Where to store connection string

[drew10]

I recently read this article on the best place to store a connection string.

http://www.aspalliance.com/stevesmith/articles/dotnetconnectionstrings.asp

Is the web.config the best place to store the connection string?

 

[hads]

In my opinion yes, the web.config is a good place to keep the connection string. As that article mentions you could also keep it in the machine.config if you have a lot of applications connecting to the same database on one server.

Hope this helps.

01101000011000010110010001110011

 

[jfrost10]

If you really wanted to add extra security to your conn string, you could keep it in a DLL file. Of course, this isn't airtight either since de-compilers are very easy to get your hands on, but it does add an extra step if people want to try and get into your information

i.e. Someone hacks into your site. They either
a) open your web.config file and see your conn string

or

b) download the dll, de-compile it, and get the conn string.

Jack