Re: security and stored procedures
From: Grant Case (hangtime79_at_DONThSoPtAmMail.com)
Date: 03/16/04
- Next message: keene: "Advice on case statement"
- Previous message: Jaxon: "Re: Prepared Statement vs. Stored Procedure"
- In reply to: toylet: "security and stored procedures"
- Messages sorted by: [ date ] [ thread ]
Date: Mon, 15 Mar 2004 20:43:49 -0600
True (as long as stored procedure is written correctly and did not use
dynamic SQL),
A number of different factors contribute to the security of a stored
procedure over straight updates and selects. First off, security is defined
at the time of creation. I as an administrator can create the proc and
grant you the user the rights to use it. I don't have to grant you the
underlying table rights in order to run the procedure. With a procedure, I
define how the selects occur...can append where clause values (in the
procedure based upon parameters) to ensure you can't see anything futher
then what you are supposed to and SIGNFICANTLY reduce the chances for SQL
injection attacks especially when used in conjunction with app roles.
Stored procedures are excellent tools to ensure the security of the
application. Of course, if you use dynamic SQL in your procedure all bets
are off because you just had to open up the underlying tables in to you the
user in order for the procedure to function correctly. You can find a great
deal more information in the BOL on this subject.
HTH,
Grant
"toylet" <toylet_at_mail.hongkong.com> wrote in message
news:%2398ImwuCEHA.2628@TK2MSFTNGP11.phx.gbl...
>
> Using stored procedures to retrieve/update data would be more secured
> than enabling a user to do it.
>
> Truth? Myth?
>
> --
> .~. Might, Courage, Vision. In Linux We Trust.
> / v \ http://www.linux-sxs.org
> /( _ )\ Linux 2.4.22-xfs
> ^ ^ 8:16am up 3 days 11:41 load average: 1.00 1.00 0.97
- Next message: keene: "Advice on case statement"
- Previous message: Jaxon: "Re: Prepared Statement vs. Stored Procedure"
- In reply to: toylet: "security and stored procedures"
- Messages sorted by: [ date ] [ thread ]
Relevant Pages
|
