Novice Q: security and application.cfm file

[sbsmithfl]

Greetings,
I am a low level cfmx programmer, trying to get smarter. I desire to get a
higher level of security, and ease of programming for my two clients. Until
now, I have been using dwmx to code queries on each page, inputing the dns
name, dsn username, dsn password each time. I'm certain there are easier
methods, and I have concocted this one (which I'm certain is not novel), and am
wondering if there is something undersireable about it:

1) In the application.cfm file, use cfset to establish the dsn name,
username, pass:
<cfset dsnname="namehere">
<cfset dsnusername="usernamehere">
<cfset dsnpass="passhere">

2) Then simply use

<cfquery name="Qnamehere" datasource="#dsnname#" username="#usernamehere#"
password="#passhere#">

....on each query location.

My question is,......is this easier?, is the application.cfm file secure
enough on a shared server to prevent this info from being accessible?, and is
there a better way?

Thanks for your help. Please remember that my ability is not great yet, and I
need things spelled out a little more.

Thanks,
Stephen
Tallahassee, FL

[HairyDude]

Hi,

yes, that is a better way to do it, as if anything changes you only have one
change in the application.cfm file to action. You cannot request
Application.cfm from the server, so it is secure, and the way most people work.
You may want to put the variables in the request scope though (or another
scope as appropriate). So you settings would be:-

<cfset request.dsnname="namehere">
<cfset request.dsnusername="usernamehere">
<cfset request.dsnpass="passhere">

<cfquery name="Qnamehere" datasource="#request.dsnname#"
username="#request.dsnusername#" password="#request.dsnpass#">

Hope that helps.

[Mike Greider]

Do you have access to the administrator? If so, just put the username/password
in the dsn properties field. I would try to avoid putting sensitive
information, like passwords, in code. If there is a problem and someone can
figure out how to dump, like cfdump, your variables scope, your username and
password would be viewable.

So ... I'd just do everything in the administrator if possible. If not, you
can create a UDF with private (var) variables that contain the
username/password. Then create "getter" methods to access this information.
Then, inside of your cfquery, you can do something like this ...

<cfquery name="whatever" datasource="#dsnname#" username="#getDSNUsername()#"
password="#getDSNPassword()#">