Question

Considering that you can use a select expression in a query

    select table1.ID, (select table2.salary, table1.id from table2 inner join...
from table1

and retrieve data that you don’t have to reference in the from statement, how is this guarded against as far as security is concerned in enterprise DBMSs? do table permissions work so that you can not allow any references to them (since this case it isn’t in your from statement)

Answer 1

You can enforce column-level permissions. So that it doesn’t matter if the request came from the select list, a subquery, where exists, etc.:

DENY SELECT ON OBJECT::dbo.table2(salary) TO [user/role];

You can also deny select on the underlying table entirely, and create a view that only exposes the columns you wish users to see. Or allow them to execute a stored procedure that only selects a subset.