MAPI xp_sendmail vulnerabilities...?

What are risks of 1) granting exec on master..xp_sendmail to a sql user acco
unt (web application front end) 2) running mapi protocol on the db server i
n order to use xp_sendmail? Will limiting to outbound mail only provide need
ed security?
Thanks in advance,
ChrisYou "may" be vulnerable to any security holes in the MAPI client as sending
mail invokes the client process in memory. To confirm this, monitor the run
ning processes then send mail. If using Outlook as the MAPI client you will
notice outlook.exe starts
as a process. If using an Exchange mailbox, Outlook will (by default) exami
ne the mail headers of the incoming mail (you may need to block incoming mai
l in Exchange or at the gateway to prevent unsolicited emails).
If using xp_sendmail and/or the SQL Agent mail then I suggest you keep your MAPI client
software patched. If you only need to send mail from an extended stored procedure you
may wish to consider xp_smtp_sendmail (www.sqldev.net) which has a smaller
attac
k area (doesn't use a MAPI client like Outlook).

Many to One with Max Date Query?

I have a master table that has all my accounts in it.
In a 2nd table I have update notes per each account, so there are
multiple notes entries for each single ID account in teh first table.

How can I get the OLDEST dated entry in teh second table, for every
account that's had a not entered into if by joining on the ID of the
first table?

This has been driving me nuts, does that make sense to you?

Here:

Table 1 FIELDS
ACCOUNTID

TABLE 2 FIELDS
NOTEID
ACCOUNTID (Foreign Key)
DATE_ENTERED

I need to join those two tables on the ACCOUNTID, but ONLY show the most
recent date for the record I pull from Table 2, since it's got multiple
entries in table 2, it's screwing my query up. Any help/ideas?

*** Sent via Developersdex http://www.developersdex.com ***
Don't just participate in USENET...get rewarded for it!SELECT T1.accountid, T2.noteid, T2.date_entered
FROM Table1 AS T1
JOIN Table2 AS T2
ON T1.accountid = T2.accountid
AND T2.date_entered =
(SELECT MIN(date_entered)
FROM Table2
WHERE accountid = T2.accountid)

--
David Portas
SQL Server MVP
--

Many to Many Question

SQL2000
I have 3 tables
Customers
TBL_Categories (Master Table of Categories)
CUS_Categories (Many-to-Many Table)
My Schema is something like this:
TBL_Categories
SysID
CategoryName
CUS_Categories
SysID
CategoryID (Sysid in TBL_Categories)
CustomerID
I am looking for a query that will give me a list of all Category Names that
do not exists in CUS_Categories for a specific customer.
i.e. SELECT CategoryName FROM TBL_Categories WHERE (no categories exists for
customer 1)
TIA
Tim Morrison
On Fri, 10 Dec 2004 10:24:40 -0600, Tim Morrison wrote:

>SQL2000
>I have 3 tables
>Customers
>TBL_Categories (Master Table of Categories)
>CUS_Categories (Many-to-Many Table)
>My Schema is something like this:
>TBL_Categories
> SysID
> CategoryName
>CUS_Categories
> SysID
> CategoryID (Sysid in TBL_Categories)
> CustomerID
>I am looking for a query that will give me a list of all Category Names that
>do not exists in CUS_Categories for a specific customer.
>i.e. SELECT CategoryName FROM TBL_Categories WHERE (no categories exists for
>customer 1)
Hi Tim,
SELECT CategoryName
FROM TBL_Categories
WHERE NOT EXISTS
(SELECT *
FROM CUS_Categories
WHERE CUS_Categories.CategoryID = TBL_Categories.SysID
AND CUS_Categories.CustomerID = 1)
(untested)
Best, Hugo
(Remove _NO_ and _SPAM_ to get my e-mail address)

Managing Transactions in Stored Procedure (Nested)

Hi Everyone:

I have a master sp that calls 5 different sps. I would like to incorporate transaction(COMMIT and ROLLBACK) into my master sp. If do that, is that enough, or do I need to add some transaction code to the 5 sps that are being called. I would appreciate if you provide me with code, syntax and steps on how to do this for a specific situation like mine. I have read some articles on nested sps and transactions, but most are very complex examples, I just need a simple approach/advise. Thanks.

Rollback and Commit action should apply to your nested stored procedure calls. When you call a stored procedure within a transaction it executes within the context of that transaction. However, be wary about errors from the stored procedures you are calling from the master stored procedure. Review error handling within stored procedures to make sure you are equipt to handle nested errors and apply the proper transaction method.

Managing Transactions in Stored Procedure (Nested)

Hi Everyone:

I have a master sp that calls 5 different sps. I would like to incorporate transaction(COMMIT and ROLLBACK) into my master sp. If do that, is that enough, or do I need to add some transaction code to the 5 sps that are being called. I would appreciate if you provide me with code, syntax and steps on how to do this for a specific situation like mine. I have read some articles on nested sps and transactions, but most are very complex examples, I just need a simple approach/advise. Thanks.

Rollback and Commit action should apply to your nested stored procedure calls. When you call a stored procedure within a transaction it executes within the context of that transaction. However, be wary about errors from the stored procedures you are calling from the master stored procedure. Review error handling within stored procedures to make sure you are equipt to handle nested errors and apply the proper transaction method.