hi,
a good "start up" article on that can be found at http://www.sqlmag.com/Articles/ArticleID/50257/50257.html, by "Notre Dame SQL Server" Kalen Delaney, where she digs into lot of new catalog views to see where data is stored in the SQL Server 2005 architecture... but it's available for SQL Server Magazine subscriber only...
regards
|||Check out:
Estimating the Size of a Table and Estimating the Size of a Database on MSDN.
Mike
TIA,
Ian
Well you do not want to hear that answer, but it depends.It′s like asking, How much gas will I need when I travel from NYC to Seattle. Well that depends on how much data / luggage will be transported, which transport device you use, how much data will be retrieved, how often you will query the database, how many users will access the database, etc. There are many parameters to consider.
Jens K. Suessmeyer.
http://www.sqlserver2005.de
sql
I need to construct a SQL statement programmatically and must escape strings included as values to follow SQL rules. For example:
command.CommandText = "INSERT INTO Table (strColumn) VALUES('" +
EscapeSQLChars(badChars) + "')";
command.ExecuteNonQuery();
Is there a built-in .Net command that does what I want EscapeSQLChars to do?
Use paramitrimized queries. Then you never have to worry about format's or
SQL Injection.
It's olso better for the preformance, because you don't need
to have to concatenate a string for example:
= "SELECT * FROM Table1 WHERE ID = " + txtId.Text + " AND Name = \"" +
"txtName.Text + "\"";
No escape characters needed, you doesn't
have to think about using a " or not etc.
Parameters are like
placeholders, you use them in Stored Procedures as well.
A little example:
variable.
DateTime date = DateTime.Now;
// Set query and parameters.
const string query = "SELECT * FROM Table1
WHERE MyDate = @.MyDate";
SqlParameter pMyDate = new SqlParameter("@.MyDate",
SqlDbType.DateTime);
pMyDate.Value = date;
// Create connection and open it.
SqlConnection dbConn = new
SqlConnection("ConnectingString");
dbConn.Open();
try
{
using(SqlCommand dbCommand = new SqlCommand(query,
dbConn))
{
// Add paramter to Command.
dbCommand.Parameters.Add(
pMyDate );
// Execute the query and get results.
SqlDataReader reader =
dbCommand.ExecuteReader();
try
{
// Walkthrough
results.
while(reader.Read())
{
// TODO: Do something with
the data.
}
}
finally
{
// Close
reader.
reader.Close();
}
}
}
finally
{
// Close
connection.
dbConn.Close();
}
I need to construct a SQL statement programmatically and must escape strings included as values to follow SQL rules. For example:
command.CommandText = "INSERT INTO Table (strColumn) VALUES('" +
EscapeSQLChars(badChars) + "')";
command.ExecuteNonQuery();
Is there a built-in .Net command that does what I want EscapeSQLChars to do?
Use paramitrimized queries. Then you never have to worry about format's or
SQL Injection.
It's olso better for the preformance, because you don't need
to have to concatenate a string for example:
= "SELECT * FROM Table1 WHERE ID = " + txtId.Text + " AND Name = \"" +
"txtName.Text + "\"";
No escape characters needed, you doesn't
have to think about using a " or not etc.
Parameters are like
placeholders, you use them in Stored Procedures as well.
A little example:
variable.
DateTime date = DateTime.Now;
// Set query and parameters.
const string query = "SELECT * FROM Table1
WHERE MyDate = @.MyDate";
SqlParameter pMyDate = new SqlParameter("@.MyDate",
SqlDbType.DateTime);
pMyDate.Value = date;
// Create connection and open it.
SqlConnection dbConn = new
SqlConnection("ConnectingString");
dbConn.Open();
try
{
using(SqlCommand dbCommand = new SqlCommand(query,
dbConn))
{
// Add paramter to Command.
dbCommand.Parameters.Add(
pMyDate );
// Execute the query and get results.
SqlDataReader reader =
dbCommand.ExecuteReader();
try
{
// Walkthrough
results.
while(reader.Read())
{
// TODO: Do something with
the data.
}
}
finally
{
// Close
reader.
reader.Close();
}
}
}
finally
{
// Close
connection.
dbConn.Close();
}
