Re: Abstracting DB Schema from Web Forms

I think this could be a good practice. For a secure application, you want as many levels of security as possible, and obfuscation, while not as powerful as some other security measures, does provide a layer of defense.

As I understand it, you're mainly doing this to prevent outsiders from gaining knowledge about your database schema to prevent malicious SQL calls from your app server, which could be solved by appending something random to your meaningful field names. I have a question about another possible use: protecting encrypted data. Is it easier to crack an encrypted string if you know values in the string, the length of the original string, or the data type of the original string? If it is indeed easier, your obfuscation could be used to help secure encrypted data from cracking. So if I had a column named '8akdb' filled with encrypted strings, it would provide no additional meta information to someone who had the data, as opposed to naming the column 'ABC_zipcode', which provides information about original string length, data type, and finite potential values. Anyone have any thoughts?