Re: Preventing Injection - Client Side

From: David Gugick (david.gugick-nospam_at_quest.com)
Date: 11/10/05 

Date: Wed, 9 Nov 2005 18:49:04 -0500

willy wrote:
> Tables - Create Drop Read Write
> SPs -- Create Execute
>
> In addition the program needs to read from
>
> system_user
> db_name()
>
> information_schema.tables
> Information_schema.columns
> sysobjects

Who is the owner of these tables? Are they owned by "dbo"? If so, all
users would have to be aliased as the dbo in the database, which means
they probably have too many rights. They could be limited to creating
tables under their user names (e.g. Joe.MyTable), but this would not
give other users access to these tables. Creating and Dropping tables is
generally a system admin or database owner function and not normal for
an application. Unless, of course, you mean temp tables.

To perform DML operations on tables, I would use stored procedures. You
can use them for SELECT statements as well, but some users choose to
embed SQL in the app (I prefer SPs all around).

The other objects/functions are available to all users.

Maybe you could explain the need to create/drop tables a little more.
Same for stored procedures. 

-- 
David Gugick
Quest Software
www.imceda.com
www.quest.com

Relevant Pages

  • Re: Help pls: Not allow users access to tables, stored procedures
    ... tables are owned by dbo. ... SQL Server MVP ... etc) is performed via stored procedures. ... correct permission for select permission on the tables. ...
    (microsoft.public.sqlserver.security)
  • Re: MS Access cant find Recordsource object
    ... object names and stored procedures that reference objects. ... I guess I'll get busy prepending dbo. ... > since later versions are better able to resolve queries where objects ... If I give those users sysadmin privileges, ...
    (microsoft.public.sqlserver.server)
  • Re: dbo. in vs generated code for stored procedures.
    ... all of your stored procedures be owned by dbo so that you don't have ... stored procedures to be owned by dbo, ... If she is not a sysadmin, ... A developer who is a db_owner can ...
    (microsoft.public.dotnet.framework.adonet)
  • Re: Granting GRANT permissions
    ... procedures for dbo. ... > they can create stored procedures owned by dbo. ... > Members of db_ddladmin can also edit the stored procedures. ... >>that errors out saying you can't use AS when granting those rights. ...
    (microsoft.public.sqlserver.security)