Yes, but the scenario was >> if you have a dedicated machine for your database That's not a machine with a browser. The game then becomes: can somebody "injec

Yes, but the scenario was >> if you have a dedicated machine for your database That's not a machine with a browser. The game then becomes: can somebody "inject" this sort of attack through a database connection. Good practice should insulate you but who knows.