mysql injections and user privileges

[bnooch]

Hello,
I'm having a friendly debate with someone I adopted some code from. Well, I noticed that he was using the $_GET variable directly in his mysql queries. So, I told him I thought that was a security vulnerability. He says its not because the user connecting to the database has select only privileges.

So my question is, is giving a user select only privileges safe enough to not have to do any data validation or scrubbing to protect from mysql injections?

 

[piti]

using the least possible privileges is only one of the methods to prevent sql injection ...

 

[lgarner]

In other words, the user's privileges should prevent the execution of unauthorized commands. But, you're relying on MySQL being bug-free.

I'd never propose *not* validating and sanitizing the SQL statements.