Hello, I have a sql server 2000 production database that will need to have
multiple web sites insert contact information into a table.  I plan to
create a new sql user and only give it permission to execute one stored
procedure (that will do the insert row into the contact table).

Then I will provide to any outside vendor the SQL Server name, database,
user id, password and stored procedure(and input parameters) name.  What are
the security concerns with this?

Would it make any sense to create a database with only this table in it, or
is this just overkill.  I see that when I assign a new user to just one
database and one stored procedure that they can see the master database.  Is
this an issue?  Should I give the user
db_denydatareader on the master database?

Thanks

Don