How to protect a connection string in ASP. -- inetserver asp db

Bob Barrows [MVP]
3/30/2005 10:51:36 AM

[quoted text, click to view]

It is secure, as long as you do not allow the include file to be browsed.
The best way to prevent it from being browsed is to give it a .asp
extension. Alternatively, you can add the extension you use for the include
file into the ISAPI filters of your website.

Of course, if you are trying to protect it from people who have physical
access to your server, that's another story.

Bob Barrows

--
Microsoft MVP -- ASP/ASP.NET
Please reply to the newsgroup. The email account listed in my From
header is my spam trap, so I don't check it very often. You will get a
quicker response by posting to the newsgroup.

Steven Burn
3/30/2005 4:49:29 PM

Stick it in a .asp file OUTSIDE of the site root (oh and password the DB =
itself)

--=20
Regards

Steven Burn
Ur I.T. Mate Group
www.it-mate.co.uk

Keeping it FREE!

[quoted text, click to view]

Fabrice
3/30/2005 4:52:02 PM

Hello,

(With ASP)

I m looking for "the best" way to secure a connection string (OLE DB or
ODBC) for an Oracle database.
Actually, i m using an include file to open and close the connection with
informations write in clear text.
I would like to permit an acces to the application over internet. How to
secure this string ?

Is it a good idea to write the connection sting in the registry or not ?
Does it exist anothers ways ? And to secure acces i think to create an NT
autentification.? What do you thong about this ?

thanks a lot for your help

fabrice

fabrice
3/31/2005 3:49:16 PM

Thanks a lot
have a nice day.

Fabrice

"Fabrice" <emouchet@spam-infonie.fr> a écrit dans le message de news:
OYlMHgTNFHA.2748@TK2MSFTNGP09.phx.gbl...
[quoted text, click to view]

Jeff
4/15/2005 9:52:12 PM

So are saying that having something like

<%
Dim Conn

Set Conn = Server.CreateObject("ADODB.Connection")
Conn.Open "DRIVER=Microsoft Access Driver (*.mdb);DBQ=" &
Server.MapPath("/logo/db/XXX.mdb")
%> at the top of a page
isn't a good thing?? that all connections should be done from an include
page like connection.asp or something??
Jeff
[quoted text, click to view]

Bob Barrows [MVP]
4/16/2005 9:51:08 AM

[quoted text, click to view]

I'm not sure what was said in this thread that gave you the idea that not
using an include file was not a "good thing".

It's not a "horrible" thing to do. However, think about what you would have
to do if you needed to change the location or name of the database. With an
include file, it's a single edit. Without it, it will involve editing all
the pages, unless you have a tool that allows you to do global
search-and-replace.

The "bad" thing about this connection string is that you are using the
obsolete ODBC driver instead of the Jet OLE DB provider:

Conn.open "provider=microsoft.jet.oledb.4.0;" & _
"data source=" & Server.MapPath("/logo/db/XXX.mdb")

Bob Barrows

--
Microsoft MVP - ASP/ASP.NET
Please reply to the newsgroup. This email account is my spam trap so I
don't check it very often. If you must reply off-line, then remove the
"NO SPAM"

Got something to say? Click here to post a reply to this thread.

Don't see what you're looking for? Try a search.

View other messages about inetserver asp db

inetserver asp db : How to protect a connection string in ASP.