This article examines the advantages of using databases and looks at how to create databases for new and existing applications.

Overview

file which contains information, including full path details, about all the files that belong to that particular database. Opening a database gives an application access to all that database's files - operating system and data dictionary protection and security permitting - in whichever directory on the system they reside and database commands can target the files as a single unit.

NOTE: The word 'database' has often been used in Xbase products to refer to an individual '.dbf' file. In this article these are referred to as 'tables' and a database may contain many tables.

Advantages

Recital has always offered developers the maximum in flexibility in the design and deployment of their applications. The SET DEFAULT and SET PATH commands along with the ability to access files via their full Operating System path name has allowed data and code to be created and stored in any required location. Such flexibility does however put the onus on the developer to manage all elements of the application and ensure that maintenance tasks cover all files. The introduction of the database commands retains the established developer-driven design, but provides functionality to facilitate the access and maintenance of the components of that design. The functionality offered is in three main areas:

• Facilitate data access
• Facilitate the storage and extraction of information about the files in an application
• Facilitate the maintenance of the files in an application

These three areas are looked at in more detail in the sections below.

Data Access

The immediate effect of using a database is that all the database's tables and associated files (indexes, dictionaries, memo files) are accessible with the issue of a single command, the OPEN DATABASE command.

// Open the database
> open database southwind
// List the database tables
> list tables

Tables in Database southwind:
 Name                Source
 categories		/usr/recital/data/southwind/categories.dbf
 customers		/usr/recital/data/southwind/customers.dbf
 employees		/usr/recital/data/southwind/employees.dbf
 example		/usr/recital/data/southwind/example.dbf
 order_details	/usr/recital/data/southwind/order_details.dbf
 orders			/usr/recital/data/southwind/orders.dbf
 productsbyname	/usr/recital/data/southwind/productsbyname.dbf
 products		/usr/recital/data/southwind/products.dbf
 shippers		/usr/recital/data/southwind/shippers.dbf
 suppliers		/usr/recital/data/southwind/suppliers.dbf
 cisamdemo		/usr/recital/data/southwind/cisamdemo.dbf

> use example

In the case of the sample southwind database that ships with Recital products on all platforms and is shown above, this effect can be achieved in other ways (SET PATH or SET DEFAULT), since its files all reside in the southwind directory. The database advantage comes when the database catalog contains files from multiple directories, e.g.

// Open the database
> open database myapp
// List the database tables
> list tables

Tables in Database myapp:
  Name                Source
  zipcodes		/usr/myapp/data/lookups/zipcodes.dbf
  customers		/usr/myapp/data/current/customers.dbf
  archive03		/usr/myapp/data/archive/archive03.dbf
  archive04		/usr/myapp/data/archive/archive04.dbf
  users			/usr/allapps/data/users.dbf
  menus		/usr/myapp/data/system/menus.dbf

// Open a table
> use users

The OPEN DATABASE command requires only the database name to be specified, not the complete path of a directory as with SET PATH or SET DEFAULT. Databases are searched for in the sub-directories of the directory defined in the DB_DATADIR environment variable or symbol. DB_DATADIR is set in the system wide configuration file.

#---------------------------------------------------
# location of directories and important files
#---------------------------------------------------
DB_DATADIR="${ROI_ROOT}data/"     ;export DB_DATADIR

NOTE: DB_DATADIR is read from these files at startup to determine the home directory for databases. Updates to DB_DATADIR once a Recital process is running do not change this setting. The OPEN DATABASE command and certain other database commands allow a '?' to be specified in place of a database name. In this case the 'Select a file' dialog is displayed, listing the available files in the DB_DATADIR directory.

Click image to display full size

Fig 1: Recital Terminal Developer OPEN DATABASE ? command.

This functionality is also supported by the PACK DATABASE, REBUILD DATABASE and REINDEX DATABASE commands.

Databases can also simplify data access for Recital Client Drivers using the Recital Database Server: instead of specifying a starting directory, only a database name is required. The database can handle files from multiple directories and associate tables with their single index files.

