Whenever you are searching for SQL query optimization tips or prevent SQL injection tips, you can find few common suggestions like: Please do not use Dynamic SQL in your Stored Procedure. Please try to avoid the use of Temp Tables.

I always tell to database developers, please try to avoid the use of Dynamic SQL and Temp Table in your Stored Procedures.

A Temp Table requires additional CPU/IO which degrades the query performance. A Dynamic SQL is not safe against the SQL Injection and It also compiles data every time which requires more Memory.

Here, I am sharing one of the important scripts which gives you list of SQL Server Stored Procedures, which use the Dynamic SQL and Temp Table.
You can easily get the list of Stored Procedures and can make plans of modifying it.

Prepared this script using sys.dm_exec_describe_first_result_set and sys.procedures where error number 4 = Dynamic SQL and error number 10 = Temporary Table.

SELECT  
	SP_Name
	,error_message
	,error_type_desc 
FROM (SELECT schema_name(schema_id)+'.'+name SP_Name FROM sys.procedures) AS T
CROSS APPLY sys.dm_exec_describe_first_result_set (SP_Name, NULL, 0) 
WHERE error_type IN (4,10)

The PostgreSQL Prepared Statement or Parameterized Statements are always good for specific purpose like: can create Prepared Statement for frequently executing query of a session, It also prevents from SQL Injections.

Prepared Statements are faster for a particular session because It does not require parsing and compiling for each execution. It is only session specific and once a session kill, Prepared Statements automatically destroy.

Here, You can access more on Prepared Statements.

Prepared or Parameterized Statements in Database System

Small demonstration of PostgreSQL Prepared Statement:

Create a table with sample records:

CREATE TABLE tbl_Students 
(
	StudID INTEGER PRIMARY KEY
	,StudName CHARACTER VARYING
	,StudClass CHAR(1)	
);

INSERT INTO tbl_Students 
VALUES (1,'Anvesh','A')
,(2,'Neevan','B'),(3,'Jenny','C')
,(4,'Roy','C'),(5,'Martin','C');

Create a Prepared Statement to SELECT Students data:

PREPARE pre_GetStudents (INT) AS 
SELECT *FROM tbl_Students WHERE StudID = $1;

Execute a Prepared Statement:

EXECUTE pre_GetStudents(2);

System view to check the Prepare statements of session:

SELECT *FROM pg_prepared_statements;

How do you grant a SQL Server developer truncate table permission without giving them the ability to alter the table?

This is accomplished by a DBA creating a stored procedure with the TRUNCATE TABLE statements and then granting execute permission on the stored procedure to those who need it.

I have a table where some of the columns should not be queryable by all users. How can I filter the data appropriately, so that not everyone can select the data?

One of the easiest ways to do this is through the use of views.

If we can use a view, we can successfully filter the data and grant the users access to the view, we can present just the data we want the users to have access to.

however, there are two requirements for this:

• The users do not already have the ability to select data from the table.
• A view can be created where an ownership chain can be established with the table.

How to grant only few columns without creating views?

We can assign column list to table.

GRANT SELECT ON dbo.Employee (EmployeeID, FirstName, MiddleName, SurName) TO HR_Intern;

I can create Stored Procedure, but However, when I went to execute the stored procedure, SQL Server told me I didn’t have permission to do so. Is this a bug or did I do something wrong?

This is entirely possible if you have the ability to create a stored procedure in a schema you don’t own.

In this particular case we’ve created a role that has the ability to create stored procedures in the database and the ability to alter the dbo schema. By default, the dbo schema is owned by the database owner.

What do you know about the SQL Server 2016 Row Level Security?

SQL Server 2016 has introduced Row Level Security (RLS) which is a feature that enables fine grained control over access to rows in a table. RLS allows you to easily control which users can access which data with complete transparency to the application.This enables us to easily restrict the data based on the user identity or security context.

Row-Level Security enables customers to control access to rows in a database table based on the characteristics of the user executing a query.

Which are the different predicates support by Row Level Security?

RLS supports two types of security predicates.

Filter predicates silently filter the rows available to read operations (SELECT, UPDATE, and DELETE).

Block predicates explicitly block write operations (AFTER INSERT, AFTER UPDATE, BEFORE UPDATE, BEFORE DELETE) that violate the predicate.

What do you know about the Dynamic Data Masking?

Dynamic data masking limits sensitive data exposure by masking it to non-privileged users. Dynamic data masking helps prevent unauthorized access to sensitive data by enabling customers to designate how much of the sensitive data to reveal with minimal impact on the application layer. It’s a data protection feature that hides the sensitive data in the result set of a query over designated database fields, while the data in the database is not changed.

