This documentation is archived and is not being maintained.

SQL Server Programming and Host Protection Attributes 

The ability to load and execute managed code in a SQL Server host requires meeting the host's requirements for both code access security and host resource protection. The code access security requirements are specified by one of three SQL Server permission sets: SAFE, EXTERNAL-ACCESS, or UNSAFE. Code executing within the SAFE or EXTERNAL-ACCESS permission sets must avoid certain types or members that have the HostProtectionAttribute attribute applied. The HostProtectionAttribute is not a security permission as much as a reliability guarantee in that it identifies specific code constructs, either types or methods, that the host may disallow. The use of the HostProtectionAttribute enforces a programming model that helps protect the stability of the host.

Host Protection Attributes

Host protection attributes identify types or members that do not fit the host programming model and represent the following increasing levels of reliability threat:

  • Are otherwise benign.

  • Could lead to destabilization of server-managed user code.

  • Could lead to destabilization of the server process itself.

SQL Server disallows the use of a type or member that has a HostProtectionAttribute that specifies a HostProtectionResource value of SharedState, Synchronization, MayLeakOnAbort, or ExternalProcessMgmt. This prevents the assemblies from calling members that enable sharing state, perform synchronization, might cause a resource leak on termination, or affect the integrity of the SQL Server process.

Disallowed Types and Members

The following table identifies types and members whose HostProtectionResource values are disallowed by SQL Server.