Recital Universal .NET Data Provider

/////////////////////////////////////////
// include the references below
using System.Data;
using Recital.Data;

/////////////////////////////////////////
// sample code to call a Stored Procedure
public int CallStoredProcedure()
{
    string source = "Data Source=localhost;" +
	                "Database=southwind;" +
			"uid=?;"+
			"pwd=?";
						
	RecitalConnection conn = new RecitalConnection(source);
	...

Recital Universal JDBC Driver

import java.sql.*;
import java.io.*;
import java.net.URL;
import java.math.BigDecimal;
import Recital.sql.*;

public class jdbc_test {

  public static void main(String argv[]) {
    int i;
    ResultSet rs;
    ResultSetMetaData rsmd;

    System.out.println("Recital JDBC driver verification.");
	
    for (int ii=0; ii<1; ++ii) {
      try {
        //----------------------------------------------------------
        //-- Load the Client Driver for the
        //-- Recital Universal Application Server
        //----------------------------------------------------------
        System.out.println("Loading Recital JDBC driver.");
        new RecitalDriver();
        //-----------------------------------------------------------
        //-- The standard format of the connection URL is as follows:
        //-----------------------------------------------------------
        String url = "jdbc:Recital:" +
                     "SERVERNAME=?;" +
                     "DATABASE=jdbc_test;" +
                     "USERNAME=?;" +
                     "PASSWORD=?;" +
                     "ENCRYPTION=false";
...

Windows Recital Universal ODBC Driver

Click image to display full size

Fig 2: Recital Universal ODBC Driver DSN setup using a database.

Database Procedure Libraries

A database can have an associated procedure library, which is automatically opened when the database is opened. This way, any procedures required by the database's data files are always available. The procedure library should reside in the database's directory and be named dbc_xxx_library.prg, where 'xxx' is the name of the database. When the OPEN DATABASE command is issued, a check is made for the database procedure library and a SET PROCEDURE TO dbc_xxx_library.prg ADDITIVE issued automatically. The procedure library is in turn closed when the CLOSE DATABASES command is issued. This is particularly convenient for client/server database access.

Database Events

Issuing the OPEN DATABASE or CLOSE DATABASES command also fires a database event. Database events, like triggers for tables and forms, can have programs associated with them. The OPEN DATABASE command fires the DBC_OPENDATA event and will run a program called db_opendata.prg if one exists in the database's directory. Similarly, the CLOSE DATABASES command fires the DBC_CLOSEDATA event and runs the db_closedata.prg program. Both of these events also allow the current open or close operation to be abandoned if the associated program returns a logical false (.F.).

Information

Databases, specifically database catalogs, are an excellent place to store information about the files required by a particular application. Instead of having to search through application code to determine which tables are being used and what index keys they have, this information can be viewed in the database catalog. Database catalogs are themselves Recital tables and can be viewed and/or updated in the same way as any other Recital table. There is also a series of commands to provide information about the currently open database. DISPLAY/LIST DATABASE The DISPLAY DATABASE and LIST DATABASE commands display the database name and path, followed by the equivalent of LIST STRUCTURE INDEX and LIST DICTIONARY for each table in the database, e.g.

> open database southwind
> display database

Database Name:  southwind
Database Path:  /usr/recital-9.0/data/southwind/

Structure for database : categories.dbf
Number of data records : 8
Date of creation : 05/12/2004
Date of last update : 05/12/2004
Database encrypted : False


Field	Field Name		Type			Width	Dec	Description
    1	CATEGORYID	Numeric       	10			Category ID
    2	CATEGORYNAME	Character     	15			Category Name
    3	DESCRIPTION	Memo           	8			Description
    4	PICTURE		Memo           	8			Picture
** Total **                       42
Production DBX file: categories.dbx
  Master Index TAG: CATEGORYID
  Key: categoryid
  Type: Binary
  Len: 8
...

DISPLAY DATABASE shows the data one screen at a time, whereas LIST DATABASE is ideal for output to a file.

> open database southwind
> list database to file info.txt

DISPLAY/LIST TABLES

LIST TABLES, as we have seen above, lists all the tables from the database, giving each table's name and path. DISPLAY TABLES shows the information one screen at a time.

Maintenance

Using a database can simplify the maintenance of an application's programs, tables and indexes. Multiple files, possibly in different directories, can be targeted by a single database command.

