My desktop is running windows NT.

Any hints would be most appreciated.

thanks.Those 56k modems can be a dog...

;-)

How are you connecting to sql server..can you show us the connection string?|||its ok, the problem was that I had to put the sql server machine in the hosts file in windows\system32\drivers\etc

i.e. 123.123.123.123 servername.

thanks anyway.

Help - problem with running SQL Server Management Studio Express CTP

I just installed SQL Server Management Studio Express CTP on a new XP Pro machine. SSMSECTP is present in the program list but nothing happens when I select it. What do I do to fix this? I don't have any type of interface to the SQL Server databases, although the Configuration Manager works OK.Problem solved - I uninstalled everything except MS .NET Framework 2.0 and then reinstalled everything. After this SSMSECTP came up OK.

Help

I make a program with vb (ADO) to connect SQL Server. If I want to execute
its program at other computer where there is no SQL Server, So what do i
have to install (what component of sql Server that I must install)? Can I
just copy files that be needed only?MDAC, that should be all to install. (If it is a .NET program you have to
install .NET Framework additionally (but nor for ADO only for ADO.NET))
--
HTH, Jens Suessmeyer.
http://www.sqlserver2005.de
--
"Bpk. Adi Wira Kusuma" wrote:

> I make a program with vb (ADO) to connect SQL Server. If I want to execute
> its program at other computer where there is no SQL Server, So what do i
> have to install (what component of sql Server that I must install)? Can I
> just copy files that be needed only?
>
>|||How to install MDAC Only?|||You can download the MDAC components here.
http://www.microsoft.com/downloads/...La
ng=en
--
Roji. P. Thomas
Net Asset Management
http://toponewithties.blogspot.com
"Bpk. Adi Wira Kusuma" <adi_wira_kusuma@.yahoo.com.sg> wrote in message
news:uozMv7LmFHA.3828@.TK2MSFTNGP12.phx.gbl...
> How to install MDAC Only?
>|||Hi
MDAC comes with quite a few programs and it is almost certain that it will
be installed.
http://www.microsoft.com/downloads/...La
ng=en
For distributing database components see
http://support.microsoft.com/defaul...kb;en-us;266322
John
"Bpk. Adi Wira Kusuma" wrote:

> How to install MDAC Only?
>
>

Help

I've tried to install MDAC only at Win 98 (MDAC_TYP.EXE). But my program is
still not able to work. My Program use ADO to connect SQL Server 2000. So
what do i need to install again to my program can work/run?Why is it not working, do you get an error message for it ?
--
HTH, Jens Suessmeyer.
http://www.sqlserver2005.de
--
"Bpk. Adi Wira Kusuma" wrote:

> I've tried to install MDAC only at Win 98 (MDAC_TYP.EXE). But my program
is
> still not able to work. My Program use ADO to connect SQL Server 2000. So
> what do i need to install again to my program can work/run?
>
>|||wehhh, I'm forget its error message. But I sure that I don't install
complettely. Nah... I just ask to you, What Any kind of which need to be
installed So My app. can work / running?|||You just need to install the MDAC:
http://www.microsoft.com/downloads/...&displaylang=en
What kind of application do you want to deploy ?
--
HTH, Jens Suessmeyer.
http://www.sqlserver2005.de
--
"Bpk. Adi Wira Kusuma" wrote:

> wehhh, I'm forget its error message. But I sure that I don't install
> complettely. Nah... I just ask to you, What Any kind of which need to be
> installed So My app. can work / running?
>
>