A word of warning about custom reports in SSMS

If you are tempted to run a custom report in SSMS that you didn't write yourself then please do open it in BIDS (just rename the .rdlc extension to .rdl for the Nov CTP to make sure you can see the queries) or your favourite XML editor first and examine the queries it contains to make sure you understand what's being run and to check for any malicious content. You can add pretty much any valid TSQL you want to a query in a report (e.g. drop database, truncate table) so unless you're 100% sure you understand what's running then don't open it in SSMS.
Published 23 November 2006 19:10 by sqldbatips
Filed under:

Comments

No Comments