Whenever you are searching for SQL query optimization tips or prevent SQL injection tips, you can find few common suggestions like: Please do not use Dynamic SQL in your Stored Procedure. Please try to avoid the use of Temp Tables.

I always tell to database developers, please try to avoid the use of Dynamic SQL and Temp Table in your Stored Procedures.

A Temp Table requires additional CPU/IO which degrades the query performance. A Dynamic SQL is not safe against the SQL Injection and It also compiles data every time which requires more Memory.

Here, I am sharing one of the important scripts which gives you list of SQL Server Stored Procedures, which use the Dynamic SQL and Temp Table.
You can easily get the list of Stored Procedures and can make plans of modifying it.

Prepared this script using sys.dm_exec_describe_first_result_set and sys.procedures where error number 4 = Dynamic SQL and error number 10 = Temporary Table.

SELECT  
	SP_Name
	,error_message
	,error_type_desc 
FROM (SELECT schema_name(schema_id)+'.'+name SP_Name FROM sys.procedures) AS T
CROSS APPLY sys.dm_exec_describe_first_result_set (SP_Name, NULL, 0) 
WHERE error_type IN (4,10)

In this post, I am sharing one T-SQL Script to find SQL Server USER LOGIN Information.

As a DBA, we should check the USER LOGIN Information to make sure about the user expiration, password expiration.
Using password expiration information, you can also notify the user before its password expires.

SELECT 
	SL.name AS LoginName 
	,LOGINPROPERTY (SL.name, 'PasswordLastSetTime') AS PasswordLastSetTime 
	,LOGINPROPERTY (SL.name, 'DaysUntilExpiration') AS DaysUntilExpiration 
	,DATEADD(dd, CONVERT(int, LOGINPROPERTY (SL.name, 'DaysUntilExpiration')) 
				, CONVERT(datetime, LOGINPROPERTY (SL.name, 'PasswordLastSetTime'))) AS PasswordExpiration 
	,SL.is_policy_checked AS IsPolicyChecked 
	,LOGINPROPERTY (SL.name, 'IsExpired') AS IsExpired 
	,LOGINPROPERTY (SL.name, 'IsMustChange') AS IsMustChange 
	,LOGINPROPERTY (SL.name, 'IsLocked') AS IsLocked 
	,LOGINPROPERTY (SL.name, 'LockoutTime') AS LockoutTime 
	,LOGINPROPERTY (SL.name, 'BadPasswordCount') AS BadPasswordCount 
	,LOGINPROPERTY (SL.name, 'BadPasswordTime') AS BadPasswordTime 
	,LOGINPROPERTY (SL.name, 'HistoryLength') AS HistoryLength 
FROM sys.sql_logins AS SL 
WHERE is_expiration_checked = 1 
ORDER BY LOGINPROPERTY (SL.name, 'PasswordLastSetTime') DESC

In this post, I am going to publish about The Row Level Security which is now a common feature of all new version of RDBMSs like SQL Server 2016, PostgreSQL 9.5.

With the concept of Row Level Security, we can restrict the user for a particular set of records.
Previously, we are doing this kind of restriction using by creating filtered VIEWS and assign related VIEWS to relevant Users.

SQL Server 2016 has this Row Level Security feature which extends the overall security policy of the SQL Server.

PostgreSQL 9.5: Row Level Security by Example

Please check the below full demonstration on this.

