1

Using MySQL, for the Staff (User) table, I am using the triggers (Before Insert and Before Update) to encrypt the passwords that are saved.

Is there anything wrong with this approach?

Improve this question

1 Answer 1

Reset to default
1

Is there anything wrong with this approach?

There might be other reasons , but what would be the most important one to consider, triggers can be bypassed.

Meaning, if you have SUPER privileges you can disable triggers and insert passwords without encryption.

My suggestion, encrypt the passwords in the application layer

Improve this answer
2
  • In my experience when I owned a software house, I did not trust the developers (that was after mishaps). So I normally put all business logic in the database. It always works, there are no accidental transaction issues, a future developer cant accidentally make the encryption fail. Commented Apr 5 at 23:58
  • @RohitGupta this is a task for the developers not DBAs, IMO. a future developer cant accidentally make the encryption fail, a future DBA can delete/change the trigger. At my current job there is a CRM system which the passwords are encrypted/hashed and it is done at application level Commented Apr 6 at 17:50

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.