0

I have filtered into 3 most used databases, MySQL, Microsoft SQL server and mangoDB. I have to choose the most secure database from these three.

Does my choice of DBMS has a role in protection against XSS attacks and other similar attacks, or is it prevented only through only secure frontend and backend programming?

1

protection against XSS attacks ...

XSS is an attack against the client side, not the server side where the DBMS resides. Thus the choice of DBMS does not matter here.

... and other similar attacks

I'm not sure what you consider similar attacks. But when talking about DBMS the main attack vector is SQL injection and in case of NoSQL DBMS like MongoDB NoSQL injection.

Does my choice of DBMS has a role in protection against ... attacks, or is it prevented only through only secure frontend and backend programming?

To protect against SQL/NoSQL injection you better make sure that you choose a DBMS where you don't need to construct query strings from user input but can use techniques like parameter binding - see bobby-tables.com for more details on this.

Apart from that you really should thoroughly verify all user input, and doubly so if your DBMS does not support things like parameter binding.

  • Hi thanks for the reply, my question is regarding stored and reflected XSS attacks involve sending attack payload to the server so that it is displayed back to the client as legitimate web content – PDHide Apr 20 at 14:17
  • @PraveenDavidMathew: As I said, XSS are solely attacks against the client side. The DBMS only stores data (in case of stored XSS) and with reflected XSS the DBMS is not even involved. Thus, the choice of DBMS does not matter in case of XSS and the protection against XSS has to be done in the application logic and not the DBMS. – Steffen Ullrich Apr 20 at 15:46
  • Thank you so much, is there anyway DBMS knows it's a xss payload ? And prevent it – PDHide Apr 21 at 16:25
  • @PraveenDavidMathew: A DBMS is a data storage. It has no idea where the string stored in the database will ever be used by the application and thus has no idea if it can be used for XSS or not. – Steffen Ullrich Apr 21 at 16:32
0

MySQL, Microsoft SQL server and mangoDB. I have to choose the most secure database from these three.

That's personal preference what you choose.

Does my choice of DBMS has a role in protection against XSS attacks

No.XSS is caused mainly by mishandling of user input,choice of database cannot prevent an XSS attack

other similar attacks

That's hard to say.But vulnerability like SQL injection will exist in every DBMS.

or is it prevented only through only secure frontend and backend programming

Absolutely.When it comes to web application most attacks are caused by improper validation of user input when it reaches the server.

  • Mango is a fruit ;-) – bradbury9 Apr 24 at 11:44
  • @bradbury9 haha.I didnt write it though,i copy pasted it from the question – Vipul Nair Apr 24 at 12:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.