For example, a call center support person may identify callers by several digits of their social security number or credit card number, but those data items should not be fully exposed to the support person. A masking rule can be defined that masks all but the last four digits of any social security number or credit card number in the result set of any query.

What should be the characteristics for strong password?

• Is at least 8 characters long.
• Combines letters, numbers, and symbol characters within the password.
• Is not found in a dictionary.
• Is not the name of a command.
• Is not the name of a person.
• Is not the name of a user.
• Is not the name of a computer.
• Is changed regularly.
• Is significantly different from previous passwords.

How SQL Injection Works?

The primary form of SQL injection consists of direct insertion of code into user-input variables that are concatenated with SQL commands and executed. A less direct attack injects malicious code into strings that are destined for storage in a table or as metadata. When the stored strings are subsequently concatenated into a dynamic SQL command, the malicious code is executed.

The injection process works by prematurely terminating a text string and appending a new command. Because the inserted command may have additional strings appended to it before it is executed, the malefactor terminates the injected string with a comment mark “–“. Subsequent text is ignored at execution time.

What are your best practices to avoid SQL Injection?

• Validate all input.
• Use Type-Safe SQL Parameters.
• Use Parameterized Input with Stored Procedures.
• Wrapping Parameters with QUOTENAME() and REPLACE().
• Use the Parameters Collection with Dynamic SQL.

How Do You Determine What Data Are Confidential?

• We should to contact our legal department (if there is one), an attorney, or law professor, if in doubt about data.
• Ask about, What type of data should we be extra cautious about?
• Ask government officials or look at government websites on the industry we are in.
• We should think like a hacker.

Have you seen any performance hit using SQL Server Transparent Data Encryption (TDE)?

Given that you are performing more operations, there is some. One advantage to TDE is that the data is only encrypted in disk. So if it’s in SQL Server’s memory buffers, there’s no repeated decryption going on.

Any concerns about the SQL Server public database role?

Yes, the general recommendation is to avoid using the public role. Every database user is a member of public. As a result, any permissions assigned to it are also assigned to every database user.

What do you use to avoid the SQL Server fixed server roles?

The recommended practice is to create a role and assign explicit permissions.

A developer wants to execute a SQL Server stored procedure in debug mode. I believe SQL Server sysadmin level access required to use debug mode. I don’t want to give sysadmin access to the developer. Is there any I can handle this without giving sysadmin access?

Unfortunately, there is not. Debugging requires sysadmin role membership.

Is it possible to grant linked server permissions to Windows user group?

Yes: A Windows group is no different from any other login.

T-SQL Script to find mismatched between Database Login and Server Login.

SELECT d.[name] AS 'DB User', s.[name] AS 'Login', s.sid AS 'SID'
FROM sys.database_principals d
 JOIN sys.server_principals s
 ON d.sid = s.sid
WHERE d.[name] <> s.[name];

What is the main hierarchy of Permissions?
Please visit this Microsoft official documents:

What should be your common practice for SQL Server Security?

• SQL Server should be hardened after the installation.
• After the installation, use the SQL Server Configuration Manager tool in order to disable unnecessary features and services.
• Install only required components.
• Recent service packs and critical fixes should be installed for SQL Server and Windows.
• Windows Authentication mode is more secure than SQL Authentication.
• If there is still a need to use SQL Authentication – enforce strong password policy.
• Disable the SA account and rename it. Do not use this account for SQL server management.
• Change default SQL Server ports associated with the SQL Server installation to keep hackers from port scanning the server.
• Hide SQL Server instances or disable the SQL Server Browser service.
• Remove BUILDIN\Administrators group from the SQL Server Logins.
• Enable logging SQL Server login attempts (failed & successful).
• Defining Database Ownership to Increase Security.
• Disabling certain system stored procedures.

What do you mean by Database Security?

Database security refers to the collective measures used to protect and secure a database or database management software from illegitimate use and malicious threats and attacks. It is a broad term that includes a multitude of processes, tools and methodologies that ensure security within a database environment.

What is Data Masking?

Database Theory: What is a Data Masking ?

What is Data Theft?

Data theft is the act of stealing computer-based information from an unknowing victim with the intent of compromising privacy or obtaining confidential information. Data theft is increasingly a problem for individual computer users, as well as big corporate firms.

Data must be stored and transmitted securely, so that information such as credit card numbers cannot be stolen. Over the Internet and Wide Area Network (WAN) environments, both public carriers and private network owners often route portions of their network through insecure landlines, extremely vulnerable microwave and satellite links, or a number of servers.

What are the different types of Security levels?

• Physical
• Human
• Operating System
• Network
• Database System

What does Database Encryption and Decryption mean?

Database encryption is the process of converting data, within a database, in plain text format into a meaningless cipher text by means of a suitable algorithm.

