0

I'd like to execute a stored procedure via web application that connects to SQL Server. The procedure is to be activated by clicking a link in an email. The link will have to be accessible from a mobile 3g connection, so the link will exist on a DMZ server.

How can I go about protecting and securely setting up this link, without potentially compromising the SQL server?

Is there a safer way to accomplish the same goal?

Improve this question

2 Answers 2

Reset to default
1

There's nothing inherently risky about what you're trying to do, given that you follow a couple of standard security rules:

  • Never expose variables used in the SQL query (ie GET or POST Variables) without ensuring they are clean before executing the query.
  • Ensure the script can't do anything beyond what you expect
  • If it is something the public shouldn't access make sure you password protect it
  • Run the script as a user with the minimum privileges required to do the job. NOT Administrator!
Improve this answer
0

If you have the resources you would have a SQL server separate from your web interface which sits in the DMZ. This is standard practice to isolate the SQL engine. Mobility interfaces get hammered by all kinds of traffic.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .