|
Ok so im making a program in C# to be a desktop based version of our AJAX chat on our site. The AJAX chat reads messages and other info from the main SQL database on the site.
Now my program does the same. BUT the problem is that the program is still decompilable(which means that anyone can get our SQL username and pass).
So how do people normally stop this?Surely im not the only one making a program that has sql info in it?
Now i first thought I could just use an Obfuscator but after reading around it seems that even that will only ward of beginners.
Please help  thanks!
|
|
|
|
|
roguemat wrote: the program is still decompilable(which means that anyone can get our SQL username and pass).
Have you never heard of a trusted connection?
roguemat wrote: So how do people normally stop this?
I use trusted connections.
|
|
|
|
|
No, i havent :-/
Are you talking about web services?
thanks
|
|
|
|
|
No, I'm not talking about web services.
A trusted connection is one where the SQL Server accepts your current Windows Domain login to connect to the database.
Remove the user name and password from your connection string and replace with Trusted_Connection=yes
For more information about the various ways you can connect to databases see Connection Strings[^]
|
|
|
|
|
thanks man
EDIT: hmmm it seems like this would require me to add every user that uses the program to the database(well their windows login)? This is possible as there are a couple thousand users
|
|
|
|
|
You can add windows (NT) groups rather than individual users, that may help.
Bob
Ashfield Consultants Ltd
|
|
|
|
|
Well that doesnt really help because I have no clue who the users will be? Think of it like CodeProject making a windows based MessageBoard viewer...they dont have any idea what users are going to be viewing their program. So they would have to have SQL info in the program, but then would be scared that someone would decompile it and get their SQL info..
|
|
|
|
|
Then you (don't) use SQL's built in security to lock their access down to a couple of stored procedures.
Use a webservice, and give the webservice access to your database server. Letting random people on the internet connect directly to your server is just asking to be owned, unless you know exactly what you are doing.
|
|
|
|
|
Well, unless its an internet program (in which case you wouldn't be able to assign individual users 'on the fly' anyway) surely you have some internal security policies, and I bet they include Windows groups, otherwise you are wide open to abuse. As a contractor I have worked at many large multi-national financial companies, all of which use Windows groups as one form of application/database security. The only time I have seen anythng other than trusted connection (and within that the groups are only assigned the minimum permissions required) is with inter/intranet applications where sql server resides on a different physical server to IIS and you have the classic 'double hop' problem.
Anyway, its up to you, but I suggest you read up on SQL Server security before making a final decision, as whatever the connection method you need to enfore security within the server.
Bob
Ashfield Consultants Ltd
|
|
|
|
|
The problem is that it is an internet application...
Im thinking of just using Web Services.
|
|
|
|
|
Thats 1 way. If you had said that in the first place though you would have got more relevant advice. An internet appication (unless running under a VPN or similar) obviously cannot use windows authentication, so your choices become more limited.
Bob
Ashfield Consultants Ltd
|
|
|
|
|
At the beginning I didnt know i was going to use that :P
|
|
|
|
|
Hi can anybody tell me how i determine the Type of a null-Reference ?
MyClass mc = null;
mc.GetType()
typeof(mc)
I just want to know the Type of "mc" when it is null.
|
|
|
|
|
Hmmm,
what about using the statement "is"?
if(mc is MyClass) {
}
Does this work? Just a guess.
Sebastian
|
|
|
|
|
no this doesn't work
<code>( ( ( MyClass ) null ) is MyClass )</code> returns false.
|
|
|
|
|
How can you possibly call a method in an object if it's null?
"Why don't you tie a kerosene-soaked rag around your ankles so the ants won't climb up and eat your candy ass..." - Dale Earnhardt, 1997
-----
"...the staggering layers of obscenity in your statement make it a work of art on so many levels." - Jason Jystad, 10/26/2001
|
|
|
|
|
John Simmons / outlaw programmer wrote: How can you possibly call a method in an object if it's null?