Create a test database:

CREATE DATABASE CheckRowSecurity;
GO 
USE CheckRowSecurity;
GO

Create a table with sample data:

CREATE TABLE tbl_employeeSalary
(
	empcode VARCHAR(10)
	,empname VARCHAR(10)
	,empsalary BIGINT
	,[month] INT
)
GO
 
INSERT  INTO tbl_employeeSalary
VALUES 
('Anv','Anvesh',150000,1)
,('Anv','Anvesh',120000,2)
,('Anv','Anvesh',160000,3)
,('Anv','Anvesh',170000,4)
,('Mar','Martin',90000,1)
,('Mar','Martin',100000,2)
,('Mar','Martin',120000,3)
,('Mar','Martin',130000,4)
GO

Create two test users and assign SELECT permission on the table:

CREATE USER Anv WITHOUT LOGIN;
CREATE USER Mar WITHOUT LOGIN;
GO

GRANT SELECT ON tbl_employeeSalary TO Anv
GRANT SELECT ON tbl_employeeSalary TO Mar
GO

Create filter predicate function:

CREATE FUNCTION rowLevelSecurity(@userName as sysname)
RETURNS TABLE
WITH SCHEMABINDING
AS
RETURN SELECT 1 AS rowLevelSecurityResult
WHERE @userName = USER_NAME();
GO

Add filter predicate to the table:

CREATE SECURITY POLICY UserFilter
ADD FILTER PREDICATE dbo.rowLevelSecurity(empcode)
ON dbo.tbl_employeeSalary
WITH (STATE = ON);
GO

Select table without any user:
You will get a blank result set because we alter the security policy of this table.

SELECT * FROM tbl_employeeSalary

Check for User ‘Anv’:

EXECUTE AS USER = 'Anv'
SELECT * FROM tbl_employeeSalary
REVERT
GO

Result:

empcode    empname    empsalary            month
---------- ---------- -------------------- -----------
Anv        Anvesh     150000               1
Anv        Anvesh     120000               2
Anv        Anvesh     160000               3
Anv        Anvesh     170000               4

Check for User ‘Mar’:

EXECUTE AS USER = 'Mar'
SELECT * FROM tbl_employeeSalary
REVERT
GO

Result:

empcode    empname    empsalary            month
---------- ---------- -------------------- -----------
Mar        Martin     90000                1
Mar        Martin     100000               2
Mar        Martin     120000               3
Mar        Martin     130000               4

As a database professional, I work with both databases on a regular basis, and I typically use all the features of both databases for design and implementation.
I have got many replies to write about the core differences between PostgreSQL and MySQL.

As innovation on these databases has progressed, each development community has actively made changes to address their respective sets of perceived disadvantages.
The result that it has gotten more difficult to objectively determine which database is likely to be better suited for a given application.

MySQL is controlled by Oracle, whereas Postgres is available under an open-source license from the PostgreSQL Global Development Group.

PostgreSQL is closer to the ANSI SQL standard, MySQL is closer to the ODBC standard.

One of the most notable differences between MySQL and PostgreSQL is the fact that you can’t do nested subqueries of subselects in MySQL. MySQL doesn’t support CTE, window functions, full outer joins and arrays.

Compare to PostgreSQL, MySQL has its own large user community and various type of materials.

MySQL uses nonstandard ‘#’ to begin a comment line and PostgreSQL use ‘–‘ to begin a comment line.

MySQL provides different type of table storage engines like: InnoDB, MyIsam, Memory. PostgreSQL does not provide different type of table stroage engines.

PostgreSQL is case-sensitive for string comparisons. The field “DbRnd” is not the same as the field “dbrnd”. This is a big change for many users from MySQL and other small database systems.

PostgreSQL has some nice features like: generate_series, custom aggregate functions, arrays etc. other hand MySQL has also some nice feature like: session variables in queries, FORCE INDEX, etc.

In PostgreSQL, when you are inside a transaction almost any operation can be undone. There are some irreversible operations (like creating or destroying a database or tablespace), but normal table modifications can be backed out by issuing a ROLLBACK via its Write-Ahead Log design.

MySQL doesn’t support any sort of rollback when using MyISAM. With InnoDB, the server has an implicit commit that occurs even if the normal auto-commit behavior is turned off. This means that any single table alteration or similar change is immediately committed.

Postgres obliterates MySQL in all manner of query-level goodness, and we can use Postgres for data mining and batch analytics databases, where we run lots of very large, hand-coded queries that can take advantage of Postgres’ advantages in join methods (MySQL only supports Nested Loop and Nested Loop over Index, while Postgres supports numerous methods), generally richer querying capabilities, and other good stuff like partial indexes can be used extensively.