COMPILE DATABASE

The COMPILE DATABASE command can be used to issue a COMPILE command for all program files listed in the database catalog.

// Open the database
open database myapp

// Compile all the database's programs
compile database

NOTE: Program files are added to a database using the SQL CREATE PROCEDURE command.

PACK DATABASE

The PACK DATABASE command issues a PACK command for every table in the database catalog. The PACK command is used to permanently remove any records that have been marked for deletion using the DELETE command.

// Open the database
open database southwind
// Pack all the database's tables
pack database

REINDEX DATABASE

The REINDEX DATABASE command rebuilds all the tag and single indexes in the catalog. This is the equivalent of an INDEX ON <key> TO | TAG <index> for each catalogued index key.

// Open the database
open database southwind
// Rebuild all the database's indexes
reindex database

NOTE: Using a database helps protect against a table being opened without its associated single index files also being opened. Any single index files that are included in the database catalog will automatically be opened when their table is opened via the database. If a single index appears in the database catalog, but the physical file no longer exists, it will be removed from the catalog when its associated table is next opened. All indexes, tagged indexes or single indexes, created while the database is open, are added automatically to the database catalog.

REBUILD DATABASE

The REBUILD DATABASE command is used to PACK, rebuild the index tags and refresh the contents of the database catalog file.

// Rebuild the database
rebuild database southwind

Creating and populating a database

Databases are created using the CREATE DATABASE command.

// Create new database
create database newdb

The CREATE DATABASE creates a sub-directory in the DB_DATADIR and initializes the new database's catalog file. The catalog file is given the same basename as the database and is a Recital table with a '.cat' file extension. It has a production index file with a '.cax' file extension and a memo file with a '.cam' file extension.

// Open the database
open database newdb

With the database open, the catalog file table is opened in the highest available workarea and is given an alias name of its basename preceded by an underscore, e.g. '_newdb'. Any new tables or indexes that are created will be automatically added into the catalog and form part of the database. 'Free' tables can also be manually added into a database using the SQL ADD TABLE command.

// config.db
set sql on
set sql to vfp
// end of config.db

// Create a 'free' table, with no database open
create table free1 (field1 char(10), field2 date)
// Open the database
open database newdb
add table free1

As the application runs, 'myapp' in the example above, each table that is opened is added to the database catalog. Indexes that are opened are added in the same way. Using SET AUTOCATALOG OFF, inclusion in the catalog can be restricted. Once all required areas of the application have been catalogued, the application can be updated to make use of the database commands.

Converting an existing application

The AUTOCATALOG commands can be used to automatically create a database catalog based on an existing application. The SET AUTOCATALOG TO >database< command will create the database if it does not already exist.

// Database must be closed during autocatalog process
close databases
// Specify the database
set autocatalog to myappdb
// Start the autocatalog process
set autocatalog on
do myapp
// The autocatalog process can be toggled off to exclude 
// certain parts of the application if required
// set autocatalog off

Exporting a database

The BACKUP DATABASE and RESTORE DATABASE commands have been added to simplify the process of moving applications between binary incompatible platforms. Binary files such as tables, memo files and data dictionaries must be exported to ASCII format to allow them to be transferred from one platform to another where the platforms have different binary ordering. For example, this is the case when moving files between a SUN Sparc Solaris machine and an Intel Linux machine. The BACKUP DATABASE and RESTORE DATABASE commands are extensions of the BUILD and INSTALL commands: where BUILD and INSTALL operate on a specified list of tables, BACKUP DATABASE and RESTORE DATABASE automatically handle an entire database.

// Open the database
open database southwind
// Export the database to ASCII format
backup database

The BACKUP DATABASE command goes through the database catalog, exporting each file into an ASCII format that can be handled by the RESTORE DATABASE command. The files are created in a directory with the same name as the database. This directory is a sub-directory of the directory specified in the environment variable DB_BACKUPDIR and is created automatically. By default, DB_BACKUPDIR is the 'backup' sub-directory of the Recital home directory.

