Re: Preventing Injection - Client Side

From: Willy (willrich33_at_yahoo.com)
Date: 11/10/05 

Date: Wed, 09 Nov 2005 20:21:43 -0800

Dan,David:

Thank you for making me think about security.

My application does not allow the user to use tables under any other
username (such as dbo) so he is fairly isolated. I realize Access
defaults to dbo but I will be shutting the database window down.

I tried to import a file to my database under a different username (like
dbo) but Access converted it back to the username of the new
database/login so that seems somewhat secure. This is why I am using
Access for a client program.

I am not coding for characters other than Like *[A-Z0-9] so the purging
of other characters from the column and table names that the user has
control of will have to do for now.

In the documentation I am going to highly recommend "isolating" the
application in separate db for "security reasons."

Thank you for suggesting parameters and DML as solutions for preventing
injection. I will keep my eye out for information on them.

I really need to learn more about SQL Server permissions and security.

Willy

*** Sent via Developersdex http://www.developersdex.com ***

Relevant Pages

  • RE: ASP.Net not impersonating for WSE 2.0
    ... When using username tokens in WSE, this is not an integrated security ... and thus is not integrated into windows security at all. ... Setting up a database that contains credentials is similar to any ...
    (microsoft.public.dotnet.framework.aspnet.webservices)
  • Re: Enter user name, enter password, then press enter...
    ... What do you do when the customer asks that the database login in be the same ... username and password to use all of the stuff that she is permitted to use. ... I have implemented this type of security for Access, VB, and Web Based ASP ...
    (microsoft.public.access.forms)
  • RE: ASP.Net not impersonating for WSE 2.0
    ... This causes calls made by the service (which call into the database ... >security from anywhere in my web services.* On some of my webservices I ... >has a column called username and one called password. ... This query is also run with Integrated Security. ...
    (microsoft.public.dotnet.framework.aspnet.webservices)
  • Re: Providing logins for users and filtering records based on users
    ... You could then secure the database. ... Security Whitepaper ... record owner field to either CurrentUseror the windows username. ...
    (microsoft.public.access.security)
  • Re: Question about SQL Server roles
    ... Not only is sysadmin mapped to dbo in the ... database, but when you run sp_adduser to add a user to a database you can ... guarantee anything about what my database username is. ... >>> SELECT R.name AS RoleName ...
    (microsoft.public.sqlserver.security)