ASP, msSQL and myODBC security

[Squibs]

As a releative newbie, I've picked up most of what I need to know about php and more recently asp via google. My latest venture is likely to be popular enough to possibly generate attention from hackers. I'm worried about my mysql connections. How hard would it be for a hacker to see my source code and be able to take over my databases? Are DSN or DSNless connections safer?

Obviously I don't allow directory indexing, and my admin area uses htprotect, but my content area is open to all. Can't you set up a browser to not process the asp and instead display the code, thus gaining access to the connection details, which you could then exploit with a program like dbTools? I'm guessing the user associated with the connection for content pages should be read only?

What about the phpbb discussion forum? The user for that connection has write access to the phpp database. I currently use a script that displays recent topics from the forum on my main page.

Sorry for all the questions, but my googling has come up blank on this...

[John Scott]

Welcome to v7n.

I know nothing about coding but I'm sure somebody who does will be along shortly.

[Squibs]

Thanks John, I certainly hope so. I'm paranoid about being hacked

[imaginemn]

All good questions. Let's see if I can answer most of them.

DSN is always best because your code will not display the passwords and better performance. I would recommend you setup a special password for your website that does NOT have full admin rights. If you are not writing to the database then make it read only. In other words DON'T USE the SA password. Create a unique username for the site like web0001 and a complex password. I would make sure that this new username only has access to the tables it needs to have access to and not any of the system tables or account tables. You can always create a unique password for system related tasks. When using ASP NEVER include any connection strings with a .inc file. If you do the any browser will see all the code by typing yourwebsite.com/filename.inc because the server does not know that an .inc file should be rendered as an ASP file. It will treat it like a typical text file. This is probably the biggest mistake most programmers make. Always make sure your connection strings are using an ASP page or better yet create a .dll file that has this information and then call the object. But that's a technique more experienced programmers do.

I would also recommend that you change your password on a regular basis "monthly". Some hackers may store your password and access it a few months later. By then your password would have changed.

Did I forget anything? Let me know.

imaginemn

[Squibs]

Thanks imaginemn,

some great answers, and a lot of work for me! All my connections are currently DSNless and there's better than 50 scripts to update. Also the user I'm using is a DBA - that needs to change (except in the admin area which needs write access and is is htprotected).

Always make sure your connection strings are using an ASP page

I don't quite understand this point. Could you please elaborate?

Squibs

[imaginemn]

NP.

Typically what you do is create 1 database script file that you can include on all your pages as a server side include file something like mydb.asp or mydb.inc, something unique and not common like db.asp or db.inc. Most programmers use db because it's easy to remember but it's also easy to try to hack. What I meant is DO NOT use the .inc file extension when using ASP. I cannot express this enough.

By only having 1 db file with the connection string. This will allow you to easily update the whole site without having to change 50 pages. As far as your DBA account you should really create a unique user that has read/write access so it can add/remove/alter data but not be able to create tables/remove tables or access any admin resources via browser. The last thing you need is to someone get your password log in create a new user and when you change your password the other account is still active if you don't know about it.

imaginemn