Table Security

SQLServerCentral is supported by Red Gate Software Ltd.

Popular Topics

Home

Members

Calendar

Who's On

Home » SQL Server 2005 » SQL Server 2005 Security » Table Security

Table Security

Rate Topic

Display Mode

Topic Options

Author

Message

Francis S. Mazeika

Posted Monday, July 28, 2008 1:39 PM

SSC Rookie

Group: General Forum Members
Last Login: Friday, June 07, 2013 9:37 PM
Points: 44, Visits: 206

I have a table which needs records inserted and updated. I do not want to grant select because that right will be abused. Is there a way to grant update and insert without granting select?

Thank you.
Francis S. Mazeika
Human Interface.

Post #542167

Jack Corbett

Posted Monday, July 28, 2008 1:55 PM

SSChampion

Group: General Forum Members
Last Login: Today @ 3:07 PM
Points: 10,613, Visits: 11,959

How can someone update a row they cannot see?

How do you abuse select?
Yes you can grant insert and update without select. I am of the opinion that you control access using stored procedures and views.

Jack Corbett

Applications Developer

Don't let the good be the enemy of the best. -- Paul Fleming

Check out these links on how to get faster and more accurate answers:
Forum Etiquette: How to post data/code on a forum to get the best help
Need an Answer? Actually, No ... You Need a Question
How to Post Performance Problems
Crosstabs and Pivots or How to turn rows into columns Part 1
Crosstabs and Pivots or How to turn rows into columns Part 2

Post #542173

Francis S. Mazeika

Posted Tuesday, July 29, 2008 10:14 AM

SSC Rookie

Group: General Forum Members
Last Login: Friday, June 07, 2013 9:37 PM
Points: 44, Visits: 206

They abuse select by dumping the contents of tables using select * with no where clause. I was hoping that by granting update with out select they can't do table dumps. I may be able to set grant update without select but the code fails, I may need to go to views.

Thank you.
Francis S. Mazeika
Human Interface.

Post #542830

Jack Corbett

Posted Tuesday, July 29, 2008 10:19 AM

SSChampion

Group: General Forum Members
Last Login: Today @ 3:07 PM
Points: 10,613, Visits: 11,959

The reasons you give are why I avoid granting direct table access whenever possible. I typically only grant access to the database through stored procedures as I can control the ability of users to do select * from table.

Post #542839

« Prev Topic | Next Topic »

Permissions