// Query the DB_BACKUPDIR environment variable setting
> ? getenv([DB_BACKUPDIR])
/usr/recital/backup

Like DB_DATADIR, DB_BACKUPDIR is set in the system-wide configuration file and is read at startup to determine the home directory for database backups. Updates to DB_BACKUPDIR once a Recital process is running do not change this setting.

# profile.db/uas extract
#---------------------------------------------------
# location of directories and important files
#---------------------------------------------------
DB_BACKUPDIR="${ROI_ROOT}backup/"     ;export DB_BACKUPDIR

Once the BACKUP DATABASE command has completed, the files can be transferred to another platform, for example from Intel SCO OpenServer to IBM AIX and the RESTORE DATABASE command used to recreate the database.

// Export the database to ASCII format
// Note: the BACKUP DATABASE command operates
// on the active or specified database
$ db
> backup database southwind
> quit

// 'tar' up the files for transfer
$ cd /usr/recital/backup
$ tar cvf southwind.tar ./southwind

// Transfer the tar archive to DB_BAKUPDIR on the 
// target machine, then extract the files
$ pwd
/usr/recital/backup
$ tar xvf southwind.tar

// Rebuild the database on the target platform
// The database is automatically created 
// as a sub-directory of DB_DATADIR
$ db
> restore database southwind

Recital is a proven and cost-effective database solution that will help reduce the cost of your database and application software infrastructure substantially. As an added benefit, Recital can run many legacy applications with little to no change as it understands FoxBASE, FoxPRO and Clipper languages as a subset of it's overall capability.

When installing nomachine on redhat 5.3 64-bit be sure to:

This article discusses Recital database security: from operating system file permissions through file and field protection to DES3 encryption.

Overview

A company's data is extremely valuable and must be protected, both in operation and in physical file format. Recital products provide a range of ways to protect your data.

Operating System File Permissions

The most basic level of database security is provided by the operating system. Recital database tables and indexes are individual files with their own respective operating system file permissions. Read permission is required to open a table and write permission to update a table. If a user does not have read permission they are denied access. Without write permission, a table will be opened read-only.

Here the owner, root, and members of the recital group have write permission, so can update the example table unless additional protection applies. Other users can only open the example table read-only.

# ls -l example*
-rwxrwxr-x    1 root     recital       147 Nov 29 14:27 example.dbd
-rwxrwxr-x    1 root     recital     41580 Nov 29 14:27 example.dbf
-rwxrwxr-x    1 root     recital     13312 Nov 29 14:28 example.dbt
-rwxrwxr-x    1 root     recital     19456 Nov 29 14:28 example.dbx

Note: As in the example above, a table's associated files should have the same permissions as the table itself:

File Extension	File Type
.dbd	Dictionary
.dbf	Table
.dbt	Memo
.dbx	Index

Database Dictionary

Each Recital table may have a Database Dictionary. The Dictionary can be used both to protect the integrity of the data and to protect access to the data. This section covers Column Constraints, Triggers, Security and Protection.

Column Constraints: Data Integrity

The Dictionary attributes or constraints either prevent the entry of incorrect data, e.g. must_enter and validation or aid the entry of correct data, e.g. default, picture and choicelist. The Dictionary can be modified in the character mode CREATE/MODIFY STRUCTURE worksurface, via SQL statements, or in the Recital Enterprise Studio Database Administrator.

Click image to display full size

Fig 1: MODIFY STRUCTURE Worksurface: Dictionary.

The SQL Column Constraints are as follows:

Constraint	Description
AUTO_INCREMENT | AUTOINC	Used to auto increment the value of a column.
CALCULATED	Used to calculate the value of a column.
CHECK | SET CHECK	Used to validate a change to the value of a column.
DEFAULT	Used to set a default value for the specified column.
DESCRIPTION	Used set the column description for the specified column.
ERROR	Used to define an error message to be displayed when a validation check fails.
FOREIGN KEY	Used to define a column as a Foreign Key for a parent table.
NOCPTRANS	Used to prevent code page translation for character and memo fields.
NOT NULL | NULL	Used to disallow/allow NULL values.
PRIMARY KEY	Used to define a table’s Primary Key.
RANGE	Used to specify minimum and maximum values for a date or numerical column.
RECALCULATE	Used to force recalculation of calculated columns when a column’s value changes.
REFERENCES	Used to create a relationship to an index key of another table.
UNIQUE	Used to define the column as a candidate index for the table

These can be specified in CREATE TABLE or ALTER TABLE statements:

exec sql
  OPEN DATABASE southwind;
exec sql
  ALTER TABLE customers ADD COLUMN timeref char(8) CHECK validtime(timeref)
  ERROR "Not a valid time string";

Click image to display full size

Fig 2: Database Administrator: Column Constraints and Attributes.

