ASP connect to SQL Server 6.5 approaches

[PBS]

Hi:

I am looking at an ASP application that has a connection to an SQL Server
6.5 database. I believe the connection is made in the global.asa, using
Visual Interdev generated code that includes the user name ( the infamous
"sa") and a corresponding password.

This approach doesn't strike me as being particularly secure. Is it OK, or
is there a recommended method for making this connection that is more
secure, and doesn't risk revealing this information?

Thanks,
Paul

[Mark Schupp]

First you should never use the "sa" account for production. Set up a
SQLServer account with the minimum database access needed to run the
application.

The level of security of the connection information will depend on who you
are trying to protect it from. If your server has all of the security
patches then global.asa is fairly safe from access through the web-server.
Other options would be to:

Put the information in the system registry and use a component to read it.

Put the information into a compiled DLL and have that DLL open all database
connections.

Put the information into a file that is not accessible through the internet
and use FSO to read the data into your application.

--
Mark Schupp
Head of Development
Integrity eLearning
[url]www.ielearning.com[/url]


"PBS" <pbs@allwave.com> wrote in message
news:ea3uXi26DHA.1368@TK2MSFTNGP10.phx.gbl...

> Hi:
>
> I am looking at an ASP application that has a connection to an SQL Server
> 6.5 database. I believe the connection is made in the global.asa, using
> Visual Interdev generated code that includes the user name ( the infamous
> "sa") and a corresponding password.
>
> This approach doesn't strike me as being particularly secure. Is it OK,

or

> is there a recommended method for making this connection that is more
> secure, and doesn't risk revealing this information?
>
> Thanks,
> Paul
>
>

[Aaron Bertrand - MVP]

> Put the information into a compiled DLL and have that DLL open all
database

> connections.

Or just return the connection information to ASP and have ASP open the
database connections. If the hacker can get at an ASP file and change it to
response.write/e-mail this information, they could also pass any queries
they want into the DLL, so doing everything from the DLL doesn't gain you
much except, potentially, worse performance.

A