Policy-Discussion

[Philipp Gühring <pg AT futureware.at>]

Hi,

> > Would the SQL server be secured on a third machine, with only network
> > connections allowed on the relevant port? I assume the only way to
> > protect data is to ensure that only certain queries can be run.  As if
> > you comprimise the web server, you have all the passwords to connect to
> > the SQL server. I'm not sure how exactly the SQL server could be
> > secured, it needs more flexible access than the root key server.
>
> Some protection would be to use stored procedures for the queries and
> limit access from the webserver to the stored procedures (hmmm, does MySQL
> do stored procedure these days?) That way only predefined queries can be
> executed...

Hmm, having a "Middleware" that implements the Busines logic and secures 
everything would be also an idea.

Doesn´t need to be implemented by stored procedures in the DB.

Regards,
Philipp Gühring