Sqlds select command warning (#1399)

* Update selecting-data-with-the-sqldatasource-component.md

* Update sqldatasource-wizard.md

* Update sqldatasource-wizard.md

* Update selecting-data-with-the-sqldatasource-component.md

* Update sqldatasource-wizard.md

* Update sqldatasource-wizard.md

---------

Co-authored-by: Todor Arabadzhiev <todor.arabadzhiev@progress.com>

designing-reports/connecting-to-data/data-source-components/sqldatasource-component/selecting-data-with-the-sqldatasource-component.md

@@ -13,7 +13,9 @@ previous_url: /sql-data-source-selecting-data, /how-to-sqldatasource-sct-storedp
 
 You can specify a SQL query for the `SqlDataSource` component to execute by setting its `SelectCommand` property.
 
-> If the SQL query returns more than one result sets, only the first set will be used.
+> The `SqlDataSource` is designed to read data from the database but internally it uses the [_DbCommand.ExecuteReader_ method](https://learn.microsoft.com/en-us/dotnet/api/system.data.common.dbcommand.executereader?view=net-8.0) which does not limit the commands that can be executed against the database connection. Therefore, the command typed in the `SelectCommand` property will be executed as-is, even if it contains statements such as DELETE, UPDATE, DROP, etc. To prevent potentially unwanted modifications to your database, we strongly recommend using connections with read-only permissions to fetch the data.
+
+> If the SQL query returns more than one result set, only the first set will be used.
 
 The following example demonstrates a SQL query that retrieves a result set consisting of the names of all the persons in the `Contact` table from the __AdventureWorks__ sample database:
 

designing-reports/report-designer-tools/desktop-designers/tools/data-source-wizards/sqldatasource-wizard.md

@@ -13,26 +13,28 @@ previous_url: /sqlDataSource-wizard,/designing-reports/report-designer-tools/des
 
 The __SQL Data Source Wizard__ allows you to create a new or edit an existing __SqlDataSource__ component based on a __SQL__ select statement or a database stored procedure. After the wizard appears you have to perform the following steps:
 
-1. __Choose data connection__ Choose an existing connection from the list of connections or specify a new connection. All local, server (if connected to Report Server) and Server Explorer (for Visual Studio) connections are listed. Server Explorer connection will not be listed if it is having the same connection string alias as a local one. If you choose a Server Explorer connection, you can save it as local or use it as embedded in the next step. If you have connected Standalone Report Designer to a Report Server you can see the server connections in this list. Server report can use only server connections and a local report can use only local connections. If you choose a connection from another source it will be used as base for a new connection that you can save or use as embedded in the next step. For report server report the user need create permission for data connections to see other sources connections and to add a new connection.
-1. __Data connection options__ For server reports this page is skipped when an existing report server connection is used.Choose *"Use as shared connection"* to store the connection string in the application configuration file under a specific name or use the connection from the shared store. What is the exact action is described in the radio button description below. The second option *"Embedded in the report definition"* will save the connection string in the report definition. Thus it will be available only for this report and will be available no matter the report definition location. For new server reports embedded connections option is not allowed.
+1. __Choose data connection__ Choose an existing connection from the list of connections or specify a new connection. All local, server (if connected to Report Server) and Server Explorer (for Visual Studio) connections are listed. Server Explorer connection will not be listed if it is having the same connection string alias as a local one. If you choose a Server Explorer connection, you can save it as local or use it as embedded in the next step. If you have connected Standalone Report Designer to a Report Server you can see the server connections in this list. A Report Server report can use only server connections and a local report can use only local connections. If you choose a connection from another source it will be used as a base for a new connection that you can save or use as embedded in the next step. For the Report Server reports the user needs to create permission for data connections to see other sources connections and to add a new connection.
+1. __Data connection options__ For server reports this page is skipped when an existing report server connection is used. Choose *"Use as shared connection"* to store the connection string in the application configuration file under a specific name or use the connection from the shared store. The exact action is described in the radio button description below. The second option *"Embedded in the report definition"* will save the connection string in the report definition. Thus it will be available only for this report and will be available no matter the report definition location. For new server reports embedded connections option is not allowed.
 
