topic Re: DIRECT DISCOVERY, SQL() and stored procedures execution in QlikView

DIRECT DISCOVERY, SQL() and stored procedures execution

alex_nerush — Tue, 29 Oct 2013 14:43:35 GMT

As you already know, DIRECT DISCOVERY allows to aggregate data at runtime using SQL-function in expressions. You can, for example, use following expression to find out maximux value for appropriate dimensions: SQL('MAX(some_column)'). But how about stored procedures execution? Something like this: SQL('EXEC MyStoredProcedure'). But such syntax is not allowed, i've go a message "Direct query failed" in my chart. After a while i've found solution and i would like to share idea here. Need to say, i've used MS SQL and following solution could be used with Microsoft SQL.

Here you are:

SQL('1 as Dummy; EXEC MyStoredProcedure; --')

Re: DIRECT DISCOVERY, SQL() and stored procedures execution

vikasmahajan — Tue, 29 Oct 2013 16:12:55 GMT

Can u please setting with attached jpg and test.

Vikas

Re: DIRECT DISCOVERY, SQL() and stored procedures execution

Anonymous — Tue, 29 Oct 2013 19:46:46 GMT

Alex

That is quite cunning,

It reminds me of the Sql Injection hacking method.

Best Regards, Bill