Software Voices - Programming

ssh tunnel to Amazon EC2 as a temporary web proxy for privacy and security

nospam@example.com (Eric Hammond) — Fri, 09 Nov 2007 16:40:57 -0600

I was recently using a public wifi connection in a situation where I trusted neither the network operators nor the other wifi users around me. In order to protect my privacy and the security of my data passed over HTTP, I set up a web proxy using a temporary Amazon EC2 instance. With an ssh tunnel from my laptop to squid running on the the EC2 instance, my HTTP traffic was encrypted over the wifi and local network, then went out as normal from Amazon's networks to the target web servers.

I started by firing up an instance of ec2gutsy.notlong.com, a base Ubuntu 7.14 Gutsy server install which I previously built, registered, and made public. Feel free to use it yourself, though this basic approach would work with pretty much any AMI as long as you can install squid. You'll obviously need to have previously set up an Amazon AWS/EC2 account and have configured and installed some sort of client (command line, web, extension) to start up instances.

ec2-run-instances -k KEYPAIR ami-b111f4d8

ec2-describe-instances INSTANCEID

Install the squid proxy server (default config works just fine) and set up an ssh tunnel from port 3128 on the local computer to the squid port on the EC2 instance.

ssh -i SSHIDENTITY root@HOSTNAME "apt-get -y install squid"

ssh -i SSHIDENTITY -f -N -L3128:localhost:3128 root@HOSTNAME

Now all that's left is to configure the web browser to use the ssh tunnel to the squid proxy. In Firefox this is under: Edit / Preferences / Advanced / Network / Settings... / [X] Manual proxy configuration

Set the HTTP Proxy to "localhost" port "3128".

You can confirm that the network traffic is going through the Amazon EC2 instance by watching the squid log file on that instance while you browse:

tail -f /var/log/squid/access.log

I thought that paying 10 cents an hour (EC2 fee) to protect my privacy and security was a pretty good bargain, but don't forget to terminate the instance when you're done with it and reset your browser proxy settings.

[Edited 2008-03-14 to update AMI ID]

Only seeing 3GB of RAM on Ubuntu 7.04 Feisty when 4GB are installed? [SOLUTION]

nospam@example.com (Eric Hammond) — Tue, 17 Jul 2007 17:59:42 -0500

I've been using Ubuntu Linux for a number of versions now. My Dell system has 4GB of memory (as verified by checking the BIOS at boot time) but after one of the upgrades it started to report that it could only see 3GB.

$ free

             total       used       free     shared    buffers     cached

Mem:       3106764    2960304     146460          0     129636    1046552

-/+ buffers/cache:    1784116    1322648

Swap:            0          0          0

This seems to be a fairly common problem. I and some Ubuntu friends suffered for many months thinking that this just wasn't solvable, waiting patiently for the good Ubuntu folks to magically make it work again in a future version.

Then, one day I installed Ubuntu Feisty on a server at JohnCompanies, and I noticed that I could see all 4GB of RAM there.

Continue reading "Only seeing 3GB of RAM on Ubuntu 7.04 Feisty when 4GB are installed? [SOLUTION]"

Convenient svn-ignore script for Subversion

nospam@example.com (Eric Hammond) — Fri, 03 Nov 2006 08:21:27 -0600

Subversion allows you to specify certain filenames that it will ignore when performing certain operations (like "svn status"). These are often temporary files that you do not want to have under revision control. Back in the CVS days this was fairly easy with a simple file named ".cvsignore" that you could edit.

With Subversion, however, I have to remember and type the following correctly and then use vi to add the name:

svn propedit svn:ignore DIRECTORY

It looks simple, but it was so unintuitive it took me months to memorize it correctly and I still think it's ugly. Plus, I'm not particularly in love with vi, though I've been using it for over 20 years. I would much rather type something direct like:

svn-ignore DIRECTORY/FILENAME

so I wrote the following shell script which lets me do just that:

Continue reading "Convenient svn-ignore script for Subversion"

Steve Kelley Heart Model-to-model Transforms ... Not

nospam@example.com (Jollymorphic) — Tue, 15 Aug 2006 01:04:00 -0500

A short while ago, I posted an article here arguing that model-to-model transformations (or rather, modularity features based on them) are necessary to escape a new "tyranny of the dominant decomposition" in model-driven programming. Well, what should arrive in my electronic mailbox a few days ago but a newsletter from MetaCase wherein the first big headline reads, provocatively, "Model-To-Model Transformations: A Recipe for Trouble." Oh my!

