Does RS2005 check for SQL Injections on it's parameters?

Dear Anyone,

One of the common usage of report parameters in reporting services is having a free form text. One of the common ways of bringing data to RS is by using stored procs -- usually taking inputs from report parameters.

Does RS2005 have safeguards for SQL Injections and other hacking problems?

Thanks,

Joseph

RS uses the .Net SqlClient classes for building its queries. These classes guard against SQL injections issues.sql

Does Reporting Services allow you to select a dataset dynamically?

I have a remote report ...
I need to call one of two stored procedures depending on which parameters were passed to the report. (Both stored procedures return the same fields.)
Does SQL Reporting Services allow you to switch the dataset or stored procedure name dynamically? If so, where do I put the logic? Right now I have it working with one stored procedure.
I'm thinking that I should just make one stored procedure that takes all parameters and calls one of the other two stored procedures. Do I have any options besides this?

Thanks in advance!
Your query can be expression-based, e.g.; =Iif(Parameters!SomeParameterValue = 0, "EXEC sp1 1<parameter list>", EXEC sp2 1<parameter list>"). Alternatively, if the sp choice can be based on a configuration convention, you can use the Report Server web.config file to store the config value. The later case is demonstrated by the DynamicConnection report in this download. The report uses a dynamic connection string but the same approach can be applied to the query.|||That worked. Thanks!
sql

Does report support this parameters: ...&rs:Format=HTML4.0&rc:Parameters=false&ChainID:isN

hi,
I am working on some report page which will be access via URL.
And I found some old reports URL look like this:
...&rs:Format=HTML4.0&rc:Parameters=false&UserID:isNull=True...
What does the UserID:IsNull=True means? Is this right format for
SSRS2005?
ThanksIt means you have a parameter defined for your report called UserID and
you're setting its value to null via the URL.
Andy Potter|||Oh, ic, Thanks

Does report support this parameters: ...&rs:Format=HTML4.0&rc:Parameters=false&Chain

hi,
I am working on some report page which will be access via URL.
And I found some old reports URL look like this:
....&rs:Format=HTML4.0&rc:Parameters=false&UserID:isNull=True....

What does the UserID:IsNull=True means? Is this right format for SSRS2005?

Thanks

The UserID:IsNull=True notation is special syntax that allows you to pass null values as report parameters. In this case, you're passing null to the UserID parameter. For more info, see Books Online here:

http://msdn2.microsoft.com/en-us/library/ms155391.aspx

Here's all the info about URL access with Reporting Services:

http://msdn2.microsoft.com/en-us/library/ms153586(en-us,SQL.90).aspx

Best,
Chris

Does dtsinstall.exe Accept any Command Line Parameters?

The question is in the title.

Just one - the name of the install manifest file (this is how it is invoked when you double click the install manifest file in explorer).|||

Thanks, I was hoping I could give it a default destination directory instead of somewhere under DTS/Packages.

Does dtsinstall.exe Accept any Command Line Parameters?

The question is in the title.

Just one - the name of the install manifest file (this is how it is invoked when you double click the install manifest file in explorer).|||

Thanks, I was hoping I could give it a default destination directory instead of somewhere under DTS/Packages.

Do you have a list of parameters

Like the "toolbar=false" somewhere?

i'll be glad to get it.

Thanks again.

Please ignore :)|||Look in the BOL for URL access.

HTH, Jens Suessmeyer.

http://www.sqlserver2005.de

Do we know when Reporting Services finish the report??

Hi all,
I'm using Reporting Services with ASP .NET, user input report parameters in the web page then click submit, report will be display in an IFRAME in page. For a small report, things go fine. However, some reports need about a minute or 2 to finish, and during that time, all we can see is a blank rectangle frame... Because the code's only job is passing parameters to Reporting Services, no running status is displayed in the status bar. Sometimes our users think that the report contains no data, but it's actually running.
I was trying to put a "Please wait" button in the page, but the wait message runs only when the program was still in OnClick proc, which is not correct in this case because OnClick finished just in second...
Any way we can know when Reporting Services finish loading data to the frame, so we can display a message or status? Right now I have to put a text say: Report process will take up to 5 minutes, please wait
Thanks,Use ReportViewer Control to show the Reports in ASP.NET pages.
http://www.odetocode.com/Articles/128.aspx
Regards,
Karthik.A|||

I'm using Report Viewer now. And that's why I have the problem. Whenever you push parameters to Reporting Services, Report Viewer "iframe" will be displayed right away, but first as a blank rectangle, then the data will appear. For a small report, the time is about a second or 2, but for some of my reports, you have to stare at that rectangle for a few minutes to see data...
And 'cause Report Viewer is loaded, no way (IMO) ASP page can know whether the data is displayed or not....
Anyway we can know when the data is displayed in the Viewer so I can tell the user?
Thanks for yr time, though

|||I am also using ReportViewer in my project.
what i did ,First invisible the ReportViewer and the time of assigning the path i make it visible.
and try using Collapsable panel of eworld.UI control.
Regards,
Karthik.A

|||But for a lot of processing, the report will not display data right after you assign the path. When you assign the path, you actually pass on the parameters, no data is available yet... My problem is after I assign the path, I make the Report Viewer visible and my sub finish; but it takes the report a few minutes to process all the SQL query then push data back to the page. In the mean time, all you see is a blank rectangle.|||yes u r correct
i too tried for the same.i also got the same problem.
i have facerd another problem
when i try to send a long parameter as Query string
it gives me an Error stating Query Parameter is too long exceds 256 Characters.
How can i overcome this.
please enlighten me.
Thanx,
Karthik.A
|||Well, for a parameter, I'm not really sure why you want to put too much data in it. 256 is fine for me. If I want to pass long string to the report, I rather put it in a db table, then have the report read it... I don't think execute 1 more SQL Select command hurts your performance...