Sorry about the question heading

I am creating an online tower defense game with SQL Server 2008 as my database.

SQL user used to send data to server is restricted to only execute existing storeprocedures which means to do anything like building or destroying a tower a storeprocedure has to be used. Now in the case of destroying of towers a storeprocedure named "sp_remove_tower" is fired with just 1 parameter "UserId" which will tell the database from which account the tower has to be removed.


is that if a person has SQL Server 2008 management studio installed and gets the SQL Server Name, SQL User ID, SQL User Password from lets say through inspect element in google chrome or by hacking the game itself. Then he can randomly pass any UserId in the storeprocedure which will cause to delete towers from other innocent players account.

How do i stop such a thing from happening?

Thanks in advance


2 things:

  1. Never, EVER, should you give the client the password to anything.
  2. Never, EVER, should the client be executing queries themselves.

So a solution is put a service between it, let the user have a session from whatever your service is written in and store the user id in there, don't let the client pass along an arbitrary user id.

  • \$\begingroup\$ i am kind of new to this so can you explain how do i connect my user to SQL without mentioning SQL user name and password? and in this case how will service work here?. \$\endgroup\$ – Developer Nation May 17 '16 at 3:56
  • \$\begingroup\$ You don't connect the user to SQL. You connect the user to some service (hosted on your own systems) written in whatever language you feel comfortable with and go "Client <-> Service <-> Database" \$\endgroup\$ – Elva May 17 '16 at 8:05

Not the answer you're looking for? Browse other questions tagged or ask your own question.