Press "Enter" to skip to content

Curated SQL Posts

Spurious Correlations: The CRAN Package

Mauricio Vargas Sepulveda has released an R package:

The goal of spuriouscorrelations is to keep alive the amazing examples from Tyler Vigen. Unfortunately, as of 2023-10-09, the website is down as my students noticed. Therefore, I decided to use the snapshot from the Internet Wayback Machine to save the datasets from 2023-06-07.

Click through to see how you can re-live those old charts, using the example of “number of people who drowned by falling into a pool” versus “films Nicolas Cage appeared in” on an annual basis. H/T R-Bloggers.

Leave a Comment

DOP Non-Feedback

Rebecca Lewis tries to get some feedback:

In my DOP Feedback post last month, I shared something very frustrating. I had all the documented prerequisites for DOP Feedback in place. Query Store in READ_WRITE mode, DOP_FEEDBACK enabled at the database scope, Compatibility Level 160, MAXDOP set to 14, and a repeatable workload generating real parallelism waits — but the DOP feedback never fired. No dop_feedback_eligible_query event. No entries in sys.query_store_plan_feedback. Nothing.

I said I’d follow with a sequel when I found a workload that does become eligible, and then I’d compare it against the one that did not. Well. This is that sequel, but I still don’t have it. Today is honestly my fourth full-day of testing without triggering any DOP Feedback.

Click through to learn what doesn’t work. Or at least didn’t work for Rebecca.

Leave a Comment

Executing Arbitrary Code during SQL Server Database Restoration

Fabiano Amorim explains a reason for the July SQL Server patch cycle:

CVE-2026-47295 is a SQL Server vulnerability that lets a maliciously crafted database backup execute attacker-controlled code with sysadmin privileges during a routine RESTORE DATABASE operation.

The flaw lives in the internal replication cleanup procedure sys.sp_MSremovedbreplication_internal, which builds a dynamic procedure name from the restored database’s name using QUOTENAME(). Because the destination variable is only nvarchar(255), a carefully crafted database name — one packed with closing square brackets — causes the generated name to be silently truncated into a different, attacker-controlled procedure name.

SQL Server then executes that procedure under an elevated internal restore context. The proof of concept detailed in this article demonstrates full instance compromise: a restored backup creates a new SQL Server login and adds it to the sysadmin fixed server role, with no application input, no visible SQL injection syntax, and no chance for an administrator to review the database first.

As mentioned in my lead-in, the July 2026 SQL Server patches fix this vulnerability, so it’d be a good idea to install that and then check out what you could do to an unpatched instance.

Leave a Comment

Viewing Statistics a SQL Server Query Used

Dualcore DBA takes a look:

Something I have been making use of recently is the change in the way statistics that have been used to compile a plan are presented to us as SQL Server users. On a number of occasions I have needed to understand, or at least get some sense of, which statistics SQL Server has used to come up with some of its estimates, usually when troubleshooting a poor estimate. This information has been available to us for a while, but up until fairly recent (OK – define recent, I guess!) versions of SQL Server, it was a bit hidden.

Granted, “fairly recent” means “all of the SQL Server versions that no longer have official support.” But there’s a compatibility level factor at play as well, so click through to learn more.

Leave a Comment

Checking Table Sizes in Microsoft Fabric Warehouses

Nikola Ilic wants to know how big that warehouse is:

If you’ve tried to check how much storage your Fabric warehouse tables consume, you’ve probably discovered that the usual SQL Server approaches don’t work. This post explains why, what else doesn’t work, and the one approach that does (and that I can use as a reference going forward, instead of wasting time and tokens asking LLMs).

Click through for the problem description and the answer. I completely agree with Nikola’s conclusion that it’s harder than it should be.

Leave a Comment

The Medallion Architecture’s Silver Layer: Physical or Virtual?

Nikola Ilic noodles a concept:

If you’ve been working with data platforms in recent years, chances are that you’ve implemented the medallion design pattern (or architecture:)) at least once. Bronze, silver, gold – raw, cleansed, curated – this design pattern has become so widely adopted that you’ll find it in every reference architecture, every certification exam, and every conference talk (including some of mine, I have to admit). And, in the vast majority of implementations I’ve seen (and built myself), all three layers are physically materialized as tables.

In this article, I’d like to challenge that habit. Not the medallion pattern itself – the logical separation of layers is, in my opinion, still of paramount importance. What I want to question is something much more specific: why is the silver layer a set of physical tables? And, with the recent announcement of GPU acceleration for the Fabric Data Warehouse, I believe this question deserves a serious answer, rather than “because that’s how the diagram looks”

Click through for Nikola’s thoughts, including when it might work for the silver layer to be virtual and when it doesn’t make sense.

Leave a Comment

TempDB as a Denial of Service Vector

Emad Al-Mousa describes a denial of service mechanism:

Denial of service attack is one of the common cyber security attacks that will cause interruption, outage and potentical finanicial and operational damages. So, its very nasty attack that attackers use for damage intent.

The main problem here is that any sql server database login (user) can create temporary tables in TEMPDB database and no specific permission is required to be granted to this account in the first place. Also, there is no way (I am currently aware off) that restricts a database login from temporary tables creation.

Prior to SQL Server 2025, I’m not sure of a great way to prevent this attack, assuming the attacker has access to run arbitrary queries against your instance.

Leave a Comment

Setting up Azure SQL DB in Podman

Vlad Drumea builds a local version of Azure SQL Database:

Microsoft has recently released in private preview (at the time of writing) the Azure SQL Database container image.
This is Microsoft’s solution for folks who want to build and test Azure SQL DB native software without having to incur additional Azure costs just for dev/test/demo work.

This provides a local option for developers who want to work on products that require Azure SQL DB’s specific developer surface: T-SQL, drivers, and engine behavior.

Click through to see how this works. As of right now, you’ll need to be in the private preview, but I imagine things won’t change significantly once they move to public preview.

Leave a Comment

Source Control and Branching in Microsoft Fabric

Jon Lunn has a series with the first two parts up. First up is part one:

Developing in Microsoft Fabric within a multi-team environment has not always been straightforward. Fabric was initially geared more towards individual users and citizen developers working independently within a workspace, which created challenges when applying traditional source control and DevOps practices.

Part two covers integration with Azure DevOps:

Now we’re going to look at deploying Fabric items through DevOps using the Microsoft-supported Fabric CI/CD Python library.

  • Set up DevOps components
    • Environments
    • Libraries
  • Creating an DevOps YAML deployment pipeline
  • Creating a Fabric CI/CD script to deploy the items
  • Using AI Tools to help speed up development of DevOps

Stay tuned for part three.

Leave a Comment