-	> Saving connection strings in the application configuration file (or application store for connections) simplifies the process of maintaining your application if the database connection changes. In the event of a change in the database connection you can edit the connection string in the application store (configuration) as opposed to editing all the report definition and having to recompile your application. However if you want to render the report definition in the context of another project or application you have to make sure that connection string with the same name is available in the application and have access to the database.
+	> Saving connection strings in the application configuration file (or application store for connections) simplifies the process of maintaining your application if the database connection changes. In the event of a change in the database connection, you can edit the connection string in the application store (configuration) as opposed to editing all the report definitions and having to recompile your application. However, if you want to render the report definition in the context of another project or application you have to make sure that connection string with the same name is available in the application and have access to the database.
 
 1. __Configure Data Source Command__ Choose whether you want to base your __SqlDataSource__ on a __SQL__ select statement or a stored procedure:
 
-	+ Choosing the *"Select Statement"* option allows you to enter a __SQL__ query statement directly in the text box below. Alternatively you can click *"Query Builder"* to invoke the Visual Studio __Query Builder__ dialog. In the context of the [Standalone Report Designer]({%slug telerikreporting/designing-reports/report-designer-tools/desktop-designers/standalone-report-designer/overview%}) the button will invoke the [Query Designer in the Standalone Designer]({%slug telerikreporting/designing-reports/report-designer-tools/desktop-designers/tools/data-source-wizards/sqldatasource-wizard/query-designer-in-the-standalone-designer%}). Both are user-friendly interfaces for building __SQL__ queries.
+	+ Choosing the *"Select Statement"* option allows you to enter a __SQL__ query statement directly in the text box below. Alternatively, you can click *"Query Builder"* to invoke the Visual Studio __Query Builder__ dialog. In the context of the [Standalone Report Designer]({%slug telerikreporting/designing-reports/report-designer-tools/desktop-designers/standalone-report-designer/overview%}) the button will invoke the [Query Designer in the Standalone Designer]({%slug telerikreporting/designing-reports/report-designer-tools/desktop-designers/tools/data-source-wizards/sqldatasource-wizard/query-designer-in-the-standalone-designer%}). Both are user-friendly interfaces for building __SQL__ queries.
 	+ Choosing the *"Stored Procedure"* option allows you to select the name of an existing database stored procedure from the drop-down list below which is responsible for the data retrieval.
 
+	> The `SqlDataSource` is designed to read data from the database but internally it uses the [_DbCommand.ExecuteReader_ method](https://learn.microsoft.com/en-us/dotnet/api/system.data.common.dbcommand.executereader?view=net-8.0) which does not limit the commands that can be executed against the database connection. Therefore, the command typed in the `SelectCommand` property will be executed as-is, even if it contains statements such as DELETE, UPDATE, DROP, etc. To prevent potentially unwanted modifications to your database, we strongly recommend using connections with read-only permissions to fetch the data.
+
 1. __Configure Data Source Parameters__ Specify the parameters for the __SQL__ query or stored procedure. Click *"New"* to add a new parameter to the __SqlDataSource__ component or *"Delete"* to remove an existing parameter. Use the arrow buttons to change the order of the parameters when necessary.
 
 	+ Specify a valid name for each data source parameter in the *"Name"* column. You can also choose that name from the list of existing parameter names which are derived directly from the __SQL__ query statement or stored procedure.
 	+ Choose the appropriate database type for the parameter in the *"DbType"* column. This type should match exactly the type of the expression in the __SQL__ query statement or the type of the parameter from the stored procedure.
 	+ Specify a default value for the parameter in the *"Value"* column or bind it via an expression.
 
