I’ve been working on a custom application for a friend’s Joomla web site. It’s not a component, it’s
a standalone PHP / mySQL app that is pulled into a specific article via a PHP include.
The data for the app, however, does reside in the same database used by the rest of the site. It sits in its own table within the database, however.
Many of you have been very helpful in pointing out security holes in my code and, since I’ve found that I can’t use a separate database, would it be a good idea from a security standpoint to create a new user and assign it access to ONLY the table used by this app?
I already know how to do it, just trying to decide if I should do it.
Of course, if your users can only access certain tables, or can do certain things, you have to narrow the possible security risks.
Grant only the permisions that are needed and nothing more.