They say it's been phased out. I hope.

Maciejasjmj

function WordSzablon (nrowid number) return VARCHAR2 is
(...)
cStmt VARCHAR2(32000);
(...)
begin
(...)
cStmt := '
<script>
function openword() {
try
{owordappl = new ActiveXObject( "Word.Application");}
		catch( e )
		{
			alert( ''Excel(sic!) cannot be opened.'' );
			return;
		}

try{
	oworddoc=owordappl.Documents.Open("c:\\hard\\coded\\path\\template.doc",0,true)
	}
	catch(e)
	{
	alert("Template not found.");
	return;
	}
	owordappl.Selection.Find.ClearFormatting();
//    owordappl.Selection.Find.Text="lk";
	owordappl.Selection.Find.Replacement.ClearFormatting();
//    owordappl.Selection.Find.Replacement.Text="AAA";

owordappl.Selection.Find.Execute("variablenamevariable",-1,0,0,0,-1,-1,1,-1,"'||name||'",2);
owordappl.Selection.Find.Execute("variableidnumbervariable",-1,0,0,0,-1,-1,1,-1,"'||idnumber||'",2);
//snip: more of that...
//oworddoc.Tables.Add(oworddoc.Range(0,0),8,9);
	owordappl.ScreenUpdating = true;
	owordappl.Visible = true;
}

function openword2() {
//same thing, with a different hardcoded path
}


</script>
';
end;

SQL which spits out a <script> which contains ActiveX which opens Word and does automatic search-and-replace on tags (creatively called variablexxxvariable, where xxx is an unique ID).

Eww.

accalia

(yep. that expression is just about perfect reaction for this code)

RaceProUK

@accalia said:

(yep. that expression is just about perfect reaction for this code)

I'm going for this:

RaceProUK

@Maciejasjmj said:

SQL which spits out a <script> which contains ActiveX which opens Word and does automatic search-and-replace on tags (creatively called variablexxxvariable, where xxx is an unique ID).

All that's missing is the wooden table…

Polygeekery

@Maciejasjmj said:

SQL which spits out a <script> which contains ActiveX which opens Word and does automatic search-and-replace on tags (creatively called variablexxxvariable, where xxx is an unique ID)

I did not know Rube Goldberg was also a programmer...

Onyx

@RaceProUK said:

All that's missing is the wooden table…

BRB, getting a printer, a digital camera and an Arduino...

TwelveBaud

@Maciejasjmj said:

SQL which spits out a <script> which contains ActiveX which opens Word and does automatic search-and-replace on tags (creatively called variablexxxvariable, where xxx is an unique ID).

And leaves Word open, and hangs SQL Server if it can't find "Excel" until the MessageBox is dismissed. On the server.

Polygeekery

@Onyx said:

BRB, getting a printer, a digital camera and an Arduino...

Hmmmm, we could have the printer feed in to a scanner and then put the wooden table in with Photoshop. Efficiency!

Onyx

You, sir, are an evil genius.

boomzilla

@TwelveBaud said:

hangs SQL Server

Wow...you can summon ActiveX from inside TSQL‽ Now I am glad I work with Oracle.

Maciejasjmj

@TwelveBaud said:

SQL Server

We wish. That's Oracle.

Also, that goes on the webpage (I hope), so it opens Word ("Excel") on the user's PC.

That being said, we do use Excel and Word interop for other stuff, so a messagebox on the server is still a real threat...

VinDuv

@TwelveBaud said:

And leaves Word open, and hangs SQL Server if it can't find "Excel" until the MessageBox is dismissed. On the <i>server</i>.

Are you sure this code runs on the database server? Given the <script> tags in the output I’d assume the result is pasted into an HTML page and sent to a user’s browser for processing...

EDIT: Hanzo’d

boomzilla

@Maciejasjmj said:

We wish. That's Oracle.

Oh, I see...you're returning stuff that's getting put into a web page or something.

Maciejasjmj

Either that, or we've written a HTML/JS parser in PL/SQL, which also does ActiveX.

Honestly? With that project, I wouldn't even be surprised.

Maciejasjmj

This post is deleted!

anonymous234

How about
https://www.youtube.com/watch?v=F1zXILvt3sY

TwelveBaud

... yes, you can summon ActiveX and Active Scripting from inside TSQL, using the right sprocs. Yes, that's every bit as dangerous as it sounds.

tarunik

@TwelveBaud said:

yes, you can summon ActiveX and Active Scripting from inside TSQL, using the right sprocs. Yes, that's every bit as dangerous as it sounds.

File upload -> SQLi -> Local Privilege Escalation = pwn, it sounds like...

TwelveBaud

That's why the permissions for those sprocs default to sa only and require special permissions bits on your login. Along with gigantic warnings in the docs about exactly that pwn. Doesn't stop some people though.

Maciejasjmj

Bonus WTF:

In another place, the thing takes the list of filters from some table and applies them to a concatenated SQL statement - obviously by concatenation. But wait! If there are no filters, we want to show some button in a different state. How do we do it?

First, in the database:

IF cWhere IS NULL THEN
	 cWhere := ' AND 1=1 ';
   END IF;
--more concatenation follows
pcOutReport := /*some unrelated stuff*/||cWhere;

Then, in the code proper:

protected void SqlDataSourceXYZSelected(object sender, SqlDataSourceStatusEventArgs e)
        {
            var value = e.Command.Parameters["pcOutReport"].Value.ToString();
            SqlDataSourceXYZ.SelectParameters["pcOutReport"].DefaultValue = value;
            _filterSet = !(value.IndexOf("1=1") > 0);
        }

Of course, that clever parsing broke the usual 'WHERE 1=1 ' || list_of_conditions pattern, so this time we have

if cWhere is not null then
	   cWhere := ' AND (2=2 ' || cWhere || ')';
   end if;

And woe be upon thee if you have a Thing1 column, filter it to 1 and forget a space. But that's never gonna happen, right?

Maciejasjmj

Bonus bonus WTF:

Another case of string replacement in Word, this time (luckily) in code, but using the same insane tags. A "description" field apparently didn't fit in a VARCHAR, so they split it into Description1 and Description2 in the DB - but there's only one tag to replace in Word, a single variabledescriptionvariable. What do we do?

ReplaceInWord("variabledesc", row.Description1);
ReplaceInWord("riptionvariable", row.Description2);

Onyx

@Maciejasjmj said:

```
ReplaceInWord("variabledesc", row.Description1);
ReplaceInWord("riptionvariable", row.Description2);
And once again, I buttume this gets fun with spaces *if* it doesn't get split in the middle of the word.