-	> You can bind a data source parameter directly to a report parameter. This way you can use the standard report parameter user interface to provide values for your data source parameters. The drop-down list of the *"Value"* column displays all existing report parameters. You can create a new report parameter by choosing *```<New Report Parameter>```* from the list. Alternatively you can invoke the __Edit Expression__ dialog by choosing `<Expression>` from the list. This allows you to specify an arbitrary expression to evaluate for the parameter value.
+	> You can bind a data source parameter directly to a report parameter. This way you can use the standard report parameter user interface to provide values for your data source parameters. The drop-down list of the *"Value"* column displays all existing report parameters. You can create a new report parameter by choosing *```<New Report Parameter>```* from the list. Alternatively, you can invoke the __Edit Expression__ dialog by choosing `<Expression>` from the list. This allows you to specify an arbitrary expression to evaluate for the parameter value.
 
 1. __Configure Design Time Parameters__ This step allows you to specify a value for each data source parameter that can be used at design time to retrieve the schema of the __SqlDataSource__ component. At design time there is no expression context, so expressions are not supported and the values must be constant.
 
-	> Specifying design time values for the parameters is necessary because the designer might need to execute the __SQL__ query or stored procedure of the data source in order to populate the schema displayed in the __Data Explorer__ tool window and the __Edit Expression__ dialog. These values do not affect the execution of the __SQL__ query at runtime however.
+	> Specifying design time values for the parameters is necessary because the designer might need to execute the __SQL__ query or stored procedure of the data source to populate the schema displayed in the __Data Explorer__ tool window and the __Edit Expression__ dialog. These values do not affect the execution of the __SQL__ query at runtime, however.
 
 1. __Preview Data Source Results__ You can preview the result set returned by the __SqlDataSource__ before completing the wizard. Click *Execute Query* to execute the __SQL__ query or stored procedure and display the retrieved data. If the data source has parameters, the wizard displays a popup dialog before each preview, which allows you to enter the parameter values. This is the last step of the wizard. After pressing *"Finish"* the wizard will configure the __SqlDataSource__ component with the specified settings and close.

designing-reports/report-designer-tools/web-report-designer/tools/sqldatasource-wizard.md

@@ -17,11 +17,11 @@ The SQL Data Source Wizard allows you to create a new or edit an existing [`SqlD
 
    + Local connection strings from the application configuration file and the [ISettingsStorage](/api/Telerik.WebReportDesigner.Services.ISettingsStorage). 
 
-   + All report server data connections that the current user has permissions to read (listed only if you use Telerik Report Server) The default implementation of the  [ISettingsStorage](/api/Telerik.WebReportDesigner.Services.ISettingsStorage) interface - [FileSettingsStorage](/api/Telerik.WebReportDesigner.Services.FileSettingsStorage) enables the designer users to save and use connection strings from the local Web Report Designer settings file. The location of the designer settings file is specified with the required constructor argument [FileSettingsStorage#ctor](/api/Telerik.WebReportDesigner.Services#Telerik_WebReportDesigner_Services_FileSettingsStorage#ctor_System_String_). If using the designer from a Report Server, this drop-down lists the server data connections. Server reports support only saved server data connections. For Report Server report, user create/read permissions for data connections are required. 
+   + All report server data connections that the current user has permissions to read (listed only if you use Telerik Report Server) The default implementation of the  [ISettingsStorage](/api/Telerik.WebReportDesigner.Services.ISettingsStorage) interface - [FileSettingsStorage](/api/Telerik.WebReportDesigner.Services.FileSettingsStorage) enables the designer users to save and use connection strings from the local Web Report Designer settings file. The location of the designer settings file is specified with the required constructor argument [FileSettingsStorage#ctor](/api/Telerik.WebReportDesigner.Services#Telerik_WebReportDesigner_Services_FileSettingsStorage#ctor_System_String_). If using the designer from a Report Server, this drop-down lists the server data connections. Server reports support only saved server data connections. For Report Server reports, user create/read permissions for data connections are required. 
 