The newsletter links to an article posted a couple of months ago by Steve Kelley on the Code Generation Network site. In a nutshell, Kelley argues "[o]ur experience is that it is better that generators produce code directly, rather than producing intermediate models that you need to extend during the development process." He has a lot more to say than this, of course, and the whole editorial is definitely worth your time.

The Whole Article

He spends some time laying out the benefits of code generation for product line development (though he distinguishes this from a one-off project, where "the payback may be little greater than the effort required to automate"). And he explains why a UML-based approach, or one based on any "general-purpose design language" for that matter, is doomed to the same fate as those products of yesteryear that have "taught many developers to look at code generators with suspicion." He argues that only domain-specific languages created by a product line's architects themselves can appropriately model features of the domain and serve as a basis for handcraft-quality code generation:

If we wish to raise the abstraction level beyond code, yet still be able to generate fully working code, going domain-specific is the only alternative.... Despite the existence of multiple ways to write code for a certain behavior, vendors usually choose just one of them, which is unlikely the ideal candidate for your specific contingency.... Third-party generators often don't know enough about an organization's specific requirements to generate ideal code, so it is not surprising that many have found generated code unsatisfactory.

Kelley then advocates simplicity as a central principle in the development of code generators based on domain-specific models. "The simpler they are to start with, the simpler it will be to make changes to them later." He discusses ways of keeping generators simple (depend on model validation rather than validating input, isolate repeating code patterns into libraries), and he prescribes the use of "a good reference implementation" as a starting point for implementing any model-to-code transformation. All of this is quite useful and appropriate advice for those using the current generation of tools, and there are many people exploring or working in this blossoming field who would doubtless benefit greatly from it.

Night and Day

As it turns out, though, our seemingly conflicting points of view amount to apples and oranges. Because when Kelley talks about model-to-model transformations, he's talking about a different way of automating software development than I am. He's talking about a user-modified, bidirectional train wreck that we both find repugnant, and for the same reasons:

Normally, the idea of model-to-model transformation is that each piece of data in the high-level language gets transformed to more than one piece of data in the lower-level language (let's say 2 pieces).

We've already parted ways here, by the way, as this passage describes the primary purpose of model-to-model transformations as the generation of lower-level models; a strictly downward-directed process. The kinds of technologies I highlight in my post are concerned with transformations in any direction, and most of the examples are horizontal, not vertical. I want a modularity strategy for transformations to be just as general as the modularity I've enjoyed in OOP languages, which have allowed me to gracefully model relationships that are horizontal, vertical, and everything "in between."

This is fine if you never (or rarely) look at the low-level language, and never (or very rarely) edit it. But if you decide to edit it, you are then working with two pieces of data, but clearly they are not totally independent, since they could be produced from one piece. The result of this is that any changes to the higher level would need to map those changes back to lower levels too.

Often people say next "and we want to be able to change the high-level models still, and have those changes reflected in the low level models". That means you are working with 1+2 pieces of information, plus that you need to come up with some way to propagate the changes down to the low-level models correctly. "Correctly" here means: without destroying information manually added to those low-level models; updating the automatically generated parts; creating new generated parts; updating manually added parts to reflect changes in the top-level models (e.g. if the manually added part refers to the name of an element originally from the high level model, and that element's name has now been changed).

Horrors, indeed! A setup like this violates a critical characteristic of successful generative methods: the inviolate nature of generated artifacts. Kelley briefly mentions an example of this characteristic elsewhere in his article, saying, "A DSM generator['s] output will not normally be edited or even checked by hand." So, of course, he finds such approaches untenable, as do I.

