3 ms·
One of the things I've done to harden an app is to revoke all permissions other than EXEC on a particular schema, then make sure everything is done via paramati
by voltagex_ 9y ago
One of the things I've done to harden an app is to revoke all permissions other than EXEC on a particular schema, then make sure everything is done via paramatised stored procedures - no chance of SQL injection then.
- flukus 9y agoBut that creates situations like this where you have to jump through hoops to solve simple problems. You solved one potential issue at the cost of creating many more. > no chance of SQL injection then. You know you can have sql injection attacks inside stored procedures? If you think stored procedures are a panacea then you don't understand the problem you're solving.
- voltagex_ 9y agoPerhaps I should have said "greatly reduced the risk of". I'm not using something like Entity Framework and the CRUD apps I mostly wrote at work were well suited to a few simple sprocs. The time it takes to write an ALTER script to change something pales in comparison to the two week change control process anyway...
- voltagex_ 9y agohttps://stackoverflow.com/a/24029829/229631 https://stackoverflow.com/a/24029829/229631 https://blogs.msdn.microsoft.com/brian_swan/2011/02/16/do-stored-procedures-protect-against-sql-injection/ https://blogs.msdn.microsoft.com/brian_swan/2011/02/16/do-st... https://security.stackexchange.com/questions/68701/how-does-stored-procedure-prevents-sql-injection https://security.stackexchange.com/questions/68701/how-does-...