Database decryption is converting the meaningless cipher text into the original information using keys generated by the encryption algorithms.

Database encryption can be provided at the file or column level.

What is SQL injection?

SQL injection is an attack by malicious users in which malicious code can be inserted into strings that can be passed to an instance of SQL server for parsing and execution. All statements have to checked for vulnerabilities as it executes all syntactically valid queries that it receives.

Even parameters can be manipulated by the skilled and experienced attackers.

What are the methods used to protect against SQL injection attack?

Following are the methods used to protect against SQL injection attack:

• Use Parameters for Stored Procedures
• Filtering input parameters
• Use Parameter collection with Dynamic SQL
• In like clause, user escape characters

How can SQL Server instances be hidden?

To hide a SQL Server instance, we need to make a change in SQL Server Configuration Manager.

To do this launch SQL Server Configuration Manager and do the following:

select the instance of SQL Server, right click and select Properties. After selecting properties you will just set Hide Instance to “Yes” and click OK or Apply.

After the change is made, you need to restart the instance of SQL Server to not expose the name of the instance.

What are Orphaned Users?

A database user for which the corresponding SQL Server login is undefined or is incorrectly defined on a server instance cannot log in to the instance. Such a user is said to be an orphaned user of the database on that server instance.

• A database user can become orphaned if the corresponding SQL Server login is dropped.
• A database user can become orphaned after a database is restored or attached to a different instance of SQL Server.
• Orphaning can happen if the database user is mapped to a SID that is not present in the new server instance.

Would you please describe any five server role with its permission?

• bulkadmin: Granted – ADMINISTER BULK OPERATIONS
• dbcreator: Granted – CREATE ANY DATABASE
• diskadmin: Granted – ALTER RESOURCES
• processadmin: Granted – ALTER ANY CONNECTION, ALTER SERVER STATE
• securityadmin: Granted – ALTER ANY LOGIN
• serveradmin: Granted – ALTER ANY ENDPOINT, ALTER RESOURCES, ALTER SERVER STATE, ALTER SETTINGS, SHUTDOWN, VIEW SERVER STATE
• setupadmin: Granted – ALTER ANY LINKED SERVER
• sysadmin: Granted with GRANT option – CONTROL SERVER

Which authentication mode is more secured?

Windows authentication is definitely more secure as it’s controlled and authenticated by Active Directory policies.

What is a Symmetric key in Data encryption process?

In Symmetric cryptography system, the sender and the receiver of a message share a single, common key that is used to encrypt and decrypt the message. This is relatively easy to implement, and both the sender and the receiver can encrypt or decrypt the messages.

What is a Asymmetric key in Data encryption process?

Asymmetric cryptography, also known as Public-key cryptography, is a system in which the sender and the receiver of a message have a pair of cryptographic keys – a public key and a private key – to encrypt and decrypt the message. This is a relatively complex system where the sender can use his key to encrypt the message but he cannot decrypt it. The receiver, on the other hand, can use his key to decrypt the message but he cannot encrypt it.

What Secure Socket Layer (SSL) with SQL Server and can we enable it?

Yes: We can enable SSL with SQL Server

Microsoft SQL Server can use Secure Sockets Layer (SSL) to encrypt data that is transmitted across a network between an instance of SQL Server and a client application. Enabling SSL encryption increases the security of data transmitted across networks between instances of SQL Server and applications.

What are basic steps to configure SSL for SQL Server?

Install a certificate in the Windows certificate store of the server computer.

Click Start, in the Microsoft SQL Server program group, point to Configuration Tools, and thenclick SQL Server Configuration Manager.

Expand SQL Server Network Configuration, right-click the protocols for the server you want, and then click Properties.

On the Certificate tab, configure the Database Engine to use the certificate.

On the Flags tab, view or specify the protocol encryption option. The login packet will always be encrypted.

What are the built-In Schemas?

• dbo
• guest
• sys
• INFORMATION_SCHEMA

Are you agree with User-Schema Separation in SQL Server?

Yes: User-schema separation allows for more flexibility in managing database object permissions. A schema is a named container for database objects, which allows you to group objects into separate namespaces.

Does SQL Server reuses space to accommodate new data, When we delete variable length column or rows?

Whenever rows or columns are deleted from a table, SQL Server reuses space to accommodate new data.

However, this is not the case when a variable length column is deleted.

The space used by this type of column is not reclaimed automatically.

Variable length columns can be of data types varchar, nvarchar, varchar(max), nvarchar(max), varbinary, varbinary(max), text, ntext, image, sql_variant, and xml.

As a DBA, what should be your daily checklist for Database Server?

