best place to store connection string

[alexjamesbrown]

Hi,
just a quick question...

I usually create a db.asp file, and include it on each page i need the db connection, but where do you think is the best place to store the db connection? anything a bit more secure?

global.asa?

 

[monksnake]

I ususally put it into a server side includes file and put an asp extension on it.

That way you can see it from a view source on a webpage.

<.

 

[Tarwn]

Just so your only response isn't monksnake, I'll chip in my two cents by giving a radically different answer.

I usually put it into server side includes file and put an asp extension on it.

At some point you have to determine when a solution is "good enough". The end user does not see the code in the ASP file, only the HTMl that is generated. So as long as you don't Response.Write the connection string, put it in a javascript comment, etc. then you are safe enough keeping it in it's own include file.
Now, while it is possible that someone could either hack into your system and read the file or find an exploit for IIS that allows them to read the file, you really have bigger problems then them being able to log into your database at this point.

One additional piece of security if your using something like SQL Server (not Access): Setup a user specifically for the website connection, build everything as stored procedures, then lockdown that users access to only allow execution of the stored procedures. Now even if someone does manage to get access tot he include file they are left with the choice of guessing a new username/password or finding something else on the system to monkey with. My bet is that in this exceedingly unlikely case they probably will go find something else to mess with.
And it means that if you one day hire an outside developer to work on the site you aren't also giving them the keys to the database.

Sorry, just some long-winded thoughts

-T

Best MS KB Ever:

http://support.microsoft.com/kb/555375

 

[monksnake]

Tarwn, our answers are like night and day .

That way you can see it from a view source on a webpage.

That should be CAN'T see it, not can.

<.

 

[Tarwn]

Heh, I didn't even notice that error, I automatically knew what you were talking about. WWURD?

Best MS KB Ever:

http://support.microsoft.com/kb/555375