MS Sqlserver 2005: Displaying only dbs user has a right to?

Hi;

My company just installed MS SQLServer 2005 ( see below the dotted
line ).

When a user logs into management studio all of the databases on the
server are displayed in the right hand column.

What can we do to have only the databases the user has rights to,
display?

Thanks much in advance for any info.

Steve

--------------------
Microsoft SQL Server Management Studio9.00.1399.00
Microsoft Analysis Services Client Tools 2005.090.1399.00
Microsoft Data Access Components (MDAC) 2000.085.1117.00
(xpsp_sp2_rtm.040803-2158)
Microsoft MSXML2.6 3.0 4.0 6.0
Microsoft Internet Explorer7.0.5730.11
Microsoft .NET Framework 2.0.50727.42
Operating System5.1.2600Steve (tinker123@.gmail.com) writes:

Quote:

Originally Posted by

My company just installed MS SQLServer 2005 ( see below the dotted
line ).
>
When a user logs into management studio all of the databases on the
server are displayed in the right hand column.
>
What can we do to have only the databases the user has rights to,
display?

What you can do is to revoke the permission VIEW ANY DATABASE from public,
or DENY this permission to the users in question. Alas, the user would then only see tempdb and msdb (or was it master?), databases he owns, and
possibly his current database. He would have to issue a USE database in
the dark to get there.

This is not an uncommon question, so I filed a suggestion for an improvement
in SQL Server. You can vote on it at
https://connect.microsoft.com/SQLSe...edbackID=273830
--
Erland Sommarskog, SQL Server MVP, esquel@.sommarskog.se
Books Online for SQL Server 2005 at
http://www.microsoft.com/technet/pr...oads/books.mspx
Books Online for SQL Server 2000 at
http://www.microsoft.com/sql/prodin...ions/books.mspx

MS SQL Server Management Studio - permissions and stored procedures

Hi

My website uses GET variables a lot and i'm trying to safe guard as much as possible against SQL injection attacks. I'm trying to create permissions which will deny a user to Delete/Insert/Update various tables.

I have managed this with the tables themselves, but when using a stored procedure, the tables do not take into account the user permissions which were set for that table!

Basically, how do i stop a stored procedure from Deleting/Inserting/Updating tables? :(

many thanksYour best bet is to avoid dynamic code within your stored procedure. Failing that, you need to avoid actually executing any submitted parameters within you stored procedure. Failing that, you need to thoroughly verify parameter strings before including them in any executed sql.|||hi blindman

I am not using any dynamic code, i am just passing in variables to my stored proc.

I'm not sure what you mean by:

Failing that, you need to avoid actually executing any submitted parameters within you stored procedure.

I'm using SELECT statements only in my stored proc, for example:

SELECT t3.sub_id, t2.SIC_id, t1.business_name, t1.venue_id, t1.address1, t1.address2, t1.address3, t1.address4, t1.county, t1.town, t1.postcode, t1.tel, t1.img_thumb
FROM VENUE AS t1 INNER JOIN SIC AS t2 ON t1.venue_id = t2.venue_id INNER JOIN SUBSCRIPTION AS t3 ON t1.venue_id = t3.venue_id INNER JOIN SIC_TYPE AS t4 ON t2.SIC_id = t4.SIC_id
WHERE (t3.sub_id = 1) AND (t2.SIC_id = 8 OR t2.SIC_id = 9) AND (t1.town = @.city OR @.city = '0') AND (postcode LIKE @.postcode + '%' OR @.postcode = '0') AND (county = @.county OR @.county = '0')

Can you see anything wrong with that with regards to injection attacks?

thanks|||The code you posted is not susceptible to SQL injection attacks.