If this reflects, as Kelley suggests, the current state of the art in model-to-model transformations, I'd be sad but not surprised. But I'm also hopeful and eager for the long-term potential presented by some of the technologies currently being nurtured academically.

And lest you thought Mr. Kelley's customers stopped there, there's more...

And next, people say "and we want to be able to change the low-level models, and have the high-level models update". This is even harder.

I'LL SAY IT IS! Now my earlier sadness has shifted focus from the model business to its customers.

Conclusion

Obviously, Kelley and I are talking about different things. He's looking at current practice, particularly people who think they want "model-to-model transformations," and he's rightly turning up his nose. What I'm interested in, on the other hand, are ways of modularizing this new abstraction layer bestowed upon us by generative and model-driven programming, so as to achieve leverage in ways analogous to those with which I've been successful using currently popular programming methods. I think the best way to do this in the new world is the same as the best way in the old: separation of concerns. And I think those concerns have to be realized in a way that cross-cuts implementations. The kinds of designs that can accomplish this tend to use model-to-model transformations, but they don't use them like code generators. Rather, they generate "intermediate build products" (in terms of current tooling nomenclature) that are inherently inviolate and of interest only to the development software itself, not to humans.

The only other way in which Kelley's post can be said to clash with mine is in his emphasis on "[k]eep[ing] it simple" when it comes to transformations in general. He and I agree that small, domain-specific models yield the best results. But because of his (and our) bad experiences with CASE technologies and their putrid generated code, he emphasizes the simulation of handcraft as a dominant theme in the design of transformations, proclaiming that ideal generated code "gives a good impression, as it looks familiar, follows the required programming mode, includes appropriate comments and follows the local standards for coding style." And this emphasis leads straight to simple, reference-implementation-based transformations. Naturally!

But I'm focused on the wider, future potential offered by this new abstraction layer, and the types of modularization of models I've already found that I need, and I see way more powerful ways to automate than the methods undertaken by the people Kelley is talking to. I'm even willing to sacrifice a little quality in the code that's ultimately generated, at least in the short term, to get there. Some may argue that more than a little quality loss must inherently follow from such flights of abstraction, but I disagree. Sure, we went through an era of Visual BASIC p-code before arriving at JITs, but now everything's copacetic. The problems that need to be solved may be more abstract than those that came before, but I think they're tractable, and I look forward to seeing how people do it.

URL design: making sure your urls are clickable in plain text emails

nospam@example.com (Craig Ogg) — Fri, 04 Aug 2006 10:48:02 -0500

One of my fellow bloggers, Eric Hammond, makes the point that dropping the www from your site name may be unwise for security and privacy reasons. Another problem with it is that it may make your urls unclickable in emails.

While some designers will aim for short urls to make them not break in an email, real email-friendliness is rarely considered when designing urls. Unfortunately ignoring it can have a negative impact on how easy it is for word of your site to travel. Most modern software (email clients, word processors, spreadsheets, file explorers, etc.) attempt to auto-recognize urls and turn them into clickable links. In order for this to work, the software has to make guesses on what an url is and isn't. In addition it has to make guesses and when the url is "finished."

Virtually software will only turn text into a link if it starts with www or http://. So dropping the www to shorten an url actually means having to prefix it with http:// instead -- a net loss.

Determining where it ends is even harder for the client software because links often appear at the end of sentences. This means that punctuation in an url will often cause the client to end the link early.

Here is how some urls are interpreted by the Thunderbird email client:

http://www.example.com/index.cfm?param=1 (query parameters dropped)
http://www.example.com/test! (exclamation dropped from urll)

It is worth the time to test the various email clients to see if your url structure is compatible.

Out of one tyranny, into the next

nospam@example.com (Jollymorphic) — Fri, 28 Jul 2006 05:50:00 -0500

Among the papers related to generative and model-driven programming I've read over the last couple of years, one old favorite is The Side Transformation Pattern - making transforms modular and re-usable by Edward Willink (the FOG guy) and Phillip Harris. The full text is no longer available for free on-line, unfortunately, so I'll attempt to summarize, quoting the authors:

Transformation is often presented as a complete activity. This impression is particularly prevalent in today's "MDA-compliant" tools, which perform a one-stage rewrite of source ... concepts. Such an approach ... offers little opportunity for evolution through progressive transformation.

