are vb database permissions safe?

[Zachery]

Originally Posted by anolian

@tbworld
Thanks for your comments. I take your points, but I still think vB could manage with 2 users, one with insert/update/delete on appropriate tables to allow users to register and contribute, with another with the more risky alter/drop/etc privileges.

@Zackery
I realise you use those permissions for admin tasks. My point was that they could be implemented in a more sophisticated manner (as is usually recommended), and that the security of the vB product might be improved as a result.

Cheerio!

Not really. Having a second DB user complicates things, and since we have to store that password in plaintext, then it really wouldn't be all that helpful. Most php/MySQL software, commercial or otherwise runs this way.

You give the specific user access to only the databases they should have access to. Which is how you keep security on the database server itself intact.

[AusPhotography]

Our architecture at work for applications is
Client (Web or Rich) -> Service -> Stored Procedure -> Database
This is normal for commercial applications.
LAMP applications tend be less layered.

vB would need a serious re-architecture to have a service layer.