Security related aspects of databases and database access.

learn more… | top users | synonyms

10
votes
2answers
1k views

What are the SQL-injections issues of parameterized queries?

I've written some code to generate an SQL query in ASP classic. I'm not sure if it's secure or not: Set adoCon = Server.CreateObject("ADODB.Connection") adoCon.Open "Provider=Microsoft.Jet.OLEDB.4.0; ...
2
votes
1answer
827 views

iOS/Android authentication and security

Here is what I am trying to do and can anyone provide some best practice advice for authentication and security? Each user will have their own private database on the cloud. He will have his local ...
3
votes
1answer
155 views

testing for 'Dangling Cursor'

While reading the updated Top 25 exploits in the Common Weakness Enumeration I came across an exploit that I was not familiar with. It is numbered CWE-619: Dangling Database Cursor. I was wondering ...
-1
votes
1answer
169 views

Theorical question on encryption methods [duplicate]

Possible Duplicate: Encryption strategies for multi users access in production systems I would like to develop a service on wich clients would connect and retrieve informations. These ...
5
votes
1answer
270 views

Secure access to a Microsoft Access Database

I have a server set up with medical files in a Access database. I am taking over this job from an existing guy who has vanished, so I don't know all the details of the system. I can find out specific ...
8
votes
3answers
3k views

Risk of configuring MySQL for remote access with a dynamic IP address?

I'm looking to make a MySQL database on a VPS, accessible to my home PC through cPanel. cPanel wants the domain name or IP address of the remote machine. However, with standard DSL, I have a dynamic ...
11
votes
3answers
238 views

Different MySQL Users Security Benefits

Anyone with a brain cell knows that using a user that isn't root/dbo/etc adds a lot to security and how effective SQL injection attacks can be. I'm wondering if taking that idea a step further is a ...
4
votes
2answers
167 views

What perils are there in allowing user input of parts of an ODBC connect string?

I'm developing an application that allows user to input hostnames, database names, usernames, and passwords for database access. The application will construct a ODBC connect string by filling in the ...
3
votes
2answers
468 views

I'm Trying to Find how to Exploit my SQL Code

I'm trying to find a way to exploit my stored procedure to test for security problems, I have specifically been testing for SQL truncation-based injection, but I did not succeed so far; I don't think ...
11
votes
3answers
6k views

PostgreSQL Security Audit

Could anyone provide a good resource or check-list for a security review of PostgreSQL?
22
votes
2answers
5k views

MySQL Server Hardening

Following the hardening theme.... What are some best practices, recommendations, required reading for securing MySQL.
4
votes
1answer
952 views

HIPAA Compliance or What measures would you recommend to secure PHI for devs?

I work with a company that sells medical supplies and equipment. As part of this, we retain patient information or Protected Health Information (PHI). What measures have you taken when providing ...
3
votes
2answers
817 views

Encrypting a Database's Primary Key when sent to the browser

When dealing with either an oData-based application (ADO.NET Data Services), or something that otherwise publishes the PrimaryKey, or ForeignKey to the client... Can someone explain to me be benefits ...
11
votes
4answers
2k views

What is the right way of storing database connection strings from the security point of view?

What are recommendations, best practices and have-to-dos regarding handling connection strings in web applications? What things one should never, ever do?
10
votes
2answers
228 views

Online SQL Server database for a Business app. Security considerations

A business application works with a SQL Server database. A SQL Server 2008 is installed on one of the computers of the local network. Technically this app works OK if the server computer with the SQL ...