Where a single stage approach satisfies the user's requirements, it can offer dramatic improvements in productivity, for example in code generator templates that produce Java or C++ source text directly from UML graphical models. Too often however, the one-stage approach inhibits a proper separation of different programming concerns. The result is a lack of flexibility and visibility in the transformation process, leading to poor opportunities for enhancement or re-use.

They may be talking about MDA, but what they're saying applies equally to almost every tool in this field and most of the projects in development. The commercial tools, in particular, seem to concentrate most of their design efforts on graphical model editors, and they treat the actual generation of artifacts as a simple, one-stage process, usually taking the form of text template languages. If you're lucky, they may incorporate some other rudimentary features, like model validation and repositories.

This insight into the inadequacy of current approaches is valuable enough on its own, but the really beautiful thing about this paper is that it's a pattern paper. It presents a solution (or, at least, a part of a solution) in the form of an easily understood, straightforwardly replicated design pattern. How many pattern papers do you see for implementors of these kinds of tools? This is the only one I'm aware of.

We therefore look to an approach that involves many small transformations, each dealing with a single aspect of the problem, such that relevant transformations extracted from a large library of re-usable transformations can be exploited to build an apparently custom composite with few truly custom contributions.

They're talking about leverage in the implementation of the application development tools themselves, here (the "factory," in Microsoft's lingo), not just the applications they produce. And they're achieving it through modularity and aspectual decomposition.

The authors go on to propose a pattern for the modularization of transforms involving forking and merging models, and they demonstrate the pattern in a few credible examples, including the addition of type inference constraints to a model and the insertion of synchronization barriers in a flow graph. The examples are concrete. The benefit they convey is tangible.

Are these guys (and some other folks I'll get to) onto something? Is "separation of different concerns[,] ... flexibility and visibility" valuable enough to invest so much in transformation? More after the fold.
Continue reading "Out of one tyranny, into the next"

Showing Implementation Details in URLs (Example from Google)

nospam@example.com (Eric Hammond) — Thu, 27 Jul 2006 10:10:31 -0500

Google's official blog annouced the location of a new help page today. Here's the link to the new page (which I haven't even gone to see):

http://www.google.com/support/bin/static.py?page=alpha_index.html

This is a good example of a poor URL and it's coming from Google. Breaking it down we see...

Continue reading "Showing Implementation Details in URLs (Example from Google)"

Security/privacy problem with dropping the "www." from your web site URL

nospam@example.com (Eric Hammond) — Mon, 03 Jul 2006 12:00:00 -0500

Given today's state of DNS, smart firewalls/routers/load balancers, and the popularity of the web, it hardly seems necessary to include the "www." on the front of the URL for your web site.

It is very tempting to drop the "www." so that when folks visit your site they are browsing "example.com" instead of "www.example.com". In fact, I did this with http://notlong.com and I'm happy with the results there.

However, there is a security/privacy issue with doing this that I have not seen discussed elsewhere. It comes about from a combination of factors which will not apply to everybody, but which are more likely to hit large, serious web sites that use third party services for part of their functionality.

Here's the situation:

Continue reading "Security/privacy problem with dropping the "www." from your web site URL"

standardCreateElement - the mystery function no one talks about but everyone uses

nospam@example.com (Craig Ogg) — Mon, 03 Jul 2006 00:05:00 -0500

Do a quick Google search on standardCreateElement() and you will get a large number of results that all match a piece of Javascript code in someone's bookmarklet (aka favelet). You'll never get a page that tells you what the function does or why it is necessary. This drove me crazy for quite some time, but I finally figured out what was going on.

