Home / user-843

Jack B Nimble's questions

Martin Hope
Jack B Nimble
Asked: 2016-06-10 09:25:20 +0800 CST
  • 0

We have several applications which use encrypted connection strings from with the machine.config on the server.

Now we are starting to experiment with RemoteApps, but are getting the error:

enter image description here

Whenever a non-Adminstrator user attempts to connect to the app.

How do I get a normal domain user to be able to access the encrypted connection strings in the server's machine.config via a RemoteApp?

windows-server-2008 remote-desktop-services
Martin Hope
Jack B Nimble
Asked: 2014-07-24 06:53:56 +0800 CST
  • 5

Despite having over 3GB of available space, I am unable to install the DHCP server role.

This originally was a 10gb virtual box drive image, but when I ran into space issues extended the drive to 12gb. I've subsequently run chkdsk and defrag, to see if I could get Windows to recognize the available space.

Is there some way I can convince Windows Server 2012 I have enough disk space?

enter image description here

virtualbox
Martin Hope
Jack B Nimble
Asked: 2012-01-25 09:40:12 +0800 CST
  • 1

I was looking through some coding standards at my work and I came across this:

string query = "SELECT * FROM USERS WHERE USER_ID='" + userIdFromWebPage + "'";

userIdFromWebPage is a variable that contains untrusted data that has not been validated.

Imagine that it contains one of the following:

  • "' or 1=1 -"
  • "' ;DROP TABLE users -"
  • "' ;exec xp_cmdshell(''format c:') -"

The final query could look like this.

string query = "select * FROM USERS WHERE USER_ID='';exec xp_cmdshell('format c:') -";

This results in a format of the c:\ drive on the database server.

Is that actually true?

sql-server
Martin Hope
Jack B Nimble
Asked: 2009-05-21 11:57:47 +0800 CST
  • 2

I am currently working on a project that will collect a lot of customer sensitive data. DOB, SSN, credit history, and other personal data.

This data is all used by a website which generates documents in PDF form which contains the personal data. Obviously if the customers' usernames and passwords are compromised their individual information is at risk, but what can I do to protect the database from being compromised?

Should I be encrypting the pdf documents and other information in the database? Will that cause significant performance problems as the number of users scale up?

Is it enough to keep the database server on a private network which the public web server accesses?

I am using MySQL

mysql security