Click here to Skip to main content
15,905,614 members
Home / Discussions / C#
   

C#

 
GeneralRe: Is it possible to edit a bitmap programmatically? Pin
Pain_Elemental6-Jul-04 19:50
Pain_Elemental6-Jul-04 19:50 
GeneralWanna Disscussion Forum Pin
RadhaKrishan5-Jul-04 21:14
RadhaKrishan5-Jul-04 21:14 
GeneralRe: Wanna Disscussion Forum Pin
Dave Kreskowiak6-Jul-04 4:57
mveDave Kreskowiak6-Jul-04 4:57 
QuestionList of installed fonts ? Pin
sachinkalse5-Jul-04 20:34
sachinkalse5-Jul-04 20:34 
AnswerRe: List of installed fonts ? Pin
Heath Stewart6-Jul-04 6:03
protectorHeath Stewart6-Jul-04 6:03 
GeneralAdding extra attribute / event to web control Pin
Member 11955125-Jul-04 20:10
Member 11955125-Jul-04 20:10 
GeneralRe: Adding extra attribute / event to web control Pin
Colin Angus Mackay5-Jul-04 21:00
Colin Angus Mackay5-Jul-04 21:00 
QuestionHow to Invoke methods declared in the dynamically loaded Assembly? Pin
ganeshvijay5-Jul-04 19:46
ganeshvijay5-Jul-04 19:46 
AnswerRe: How to Invoke methods declared in the dynamically loaded Assembly? Pin
MKlucher5-Jul-04 20:52
MKlucher5-Jul-04 20:52 
GeneralCookie Pin
Moon Boy5-Jul-04 18:25
Moon Boy5-Jul-04 18:25 
GeneralRe: Cookie Pin
Heath Stewart5-Jul-04 19:03
protectorHeath Stewart5-Jul-04 19:03 
GeneralRe: Cookie Pin
Moon Boy5-Jul-04 19:07
Moon Boy5-Jul-04 19:07 
GeneralRe: Cookie Pin
Heath Stewart5-Jul-04 19:09
protectorHeath Stewart5-Jul-04 19:09 
GeneralRe: Cookie Pin
Moon Boy5-Jul-04 19:16
Moon Boy5-Jul-04 19:16 
QuestionHow to add Textbox's PasswordChar property in PropertyGrid Control? Pin
god4k5-Jul-04 15:48
god4k5-Jul-04 15:48 
AnswerRe: How to add Textbox's PasswordChar property in PropertyGrid Control? Pin
Heath Stewart5-Jul-04 18:17
protectorHeath Stewart5-Jul-04 18:17 
GeneralRe: How to add Textbox's PasswordChar property in PropertyGrid Control? Pin
god4k5-Jul-04 18:42
god4k5-Jul-04 18:42 
GeneralQuick bit field question Pin
benglish725-Jul-04 13:28
benglish725-Jul-04 13:28 
GeneralRe: Quick bit field question Pin
Mike Dimmick5-Jul-04 13:38
Mike Dimmick5-Jul-04 13:38 
GeneralRe: Quick bit field question Pin
benglish725-Jul-04 15:12
benglish725-Jul-04 15:12 
QuestionSQL Security Hole - am I vulnerable? Pin
Ian Bowler5-Jul-04 13:04
Ian Bowler5-Jul-04 13:04 
AnswerRe: SQL Security Hole - am I vulnerable? Pin
Mike Dimmick5-Jul-04 13:33
Mike Dimmick5-Jul-04 13:33 
OK, here we go:

#1:

Windows Authentication uses the account of the user running the process connecting to SQL Server (or, I think, the account being impersonated by the process). Mixed mode uses Windows authentication or SQL Server authentication, where you supply the username and password in the connection string. The difference is that with SQL Server authentication, the usernames and passwords are stored in the MSDB database, whereas with Windows authentication, the usernames and passwords are stored either in the SAM (Security Accounts Manager, a Windows subsystem which uses the registry as a back-end store) or in Active Directory (on a Windows 2000 or higher domain). The server machine and client machine have to trust each other - if they're not the same machine, they have to be part of the same domain or domains which trust each other.

#2:

sa is typically a SQL Server account, stored in MSDB. If you want to use Windows authentication, you have to specify Trusted Connection=yes in the connection string. This tells the client code to negotiate a trusted connection. If the server is set to Windows Authentication only, you can't supply a username and password. If you had the Trusted Connection setting enabled, and you still couldn't connect, we need to talk about logins.

It isn't enough just to have a Windows user account to connect to SQL Server. The server also needs to know that the user is permitted to use it. By default only the built-in Administrators group is given access. To add a Windows login to SQL Server, open Enterprise Manager and go to Security > Logins. Right-click a blank area and choose New Login.

You also have to choose the roles for your user. Typically you want to select the public role. This role is usually given only the permissions necessary to use the database, not to administer it.

This is the reason you shouldn't use the sa user from an application: it's too powerful. The sa user maps to the dbo role, and is a server administrator. This means that the user can drop tables, delete data, insert data, alter stored procedures, alter table structure, basically do anything to any database on the server. That's far too powerful for an application.

By default, the public built-in role has no permissions at all. To add permissions in Enterprise Manager, expand the database you want to give permissions on and select Roles in the tree. Double-click the public role then click Permissions. Check the boxes for the permissions you want a general user to have.

#3:

Mixed Mode is a bit of a flaw because passwords are transmitted in the clear on the network between the client and the server. Anyone with a packet sniffer can read the passwords. You also have to store the password somewhere on the local machine. It's possible to do this in a secure way but it's typically easier to go with Windows authentication. You definitely want a strong sa password so that you're not susceptible to password-guessing attacks.

Stability. What an interesting concept. -- Chris Maunder
GeneralRe: SQL Security Hole - am I vulnerable? Pin
Ian Bowler5-Jul-04 21:32
Ian Bowler5-Jul-04 21:32 
GeneralRe: SQL Security Hole - am I vulnerable? Pin
Colin Angus Mackay5-Jul-04 23:25
Colin Angus Mackay5-Jul-04 23:25 
Generalcomparison of two strings - how to get a score Pin
rlacatus5-Jul-04 12:34
rlacatus5-Jul-04 12:34 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.