PostgreSQL uses a robust locking model called MVCC that limits situations where individual clients interfere with each other. A short summary of the main benefit of MVCC would be “readers are never blocked by writers”.

MySQL’s InnoDB implements MVCC using a rollback segment and InnoDB databases supports all four SQL standard transaction isolation levels.

PostgreSQL uses cost-based query optimization methods in order to get good performance for many different types of joins. Query costs are assessed based on planner statistics collected when tables are analyzed combined with adjustable planner costs and advanced features such as the Genetic Query Optimizer.

MySQL doesn’t have this level of sophistication in its planner, and the tunables for Controlling Query Optimizer Performance are crude. Developers instead do things like explicitly provide index hints to make sure joins are executed correctly.

PostgreSQL has different replication options than MySQL. MySQL has no point-in-time recovery.

One operation that PostgreSQL is known to be slow performing is doing a full count of rows in a table, typically using this SQL:

SELECT COUNT(*) FROM your_table_name;

The reason why this is slow is related to the MVCC implementation in PostgreSQL. The fact that multiple transactions can see different states of the data means that there can be no straightforward way for “COUNT(*)” to summarize data across the whole table; PostgreSQL must walk through all rows, in some sense.

In MySQL, MyISAM tables cache the row count information, making this type of count operation almost instant. But if you’re using InnoDB instead, this is no longer the case and on InnoDB can’t assume that a full row count will be fast.

I know, you guys are thinking that why we require DDL Trigger to track database changes in SQL Server.

SQL Server already has Changed Data Capture (CDC) and Audit option.
When we are talking about DDL Trigger, compare to other automated process this manual process is still preferred by SQL DBA because It is easy to use and manage.

A Database Administrator is also responsible for all different types of Database Security like: Database / Schema / Object level permission, Tracking object creation.

I have enabled SQL Server Audit for one of our production report server, but some time It does not work as per the expectation.

I have searched the alternate solution and found that we can create DDL trigger on a database to track the DDL operation of different objects.
We can also use DDL triggers to verify the result of SQL Server Audit.

Other take care points of DDL Trigger are:

Only SA or Admin user has to perform this stuff. The DBA should restrict other common database user to view or modify the DDL trigger.

It should be encrypted.

If our database is heavily loaded with tons of transaction, we should not create any type of DDL trigger on it.

Here, I am creating one encrypted DDL Trigger which tracks different types of object like:
Stored Procedure, Table, View, Function, Trigger, Sequence, Index.

Step to create Encrypted DDL Trigger:

First Create separate database:

CREATE DATABASE [DDLChanges]
GO

Create one table which will hold all event information:

CREATE TABLE [DDLChanges].[dbo].[tbl_TrackDDLChanges](
	[EventDate] [datetime] NOT NULL DEFAULT (getdate()),
	[EventType] [nvarchar](64) NULL,
	[EventDDL] [nvarchar](max) NULL,
	[LoginName] [nvarchar](255) NULL,
	[DatabaseName] [nvarchar](255) NULL,
	[SchemaName] [nvarchar](255) NULL,
	[ObjectName] [nvarchar](255) NULL,
	[HostName] [varchar](64) NULL,
	[IPAddress] [varchar](32) NULL,
	[ProgramName] [nvarchar](255) NULL,
	[EventXML] [xml] NULL
)
GO

SELECT your application Database and create below encrypted DDL trigger:

If you require to enable DDL trigger on multiple database, execute DDL trigger one by one on each require a database.

Please do not create a DDL Trigger on [DDLChanges] database, that we have created in the first step which is for tracking purposes.

Now, perform any DDL action on your database and check [DDLChanges].[dbo].[tbl_TrackDDLChanges] table where you can find important information like: which SQL Query, who created, which host, what time, on which database and other.

