Security practices for SQL Server & C# with limited database access

Question

I have a project that I am working on that is essentially a self service database restoration / backup tool for client machines that run a database locally on their machines and contain sensitive information. Due to the nature of the business, and the amount of clients we have I simply cannot create stored procedures to use on the database with the program I am creating.

I am aware that using raw SQL statements in string format is highly susceptible to injection attacks. But with limited access to a database (essentially just to restore and back-up the database) I am asking what is the most effective and secure method to run these commands without compromising security?

Clients would simply choose the option "restore" or "backup" and the backup would only create a full copy-only backup of the database. The file location for both the backup and the restore would be set in the code an be unmodifiable.

What exactly are you backing up? The table structure? Just the row data? Why can't you trigger a normal database backup and encrypt that backup accordingly? — Eric J.
– Eric J., Commented Jul 27, 2015 at 20:09
For a backup / restore where would you be passing text from the user? — paparazzo
– paparazzo, Commented Jul 27, 2015 at 20:23
Using strings is only insecure if you're building the strings with user specified values. From your description it doesn't sound like you are so I don't believe there are any security implications. — dmeglio
– dmeglio, Commented Jul 27, 2015 at 20:27
It's not really clear to me how you are doing this, but in general I think any query that is not parameterized is subject to SQL injection. — Eric J.
– Eric J., Commented Jul 27, 2015 at 20:45

paparazzo · Accepted Answer · 2015-07-27 21:55:33Z

1

Then just use a parameterized queries

answered Jul 27, 2015 at 21:55

paparazzo

45.2k24 gold badges110 silver badges180 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Security practices for SQL Server & C# with limited database access

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related