Groups | Blog | Home
all groups > sql server reporting services > december 2004 >

sql server reporting services : URL Paramater limatation


timb84
12/29/2004 1:31:03 PM
I get the following error when trying to pass a very large paramater through
a url.

The path of the item '/TCM
Reporting/TCM_gridexport_Carrier2,061IPCE0^,4801^, Order By Line_lac' is not
valid. The full path must be less than 260 characters long, must start with
slash; other restrictions apply. Check the documentation for complete set of
restrictions. (rsInvalidItemPath) Get Online Help

--------------------------------------------------------------------------------
This is the url:
http://wspnywebdev2/ReportServer?%2fTCM+Reporting%2fTCM_gridexport_Carrier2&rs:Command=Render&rs:Format=excel&rc:Parameters=false&SQL=SELECT
a.entry_id, a.line_wire_link_id, b.CarrierName AS Carrier, circuit_id AS
CircuitID, b.DEAddress1 AS BEndAddress, b.DEClient AS DEClient,
b.DECityName AS BEndCity, RTRIM(JBA_Reference_Number) AS
JBA_Reference_Number, RTRIM(JBA_Site_id) AS JBA_Site_id, line_lac,
system_descriptor, COALESCE(aaa.TraderCount,0) AS TraderCount FROM
(AFM_LINE_DS0 a LEFT JOIN AFM_LINE_DS0_Computed aaa ON a.entry_id =
aaa.entry_id) LEFT OUTER JOIN AFM_LINE_DS0_Ext b ON a.Entry_ID = b.Entry_ID
WHERE 1 = 1 AND JBA_Reference_Number IN (^&061IPCE0^&) AND Carrier =
^&4801^& Order By Line_lac

I was trying to pass the entire sql statement as the paramater. I probably
won't use this because of security reasons but wanted to see if it would
work. It is 723 characters in size.

2nd url
http://wspnywebdev2/Reports/Pages/Report.aspx?ItemPath=%2fTCM+Reporting%2fTCM_gridexport_Carrier2

param:SQL=
SELECT a.entry_id, a.line_wire_link_id, b.CarrierName AS Carrier,
circuit_id AS CircuitID, b.DEAddress1 AS BEndAddress, b.DEClient AS
DEClient, b.DECityName AS BEndCity, RTRIM(JBA_Reference_Number) AS
JBA_Reference_Number, RTRIM(JBA_Site_id) AS JBA_Site_id, line_lac,
system_descriptor, COALESCE(aaa.TraderCount,0) AS TraderCount FROM
(AFM_LINE_DS0 a LEFT JOIN AFM_LINE_DS0_Computed aaa ON a.entry_id =
aaa.entry_id) LEFT OUTER JOIN AFM_LINE_DS0_Ext b ON a.Entry_ID = b.Entry_ID
WHERE 1 = 1 AND JBA_Reference_Number IN
(^&061IPCE0^&,^&101IPCG0^&,^&101IPCG0^&,^&101IPCG0^&,^&101IPCG0^&,^&101IPCG0^&,^&101IPCG0^&,^&101IPCG0^&,^&101IPCG0^&,^&101IPCG0^&,^&101IPCG0^&,^&101IPCG0^&,^&101IPCG0^&,^&101IPCG1^&,^&101IPCI0^&,^&101IPCI0^&,^&101IPCJ0^&,^&101IPCJ0^&,^&101IPCL0^&,^&101IPCL0^&,^&101IPCN0^&,^&221IPCC1^&,^&221IPCC1^&,^&301IPCC2^&,^&301IPCC2^&,^&401IPCL1^&,^&401IPCL1^&,^&401IPCL1^&,^&411IPCF1^&,^&411IPCF1^&,^&501IPCD0^&,^&102IPCG0^&,^&102IPCM0^&,^&102IPCM0^&,^&102IPCN0^&,^&102IPCS0^&,^&102IPCS0^&,^&201IPCB0^&,^&201IPCB0^&,^&211IPCP0^&,^&211IPCP0^&,^&221IPCC1^&,^&221IPCC1^&,^&301IPCC2^&,^&301IPCC2^&,^&401IPCL1^&,^&401IPCL1^&,^&401IPCL1^&,^&411IPCF1^&,^&411IPCF1^&) AND Carrier = ^&4801^& Order By Line_lac

In this case I am bringing up the report through the main SQL RS page then
entering the value for the param. The parmater @SQL is 1226 characters in
size. This works but anything larger than 1226 characters fails.

This url also works
http://wspnywebdev2/ReportServer?%2fTCM+Reporting%2fTCM_gridexport_Carrier&rs:Command=Render&rs:Format=excel&rc:Parameters=false&CFIDTOKEN=198148:89406666&UserID=57348022&JBA_SiteID=981IPCI1-000&Type=1&SiteQuery=2&Carrier=%&CircuitID=%&ClientName=%&LocalID=%&TraderGrp=%&TraderName=%&LineLAC=%&TraderID=%

It is 304 characters in size. Why does this work if the above error states
the entire url has to be less than 260 characters?

Jeff A. Stucker
12/30/2004 11:16:48 AM
The limits are described in the error message -- you got 260 characters to
work with. Your gut feel to not put SQL in a query are absolutely correct.
SQL injection attacks are hideous.

--
Cheers,

'(' Jeff A. Stucker
\

Business Intelligence
www.criadvantage.com
--------------------------------------
[quoted text, click to view]

AddThis Social Bookmark Button