Re: [bdbxml] Security in XML Database

Tobias,

I'm not sure if this addresses your concern specifically, but
you can do at least a couple of things:

1.  use file protections to not allow random
processes to access your containers or
environment files.
2.  Encrypt your containers.

Because BDB XML is a library, it is assumed that
any security-related mediation with regards to data put into a container
is being done by the application.
The techniques above help safeguard against attacks from
other processes.

Regards,

George

> Hi,
>
> I'm writing a web application with PHP and DBXML and I wonder how  
> secure
> it is.
>
> I have 2 kinds of user input:
> - keywords, used in the "where" clause of XQueries
> - XML documents from different sources, which are Schema validated and
> then put into the container
>
> I use $Context->setVariableValue to insert the user input into the  
> XQueries.
>
> The data in the database isn't secret and XQuery can't change the
> database, so I think the only real problem could be the XML documents.
>
> Are there any security risks by this? Can something similar to an SQL
> injection happen? How do you secure your database?
>
> Thank you,
>   Tobias Neumann
>


------------------------------------------
To remove yourself from this list, send an
email to [email protected]