TRIGGERS

Table Level Triggers are event-driven procedures called before an I/O operation. These can be used to introduce another layer of checks before a particular operation is permitted to take place or to simply set up logging of those operations.

The CREATE/MODIFY STRUCTURE worksurface <TRIGGERS> menu bar option allows you to specify table level triggers. You may edit a trigger procedure from within the <TRIGGERS> menu by placing the cursor next to the procedure name and pressing the [HELP] key. A text window pops up for editing. If the table triggers are stored in separate <.prg> files, rather than in a procedure library, procedures need not be predefined (SET PROCEDURE) before using the table.

Click image to display full size

Fig 3: MODIFY STRUCTURE Worksurface: Triggers.

 

The following triggers can be selected and associated with a specified procedure name in the <TRIGGERS> menu.

Trigger	Description
UPDATE	The specified procedure is called prior to an update operation on the table. If the procedure returns .F., then the UPDATE is canceled.
DELETE	The specified procedure is called prior to a delete operation on the table. If the procedure returns .F., then the DELETE is canceled.
APPEND	The specified procedure is called prior to an append operation on the table. If the procedure returns .F., then the APPEND is canceled.
OPEN	The specified procedure is called after an open operation on the table.
CLOSE	The specified procedure is called prior to a close operation on the table.
ROLLBACK	The specified procedure is called when a user presses the [ABANDON] key in a forms based operation.

The Recital Enterprise Studio Database Administrator also allows you to associate existing programs as Table Trigger Procedures.

Click image to display full size

Fig 4: Database Administrator: Triggers.

 

Programmatically, Trigger Procedures can also be associated with a table using SQL. The following table constraints may be applied in the SQL CREATE TABLE and ALTER TABLE statements:

Trigger	Description
ONUPDATE	The specified procedure is called prior to an update operation on the table. If the procedure returns .F., then the UPDATE is canceled. e.g. SQL> ALTER TABLE customer modify ONUPDATE "p_update";
ONDELETE	The specified procedure is called prior to a delete operation on the table. If the procedure returns .F., then the DELETE is canceled. e.g. SQL> ALTER TABLE customer modify ONDELETE "p_delete";
ONINSERT	The specified procedure is called prior to an insert operation on the table. If the procedure returns .F., then the INSERT is canceled. e.g. SQL> ALTER TABLE customer modify ONINSERT "p_insert";
ONOPEN	The specified procedure is called after an open operation on the table. e.g. SQL> ALTER TABLE customer modify ONOPEN "p_open";
ONCLOSE	The specified procedure is called prior to a close operation on the table. e.g. SQL> ALTER TABLE customer modify ONCLOSE "p_close";
ONROLLBACK	The specified procedure is called when a user presses the [ABANDON] key in a forms based operation. e.g. SQL> ALTER TABLE customer modify ONROLLBACK "p_rollback";

SECURITY

As mentioned above, all Recital files are subject to Operating System read and write permissions. These permissions can be further refined, while still using the Operating System user and group IDs, in the Security and Protection sections of the Dictionary. The Security section handles table based operations and the Protection section focuses on individual fields.

Security and Protection rules can be defined in the CREATE/MODIFY STRUCTURE worksurface of Recital Terminal Developer, via the SQL GRANT and REVOKE statements or in the Recital Enterprise Studio Database Administrator.

Click image to display full size

Fig 5: MODIFY STRUCTURE Worksurface: Security.

 

The Security section has table operations for which Access Control Strings can be specified. An Access Control String (ACS) is a range of valid user identification codes, and is used to restrict table operations to certain individuals or groups. Each user on the system is allocated a group number and a user number. The user identification code is the combination of group and user numbers. When constructing an Access Control String of linked user identification codes, wild card characters may be used.

