Take the 2-minute tour ×
Database Administrators Stack Exchange is a question and answer site for database professionals who wish to improve their database skills and learn from others in the community. It's 100% free, no registration required.

I am looking into a practical defense in depth strategy which helps to limit the damage if, for some reasons, an attacker succeeds in performing an SQL injection. Supposing the website contains numerous scripts that runs SQL queries, some involving SELECT, some involving UPDATE and INSERT, a few involving DELETE. JOINS are also being used to a certain extend. I understand that by allowing UPDATE permission, it is possible to overwrite all the data in a database. How would a DBA go about securing such a system without making it too onerous to maintain?

share|improve this question
    
If you start from "there was a successful SQL injection attack against this web site/application", then you have to assume that anything that the (mysql) user (the one the webapp uses) has update/delete access to is compromised. Similarly, any stored procs that the user has execute rights to will probably have been run. The best defense against that is to limit the permissions that the mysql user has. Unfortunately I don't know enough about the mysql permissions model to expand on what 'limit' will mean in a mysql context. –  Simon Righarts Dec 19 '13 at 2:27
add comment

Know someone who can answer? Share a link to this question via email, Google+, Twitter, or Facebook.

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.