title: If my database user is read only, why do I need to worry about sql injection?
body: <p>Can they (malicious users) describe tables and get vital information?  What about if I lock down the user to specific tables?  I'm not saying I want sql injection, but I wonder about old code we have that is susceptible but the db user is locked down.  Thank you.</p>
  
  <p>EDIT:  I understand what you are saying but if I have no response.write for the other data, how can they see it.  The bringing to crawl and dos make sense, so do the others but how would they actually see the data?</p>