Concern about putting connection strings in an Include file (.inc) 1

[Rexolio]

Hi, recently in an effort to start cleaning up my scripting (I'm pretty sloppy) and to reduce redundancy, I began putting database connection strings in an include file for all of my ASP.

I've been doing this for a while now, but then it occurred to me the other day that anyone could view the source code of my page, add the .inc file onto the end of the web address in their browser and then view the connection string right there in their browser!

Does anyone else do this? What are the potential problems? Is it a problem? Any input would be great!

Thanks,
Rexolio

 

[derren]

Hi

Yes, there is a danger of someone guessing the name of the include file and downloading it which is why it is a really good idea to change the .inc to .asp. Then, if someone is mad enough to guess the name of the file the preprocessor will read the asp code and return only the response data to the user - which in the case of a connection string is rock-all. Derren
[The only person in the world to like Word]

 

[Rexolio]

I never even thought of doing that!!! Rock on! Thanks!