Security
SECURITY implications relating to SQL Databases are regarded with the utmost highest priorities, you just have to take into account the amount of sensitive information that is being stored.
Let’s say you are running an e-Commerce site for your business with user logins and passwords. If the owner of a site doesn't define their code properly this often leads to attackers exploiting this and execute arbitrary user controlled queries, extracting information from the database being leaked back onto the page. This can come in the form of an error message, or simple next to a value that's on the page for example - a product name. Next to the product name comes the result of the query the attacker injected, potentially giving out information as sensitive as usernames or passwords or even credit card details.
SQL Injections have become one of the most common attacks seen today, approximately 50% of the larger eCommerce sites and 60 – 80% of the medium to smaller sites are at risk or vulnerable to this kind of attack.
The best defense against these attacks is prevention, to ensure your databases remain secure you should take all necessary precautions to eliminate any risk of exposure to any kind of exploit. Whether it be as simple as locking down access with NTFS permissions on the MySQL Server or as intense as redefining and hardening code.
You should ensure you lock down your MySQL server by defining a strong password for the root account, and if appropriate restrict access to the “root” account remotely, so that this Administrative account can only be used infront of the MySQL Server.
For security at a local standpoint, you should have installed either a hardware firewall or software firewalls, as well as locking down privileges to user accounts appropriately.
Some great examples of MySQL Security can be found at : http://swik.net/MySQL/MySQL+Security .
I have listed one example below.
Communications Security
“The communication between the MySQL server and a Webserver is to deploy an SSH server on the same host as the MySQL server and use port forwarding to connect to port 3306 over encryption tunnel. In many cases secure configuration guides impose that MySQL server should run on the same machine. This restriction leads to other security risks: database tables are stored in files that are not normally locked, so that a bug in web applications may offer the possibility to an attacker to download the entire database. Also, a SQL injection bug in a web application can offer the possibility to an attacker to modify the web scripts.
Correct permissions will help prevent these problems.”
http://swik.net/MySQL/MySQL+Security – Accessed 14th October, 2007 (Wiki)