User account for web applications (to avoid sql-injection)

From: Mike (Mike_at_discussions.microsoft.com)
Date: 03/28/05

  • Next message: Uri Dimant: "Re: User account for web applications (to avoid sql-injection)" 
    Date: Sun, 27 Mar 2005 20:05:01 -0800

    Hi,
    I have been using 'sa' for my web applications but after reading articles
    about sql-injection I want to change the account immediately. Can you please
    advise how I should be doing this. what rights should be given to the web
    application so that they can do regular, selects, inserts , updates and
    deletes(in some cases) at the same time avoid a SQL attack like DROP Table or
    other major attacks.
    I will be trying to do this at the application level too but I would like to
    make sure SQL Server is safe.
    I am using sql server 2000 and I have about 12 databases (approximately
    10-15 tables in each dB).

  • Next message: Uri Dimant: "Re: User account for web applications (to avoid sql-injection)"

    Relevant Pages

    • Re: User account for web applications (to avoid sql-injection)
      ... > I have been using 'sa' for my web applications but after reading articles ... > about sql-injection I want to change the account immediately. ... > deletesat the same time avoid a SQL attack like DROP Table ...
      (microsoft.public.sqlserver.security)
    • Re: Error : "SELECT permission denied on object"
      ... The SQL Server Express installation does not grant access to the ASP.NET ... worker process identity (ASPNET on Windows 2000 and Windows XP; ... filesystem Web applications will run under the Visual ... Web applications cause permission denied errors at runtime. ...
      (microsoft.public.dotnet.framework.aspnet)
    • Re: Database for .NET Windows, PPC, and elsewhere?
      ... > with web applications. ... Replication is necessary. ... > I could go the SQL Server way, and it would certainly work, but it has ... with ADOCE on the PPC. ...
      (microsoft.public.dotnet.general)
    • Re: SQL Server 2005 - getting Bruteforced
      ... The SQL Server is running on an Internet Server with ASP.NET v2 remotely. ... We are testing several Web Applications there with a Remote Team. ... The ASP.NET Applications are using SQL Authentication instead of Windows ... Here's an example ADO.NET connection string using integrated security. ...
      (microsoft.public.sqlserver.security)
    • Re: SQL Server 2005 - getting Bruteforced
      ... We are testing several Web Applications there with a Remote Team. ... The ASP.NET Applications are using SQL Authentication instead of Windows Authentication. ... Also you can move SQL Server off of port 1433, and change your connection strings accordingly. ...
      (microsoft.public.sqlserver.security)