Connection String

Question

Where we should give the Connection String whether in (Web .Config or .cs or seperate class file )? which is more secure?

Francis · Answer

Mostly the connection strings are kept in "Web.config" files.It providesa lot offlexibility and easy to maintain. 1.You can easily modify at any time. 2. Also, provides single place modification for the entire application. It easy the deployment process. 3. You canalso encrypt the web.config, whichadded another level of security. Incase, if you embed your connection string in a class. It adds the following cons: 1. Whenever, you change the connection string, you should need to compile the application or class library, where the class located. 2. It willmakehard the deployment process harder. 3. Also it introduce hard to maintain code. Most of the professional website kept the connection string in the web.config. So I always suggest you go with Web.config to embed your connection string.

Vinay Singh · Answer

Hi You should always define your connection string in web.config file. have a look how to define the connection string in web.config file. connectionStrings > add name = " myconnectionstring " connectionString = " Data Source=Server;Integrated Security=true;Initial Catalog=DBConnectionStrings " /> connectionStrings > Now access the connection string in code. string val = System.Configuration. ConfigurationManager .ConnectionStrings[ "myconnectionstring" ]. ToString(); For detail check the link Retrieve Connection String From Web.config In ASP.net Using C#.Net (AppSettings,ConnectionStrings)

Surya Kant · Answer

According to MSDN :- "Embedding connection strings in your application's code can lead to security vulnerabilities and maintenance problems. Unencrypted connection strings compiled into an application's source code can be viewed using the Ildasm.exe (IL Disassembler) tool. Moreover, if the connection string ever changes, your application must be recompiled. For these reasons, we recommend storing connection strings in an application configuration file." So for heighly security reason it is recomonded that you can use window authontication mode.Windows authentication is specified in a connection string by using the Integrated Security or Trusted_Connection keywords, eliminating the need to use a user ID and password. When using Windows authentication, users are authenticated by Windows, and access to server and database resources is determined by granting permissions to Windows users and groups. If it is not possible to use window authontication mode then you have to store your connection string inside configuration file and though configuration file is XML file you have an option to encrypt your configuration file;so that no volunaberilty can happen to your file. Hope you got. Mark as answer

ali tuncer · Answer

If you are not encrypting the connecting string, I think it is better to leave it inside code, it is recommended to store it in config files, but you need to encrypt it first. https://msdn.microsoft.com/en-us/library/dtkwfdky(v=vs.100).aspx If you store it in source code, it could be viewed by tools like ildasm, ILspy..also when there is a change in connection string, you will have to compile your code again.

Ashiwani Sharma · Answer

But what are the pros and cons in class ? can u tell me and which is more secure ?

Rajeesh Menoth · Answer

Hi, Lots of pros and cons in class so you can use Web Config. You can easily change the Connection String In Web Config.