3 ms·
Heh. One of the best protections against SQL injection is not to grant those privileges to the db account from the webserver. So many sites could protect themse
by fleitz 16y ago
Heh. One of the best protections against SQL injection is not to grant those privileges to the db account from the webserver. So many sites could protect themselves at the least from data loss by using the built in tools. Also, I've worked on projects where the only way to change a table is via a stored proc, no select access on the tables, no SQL injection. Or at least you'll have to figure out a way to to the injection into the stored proc which is nigh impossible unless they are using exec_sql in the store proc.
- dennisgorelik 16y agoIf you take away write-access privileges, then malicious script still can steal your data. Most of the time - that's really bad by itself even if you keep your copy of data intact.
- jpadvo 16y agoWhy the downvotes? It is common sense to not run software with more permissions than it needs. Your production app shouldn't connect to your database through the root account, for example, unless it needs full, complete permissions to function. Not likely. Of course, this does not eliminate the need for solid code-based prevention of injections...