Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'd like to execute a stored procedure via web application that connects to SQL Server. The procedure is to be activated by clicking a link in an email. The link will have to be accessible from a mobile 3g connection, so the link will exist on a DMZ server.

How can I go about protecting and securely setting up this link, without potentially compromising the SQL server?

Is there a safer way to accomplish the same goal?

share|improve this question
add comment

2 Answers

up vote 1 down vote accepted

There's nothing inherently risky about what you're trying to do, given that you follow a couple of standard security rules:

  • Never expose variables used in the SQL query (ie GET or POST Variables) without ensuring they are clean before executing the query.
  • Ensure the script can't do anything beyond what you expect
  • If it is something the public shouldn't access make sure you password protect it
  • Run the script as a user with the minimum privileges required to do the job. NOT Administrator!
share|improve this answer
add comment

If you have the resources you would have a SQL server separate from your web interface which sits in the DMZ. This is standard practice to isolate the SQL engine. Mobility interfaces get hammered by all kinds of traffic.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.