Accessing SQL Server Using HTTP

Accessing SQL Server Using HTTP
You can access SQL Server using HTTP (Hypertext Transfer Protocol). This allows you
to run SQL statements from a browser. For example, you can run a SELECT statement
that returns XML, and SQL Server will display the results in your browser. You can use
XPath statements to locate data in the returned XML, and use XSL stylesheets to format
the returned XML. I'll show you how to do all of these things in this section.
Warning You can even run INSERT, UPDATE, and DELETE statements-but you'll need
to be careful about restricting the ability to run these types of statements
because an errant user could easily wreck your database.
Before you can access SQL Server using HTTP, you'll need to configure SQL XML
support for IIS (Internet Information Server).
Configuring SQL XML Support for IIS
To configure SQL XML support for IIS, select Start ➣ Programs ➣ Microsoft SQL
Server ➣ Configure SQL XML Support in IIS. This starts the IIS Virtual Directory
Management for SQL Server console, as shown in Figure 16.6
. You use this console to
define a virtual directory through which you access SQL Server via HTTP.

Figure 16.6: The IIS Virtual Directory Management for SQL Server console
To define a virtual directory, expand the node for your computer using the + icon (I've
expanded the node for my computer-which is named JMPRICE-DT1-in Figure 16.6
).
Next, right-click on Default Web Site and select New ➣ Virtual Directory from the pop-
up menu. You'll need to set the properties for your virtual directory using the New
Virtual Directory Properties window. This window contains six tabs, the first of which is
named General, which you use to set your Virtual Directory Name (the name through
which you access SQL Server) and Local Path (the actual directory in your computer's
file system where you store files, such as XML and XSLT files). I've set my Virtual
Directory Name to Northwind and my Local Path to F:\Northwind, as shown in Figure
16.7.

Figure 16.7: Setting the Virtual Directory Name and Local Path
Warning The directory you specify for your Local Path must already exist in your
computer's file system. Create it using Windows Explorer, and then browse to
that directory using the Browse button.
Next, you use the Security tab to set the details of how to authenticate the user when
accessing SQL Server. I've used the sa SQL Server account, as shown in Figure 16.8
.

Figure 16.8: Setting the authentication details
Warning In a production system, you'll want to use an account that has limited
permissions in the database. For example, you'll probably want to grant read
access only to tables.
Next, you use the Data Source tab to set which SQL Server you want to use, along with
the database you want to access. I've picked the local SQL Server and the Northwind
database, as shown in Figure 16.9
.

Figure 16.9: Setting the data source
Next, you use the Settings tab to specify the type of access to SQL Server you want to
provide. Check the following boxes: Allow URL Queries (allows direct execution of
SQL statements), Allow Template Queries (allows the use of XML and XSLT files to
retrieve and format results from the database), and Allow XPath Queries (allows
execution of queries with XPath expressions), as shown in Figure 16.10
.

Figure 16.10: Setting the type of access
Warning In a production system, you'll want to restrict access to Allow Template Queries
only. That way, users can execute only queries defined in an XML template file.
Next, you use the Virtual Names tab to map a database schema, a template directory

containing XML and XSLT files, or a database object (dbobject) to a path relative to your
virtual directory. Click the New button and set your Virtual Name to Templates, the Type
to template, and your Path to a subdirectory named Templates in your Northwind
directory , as shown in Figure 16.11
. You'll need to create the Templates folder first.

Figure 16.11: Setting the virtual name configuration
Warning The Templates subdirectory you specify in your Path must already exist in your