Q:

Safely Execute Stored Procedure Via DMZ Server

I'd like to execute a stored procedure via web application that connects to SQL Server. The procedure is to be activated by clicking a link in an email. The link will have to be accessible from a mobile 3g connection, so the link will exist on a DMZ server. 
How can I go about protecting and securely setting up this link, without potentially compromising the SQL server? 
Is there a safer way to accomplish the same goal?

A:

There's nothing inherently risky about what you're trying to do, given that you follow a couple of standard security rules:

Never expose variables used in the SQL query (ie GET or POST Variables) without ensuring they are clean before executing the query.
Ensure the script can't do anything beyond what you expect
If it is something the public shouldn't access make sure you password protect it
Run the script as a user with the minimum privileges required to do the job. NOT Administrator!