• Check status of backups
• Review the nightly run processes
• Check the error log files
• Check the windows error log files
• Check the status of SQL Agent jobs
• Review the performance related report of SQL Server
• Check the storage information
• Review the configured Service broker
• Indentify the different type of fragmentations

How to recycle SQL Server Agent Error logs?

We can use sp_cycle_agent_errorlog system procedure to recycle SQL Server Agent Error logs.

When we cycle the error logs it is easier to open up a SQL Server Agent Error Log file when it is smaller in size.

What is a Scheduled Jobs or What is a Scheduled Tasks?

Scheduled tasks let user automate processes that run on regular or predictable cycles. User can schedule administrative tasks, such as cube processing, to run during times of slow business activity.

User can also determine the order in which tasks run by creating job steps within a SQL Server Agent job. E.g. back up database, Update Stats of Tables. Job steps give user control over flow of execution. If one job fails, user can configure SQL Server Agent to continue to run the remaining tasks or to stop execution.

What should be your recommendations for Shrinking a database?

Shrink the file by using Truncate Only: First it removes the inactive part of the log and then perform shrink operation.

Rebuild / Reorganize the indexes once the shrink is done so the Fragmentation level is decreased.

What are the different type of log files?

• SQL Server Error Log
• SQL Server Agent Log
• Windows Event Log
• SQL Server Setup Log
• SQL Server Profiler Log

How many datafiles I can put in Tempdb? What is the effect of adding multiple data files?

The most effective configuration is to set tempdb on its own separate fast drive away from the user databases. I would set the number of files based on # of cpu’s divided by 2.

Which trace flag is used to find log record for SQL Server connection?

trace flag number: 4013

What do you know about the resource database?

All sys objects are physically stored in resource database and logically available on every database.

Resource database can faster the service packs or upgrades.

Why can’t I view the list of databases, tables, views in the SQL ServerManagement Studio Object Explorer?

This issue is due to not having VIEW DEFINITION permission on the specific object.

To resolve this issue, you need to grant VIEW DEFINITION permission on the object to the user which is mapped to the login you used.

You can perform this by running the following Transact-SQL.

USE database_name;
GO
GRANT VIEW DEFINITION ON [object_name] TO
[database_user/database_role]

Can we initiate a external COM object from within SQL?

Yes: we can use the stored procedure sp_OACreate to initiate the external COM object from the T-SQL.

What sp_MSforeachtable  does ?

You can use sp_MSforeachtable undocumented stored procedure to rebuild all indexes in your database.

Try to schedule it to execute during CPU idle time and slow production periods.

What will you do if you lost rights of your SQL Server instance?

We can use the below options:

• Dedicated Administrator Connection
• BUILIN\Administrator Group (Incase its rights are not revoked)
• Final Option is to change the registry value
• You can change authentication mode via registry

What is SQL Injection?

SQL Injection is developed where unhandled\unexpected SQL commands are passed to SQL Server in a malicious manner. It is a problem because unknowingly data can be stolen, deleted, updated, inserted or corrupted.

What is CPU Affinity?

CPU Affinity sometimes refers as CPU pinning enables a particular process or a thread to use one or more Central Processing Unit, it depends upon the number of CPU configured in your system. It enables particular thread or process to use only configured CPU rather than any CPU that’s configured in your Operating system.

As a part of your job, what are the DBCC commands that you commonly use for database maintenance?

• DBCC CACHESTATS – Displays information about the objects currently in the buffer cache.
• DBCC CHECKDB – This will check the allocation of all pages in the database as well as check for any integrity issues.
• DBCC CHECKTABLE – This will check the allocation of all pages for a specific table or index as well as check for any integrity issues.
• DBCC DBREINDEX – This command will reindex your table. If the indexname is left out then all indexes are rebuilt. If the fillfactor is set to 0 then this will use the original fillfactor when the table was created.
• DBCC PROCCACHE – This command will show you information about the procedure cache and how much is being used. Spotlight will also show you this same information.
• DBCC MEMORYSTATUS – Displays how the SQL Server buffer cache is divided up, including buffer activity.
• DBCC SHOWCONTIG – This command gives you information about how much space is used for a table and indexes. Information provided includes number of pages used as well as how fragmented the data is in the database.
• DBCC SHOW_STATISTICS – This will show how statistics are laid out for an index. You can see how distributed the data is and whether the index is really a good candidate or not.
• DBCC SHRINKFILE – This will allow you to shrink one of the database files. This is equivalent to doing a database shrink, but you can specify what file and the size to shrink it to. Use the sp_helpdb command along with the database name to see the actual file names used.
• DBCC SQLPERF – This command will show you much of the transaction logs are being used.
• DBCC TRACEON – This command will turn on a trace flag to capture events in the error log. Trace Flag 1204 captures Deadlock information.
• DBCC TRACEOFF – This command turns off a trace flag.