CREATE TRIGGER [trg_DDL_Changes]
ON DATABASE
WITH ENCRYPTION
FOR 
	CREATE_PROCEDURE
	,ALTER_PROCEDURE
	,DROP_PROCEDURE
	,CREATE_TABLE
	,ALTER_TABLE
	,DROP_TABLE
	,CREATE_VIEW
	,ALTER_VIEW
	,DROP_VIEW
	,CREATE_FUNCTION
	,ALTER_FUNCTION
	,DROP_FUNCTION
	,CREATE_TRIGGER
	,ALTER_TRIGGER
	,DROP_TRIGGER
	,CREATE_SEQUENCE
	,ALTER_SEQUENCE
	,DROP_SEQUENCE
	,CREATE_INDEX
	,ALTER_INDEX
	,DROP_INDEX
AS
BEGIN
    SET NOCOUNT ON;
    DECLARE
        @EventData XML = EVENTDATA(); 
    DECLARE 
        @ip VARCHAR(32) =
        (
            SELECT client_net_address
            FROM sys.dm_exec_connections
            WHERE session_id = @@SPID
        );
 
    INSERT DDLChanges.dbo.tbl_TrackDDLChanges
    (
        EventType
        ,EventDDL
	,LoginName        
        ,DatabaseName
        ,SchemaName
        ,ObjectName
        ,HostName
        ,IPAddress
        ,ProgramName        
	,EventXML
    )
    SELECT
        @EventData.value('(/EVENT_INSTANCE/EventType)[1]','NVARCHAR(100)')
        ,@EventData.value('(/EVENT_INSTANCE/TSQLCommand)[1]','NVARCHAR(MAX)')
	,SUSER_SNAME()        
        ,DB_NAME()
        ,@EventData.value('(/EVENT_INSTANCE/SchemaName)[1]','NVARCHAR(255)')
        ,@EventData.value('(/EVENT_INSTANCE/ObjectName)[1]','NVARCHAR(255)')
        ,HOST_NAME()
        ,@ip
        ,PROGRAM_NAME()        
	,@EventData
END
GO

The Database security is always one of the major tasks for all the Database Administrators.
I have also prepared one article to create Read only User in PostgreSQL.

PostgreSQL: Script to Create a Read-Only Database User

In this post, I am sharing small note about REVOKE privileges for newly created Database Users of PostgreSQL.

Before a few days ago, one of the PostgreSQL Junior DBA asked this question on my FB Page. He created one new DB User in PostgreSQL and without giving a any permission that USER can CONNECT to all Databases.

Yes: When you create any new DB User in PostgreSQL, It has a default CONNECT privileges.
But It cannot access any Table or data of Databases, yes It can create new Table in any Database.

To prevent a new User for connecting any existing Database, we should run REVOKE command on particular User or Role.

REVOKE CONNECT privileges from Database:

REVOKE CONNECT ON DATABASE Database_Name FROM User_Name;

REVOKE all privileges from Database:

REVOKE ALL PRIVILEGES ON DATABASE Database_Name FROM User_Name;

You should GRANT only required Databases:

GRANT CONNECT ON DATABASE Database_Name TO User_Name;

Hello guys, Since last two months I have published about the SQL Server Interview Questions and Answers.
During this time, I got lots of messages and requests about the PostgreSQL.

In this August – 2016, I am going to post about only PostgreSQL and will try to complete all pending requests of readers.

In this post, I am going to publish about The Row Level Security which is now a common feature of all new version of RDBMSs like SQL Server 2016, PostgreSQL 9.5.

With the concept of Row Level Security, we can restrict the user for a particular set of records.
Previously, we are doing this kind of restriction using by creating filtered VIEWS and assign related VIEWS to related Users.

PostgreSQL 9.5 has this Row Level Security feature which extends the overall security policy of the PostgreSQL.

Let me demonstrate this.

