Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

I am looking for advice on how to create my data schema for a public web site.

Currently, we have an Intranet website where our agents create the data needed for reservations. The data includes tables like Establishments, products, prices per periods, and a typical Users table.

This intranet is already in production.

I've been tasked to create a public web site, where anonymous Joe and Jane will be able to book a reservation without calling one of our agent. The site will offer registration and will display the data available from the Intranet, albeit as read-only.

The public site itself will have some data of its own.

I am a bit reluctant to combine the data from the public site into the same database than our intranet, but most of the information that will be displayed on the public site will come from the pre-entered data from the intranet.

Are there any best practices concerning the separation and sharing of information between a public and a private website?

share|improve this question
    
One thing I hope you have already considered here is the privacy of your customers. I would think that your agents would be able to get more information about reservations that your prospective customers. And that you would not want just anyone to be able to see all of your reservations and who what etc. –  Chad Aug 11 '11 at 16:00
    
Of course, that is the main goal of the public site: offering a subset of the products from the intranet. The agent will have access to the customer order, but of course, between customer, there is no access. –  Pierre-Alain Vigeant Aug 11 '11 at 17:28
add comment

2 Answers

up vote 5 down vote accepted

Write web services to expose the necessary data and other actions, as needed by your site, and deploy the services so that they have access to the database, but can only be accessed by your specific web site (only allow a certain IP to perform actions, etc.).

This gives you access to your data, removes the necessity of creating another schema, syncing data between the two, and eliminates some of the hazards of wiring up your agent's database directly to your web application.

There may be other solutions, but this worked well for my company.

share|improve this answer
    
-1, IP restrictions are not securing much of anything. Please add some real application layer security. –  Wyatt Barnett Dec 17 '11 at 19:49
add comment

Since its your code thats manipulating the databases, the safety of accessing the internal database from a public facing site really isnt an issue. You just need to make sure you follow safe coding standards to prevent things like sql injection. You can also use in the public facing app, as an extra precaution, a database user name with proper GRANT privileges such that it only has rights to modify certain tables - your sessions table, for example - but not the rights to modify other data.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.