User account for web applications (to avoid sql-injection)

From: Mike (Mike_at_discussions.microsoft.com)
Date: 03/28/05

  • Next message: Uri Dimant: "Re: User account for web applications (to avoid sql-injection)" 
    Date: Sun, 27 Mar 2005 20:05:01 -0800

    Hi,
    I have been using 'sa' for my web applications but after reading articles
    about sql-injection I want to change the account immediately. Can you please
    advise how I should be doing this. what rights should be given to the web
    application so that they can do regular, selects, inserts , updates and
    deletes(in some cases) at the same time avoid a SQL attack like DROP Table or
    other major attacks.
    I will be trying to do this at the application level too but I would like to
    make sure SQL Server is safe.
    I am using sql server 2000 and I have about 12 databases (approximately
    10-15 tables in each dB).

  • Next message: Uri Dimant: "Re: User account for web applications (to avoid sql-injection)"

    Relevant Pages

    • Re: User account for web applications (to avoid sql-injection)
      ... > I have been using 'sa' for my web applications but after reading articles ... > about sql-injection I want to change the account immediately. ... > deletesat the same time avoid a SQL attack like DROP Table ...
      (microsoft.public.sqlserver.security)
    • Re: Error : "SELECT permission denied on object"
      ... The SQL Server Express installation does not grant access to the ASP.NET ... worker process identity (ASPNET on Windows 2000 and Windows XP; ... filesystem Web applications will run under the Visual ... Web applications cause permission denied errors at runtime. ...
      (microsoft.public.dotnet.framework.aspnet)
    • Re: Database for .NET Windows, PPC, and elsewhere?
      ... > with web applications. ... Replication is necessary. ... > I could go the SQL Server way, and it would certainly work, but it has ... with ADOCE on the PPC. ...
      (microsoft.public.dotnet.general)
    • Re: SQL Server 2005 - getting Bruteforced
      ... The SQL Server is running on an Internet Server with ASP.NET v2 remotely. ... We are testing several Web Applications there with a Remote Team. ... The ASP.NET Applications are using SQL Authentication instead of Windows ... Here's an example ADO.NET connection string using integrated security. ...
      (microsoft.public.sqlserver.security)
    • table and class
      ... in my web application (as quite all web applications) i have a lot of ... (integrating javascript and css) ... or should i mix javascript "classes" and PHP classes? ... PostgreSQL 8.2.4 / MS SQL server 2005 ...
      (php.general)