0

How can I validate SELECT statements, without executing using .Net and C#?

If the sql is not valid or if the sql is other operation than SELECT (example: alter, insert, delete, ...) I want to return error rows.

This question is very much like: Code to validate SQL Scripts. But I'm not want to accept any sql script. I want to accept only SELECT statements.

Improve this question

2 Answers 2

Reset to default
2

Begin the statement with SET NOEXEC ON

http://msdn.microsoft.com/en-us/library/ms188394.aspx

Improve this answer
Sign up to request clarification or add additional context in comments.

3 Comments

Thanks for help but this solve the SQL script validation. How to solve my question about SELECT? I want to validate ONLY select statements.
You could check it as per SverreN's answer, but that could be pretty unsafe. Better would be to check it as per this answer, and only ever run it under a very limited SQL user account which only had SELECT permissions.
Thinking outside the box, you could ensure that the user is a read only user. Then they can never update data. Don't rely in manual parsing to exclude data changes. They could run a stored procedure that performs updates/inserts and you wouldn't know.
0

Use a Regular Expression to check it:
regex = "SELECT [*] FROM [*]"

Improve this answer

1 Comment

Good idea, but would have to be really careful that the regex used didn't allow injection vectors like comments and so on.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.