It is an eBay specific hack. Here is the code eBay uses to try to stop bookmarklets and other active content from working:

function EbayBlockActiveContent(pParent,pName)

{

  ...

  document.standardWrite=document.write;

  this.documentWrite=function(pStr)...

  document.standardWriteln=document.writeln;

  this.documentWriteln=function(pStr)...

  document.standardCreateElement=document.createElement;

  this.createElement=function(pStr)...

  document.write=c.documentWrite;

  document.writeln=c.documentWriteln;

  document.createElement=c.createElement;

  ...

}

For those readers that may be somewhat new to Javascript, what this function does is redefine a few of the standard methods on the document object so that they call new eBay defined methods and rename the old methods standardOLDNAME. Sneaky.

Book Review: Joe Celko's Trees and Hierarchies

nospam@example.com (Glenn Crowe) — Thu, 25 May 2006 22:22:00 -0500

This is a book review of Joe Celko's book titled "Joe Celko's Trees and Hierarchies in SQL for Smarties" ISBN: 1558609202

Should you read this book? This, it seems to me, is the point a book review must inevitably resolve. Ill go ahead and kill the suspense by saying "yes." If you are involved with the development of SQL systems at any level and wish to read some productive material you can safely turn to this book. This isnt a perfect book by any means. It disappoints in some key ways. However, I am hard pressed to find fault enough to justify not recommending the book.

The Good News

Continue reading "Book Review: Joe Celko's Trees and Hierarchies"

Counting nodes in a tree: A bottom-up approach

nospam@example.com (Glenn Crowe) — Tue, 25 Apr 2006 23:43:00 -0500

A popular interview question for SQL Developers goes something like the following: Given an employee table where ManagerID is an attribute of the Employee record, write a stored procedure which counts the total number of employees which report to the passed employee.

For clarity I will point out that the organization is a tree where each employee represents a node.

There is a simple answer which you should probably stick to in the context of an interview. A top down approach (without the sproc wrapper) would look like this:



Create table #tEmployeeTree 

( EmployeeID int, ManagerID int, PassNumber int )



Declare @Pass int, @RowCount int, @EmpIDParam int

Select  @Pass = 1, @RowCount = 0, @EmpIDParam = 12

Insert #tEmployeeTree ( EmployeeID, ManagerID, PassNumber )

Select EmployeeID, ManagerID, @Pass 

  from HumanResources.Employee a

 where  ManagerID = @EmpIDParam



Select @RowCount = @@RowCount, @Pass = @Pass + 1



While ( @RowCount != 0 )

begin



    Insert #tEmployeeTree 

    ( EmployeeID, ManagerID, PassNumber )

    Select

          b.EmployeeID

         ,b.ManagerID

         ,@Pass

      from  #tEmployeeTree a

       join HumanResources.Employee b on a.EmployeeID = b.ManagerID

     where a.PassNumber = @Pass -1



    Select @RowCount = @@RowCount, @Pass = @Pass + 1

end

At this point you can be confident that the number of records in the #tEmployeeTree table represents the correct answer.

Now, there is an embellishment to this question which can lead to some interesting discussion. An executive would like to know which of his or her direct subordinates has the most number of employees in their organization.

Continue reading "Counting nodes in a tree: A bottom-up approach"

Subclassing DBI when using Class::DBI

nospam@example.com (Eric Hammond) — Wed, 05 Apr 2006 16:52:35 -0500

[Update: I've been informed that you should be using DBIx::Class instead of Class::DBI because the latter is no longer supported, but I haven't had time to switch yet.]

The DBI manpage describes how to subclass DBI to override certain methods on database and statement handles (search for MySubDBI in the DBI manpage). If you are using Class::DBI, however, the instructions there won't work and it won't be obvious why.

The secret to being able to override DBI methods when using Class::DBI (and subclasses like Class::DBI::mysql) is to instead subclass DBIx::ContextualFetch. That class is used by Ima::DBI (a parent of Class::DBI) to add functionality to the database handles and statement handles even if you or Class::DBI thought your code was directly calling DBI->connect().

