Hi. I just wrote a very simple application that uses SQLite. I don't know how much crossover there is, but what I did was create the db as myself, set the perms of the directory it's in to 600, and then added the web server account as rw to the ACLs of the directory and file. The script itself checks the user's identity by using the REMOTE_USER env var. Having a .htacc file in the same directory as the script limits anyone not in a certain security group from even accessing the application. So basically you can't even see the page unless you're logged in and cookied, but that's transparent to me cos that's just how the web server is set up. I also locked down permissions on the directory the script lives in so no one can look at the code. The residual risk is someone who also has privileges to write CGI scripts writes a program to access the database, and in my org. that's apparently OK since there's a vetting process for programmers to get CGI script writing privileges, and it would take a lot of concerted effort and some luck.

Does that make sense?

_________________________________________________________________________________

I like computer programming because it's like Legos for the mind.

In reply to Re: Basics: CGI MySQL security by OfficeLinebacker
in thread Basics: CGI MySQL security by jfrm

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.