When it is a crazy extension method[^]
|
|
|
|
|
Interesting! I never considerd using extension methods for that sort of stuff, as you say in the blog, probably not the best idea though.
The OP could do this then:
public static class Extensions
{
public static Type GetTypeIfNull(this MyClass instance)
{
return typeof(MyClass);
}
}
DaveBTW, in software, hope and pray is not a viable strategy. (Luc Pattyn)Visual Basic is not used by normal people so we're not covering it here. (Uncyclopedia)
|
|
|
|
|
no such thing but i thought there would be some reflection methode wich can tell me this
|
|
|
|
|
You can't.
A null object doesn't have a type, that's why it throws an exception. Reflection is for viewing the runtime state of objects and during runtime a null object is null and has no type.
If you need a Type object, you can use typeof(MyClass).
It's like asking if a pen is made from plastic or metal before it's been made. You can't. You can ask afterwards. But before, all you can do is look at the construction materials in the blueprint for a PlasticPen or a MetalPen (the classes), you don't know which it is until after you've created it.
Simon
|
|
|
|
|
Correct. I gave you 5. As in the rating, not the gesture.
I can give you 5 as in the gesture if you like though: *holds up palm*
|
|
|
|
|
Thanks.
*slaps raised palm* 
Simon
|
|
|
|
|
Glad you didn't leave me hanging
|
|
|
|
|
One thing no one really addressed is why you need to be able to do this? What is the problem you are trying to solve where you think you need to know the type of a null object?
Scott Dorman Microsoft® MVP - Visual C# | MCPD
President - Tampa Bay IASA
[ Blog][ Articles][ Forum Guidelines]
Hey, hey, hey. Don't be mean. We don't have to be mean because, remember, no matter where you go, there you are. - Buckaroo Banzai
|
|
|
|
|
Hi All
I have send keys to the application(other) which i have started using my windows form .
By using API and managed code SetForeGroundWindow.. and SendKeys.Send...
This is working fine.But while my application sends keys if a user click on any other window then that(window on which user clicked) get the keys not the window for which it was meant.
So i had to chose other way.
Now I am using SendMeassage API and I want to send a Key to that application
[DllImport("User32.dll", EntryPoint = "SendMessage")]
public static extern int SendMessage(int hWnd, int Msg, int wParam,int lParam);
I have got the handle(hwnd) of the window to which i want to send a key(for here say F1 key)
public const WM_KEYDOWN =0x100; /which is one of the possible value of msg
/Here It is for keydown event.
public const VK_F1=0x70;
// it is a virtual key code for F1 to be passed in wparam
For lparam i have following inf
lParam
Specifies the repeat count, scan code, extended-key flag, context code, previous key-state flag, and transition-state flag, as shown in the following table.
0-15
Specifies the repeat count for the current message. The value is the number of times the keystroke is autorepeated as a result of the user holding down the key. If the keystroke is held long enough, multiple messages are sent. However, the repeat count is not cumulative.
16-23
Specifies the scan code. The value depends on the OEM.
24
Specifies whether the key is an extended key, such as the right-hand ALT and CTRL keys that appear on an enhanced 101- or 102-key keyboard. The value is 1 if it is an extended key; otherwise, it is 0.
25-28
Reserved; do not use.
29
Specifies the context code. The value is always 0 for a WM_KEYDOWN message.
30
Specifies the previous key state. The value is 1 if the key is down before the message is sent, or it is zero if the key is up.
31
Specifies the transition state. The value is always zero for a WM_KEYDOWN message.
Return Value
An application should return zero if it processes this message.
I do not know how to pass lparam to the function.
Note:I have set 0x00 for lparam and i am gettingreturn value 0 which i had stored in a variable.This means the message was processed by the window according to return value condition above.But I did not saw any Help window of that application.
Please guide in using lparam particularly for case of KeyDown msg of F1
Thanks
THE SK
(Sandeep Kalra)
"I am the One"
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
