Security and compliance
Ensure data security and compliance with data masking, monitoring, and change traceability
Posts tagged with SQL code smells
The risks of using EXECUTE (‘SQL Script’)
Execute(string) to execute a batch in a string, often assembled dynamically from user input. This technique is dangerous because the parameter values are injected before the statement is parsed by SQL Server, allowing an attacker to "tag on"… Read moreSQL Prompt Code Analysis: A Hint is Used (PE004-7)
SQL Prompt Code Analysis: Avoid using the ISNUMERIC Function (E1029)
IsNumeric() function, because it can often lead to data type conversion errors, when importing data. On SQL Server 2012 or later, use the Try_Convert() or Try_Cast() function instead. On earlier SQL Server versions, the only way to avoid it is by using LIKE expressions. Read more