Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Script Change for instaWDB in Drop Database Section #1311

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Script Change for instaWDB in Drop Database Section #1311

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
f23ab4c
Script Change for instaWDB in Drop Database Section
Jun 27, 2024
c6f4e6f
Made tables script more readable for northwind-pubs
Jun 27, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 19 additions & 5 deletions samples/databases/adventure-works/oltp-install-script/instawdb.sql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -85,14 +85,28 @@ PRINT '';
PRINT '*** Dropping Database';
GO

IF EXISTS (SELECT [name] FROM [master].[sys].[databases] WHERE [name] = N'$(DatabaseName)')
DROP DATABASE $(DatabaseName);
DECLARE @DBName NVARCHAR(128) = N'$(DatabaseName)';

-- If the database has any other open connections close the network connection.
IF @@ERROR = 3702
RAISERROR('$(DatabaseName) database cannot be dropped because there are still other open connections', 127, 127) WITH NOWAIT, LOG;
IF EXISTS (SELECT [name] FROM [master].[sys].[databases] WHERE [name] = @DBName)
BEGIN
-- Close existing connections to the database
DECLARE @SQL NVARCHAR(MAX) = N'';
SELECT @SQL += 'ALTER DATABASE [' + @DBName + '] SET SINGLE_USER WITH ROLLBACK IMMEDIATE;'
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Modify to use QUOTENAME(@dbname). Current string concatenation technique is susceptible to SQL injection attacks.

EXEC sp_executesql @SQL;

-- Drop the database
SET @SQL = N'DROP DATABASE [' + @DBName + '];';
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same here. Get the quoted identifier first & then concatenate.

EXEC sp_executesql @SQL;
END
GO

IF EXISTS (SELECT [name] FROM [master].[sys].[databases] WHERE [name] = @DBName)
BEGIN
RAISERROR('%s database cannot be dropped because there are still other open connections', 127, 127, @DBName) WITH NOWAIT, LOG;
END
GO



-- ****************************************
-- Create Database
Expand Down