Here's a sample following the naming conventions in the DBI manpage. Note that the "connected" sub is not needed and is only provided as a sample which can be used to make sure that the subclassing is actually working for you.



package MySubDBI;

use strict;

use base 'DBIx::ContextualFetch';



package MySubDBI::db;

use base 'DBIx::ContextualFetch::db';



# Override methods for the database handle here. (Sample provided)

sub connected {

  my $dbh = shift;

  my ($dsn, $user, $pass, $attr) = @_;

  warn "Connected to $dsn as $user";

  return $dbh->SUPER::connected($dsn, $user, $pass, $attr);

}



package MySubDBI::st;

use base 'DBIx::ContextualFetch::st';



# Override methods for the statement handle here.

Important: When opening the database handle for your Class::DBI objects, you need to specify the following attribute in the DSN string: "RootClass=MySubDBI" (where MySubDBI is the name of your subclass above). For example the DSN might look like:

"DBI:mysql(RootClass=MySubDBI):host=localhost;database=dbname"

Specifying RootClass in the %attr hash does not seem to be sufficient, possibly due to the way that DBIx::ContenxtualFetch overrides the attributes and tries to insert its own RootClass, but I didn't spend a lot of time trying to figure out exactly why.

Debugging Character Set Problems (aka, how to fix smart quotes that turn into diamonds)

nospam@example.com (Craig Ogg) — Tue, 04 Apr 2006 16:16:00 -0500

It all started with a simple bug report: when the user pastes a registered trademark symbol (®) into a textarea is "having children" when it is displayed -- multiple characters are appearing where there was only one before. Many hours later I concluded that my attempts at quick fixes weren't going to work -- I was getting different results from Firefox on Linux than from IE on Windows XP.

My comments below are my experience in Perl on Linux, but much of the advice should be language and platform independent.

30 Second Guide to Character Sets¹

Strings are stored as a sequence of bytes.

What characters these bytes represent is completely arbitrary, but it is dictated by what the software believes the character set encoding is.

Every piece of software the touches the string has an opportunity to screw it up if it believes wrong.

If English is your primary language, you won't notice it is screwed up until you get to unusual characters (registered trademark, smart quotes, foreign language character).

Fixing it once it is screwed up will be painful.

Once you fix it, it will break again every time there is new software that touches the string.

Fortunately it is relatively straightforward to debug if you follow:

Ogg's Rules for Debugging Character Set Problems

Never waste your time debugging by printing the strings to the terminal or to a file. Your screen driver or editor is software. Its interpretation of the character set just introduces more variables into the equation.²

Always print the bytes as hex or use another reliable mechanism for determine what bytes actually make up the string. For Perl, this is Devel::Peek::Dump.

Check the values before and after any operation that modifies the string.

For languages like Perl that attempt to transparently handle both ASCII and Unicode, check what the language believes the string is before and after any operation that modifies the string.

Don't use string literals that have characters that aren't 7-bit safe (their ASCII value is < 128), instead specify them with the character set appropriate numeric value. In Perl, always use the Unicode value for this.³

If a web page says it is using ISO-8859-1 encoding or Latin-1 encoding, assume they are actually using Windows-1252 encoding instead. This is what the browsers assume, so you might as well (this primarily affects the ™ symbol).

If you don't know what encoding the input is in, you really have no chance of actually knowing what the bytes mean. For an HTML input form this means using a hidden field named _charset_. You are using one in every form, right? (See this Mozilla bug report for details)

¹Read Advanced Perl Programming for more in depth coverage.

²For example, if you output a Perl string that is not marked as utf8 to UTF-8 terminal as you normally would, it will print correctly (even though it is wrong). If the string is correctly marked as utf8, it will print as if it is screwed up. If you correctly set STDOUT to utf8 (binmode(STDOUT, ":utf8")), the results will be reversed. Do you even know what character set your terminal uses?

³If you ignore this advice and are using string constants anywhere in your code and those constants have non-English or special characters, make sure you know what character set your language is going to think the file is in (which, of course, is probably unrelated to what character set your OS thinks the file is in). For Perl, if you have use utf8; at the top of your file, the file will be assumed to be in the UTF-8 encoding. If you use use encoding "latin-1"; then Perl will assume your file is in Latin-1. See perldoc utf8.

