Re: Application level firewall

[Bob Field]

You can set up user accounts in MySQL with the specific access permissions that you require. Not having your web pages connect as 'root' helps a great deal. I typically create two user accounts for each database, one with only SELECT access and another with SELECT+INSERT+UPDATE+DELETE. Using an account with the minimum level of access to your database as required to load the page minimizes the damage should an attack occur, and also simple precautions in the web page's scripting can further protect you.