Click here to Skip to main content
15,915,172 members
Home / Discussions / Database
   

Database

 
GeneralRe: Huge Memory Consumption Pin
Mike Dimmick2-Jan-05 6:16
Mike Dimmick2-Jan-05 6:16 
GeneralRe: Huge Memory Consumption Pin
Developer56783-Jan-05 2:45
Developer56783-Jan-05 2:45 
GeneralHow Pin
KORCARI31-Dec-04 0:09
KORCARI31-Dec-04 0:09 
GeneralRe: How Pin
Rob Graham31-Dec-04 3:45
Rob Graham31-Dec-04 3:45 
GeneralWhere.... Pin
KORCARI31-Dec-04 0:06
KORCARI31-Dec-04 0:06 
GeneralMySQL GRANT SELECT Pin
alex.barylski30-Dec-04 15:09
alex.barylski30-Dec-04 15:09 
GeneralRe: MySQL GRANT SELECT Pin
WoutL31-Dec-04 0:46
WoutL31-Dec-04 0:46 
GeneralRe: MySQL GRANT SELECT Pin
Colin Angus Mackay31-Dec-04 15:46
Colin Angus Mackay31-Dec-04 15:46 
As Wout Louwers has said, using SELECT TOP 1 will guarantee that only one row is returned. However, that is only for one query, and will not help if, somehow, an injection attack is occurring.

What you need to do is to make sure that that the account being used to access your SQL Server does not have any rights to query or modify the table(s). If the account that is accessing SQL Server has no rights to query or modify the table they cannot attack it. (By "query" I mean a SELECT statement, and by "modify" I mean INSERT, UPDATE or DELETE).

In order to actually check a users validity, or create a new user and so on, you will need to create stored procedures for the operations you wish to perform on the table. You then give the permission to EXECUTE the stored procedures to the accounts that you need.

The way SQL Server security works is that if the user attempts to execute a stored procedure then the SQL Server with check that user is authorised to do that. If so then they stored procedure can run and, normally, no further checks are made. This means that a user can be permitted to use a stored procedure that uses tables that the user does not have access to. This protects the tables as the stored procedure can make additional checks to ensure that the data is valid before the request is performed. It also means that only the operations you specify in the stored procedures can be carried out.

I said that "normally" the security is not checked again when the system discovers that the user has permission to execute the stored procedure. There are cases where additional checks are made. One example is if some dynamic SQL is executed inside a stored procedure. Dynamic SQL is where the stored procedure takes information from the parametes or from tables in the database and constructs a new query internally in a string, then executes the SQL in the string. Dynamic SQL is a source for secondary injection attacks. These are often more problematic to trace to the source because the source of the attack can lay dormant in the database for some time before becoming activated.

I hope I've managed to answer your question, and anticipate follow up questions. Let me know if you need more.

[EDIT]
Sorry, I just realised you were talking about MySQL and not SQL Server. The principles are more or less the same for all databases and should work if MySQL supports stored procedures - It was in the pipeline the last time I looked, but I don't know if it is available yet.
[/EDIT]


Do you want to know more?
WDevs.com - Open Source Code Hosting, Blogs, FTP, Mail and Forums


GeneralTOPLESS LADIES INSIDE - SQL Pin
HarryBo30-Dec-04 9:10
HarryBo30-Dec-04 9:10 
GeneralRe: TOPLESS LADIES INSIDE - SQL Pin
Javier Lozano1-Jan-05 13:44
Javier Lozano1-Jan-05 13:44 
GeneralOracle forms 6i problem Pin
missnazar30-Dec-04 4:00
missnazar30-Dec-04 4:00 
GeneralStored Procedure PRoblem Pin
percyvimal30-Dec-04 2:15
percyvimal30-Dec-04 2:15 
GeneralRe: Stored Procedure PRoblem Pin
Mike Dimmick30-Dec-04 3:50
Mike Dimmick30-Dec-04 3:50 
GeneralRe: Stored Procedure PRoblem Pin
abbaskaya30-Dec-04 4:29
abbaskaya30-Dec-04 4:29 
GeneralRe: Stored Procedure PRoblem Pin
abbaskaya30-Dec-04 4:30
abbaskaya30-Dec-04 4:30 
GeneralRe: Stored Procedure PRoblem Pin
percyvimal30-Dec-04 5:44
percyvimal30-Dec-04 5:44 
GeneralRe: Stored Procedure PRoblem Pin
WoutL30-Dec-04 9:33
WoutL30-Dec-04 9:33 
GeneralRe: Stored Procedure PRoblem Pin
percyvimal30-Dec-04 10:42
percyvimal30-Dec-04 10:42 
GeneralRe: Stored Procedure PRoblem Pin
WoutL31-Dec-04 0:43
WoutL31-Dec-04 0:43 
GeneralUnable to install Oracle 8i Release 3 Pin
missnazar30-Dec-04 0:02
missnazar30-Dec-04 0:02 
GeneralRe: Unable to install Oracle 8i Release 3 Pin
Graham Bradshaw30-Dec-04 0:18
Graham Bradshaw30-Dec-04 0:18 
GeneralRe: Unable to install Oracle 8i Release 3 Pin
missnazar30-Dec-04 3:46
missnazar30-Dec-04 3:46 
GeneralWhy Reset button does not work more than once in ASP.NET web application Pin
amittinku29-Dec-04 23:03
amittinku29-Dec-04 23:03 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.