[quoted text, click to view] Wilton Yuan wrote:
> Hi Steven Burn,
>
> Thank you very much. Now I added the connection string to global.asa,
> but I don't which way is more secure, global.asa or using include
> file?
>
Neither. They are both equally secure. Somebody would require physical
access to your server in order to acquire your connection string.
I should qualify that: if you've used .inc (or some other extension which is
not included in your ISAPI filter) as the extension for your include file,
it is possible somebody could guess the name of the file and browse to it,
which would in effect, display its contents in the browser (try it). It's a
good practice to use .asp for all files you wish to protect from browsers.
Bob Barrows
--
Microsoft MVP - ASP/ASP.NET
Please reply to the newsgroup. This email account is my spam trap so I
don't check it very often. If you must reply off-line, then remove the
"NO SPAM"