Question

What is the most secure and easier way to send approx. 1000 different records into database that is not directly accessible – MySQL database on Web provider’s server – using Windows application . Data will be stored into different tables.

Edited: The application will be distributed to users who have no idea what is database or putty or… They just install my application, open it, enter some data and press Submit.

Currently I’m using php to upload the generated script into webserver and there process it. I think I should also include some signature to the file to avoid some ‘drop…’ hacks.

Answer 1

As I can’t execute any external programs on external server, I created following solution:

• My program creates script file and calculates it’s salted hash
• Program sends this file together with user credentials and hash into PHP page on the server
• PHP page checks the username and password, then checks hash and then executes script. Only Insert and Update commands are allowed.

Is this approach secure enough?