CODEWITHSUNDEEP
c#sql
GRush
GRush

Reputation: 165

Allowing SQL queries that view data not modify it

I am working on an application that will allow users to create queries on their own to view data in their database. However the stipulation is that the application should prevent any modification of the tables and data stored in the database. The Application will be written in C#. Any good suggestions of how this could be done? Possible idea that I have thought of:

Any suggestion to block any changes made from this application to prevent any chance of a user error or attempt to modify tables of data is much appreciated.

Upvotes: 0

Views: 454

Answers (5)

D'Arcy Rittich
D'Arcy Rittich

Reputation: 171411

This is usually handled by giving users access to (non-updatable) views, but not to tables.

Upvotes: 2

Damian Leszczyński - Vash
Damian Leszczyński - Vash

Reputation: 30865

IMHO, the best way is to create a user that can only do select on specified tables. And then use that user for connection.

Upvotes: 1

Joel Coehoorn
Joel Coehoorn

Reputation: 415735

This needs to be handled at the user level rather than the query level. When you set up your app, you'll need to make sure that the account used to run the queries does not have any dbwriter permissions.

Upvotes: 2

SLaks
SLaks

Reputation: 887453

You should run your queries as a user that doesn't have write permission.

Upvotes: 10

paxdiablo
paxdiablo

Reputation: 881443

Any decent DBMS should have these protections already built in (at a per-user level). You just make sure the only access they have is read-only.

Then you don't have to worry about anything that they do. Let them try to insert, update and delete all they want.

It's a basic tenet of databases that they are responsible for their own security and integrity. You never leave that up to an external application since any monkey can write an application to connect to the database that doesn't follow the rules.

Upvotes: 4

Related Questions