Execute below all steps using Postgres Super user:

First create two sample users:

CREATE USER abc LOGIN PASSWORD '123';
CREATE USER xyz LOGIN PASSWORD '321';

CREATE TABLE tbl_Employees
(
	EmpID INT
	,EmpName CHARACTER VARYING 
);
INSERT INTO tbl_Employees VALUES 
(1,'Anvesh'),(2,'Martin'),(3,'Roy')
,(4,'Jeeny'),(5,'Kavita'),(6,'Neevan');

ALTER TABLE tbl_Employees ADD pgUser CHARACTER VARYING;

UPDATE tbl_Employees SET pgUser = 'abc' WHERE EmpID IN (1,2,3);
UPDATE tbl_Employees SET pgUser = 'xyz' WHERE EmpID IN (4,5,6);

GRANT SELECT,UPDATE,INSERT,DELETE ON tbl_Employees TO abc;
GRANT SELECT,UPDATE,INSERT,DELETE ON tbl_Employees TO xyz;

CREATE POLICY policy_employee_user ON tbl_Employees FOR ALL
TO PUBLIC USING (pgUser = current_user);

ALTER TABLE tbl_Employees ENABLE ROW LEVEL SECURITY;

SELECT *FROM tbl_Employees;

empid   empname   pguser
--------------------------
 1      Anvesh     abc
 2      Martin     abc
 3      Roy        abc

empid   empname   pguser
--------------------------
 4      Jeeny      xyz
 5      Kavita     xyz
 6      Neevan     xyz

What do you mean by Database Security?

Database security refers to the collective measures used to protect and secure a database or database management software from illegitimate use and malicious threats and attacks. It is a broad term that includes a multitude of processes, tools and methodologies that ensure security within a database environment.

What is Data Masking?

Database Theory: What is a Data Masking ?

What is Data Theft?

Data theft is the act of stealing computer-based information from an unknowing victim with the intent of compromising privacy or obtaining confidential information. Data theft is increasingly a problem for individual computer users, as well as big corporate firms.

Data must be stored and transmitted securely, so that information such as credit card numbers cannot be stolen. Over the Internet and Wide Area Network (WAN) environments, both public carriers and private network owners often route portions of their network through insecure landlines, extremely vulnerable microwave and satellite links, or a number of servers.

What are the different types of Security levels?

• Physical
• Human
• Operating System
• Network
• Database System

What does Database Encryption and Decryption mean?

Database encryption is the process of converting data, within a database, in plain text format into a meaningless cipher text by means of a suitable algorithm.

Database decryption is converting the meaningless cipher text into the original information using keys generated by the encryption algorithms.

Database encryption can be provided at the file or column level.

What is SQL injection?

SQL injection is an attack by malicious users in which malicious code can be inserted into strings that can be passed to an instance of SQL server for parsing and execution. All statements have to checked for vulnerabilities as it executes all syntactically valid queries that it receives.

Even parameters can be manipulated by the skilled and experienced attackers.

What are the methods used to protect against SQL injection attack?

Following are the methods used to protect against SQL injection attack:

• Use Parameters for Stored Procedures
• Filtering input parameters
• Use Parameter collection with Dynamic SQL
• In like clause, user escape characters

How can SQL Server instances be hidden?

To hide a SQL Server instance, we need to make a change in SQL Server Configuration Manager.

To do this launch SQL Server Configuration Manager and do the following:

select the instance of SQL Server, right click and select Properties. After selecting properties you will just set Hide Instance to “Yes” and click OK or Apply.

After the change is made, you need to restart the instance of SQL Server to not expose the name of the instance.

What are Orphaned Users?

A database user for which the corresponding SQL Server login is undefined or is incorrectly defined on a server instance cannot log in to the instance. Such a user is said to be an orphaned user of the database on that server instance.

• A database user can become orphaned if the corresponding SQL Server login is dropped.
• A database user can become orphaned after a database is restored or attached to a different instance of SQL Server.
• Orphaning can happen if the database user is mapped to a SID that is not present in the new server instance.

