Password Storing Standard

[Kit Truong]

Hello,

When I'm creating database driven asp applications, I store my constants,
including my connection string to the database within an asp file called
constants.asp. All constants are stored inside asp coding <% ... %> so
people can't save the data through the web.

I've been told this is an insecure way of storing the connect string becuase
my connect string would also store the username and password to connect to
the db.

My question is, what is the current standard for storing an connect string
to a database for asp applications?

Thanks.

[Aaron [SQL Server MVP]]

Please don't multi-post.
http://www.aspfaq.com/5003

--
http://www.aspfaq.com/
(Reverse address to reply.)


"Kit Truong" <ki*@e-nablesolutions.ca> wrote in message
news:J4****************@news20.bellglobal.com...

Hello,

When I'm creating database driven asp applications, I store my constants,
including my connection string to the database within an asp file called
constants.asp. All constants are stored inside asp coding <% ... %> so
people can't save the data through the web.

I've been told this is an insecure way of storing the connect string becuase my connect string would also store the username and password to connect to
the db.

My question is, what is the current standard for storing an connect string
to a database for asp applications?

Thanks.

[dlbjr]

I use the global.asa file for this. It's purpose is to hold constants in application variables.
Yes, There is a level of insecurity in having your connection string here or an asp.
This is fine in most situations. You are limited to your options when your site is on a host server.

If you have exclusive use of a server, you have many other options. A dll with the connection string
can be used to load the connection string on the application start.
--
'dlbjr
'Pleading sagacious indoctrination!