I'd like to execute a stored procedure via web application that connects to SQL Server. The procedure is to be activated by clicking a link in an email. The link will have to be accessible from a mobile 3g connection, so the link will exist on a DMZ server.

How can I go about protecting and securely setting up this link, without potentially compromising the SQL server?

Is there a safer way to accomplish the same goal?

2 Answers 2


There's nothing inherently risky about what you're trying to do, given that you follow a couple of standard security rules:

  • Never expose variables used in the SQL query (ie GET or POST Variables) without ensuring they are clean before executing the query.
  • Ensure the script can't do anything beyond what you expect
  • If it is something the public shouldn't access make sure you password protect it
  • Run the script as a user with the minimum privileges required to do the job. NOT Administrator!

If you have the resources you would have a SQL server separate from your web interface which sits in the DMZ. This is standard practice to isolate the SQL engine. Mobility interfaces get hammered by all kinds of traffic.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.