Example ACS	Description
[1,2]	In group 1, user 2
[100,*]	In group 100, all users
[2-7,*]	In groups 2-7, all users
[*,100-200]	In all groups, users 100-200
[1,*]&[2-7,1-7]	In group 1, all users, in groups 2-7, users 1-7

Please note that the maximum ACS length is 254 characters. OpenVMS group and user numbers are stored and specified in octal. On other Operating Systems, group and user numbers are stored and specified in decimal.

Access Control Strings may be associated with the following operations:

Operation	Description
READONLY	Users specified in the ACS have read-only access to the table. All other users have update access.
UPDATE	Users specified in the ACS have update access to the table. All other users are restricted to read-only access.
APPEND	Users specified in the ACS can append records into the table. No other users can append.
DELETE	Users specified in the ACS can delete records from the table. No other users can delete.
COPY	Users specified in the ACS can copy records from the table. No other users can copy.
ADMIN	Users specified in the ACS can use the following commands: SET DICTIONARY TO MODIFY STRUCTURE PACK ZAP REINDEX All other users cannot, except the creator of the table, who is always granted ADMIN access.

The corresponding SQL privileges are:

Operation	Description
SELECT	Users specified in the ACS may name any column in a SELECT statement. All other users have update access.
UPDATE	Users specified in the ACS may name any column in an UPDATE statement. All other users are restricted to read-only access.
INSERT	Users specified in the ACS can INSERT rows into the table. No other users can INSERT.
DELETE	Users specified in the ACS can DELETE rows from the table. No other users can DELETE.
ALTER	Users specified in the ACS can use the ALTER TABLE statement on this table.
READONLY	Users specified in the ACS may read any column in a SELECT statement. All other users have update access.

// Grant insert privilege for the customer table
exec sql
  OPEN DATABASE southwind;
exec sql
  GRANT UPDATE (lastname, firstname)
  INSERT ON customers
  TO '[20,100]'; 
	
// Grant all privileges to all users
exec sql
  OPEN DATABASE southwind;
exec sql
  GRANT ALL 
  ON shippers TO PUBLIC;

PROTECTION

Security and Protection rules can be defined in the CREATE/MODIFY STRUCTURE worksurface of Recital Terminal Developer, via the SQL GRANT and REVOKE statements or in the Recital Enterprise Studio Database Administrator.

Click image to display full size

Fig 6: Database Administrator: Protection.

 

The format of the ACS is the same as in <SECURITY> above. The following protection can be defined:

Operation	Description
READONLY	Users specified in the ACS have read-only access to the field. All other users have update access.
UPDATE	Users specified in the ACS have update access to the field. All other users are restricted to read-only access.

Recital Terminal Developer also has 'HIDDEN' Protection:

Operation	Description
HIDDEN	Users specified in the ACS see the 'hiddenfield'character rather than the data in the field. All other users see the data.

Hidden fields can be accessed and viewed on a work surface, but the field contains the hiddenfield character, ‘?’. If the field is referenced in an expression, it will contain the following: blanks for character fields, ‘F’ for logical fields, 00/00/0000 for date fields and blank for memo fields.

The corresponding SQL privileges are:

Operation	Description
SELECT	Users specified in the ACS may name the column in a SELECT statement. All other users have update access.
UPDATE	Users specified in the ACS may name the column in an UPDATE statement. All other users are restricted to read-only access.
READONLY	Users specified in the ACS may read the column in a SELECT statement. All other users have update access.

// Grant update privilege for columns lastname and firstname from the customer table
exec sql
  OPEN DATABASE southwind;
exec sql
  GRANT UPDATE (lastname, firstname)
  customers TO '[20,100]';

Encryption

From Recital 8.5 onwards, Recital installations that have the additional DES3 license option have the ability to encrypt the data held in Recital database tables. Once a database table has been encrypted, the data cannot be accessed unless the correct three-part encryption key is specified, providing additional security for sensitive data.

ENCRYPT

The ENCRYPT Recital 4GL command is used to encrypt the data in the specified table or tables matching a skeleton. If the skeleton syntax is used, then all matching tables will be given the same encryption key. The encryption key is a three part comma-separated key and may optionally be enclosed in angled brackets. Each part of the key can be a maximum of 8 characters. The key is DES3 encrypted and stored in a .dkf file with the same basename as the table. After encryption, the three parts of the key must be specified correctly before the table can be accessed.

// Encrypt individual tables
encrypt customers key "key_1,key_2,key_3"
encrypt employees key "<key_1,key_2,key_3>"

// Encrypt all .dbf files in the directory
encrypt *.dbf key "key_1,key_2,key_3"

SET ENCRYPTION

If a database table is encrypted, the correct three-part encryption key must be specified before the table's data or structure can be accessed. The SET ENCRYPTION TO set command can be used to specify a default encryption key to be used whenever an encrypted table is accessed without the key being specified. The encryption key is a three part comma-separated key.

If the command to access the table includes the key, either by appending it to the table filename specification or using an explicit clause, this will take precedence over the key defined by SET ENCRYPTION TO.

Issuing SET ENCRYPTION TO without a key causes any previous setting to be cleared. The key must then be specified for each individual encrypted table.

The default key defined by SET ENCRYPTION is only active when SET ENCRYPTION is ON. SET ENCRYPTION OFF can be used to temporarily disable the default key. The SET ENCRYPTION ON | OFF setting does not change the default key itself. SET ENCRYPTION is ON by default.

// Encrypt individual tables
encrypt customers key "key_1,key_2,key_3"
encrypt shippers key "key_2,key_3,key_4"
// Specify a default encryption key
set encryption to "key_1,key_2,key_3"
// Open customers table using the default encryption key
use customers
// Specify shippers table's encryption key
use shippers<key_2,key_3,key_4>
// Disable the default encryption key
set encryption to
// Specify the individual encryption keys
use customers encryption "key_1,key_2,key_3"
use shippers<key_2,key_3,key_4>

DECRYPT

The DECRYPT command is used to decrypt the data in the specified table or tables matching a skeleton. The specified key must contain the three part comma-separated key used to previously encrypt the table and may optionally be enclosed in angled brackets. The skeleton syntax can only be used if all tables matching the skeletonhave the same key.

The DECRYPT command decrypts the data and removes the table’s .dkf file. After decryption, the key need no longer be specified to gain access to the table.

// Decrypt individual tables
decrypt customers key "key_1,key_2,key_3"
decrypt employees key "<key_1,key_2,key_3>"

// Decrypt all .dbf files in the directory
decrypt *.dbf key "key_1,key_2,key_3"

All of the following commands are affected when a table is encrypted:

• APPEND FROM
• COPY FILE
• COPY STRUCTURE
• COPY TO
• DIR
• USE
• SQL INSERT
• SQL SELECT
• SQL UPDATE

APPEND FROM

Used to append records to the active table from another table.

// The key must be specified for an encrypted source table
use mycustomers
append from customers encryption "key_1,key_2,key_3";
for country = "UK"

COPY FILE

Used to copy a file.

// The key file must also be copied for an encrypted source table
// as the target table will be encrypted
encrypt customers key "key_1,key_2,key_3"
copy file customers.dbf to newcustomers.dbf
copy file customers.dkf to newcustomers.dkf
use newcustomers encryption "key_1,key_2,key_3"

COPY STRUCTURE

Used to copy a table's structure to a new table.

// The key file is automatically copied for an encrypted source table
// and the target table encrypted
encrypt customers key "key_1,key_2,key_3"
use customers encryption "key_1,key_2,key_3"
copy structure to blankcust
use blankcust encryption "key_1,key_2,key_3"

COPY TO

Used to copy a table.

// By default, the key file is automatically copied for an encrypted
// source table and the target table encrypted with the same key
encrypt customers key "key_1,key_2,key_3"
use customers encryption "key_1,key_2,key_3"
copy to newcustomers
use newcustomers encryption "key_1,key_2,key_3"

// You can also create a copy with a different key
encrypt customers key "key_1,key_2,key_3"
use customers encryption "key_1,key_2,key_3"
copy to newcustomers encrypt "newkey_1,newkey_2,newkey_3"
use newcustomers encryption "newkey_1,newkey_2,newkey_3"

// Or create a decrypted copy
encrypt customers key "key_1,key_2,key_3"
use customers encryption "key_1,key_2,key_3"
copy to newcustomers decrypt
use newcustomers

// You can also create an encrypted copy of a non-encrypted source table
use orders
copy to encorders encrypt "newkey_1,newkey_2,newkey_3"
use encorders encryption "newkey_1,newkey_2,newkey_3"

DIR

Used to display a directory listing of tables.

