Web Hosting Reviews & Ratings

June 21, 2010

How to Secure an MS SQL Connection String in ASP.NET

Securing an MS SQL connection string in ASP.NET is a vital procedure especially for protecting corporate clients and those that store their credit card information in a database. The result of not doing this can be a hacker obtaining all this information and exploiting it for personal use.

Consequently there are a few methods for securing an MS SQL connection string in ASP.NET. These methods include:

• Encrypting the connection string
• Saving the connection string in Windows registry
• Saving the connection string as a DLL
• Storing the connection string
• Using a DSN connection string

By encrypting a connection string, it must be written in ASP.NET 2.0 because this is a new feature update. Encrypting the string will result in a much more secure environment protecting pertinent client information.

Another secure method is to save the connection string in Windows registry. The only issue is that appropriate permissions must be granted so that the web user can actually read the data that’s available within the Windows registry.

By saving the connection string as a DLL, Visual Basic must be used. Although the data will be secure, there’s one primary shortcoming involved in the process. Decryption of the DLL is a must in order to make any changes. Once the changes are completed, it must be re-encrypted. This can cause complications   especially on a shared hosting plan.

An addition method of security is to store the connection string in a web.config or global.asa file. These files cannot be accessed from a browser making them extremely difficult to connect to by an outside user. However, webmasters should enable customer error within web.config to display a message in the event of an error.

The final method is to use a DSN connection string. This can be conducted right in the hosting provider’s control panel. This method simply creates a DSN with an ODBC connector that stores the database username and password. This can also be accomplished on a Windows server with top permissions by accessing Start – Administrative Tools – Data Sources (ODBC).

Security is one of the most important issues within server maintenance. By personally securing as many aspects of your website as possible, the risk of an attack will greatly decrease. The previous tips will improve the security of a MS SQL connection string in ASP.NET thus eliminating another weakness within server systems.

Tags: MS SQL,  MS SQL connection,  ASP,  asp.net,  encrypting a connection string