Creating a dynamic search form with database paging Tony Rogerson SQL Server MVP Torver Computer Consultants

What we trying to do?

The presentation Methods of coding the stored procedure Methods of coding the stored procedure –Static SQL method –Dynamic SQL method –Pros and Cons of each approach –SQL Injection/Security –The execution cache ASP.NET (VB.NET) interface ASP.NET (VB.NET) interface –Overview –Coding specifics

Static SQL method Same stored procedure parameters Same stored procedure parameters create procedure smallint = NULL int = nchar(10) = NULL

Static SQL method – ISNULL select * from Orders o left outer join Employees e on e.EmployeeID = o.EmployeeID left outer join Customers c on c.CustomerID = o.CustomerID where o.CustomerID = o.CustomerID ) and o.EmployeeID = o.EmployeeID ) order by o.ShippedDate desc Table 'Customers'. Scan count 5, logical reads 10. Table 'Employees'. Scan count 5, logical reads 10. Table 'Orders'. Scan count 1, logical reads 21.

Static SQL method – AND/OR Table 'Customers'. Scan count 5, logical reads 10. Table 'Employees'. Scan count 5, logical reads 10. Table 'Orders'. Scan count 2, logical reads 40. select * from Orders o left outer join Employees e on e.EmployeeID = o.EmployeeID left outer join Customers c on c.CustomerID = o.CustomerID where ( o.CustomerID or o.CustomerID is null ) and ( o.EmployeeID or o.EmployeeID is null ) order by o.ShippedDate desc

Static SQL method – IF THEN ELSE is not null is not null select.... from Orders o left outer join Employees e on e.EmployeeID = o.EmployeeID left outer join Customers c on c.CustomerID = o.CustomerID where o.CustomerID and o.EmployeeID order by o.ShippedDate desc else select.... from Orders o left outer join Employees e on e.EmployeeID = o.EmployeeID left outer join Customers c on c.CustomerID = o.CustomerID where o.EmployeeID order by o.ShippedDate desc else select.... from Orders o left outer join Employees e on e.EmployeeID = o.EmployeeID left outer join Customers c on c.CustomerID = o.CustomerID where o.CustomerID order by o.ShippedDate desc

Static SQL - summary Inflexible for optional parameters Inflexible for optional parameters IF then ELSE is efficient but will give a big plan which increases chances of a recompile. Greater maintenance. IF then ELSE is efficient but will give a big plan which increases chances of a recompile. Greater maintenance. ISNULL and AND/OR will give a general plan and perhaps a very bad plan for the parameter combination. ISNULL and AND/OR will give a general plan and perhaps a very bad plan for the parameter combination. More secure then dynamic SQL. More secure then dynamic SQL.

Dynamic SQL - coding is not null + ' and is not null + ' and = ' select o.OrderID, c.CompanyName, EmployeeName = e.LastName + '', '' + e.FirstName, ShippedDate = CONVERT( varchar(20), o.ShippedDate, 106 ) from Orders o left outer join Employees e on e.EmployeeID = o.EmployeeID left outer join Customers c on c.CustomerID = o.CustomerID ' + ' order by o.ShippedDate desc ' EXEC @CustomerID

Dynamic SQL - summary Specific plan for each iteration. Specific plan for each iteration. Plan is reused. Plan is reused. Use sp_executesql. Use sp_executesql. Parameterise instead of hard coding constants. Parameterise instead of hard coding constants. Be-careful of SQL Injection. Be-careful of SQL Injection. Security implications. Security implications.

Security Use ADO.NET SqlCommand object instead of building a SQL string. Use ADO.NET SqlCommand object instead of building a SQL string. SQL Injection: remember to replace a single quote with two single quotes… REPLACE(, ''', '''' ) SQL Injection: remember to replace a single quote with two single quotes… REPLACE(, ''', '''' ) Permission required on base tables used within the dynamic SQL block. However, you can create views over the base tables and permission them instead. Permission required on base tables used within the dynamic SQL block. However, you can create views over the base tables and permission them instead.

Execution cache Check master..syscacheobjects Check master..syscacheobjects Pages usecount refcount and Pages usecount refcount and After 5 executions – check usecount – plan reuse!

ASP.NET Part Use ViewState( ) to keep track of page number and maximum pages. Use ViewState( ) to keep track of page number and maximum pages. Can’t pick up the output parameter until the datareader has been closed. Can’t pick up the output parameter until the datareader has been closed.

Questions