// Encrypted tables are flagged as such with (DES3)
> open database southwind
> dir

Current database: southwind
Tables				# Records		Last Update	Size		Dictionary	Triggers	Security
categories.dbf			8			01/10/06		24576	None		None		None
cisamdemo.dbf       ---> CISAM/Bridge        [cisamdemo]
customers.dbf (DES3)		91			05/12/04		49600	None		None		None
employees.dbf			9			05/12/04		25520	None		None		None
example.dbf   (DES3)		100			12/24/05		38080	Yes		Yes		None
order_details.dbf			2155			05/12/04		296320	None		None		None
orders.dbf				829			05/12/04		232704	None		None		None
products.dbf			77			05/12/04		37112	None		None		None
productsbyname.dbf		77			05/12/04		29104	None		None		None
shippers.dbf  (DES3)		3			05/12/04		20864	None		None		None
suppliers.dbf			29			12/08/05		29992	Yes		None		None

   0.765 MB in 11 files.
   1.093 GB remaining on drive.

USE

Used to open a table.

// The three part key must be specified to open an
// encrypted table.  All of the following are valid.
// 1. Specifying a default encryption key before opening the table
set encryption to "key_1,key_2,key_3"
use customers
// 2. Appending the key to the filename
use customers<key_1,key_2,key_3>
// 3. Using the ENCRYPTION clause, optionally specifying angled brackets
use customers encryption "key_1,key_2,key_3"
use customers encryption "<key_1,key_2,key_3>"

SQL INSERT

Used to add a row to a table via SQL.

// The three part key can be specified using a
// default encryption key before opening the table
exec sql
  OPEN DATABASE southwind;
exec sql
  SET ENCRYPTION TO "key_1,key_2,key_3";
exec sql
  INSERT INTO customers
  (customerid, companyname)
  VALUES
  ('RECIT','Recital Corporation');
// Or by appending the key to the filename
exec sql
  OPEN DATABASE southwind;
exec sql
  INSERT INTO customers<key_1,key_2,key_3>
  (customerid, companyname)
  VALUES
  ('RECIT','Recital Corporation');

SQL SELECT

Used to return data from a table via SQL.

// The three part key can be specified using a
// default encryption key before opening the table
exec sql
  OPEN DATABASE southwind;
exec sql
  SET ENCRYPTION TO "key_1,key_2,key_3";
exec sql
  SELECT * FROM customers;
// Or by appending the key to the filename
exec sql
  OPEN DATABASE southwind;
exec sql
  SELECT * FROM customers<key_1,key_2,key_3>;

SQL UPDATE

Used to update data in a table via SQL.

// The three part key can be specified using a
// default encryption key before opening the table
exec sql
  OPEN DATABASE southwind;
exec sql
  SET ENCRYPTION TO "key_1,key_2,key_3";
exec sql
  UPDATE customers
  SET companyname='Recital Corporation Inc.'
  WHERE customerid='RECIT';
// Or by appending the key to the filename
exec sql
  OPEN DATABASE southwind;
exec sql
  UPDATE customers<key_1,key_2,key_3>
  SET companyname='Recital Corporation Inc.'
  WHERE customerid='RECIT';

Summary

Recital offers a range of ways to keep your data secure. These start with the Operating System read/write permissions, which can be further refined to the level of table I/O operations and then field access in the Dictionary based Security and Protection rules. The Dictionary also provides the means to protect the integrity of the data via data validation and to assist in correct data entry through the use of choicelists, help messages and picture clauses etc. A further role of the Dictionary is in the provision of Table Triggers, which can be used to enable a programmatic response to table operations to add in additional checks or audit trails. For the most sensitive data, DES3 encryption is the ultimate protection: encrypting the physical data on the disk and only permitting table access on the production of the three part encryption key.