Namespace Type or member


PowerModeChangedEventArgs class

PowerModeChangedEventHandler delegate

SessionEndedEventArgs class

SessionEndedEventHandler delegate

SessionEndingEventArgs class

SessionEndingEventHandler delegate

SessionSwitchEventArgs class

SessionSwitchEventHandler delegate

SystemEvents class

TimerElapsedEventArgs class

TimerElapsedEventHandler delegate

UserPreferenceChangedEventArgs class

UserPreferenceChangingEventArgs class


System.Collections.ArrayList.Synchronized method

System.Collections.Hashtable.Synchronized(System.Collections.Hashtable) method

System.Collections.Queue.Synchronized(System.Collections.Queue) method

System.Collections.SortedList.Synchronized(System.Collections.SortedList) method

System.Collections.Stack.Synchronized(System.Collections.Stack) method


AddingNewEventArgs class

AddingNewEventHandler delegate

ArrayConverter class

AsyncCompletedEventArgs class

AsyncCompletedEventHandler delegate

AsyncOperation class

AsyncOperationManager class

AttributeCollection class

BackgroundWorker class

BaseNumberConverter class

BindingList class

BooleanConverter class

ByteConverter class

CancelEventArgs class

CancelEventHandler delegate

CharConverter class

CollectionChangeEventArgs class

CollectionChangeEventHandler delegate

CollectionConverter class

ComponentCollection class

ComponentConverter class

ComponentEditor class

ComponentResourceManager class

Container class

ContainerFilterService class

CultureInfoConverter class

CustomTypeDescriptor class

DateTimeConverter class

DecimalConverter class

ActiveDesignerEventArgs class

ActiveDesignerEventHandler delegate

CheckoutException class

CommandID class

ComponentChangedEventArgs class

ComponentChangedEventHandler delegate

ComponentChangingEventArgs class

ComponentChangingEventHandler delegate

ComponentEventArgs class

ComponentEventHandler delegate

ComponentRenameEventArgs class

ComponentRenameEventHandler delegate

DesignerCollection class

DesignerEventArgs class

DesignerEventHandler delegate

DesignerOptionService class

DesignerTransaction class

DesignerTransactionCloseEventArgs class

DesignerTransactionCloseEventHandler delegate

DesignerVerb class

DesignerVerbCollection class

DesigntimeLicenseContext class

DesigntimeLicenseContextSerializer class

MenuCommand class

ComponentSerializationService class

ContextStack class

DesignerLoader class

InstanceDescriptor class

MemberRelationshipService class

ResolveNameEventArgs class

ResolveNameEventHandler delegate

SerializationStore class

ServiceContainer class

ServiceCreatorCallback delegate

StandardCommands class

StandardToolWindows class

DoubleConverter class

DoWorkEventArgs class

DoWorkEventHandler delegate

EnumConverter class

EventDescriptor class

EventDescriptorCollection class

EventHandlerList class

ExpandableObjectConverter class

HandledEventArgs class

HandledEventHandler delegate

InstanceCreationEditor class

Int16Converter class

Int32Converter class

Int64Converter class

InvalidAsynchronousStateException class

InvalidEnumArgumentException class

BeginInvoke method

License class

LicenseContext class

LicenseException class

LicenseManager class

LicenseProvider class

LicFileLicenseProvider class

ListChangedEventArgs class

ListChangedEventHandler delegate

ListSortDescription class

ListSortDescriptionCollection class

MaskedTextProvider class

MemberDescriptor class

MultilineStringConverter class

NestedContainer class

NullableConverter class

ProgressChangedEventArgs class

ProgressChangedEventHandler delegate

PropertyChangedEventArgs class

PropertyChangedEventHandler delegate

PropertyDescriptor class

PropertyDescriptorCollection class

ReferenceConverter class

RefreshEventArgs class

RefreshEventHandler delegate

RunWorkerCompletedEventArgs class

RunWorkerCompletedEventHandler delegate

SByteConverter class

SingleConverter class

StringConverter class

SyntaxCheck class

TimeSpanConverter class

TypeConverter class

TypeDescriptionProvider class

TypeDescriptor class

TypeListConverter class

UInt16Converter class

UInt32Converter class

UInt64Converter class

WarningException class

Win32Exception class


System.Diagnostics.Debug.Listeners property

System.Diagnostics.Trace.Listeners property

System.Diagnostics.EventLog.SynchronizingObject property

ConsoleTraceListener class

DefaultTraceListener class

DelimitedListTraceListener class

EventLogTraceListener class

PerformanceCounter class

PerformanceCounterCategory class

Process class

ProcessStartInfo class

TextWriterTraceListener class

TraceListener class

XmlWriterTraceListener class

System.Diagnostics.TraceSource.Listeners property


System.IO.Stream.Synchronized(System.IO.Stream) method

System.IO.TextReader.Synchronized(System.IO.TextReader) method

System.IO.TextWriter.Synchronized(System.IO.TextWriter) method


ConstructorBuilder class

EventBuilder class

FieldBuilder class

MethodBuilder class

CustomAttributeBuilder class

MethodRental class

ModuleBuilder class

PropertyBuilder class

TypeBuilder class

UnmanagedMarshal class


System.Text.RegularExpressions.Group.Synchronized(System.Text.RegularExpressions.Group) method

System.Text.RegularExpressions.Match.Synchronized(System.Text.RegularExpressions.Match) method


AutoResetEvent class

EventWaitHandle class

ManualResetEvent class

Monitor class

Mutex class

ReaderWriterLock class

Semaphore class

System.Threading.Thread.AllocateNamedDataSlot(System.String) method

System.Threading.Thread.BeginCriticalRegion method

System.Threading.Thread.EndCriticalRegion method

System.Threading.Thread.FreeNamedDataSlot(System.String) method

System.Threading.Thread.GetData(System.LocalDataStoreSlot) method

System.Threading.Thread.Join method

System.Threading.Thread.SetApartmentState(System.Threading.ApartmentState) method

System.Threading.Thread.SetData(System.LocalDataStoreSlot,System.Object) method

System.Threading.Thread.SpinWait(System.Int32) method

System.Threading.Thread.Start method

System.Threading.Thread.TrySetApartmentState(System.Threading.ApartmentState) method

ThreadPool class

Timer class


Timer class


MachineKeyValidationConverter class


System.Windows.Forms.AutoCompleteStringCollection.SyncRoot property

SQL Server Permission Sets

SQL Server allows users to specify the reliability requirements for code deployed into a database. When assemblies are uploaded into the database, the author of the assembly can specify one of three permission sets for that assembly: SAFE, EXTERNAL-ACCESS, or UNSAFE.


Code access security

Execute only

Execute + access to external resources


Programming model restrictions



No restrictions

Verifiability requirement




Ability to call native code




SAFE is the most reliable and secure mode with associated restrictions in terms of the allowed programming model. SAFE code has high reliability and security features. SAFE assemblies are given enough permission to run, perform computations, and have access to the local database. SAFE assemblies need to be verifiably type safe and are not allowed to call unmanaged code.

EXTERNAL-ACCESS provides an intermediate security option, allowing code to access resources external to the database but still having the reliability and safety of SAFE.

UNSAFE is for highly trusted code that can only be created by database administrators. This trusted code has no code access restrictions, and it can call unmanaged (native) code.

SQL Server uses the host-level code access security policy layer to set up a host policy that grants one of the three sets of permissions based on the permission set stored in SQL Server catalogs. Managed code running inside the database always gets one of these code access permission sets.

Programming Model Restrictions

The programming model for managed code in SQL Server requires functions, procedures, and types which do not require the use of state held across multiple invocations or the sharing of state across multiple user sessions. Further, as described earlier, the presence of shared state can cause critical exceptions that impact the scalability and the reliability of the application.

Given these considerations, SQL Server disallows the use of static variables and static data members. For SAFE and EXTERNAL-ACCESS assemblies, SQL Server examines the metadata of the assembly at CREATE ASSEMBLY time, and fails the creation of such assemblies if it finds the use of static data members and variables.

See Also