Passing n parameters to a Stored Procedure in a single call

nospam@example.com (Glenn Crowe) — Wed, 01 Mar 2006 00:03:00 -0600

Application developers have long lamented the seemingly delinquent support for passing an unbounded number of parameters to a SQL Server stored procedure. Such support has always existed, but the mechanism has never been entirely intuitive.

Observe a stored procedure defined thusly:

Create proc sp_AsManyAsYouLike as

set nocount on Select myInt * 1000 from #tempParam

go

Now I bring all of my Perl programming skills to bear:

$cmd->{ActiveConnection} = $conn;

$cmd->{CommandType} = 1;

$cmd->{CommandText} = "set nocount on Create table #tempParam (MyInt int)\n";

$cmd->{CommandText} = $cmd->{CommandText} . "Insert #tempParam Select 1\n";

$cmd->{CommandText} = $cmd->{CommandText} . "Insert #tempParam Select 2\n";

$cmd->{CommandText} = $cmd->{CommandText} . "Exec sp_AsManyAsYouLike";



$WScript->Echo($cmd->CommandText . "\n");

    

$RS = $cmd->Execute();



while(!$RS->EOF){

$WScript->Echo($RS->Fields(0)->value);

$RS->MoveNext;}

Which yeilds the following:

set nocount on Create table #tempParam (MyInt int)

Insert #tempParam Select 1

Insert #tempParam Select 2

Exec sp_AsManyAsYouLike



1000

2000

My example above is simplistic, but you can extend this model to pass all sorts of complex structures to a stored procedure. I don't offer this solution as a brilliant design. It is merely more palatable, and more flexible, than parsing strings with Transact SQL.

Code Review: OUTPUT parameters and transactions

nospam@example.com (Glenn Crowe) — Thu, 16 Feb 2006 23:47:03 -0600

File this one away for the next time you code review a SQL Server stored procedure. Those OUTPUT parameters arent bound to your transactions in any way.

Observe:



Create proc sp_OutputMyIdent (@myOutputIdent int output)

as

set nocount on

Begin transaction 

    Insert myIdentTable Select 'foo'

    Select @myOutputIdent = @@Identity

rollback transaction

go

Now a little ADO from JScript:



myCommand.CommandText = "sp_OutputMyIdent";

myCommand.CommandType = adCmdStoredProc;

myCommand.ActiveConnection = myConnection;        

myCommand.Parameters("@myOutputIdent") = 0;        

WScript.Echo("Before:  " + myCommand.Parameters("@myOutputIdent"));

myCommand.Execute();        

WScript.Echo("After:  " + myCommand.Parameters("@myOutputIdent"));

Which yields the following:



Before:  0

After:  1

Errors dont alter this behavior at all. Any reasonably competent scripting programmer can trap and then disregard your error.

Observe:



Create proc sp_OutputMyIdent (@myOutputIdent int output)

as

set nocount on

Begin transaction 

    Insert myIdentTable Select 'foo'

    Select @myLocalVar = @@Identity

    RaisError ( N'Uh Oh!', 16, 1 )

rollback transaction 

go



try

{

myCommand.CommandText = "sp_OutputMyIdent";

myCommand.CommandType = adCmdStoredProc;

myCommand.ActiveConnection = myConnection;        

myCommand.Parameters("@myOutputIdent") = 0;        

WScript.Echo("Before:  " + myCommand.Parameters("@myOutputIdent"));

myCommand.Execute();

}

catch(e){ WScript.Echo(e.description) }

WScript.Echo("After: " + myCommand.Parameters("@myOutputIdent"));

Which yields the following:



Before:  0

Uh Oh!

After:  2

The best thing to do is to keep your progress private until you know you are done:



Create proc sp_OutputMyIdent (@myOutputIdent int output)

as

set nocount on

Declare @myLocalVar int

Begin transaction 

    Insert myIdentTable Select 'foo'

    Select @myLocalVar = @@Identity

    RaisError ( N'Uh Oh!', 16, 1 )

commit transaction 

Select @myOutputIdent = @myLocalVar

go