Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'd like to execute a stored procedure via web application that connects to SQL Server. The procedure is to be activated by clicking a link in an email. The link will have to be accessible from a mobile 3g connection, so the link will exist on a DMZ server.

How can I go about protecting and securely setting up this link, without potentially compromising the SQL server?

Is there a safer way to accomplish the same goal?

share|improve this question
up vote 1 down vote accepted

There's nothing inherently risky about what you're trying to do, given that you follow a couple of standard security rules:

  • Never expose variables used in the SQL query (ie GET or POST Variables) without ensuring they are clean before executing the query.
  • Ensure the script can't do anything beyond what you expect
  • If it is something the public shouldn't access make sure you password protect it
  • Run the script as a user with the minimum privileges required to do the job. NOT Administrator!
share|improve this answer

If you have the resources you would have a SQL server separate from your web interface which sits in the DMZ. This is standard practice to isolate the SQL engine. Mobility interfaces get hammered by all kinds of traffic.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.