Not sure if you can use Integrated Authentication with SQL Server or not, but if someone has access to your code to read the user name/password (and you don't trust them) I think you've got bigger problems.
that is correct. and thats why id like to store the password encrypted in the config-file. forget about the windows integrated authentication. what possibility do i have to encrypt it?
Kinda missed the latter point: if they have access to your code there's nothing to stop them from copying and using the connection information - encrypted or otherwise. If they have that kind of access to your server then you are screwed.
if you're really using integrated authentication in your sql server you don't have to worry about passwords in the config file, the sql server will automatically use the windows user account that your web server is running under, not whatever you might have in the connection string.
Topic Locked
Posted - 23 June 2009 : 12:12:43
