global asa database connection

[derwent]

At present I am connecting to the SQL Server DB on each page that uses it. I have been informed that creating a database.inc for example to contain the database connection and including it on relevant pages is unsecure, and I should use the global.asa. But I cannot get this to work.

at present I have this in each page

Set objConn=Server.CreateObject("ADODB.Connection")
	cs = "Driver={SQL Server};Server=(local);Database=myDB;Trusted_Connection=yes;"
objConn.open cs
	
SQL = "SELECT * FROM mytable order by title"
set rs = server.CreateObject("ADODB.RECORDSET")
rs.open SQL,objConn

What do I need to use in global.asa and what should stay on each page?

Thanks folks

 

[FesterSXS]

rename your database.inc to database.asp to prevent its contents from being downloaded over the browser.

Tony
_______________________________________________________________

http://www.SpiraxSarco.com/

 

[Sheco]

FesterSXS is correct, renaming it will solve your security concerns.

The reason that I am responding though is that I wanted to add that I prefer to only use the global.asa for storing the connection string in a session variable. I don't like to keep an ADO connection object in a session variable because I think it is a waste of memory resources.

 

[derwent]

Thanks folks, went for the database.asp route. Is that secure?

 

[kisasama]

hey derwent

I hope this helps from what I see you're still using VBSCRIPT to open your code in your global.asa. however that won't work

the normal process is by doing this.

<code>
<SCRIPT LANGUAGE=VBScript RUNAT=Server>

Sub Application_OnStart
Application("ConnectionString") = "Driver={SQL Server};Server=(local);Database=myDB;Trusted_Connection=yes;"
End Sub



</SCRIPT>
</code>

and when you call it in your files I would still suggest using a inc file you can call the global.asa as the following.


Set objConn=Server.CreateObject("ADODB.Connection")
cs = application.ConnectionString
objConn.open cs

that should work for u.