SQL Server does enforce security even through ODBC so it sounds as though POMUSER has Select access via another vehicle. Do you have any Roles defined? What are the permissions for the Public role?

If all these check out okay, I'm not sure what's going on.

>The owner is 'dbo'. As explained below, I try to acces (via VFP) with
>user name 'pomuser' and not 'dbo'. Why 'pomuser' give all rights?
>Thank you again.
>
>>Who owns the table? The owner has all rights to a table even if it is >specified otherwise.
>
>>>Thank you! Everything works fine.
>>>But I got another problem with SQL-Server permissions.
>>>
>>>My SQL-Server table (pom_punches) has permissions setted like below:
>>>-User name is 'pomuser' and only the Insert permission is granted.
>>>When I do connection to my SQL table in VFP
>>>(using SqlStringConnect function with UID='pomuser';PWD='xxxx'),
>>>the result is success (I get an handle). But I can also do a
>>>SQLEXEC(lnhandle, "select * from pom_punches", "mycursor")
>>>or a SQLEXEC(lnhandle, "delete from pom_punches") with success.
>>>Why the Select always works (permission is revoked)?
>>>
>>>Thank you again for your help.