Re: Has there been in-the-wild i Series virus?

On Wed, Mar 25, 2020 at 6:17 AM Tim Fathers <X700-IX2J@xxxxxxxxxxx> wrote:

It's exactly for this reason that our web app's logic is behind stored
procedures, which are the only things that can be called by the application
server. I think it's asking for trouble if you use the normal way of
allowing a PHP or Node applications free run at the database.

this makes a lot of sense to me. All of my access to the database is thru
stored procedures. But the mistake I have made is in storing the stored
procedure in the same library as the data file. Doing it this way is
easier and more straightforward. But also means the data library is the
database that the PHP code talks to. Meaning, all the stored procedures and
data files in the library/database are open to PHP web code. Much better I
think to have the stored procedure in a standalone library/database. Then
the code of each stored procedure will add the data library to the library
list. This should cut down the attack surface - where PHP code has no
direct access to data files.

-Steve