Would you please describe any five server role with its permission?

• bulkadmin: Granted – ADMINISTER BULK OPERATIONS
• dbcreator: Granted – CREATE ANY DATABASE
• diskadmin: Granted – ALTER RESOURCES
• processadmin: Granted – ALTER ANY CONNECTION, ALTER SERVER STATE
• securityadmin: Granted – ALTER ANY LOGIN
• serveradmin: Granted – ALTER ANY ENDPOINT, ALTER RESOURCES, ALTER SERVER STATE, ALTER SETTINGS, SHUTDOWN, VIEW SERVER STATE
• setupadmin: Granted – ALTER ANY LINKED SERVER
• sysadmin: Granted with GRANT option – CONTROL SERVER

Which authentication mode is more secured?

Windows authentication is definitely more secure as it’s controlled and authenticated by Active Directory policies.

What is a Symmetric key in Data encryption process?

In Symmetric cryptography system, the sender and the receiver of a message share a single, common key that is used to encrypt and decrypt the message. This is relatively easy to implement, and both the sender and the receiver can encrypt or decrypt the messages.

What is a Asymmetric key in Data encryption process?

Asymmetric cryptography, also known as Public-key cryptography, is a system in which the sender and the receiver of a message have a pair of cryptographic keys – a public key and a private key – to encrypt and decrypt the message. This is a relatively complex system where the sender can use his key to encrypt the message but he cannot decrypt it. The receiver, on the other hand, can use his key to decrypt the message but he cannot encrypt it.

What Secure Socket Layer (SSL) with SQL Server and can we enable it?

Yes: We can enable SSL with SQL Server

Microsoft SQL Server can use Secure Sockets Layer (SSL) to encrypt data that is transmitted across a network between an instance of SQL Server and a client application. Enabling SSL encryption increases the security of data transmitted across networks between instances of SQL Server and applications.

What are basic steps to configure SSL for SQL Server?

Install a certificate in the Windows certificate store of the server computer.

Click Start, in the Microsoft SQL Server program group, point to Configuration Tools, and thenclick SQL Server Configuration Manager.

Expand SQL Server Network Configuration, right-click the protocols for the server you want, and then click Properties.

On the Certificate tab, configure the Database Engine to use the certificate.

On the Flags tab, view or specify the protocol encryption option. The login packet will always be encrypted.

What are the built-In Schemas?

• dbo
• guest
• sys
• INFORMATION_SCHEMA

Are you agree with User-Schema Separation in SQL Server?

Yes: User-schema separation allows for more flexibility in managing database object permissions. A schema is a named container for database objects, which allows you to group objects into separate namespaces.

In this post, I am sharing the help on how to create, a read-only user with limited access in PostgreSQL Database Server?.

As a Database Administrator, you should create different database users for the different purposes.
In the standard application, there are a few various types of Database Users like Application user, Read-only user, Admin user.

You should always create a shared database role group and assign roles to the user.

Here, I am sharing one script to create the read only user with limited access to PostgreSQL Database. This user can only SELECT table data and also restricted by schema access.

Create the Read-Only user:

CREATE ROLE Read_Only_User WITH LOGIN PASSWORD 'Test1234' 
NOSUPERUSER INHERIT NOCREATEDB NOCREATEROLE NOREPLICATION VALID UNTIL 'infinity';

Assign permissions to the read only user:

GRANT CONNECT ON DATABASE YourDatabaseName TO Read_Only_User;
GRANT USAGE ON SCHEMA public TO Read_Only_User;
GRANT SELECT ON ALL TABLES IN SCHEMA public TO Read_Only_User;
GRANT SELECT ON ALL SEQUENCES IN SCHEMA public TO Read_Only_User;

In the above script, you can find that I restricted user by Database, Schema and gave only SELECT permission for tables.

If you need to give any additional permission like EXECUTE permission for functions, use below script.

GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA public TO Read_Only_User;