-1. __Data connection options__ For server reports, this page is skipped when an existing report server connection is used.Select *Use as shared connection* to store the connection string under a specific name or use the connection from the shared store. The specific action depends on the wizard context and is described in the radio button description. The second option, *Embedded in the report definition* will save the connection string in the report definition. Thus it will be available only for this report and will be available no matter the report definition location. If you use Telerik Report Server, the Embedded connection string in the report's functionality is forbidden. Otherwise, you can control the embedded connection string by overriding the [GetConnectionsPermissions](/api/Telerik.WebReportDesigner.Services.Controllers.ReportDesignerControllerBase#Telerik_WebReportDesigner_Services_Controllers_ReportDesignerControllerBase_GetConnectionsPermissions) that returns serialized [ConnectionsPermissions](/api/Telerik.WebReportDesigner.Services.ConnectionsPermissions) in `camelCase` JSON. For new Report Server reports, the embedded connections option is not allowed. 
+1. __Data connection options__ For server reports, this page is skipped when an existing report server connection is used. Select *Use as shared connection* to store the connection string under a specific name or use the connection from the shared store. The specific action depends on the wizard context and is described in the radio button description. The second option, *Embedded in the report definition* will save the connection string in the report definition. Thus it will be available only for this report and will be available no matter the report definition location. If you use Telerik Report Server, the Embedded connection string in the report's functionality is forbidden. Otherwise, you can control the embedded connection string by overriding the [GetConnectionsPermissions](/api/Telerik.WebReportDesigner.Services.Controllers.ReportDesignerControllerBase#Telerik_WebReportDesigner_Services_Controllers_ReportDesignerControllerBase_GetConnectionsPermissions) that returns serialized [ConnectionsPermissions](/api/Telerik.WebReportDesigner.Services.ConnectionsPermissions) in `camelCase` JSON. For new Report Server reports, the embedded connections option is not allowed. 
 
-   >Saving connection strings simplifies the process of maintaining your application if the database connection changes. In the event of a change in the database connection, edit the connection string in the application store (configuration) as opposed to editing all the report definition. However, to render the report definition in the context of another project or application, make sure that a connection string with the same name is available in the application and has access to the database. 
+   >Saving connection strings simplifies the process of maintaining your application if the database connection changes. In the event of a change in the database connection, edit the connection string in the application store (configuration) as opposed to editing all the report definitions. However, to render the report definition in the context of another project or application, make sure that a connection string with the same name is available in the application and has access to the database. 
 
 1. __Configure Data Source Command__ Choose whether to base the __SqlDataSource__ on a __SQL__ Select Statement or a Stored Procedure: 
 
@@ -29,6 +29,8 @@ The SQL Data Source Wizard allows you to create a new or edit an existing [`SqlD
 
    + Choosing the `"Stored Procedure"` option allows you to select the name of an existing database Stored Procedure from the drop-down list below, which is responsible for the data retrieval. 
 
+   >The `SqlDataSource` is designed to read data from the database but internally it uses the [_DbCommand.ExecuteReader_ method](https://learn.microsoft.com/en-us/dotnet/api/system.data.common.dbcommand.executereader?view=net-8.0) which does not limit the commands that can be executed against the database connection. Therefore, the command typed in the `SelectCommand` property will be executed as-is, even if it contains statements such as DELETE, UPDATE, DROP, etc. To prevent potentially unwanted modifications to your database, we strongly recommend using connections with read-only permissions to fetch the data.
+
 1. __Configure Data Source Parameters__ Specify the parameters for the __SQL__ Query or Stored Procedure. Click *"New"* to add a new parameter to the __SqlDataSource__ component or *"Delete"* to remove an existing parameter. Use the arrow buttons to change the order of the parameters when necessary. 
 
    + Specify a valid name for each data source parameter in the `"Name"` column. You can also choose that name from the list of existing parameter names, which are derived directly from the __SQL__ Query Statement or Stored Procedure.