|
Already posted 3 times. Try reading the answers people give you!
Bob
Ashfield Consultants Ltd
|
|
|
|
|
Ok so im making a program in C# to be a desktop based version of our AJAX chat on our site. The AJAX chat reads messages and other info from the main SQL database on the site.
Now my program does the same. BUT the problem is that the program is still decompilable(which means that anyone can get our SQL username and pass).
So how do people normally stop this?Surely im not the only one making a program that has sql info in it?
Now i first thought I could just use an Obfuscator but after reading around it seems that even that will only ward of beginners.
Please help  thanks!
|
|
|
|
|
roguemat wrote: the program is still decompilable(which means that anyone can get our SQL username and pass).
Have you never heard of a trusted connection?
roguemat wrote: So how do people normally stop this?
I use trusted connections.
|
|
|
|
|
No, i havent :-/
Are you talking about web services?
thanks
|
|
|
|
|
No, I'm not talking about web services.
A trusted connection is one where the SQL Server accepts your current Windows Domain login to connect to the database.
Remove the user name and password from your connection string and replace with Trusted_Connection=yes
For more information about the various ways you can connect to databases see Connection Strings[^]
|
|
|
|
|
thanks man
EDIT: hmmm it seems like this would require me to add every user that uses the program to the database(well their windows login)? This is possible as there are a couple thousand users
|
|
|
|
|
You can add windows (NT) groups rather than individual users, that may help.
Bob
Ashfield Consultants Ltd
|
|
|
|
|
Well that doesnt really help because I have no clue who the users will be? Think of it like CodeProject making a windows based MessageBoard viewer...they dont have any idea what users are going to be viewing their program. So they would have to have SQL info in the program, but then would be scared that someone would decompile it and get their SQL info..
|
|
|
|
|
Then you (don't) use SQL's built in security to lock their access down to a couple of stored procedures.
Use a webservice, and give the webservice access to your database server. Letting random people on the internet connect directly to your server is just asking to be owned, unless you know exactly what you are doing.
|
|
|
|
|
Well, unless its an internet program (in which case you wouldn't be able to assign individual users 'on the fly' anyway) surely you have some internal security policies, and I bet they include Windows groups, otherwise you are wide open to abuse. As a contractor I have worked at many large multi-national financial companies, all of which use Windows groups as one form of application/database security. The only time I have seen anythng other than trusted connection (and within that the groups are only assigned the minimum permissions required) is with inter/intranet applications where sql server resides on a different physical server to IIS and you have the classic 'double hop' problem.
Anyway, its up to you, but I suggest you read up on SQL Server security before making a final decision, as whatever the connection method you need to enfore security within the server.
Bob
Ashfield Consultants Ltd
|
|
|
|
|
The problem is that it is an internet application...
Im thinking of just using Web Services.
|
|
|
|
|
Thats 1 way. If you had said that in the first place though you would have got more relevant advice. An internet appication (unless running under a VPN or similar) obviously cannot use windows authentication, so your choices become more limited.
Bob
Ashfield Consultants Ltd
|
|
|
|
|
At the beginning I didnt know i was going to use that :P
|
|
|
|
|
Hi can anybody tell me how i determine the Type of a null-Reference ?
MyClass mc = null;
mc.GetType()
typeof(mc)
I just want to know the Type of "mc" when it is null.
|
|
|
|
|
Hmmm,
what about using the statement "is"?
if(mc is MyClass) {
}
Does this work? Just a guess.
Sebastian
|
|
|
|
|
no this doesn't work
<code>( ( ( MyClass ) null ) is MyClass )</code> returns false.
|
|
|
|
|
How can you possibly call a method in an object if it's null?
"Why don't you tie a kerosene-soaked rag around your ankles so the ants won't climb up and eat your candy ass..." - Dale Earnhardt, 1997
-----
"...the staggering layers of obscenity in your statement make it a work of art on so many levels." - Jason Jystad, 10/26/2001
|
|
|
|
|
John Simmons / outlaw programmer wrote: How can you possibly call a method in an object if it's null?
When it is a crazy extension method[^]
|
|
|
|
|
Interesting! I never considerd using extension methods for that sort of stuff, as you say in the blog, probably not the best idea though.
The OP could do this then:
public static class Extensions
{
public static Type GetTypeIfNull(this MyClass instance)
{
return typeof(MyClass);
}
}
DaveBTW, in software, hope and pray is not a viable strategy. (Luc Pattyn)Visual Basic is not used by normal people so we're not covering it here. (Uncyclopedia)
|
|
|
|
|
no such thing but i thought there would be some reflection methode wich can tell me this
|
|
|
|
|
You can't.
A null object doesn't have a type, that's why it throws an exception. Reflection is for viewing the runtime state of objects and during runtime a null object is null and has no type.
If you need a Type object, you can use typeof(MyClass).
It's like asking if a pen is made from plastic or metal before it's been made. You can't. You can ask afterwards. But before, all you can do is look at the construction materials in the blueprint for a PlasticPen or a MetalPen (the classes), you don't know which it is until after you've created it.
Simon
|
|
|
|
|
Correct. I gave you 5. As in the rating, not the gesture.
I can give you 5 as in the gesture if you like though: *holds up palm*
|
|
|
|
|
Thanks.
*slaps raised palm* 
Simon
|
|
|
|
|
Glad you didn't leave me hanging
|
|
|
|
|
One thing no one really addressed is why you need to be able to do this? What is the problem you are trying to solve where you think you need to know the type of a null object?
Scott Dorman Microsoft® MVP - Visual C# | MCPD
President - Tampa Bay IASA
[ Blog][ Articles][ Forum Guidelines]
Hey, hey, hey. Don't be mean. We don't have to be mean because, remember, no matter where you go, there you are. - Buckaroo Banzai
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
