Stored Procedure Single Quotes

Nowhere in all this elaborate brain circuitry, alas, is there the equivalent of the chip found in a five-dollar calculator. This deficiency can make learning that terrible quartet—“Ambition, Distraction, Uglification, and Derision,” as Lewis Carroll burlesqued them—a chore. It’s not so bad at first. Our number sense endows us with a crude feel for addition, so that, even before schooling, children can find simple recipes for adding numbers. If asked to compute 2 + 4, for example, a child might start with the first number and then count upward by the second number: “two, three is one, four is two, five is three, six is four, six.” But multiplication is another matter. It is an “unnatural practice,” Dehaene is fond of saying, and the reason is that our brains are wired the wrong way. Neither intuition nor counting is of much use, and multiplication facts must be stored in the brain verbally, as strings of words. The list of arithmetical facts to be memorized may be short, but it is fiendishly tricky: the same numbers occur over and over, in different orders, with partial overlaps and irrelevant rhymes. (Bilinguals, it has been found, revert to the language they used in school when doing multiplication.) The human memory, unlike that of a computer, has evolved to be associative, which makes it ill-suited to arithmetic, where bits of knowledge must be kept from interfering with one another: if you’re trying to retrieve the result of multiplying 7 X 6, the reflex activation of 7 + 6 and 7 X 5 can be disastrous. So multiplication is a double terror: not only is it remote from our intuitive sense of number; it has to be internalized in a form that clashes with the evolved organization of our memory. The result is that when adults multiply single-digit numbers they make mistakes ten to fifteen per cent of the time. For the hardest problems, like 7 X 8, the error rate can exceed twenty-five per cent. Our inbuilt ineptness when it comes to more complex mathematical processes has led Dehaene to question why we insist on drilling procedures like long division into our children at all. There is, after all, an alternative: the electronic calculator. “Give a calculator to a five-year-old, and you will teach him how to make friends with numbers instead of despising them,” he has written. By removing the need to spend hundreds of hours memorizing boring procedures, he says, calculators can free children to concentrate on the meaning of these procedures, which is neglected under the educational status quo.

I'm not convinced," Dodds said. It was Thursday morning, just six hours after Bosch and Chu had ended their surveillance of Chang, with the suspect going to an apartment in Monterey Park and apparently retiring for the night. "Well, Cap, you shouldn't be convinced yet," Bosch said. "That's why we want to continue the surveillance and get the wire." "What I mean is, I'm not convinced it's the way to go," Dodds said, "Surveillance is fine. But a wire is a lot of work and effort for long-shot results." Bosch understood. Dodds had an excellent repu tation as a detective, but he was now an administrator and about as far removed from the detective work in his division as a Houston oil executive is from the gas pump, He now worked with personnel numbers and budgets, He had to find ways of doing more with less and never allowing a dip in the statistics of arrests made and cases closed. That made him a realist and the reality was that electronic surveillance was very expensive. Not only did it take double-digit man hours to carefully draft a fifty plus-page affidavit secking court permission, but once permission was granted, a wiretap room had to be staffed twenty-four hours a day with a detective monitoring the line. Often a single-number tap led to other numbers needing to be tapped and under the law each line had to have its own monitor. Such an operation quickly sucked up overtime like a giant sponge. With the RHD's OT budget seriously down because of economic constraints on the department, Dodds was reluctant to give any of it up for what amounted to an investigation of the mur der of a South Side liquor store clerk. He would rather save it for a rainy day-a big-time media case that might come up and that would demand it.

The way xp_ cmdshell works is very simple: It takes a single string argument and then executes that as a command-line call. For example, the call would perform a directory listing of the server’s C drive. Again, at this point the damage is limited only by the attacker’s imagination, and exploiting this through SQL injection is absolutely trivial: If you’re running SQL Server, we strongly recommend disabling or removing the xp_cmdshell stored procedure. You can disable it through use of the sp_configure stored procedure, like so: