Hiding an oracle password in an ASP page

[telemorgan]

I am creating an ASP webpage that connects to an oracle database. I have the username and password imbedded into a connection string within the code on the page. Anyone that can run that page can simply "view source" and see the connection string. Does anyone have a way that I can hide or encrypt this username\password so that a user cannot view it?

Thanks in advance

 

[damber]

I have the username and password imbedded into a connection string within the code on the page. Anyone that can run that page can simply "view source" and see the connection string.

No they can't.

Anything in a .asp file and inside <% and %> will not be sent to the browser, so no amount of 'view-source' will get them to see what your server side code is.

It will be visible to anyone with access to the filesystem that the webserver reads the files from though - however this is usually developers/admins only, so is normally 'acceptable'. There are ways of securing further, such as using a DLL to store your DB connectivity logic (and the password etc). But it makes maintenance more difficult and complicates the solution.



A smile is worth a thousand kind words. So smile, it's easy!

 

[etjohnson81]

That is right. Depending on your access to the server where your sight is, you can put an include file in a directory not on the website, then use a Server.Mappath("c:\notin

http://www\connstring.asp")

<A href="

http://www.easycgi.com/shared_hosting/?kbid=4815&img=easycgi_120x60_5.gif">

<img src="

http://banners.easycgi.com/ShowBanner.asp?id=4815&img=easycgi_120x60_5.gif"

border=0></a>

 

[damber]

etjohnson81,

Depending on your access to the server where your sight is, you can put an include file in a directory not on the website, then use a Server.Mappath("c:\notinwww\connstring.asp")

I think you might want to clarify a few things in your post:
a) you would commonly use the <!--#include virtual.... declaration to 'include' an additional asp file.
b) you could use Server.Execute, or Execute and FSO to process the file using Mappath... but why go to the trouble (and create complexities / issues in the process) ?
c) what extra (real) security is this providing over a standard included asp file ? None, really.
d) most server set-ups (esp. IIS 6.0 by default) will disable parent paths, breaking server.mappath when accessing outside of the website root.
e) mappath translates from a website relative path (e.g. /) to an absolute path (e.g. C:\...) - so it wouldn't take an absolute path as a parameter.

Hope that helps to clarify things for you.



A smile is worth a thousand kind words. So smile, it's easy!

 

[etjohnson81]

haha sorry, I am kinda new with this

<A href="

http://www.easycgi.com/shared_hosting/?kbid=4815&img=easycgi_120x60_5.gif">

<img src="

http://banners.easycgi.com/ShowBanner.asp?id=4815&img=easycgi_120x60_5.gif"

border=0></a>