Click here to Skip to main content
15,913,487 members
Home / Discussions / Database
   

Database

 
AnswerRe: How to store and retrieve metadata about a database table column? Pin
Colin Angus Mackay19-Aug-04 4:09
Colin Angus Mackay19-Aug-04 4:09 
GeneralRe: How to store and retrieve metadata about a database table column? Pin
Salil Khedkar19-Aug-04 20:09
Salil Khedkar19-Aug-04 20:09 
QuestionHow can i add 2 querys from a select statement Pin
Member 123213618-Aug-04 22:07
Member 123213618-Aug-04 22:07 
AnswerRe: How can i add 2 querys from a select statement Pin
Colin Angus Mackay18-Aug-04 22:58
Colin Angus Mackay18-Aug-04 22:58 
AnswerRe: How can i add 2 querys from a select statement Pin
Pradeep Shamarao3-Sep-04 4:36
Pradeep Shamarao3-Sep-04 4:36 
GeneralConvert SQL Server to Oracle Script Pin
Vadim Tabakman18-Aug-04 17:51
Vadim Tabakman18-Aug-04 17:51 
GeneralADO Recordset querie Pin
Asha Rams18-Aug-04 17:41
Asha Rams18-Aug-04 17:41 
General:confused: Password text is always shown in ConnectionString Pin
scadena18-Aug-04 11:48
scadena18-Aug-04 11:48 
Problem:
Password text is shown in ConnectionString property of ADODB.Connection when using an OLEDB provider and specifying Persist Security Info=false.

Applies to:
ADO, OLE DB Provider

Description:
According to MSDN documentation: http://msdn.microsoft.com/library/default.asp?url=/library/en-us/adosql/adoprg04_97g9.asp

If Persist Security Info is set to False at the time the data source is initialized, the data source cannot persist sensitive authentication information. Furthermore, a call to a property that contains sensitive authentication information, such as a password, returns a default value instead of the actual password.
After the data source has been uninitialized, sensitive information that was set when the data source was initialized with the Persist Security Info property set to False still cannot be obtained from the Properties collection or by persisting the uninitialized data source object. However, new properties set after the data source object has been uninitialized can be persisted or obtained if Persist Security Info is set to True.
Before the data source is initialized for the first time, sensitive information can be obtained from the Properties collection, and can be persisted, regardless of the setting of the Persist Security Info property. Therefore, sensitive applications should avoid passing uninitialized data source objects.

However, password text is shown in the ConnectionString property after an error occurs or when asking for ConnectionString after the ADO Connection has been closed.

The following code shows how to reproduce the problem:


private sub tryConnection()
Dim adoConn As ADODB.Connection
Dim sSql As String
Dim sConnectionString as String
Dim rstConsulta As ADODB.Recordset
Dim pwd As String
On Error GoTo ErrorHandler

Set adoConn = New ADODB.Connection
Set rstConsulta = New ADODB.Recordset

‘//Any SQL statement
sSql = "select Count(*) from K_User " '//Change this for a valid statement

'//Declares the connection using Persist Security Info=false

sConnectionString = "Provider=SQLOLEDB;Data Source=localhost; User ID=acdev;” & _
“Password=acdev; Initial Catalog=Keyadmin40; Persist Security Info=false;"

adoConn.Open (sConnectionString)

pwd = adoConn.Properties("password") '//pwd is blank, this is ok
MsgBox adoConn.ConnectionString '//password text is not shown, this is ok

rstConsulta.Open sSql, adoConn '//Executes ok

adoConn.Close '//Closes connection

‘//If the next line is uncommented, the message box will not show the password text.
‘//pwd = adoConn.Properties("password") '//pwd is blank, this is ok

MsgBox adoConn.ConnectionString ‘// The password text is shown, which is really bad.

Set adoConn = Nothing

Exit Sub

ErrorHandler:
'//If an error occurs, for example the table name on the sSql string
'//does not exist
MsgBox Err.Description
MsgBox adoConn.ConnectionString '//password text is not shown, this is ok
adoConn.Close
MsgBox adoConn.ConnectionString '//password text is SHOWN, this is really bad
End Sub


Conclusion:
Password text is shown after the data source object has been uninitialized

GeneralRe: :confused: Password text is always shown in ConnectionString Pin
mav.northwind22-Aug-04 1:27
mav.northwind22-Aug-04 1:27 
GeneralDataColumn Expresion problem Pin
blankg18-Aug-04 5:16
blankg18-Aug-04 5:16 
GeneralRe: DataColumn Expresion problem Pin
Syed Abdul Khader18-Aug-04 6:33
Syed Abdul Khader18-Aug-04 6:33 
GeneralRe: DataColumn Expresion problem Pin
blankg18-Aug-04 7:42
blankg18-Aug-04 7:42 
Generalhelp... (Java trouble) Pin
PeVoo17-Aug-04 17:08
PeVoo17-Aug-04 17:08 
GeneralRe: help... (Java trouble) Pin
EdbertP18-Aug-04 13:12
EdbertP18-Aug-04 13:12 
GeneralCreating an ADO _RecordsetPtr Pin
Anonymous17-Aug-04 13:04
Anonymous17-Aug-04 13:04 
GeneralRe: Creating an ADO _RecordsetPtr Pin
Rob Graham17-Aug-04 13:57
Rob Graham17-Aug-04 13:57 
GeneralRe: Creating an ADO _RecordsetPtr Pin
Anonymous18-Aug-04 4:27
Anonymous18-Aug-04 4:27 
GeneralRe: Creating an ADO _RecordsetPtr Pin
Rob Graham19-Aug-04 9:51
Rob Graham19-Aug-04 9:51 
GeneralStoring an image in a sql server db Pin
Rashid_Mehmood17-Aug-04 10:33
Rashid_Mehmood17-Aug-04 10:33 
GeneralRe: Storing an image in a sql server db Pin
S Sansanwal17-Aug-04 12:10
S Sansanwal17-Aug-04 12:10 
GeneralGeneral Database Question Pin
Anonymous17-Aug-04 10:14
Anonymous17-Aug-04 10:14 
GeneralRe: General Database Question Pin
S Sansanwal17-Aug-04 12:25
S Sansanwal17-Aug-04 12:25 
General3 database questions Pin
Chodici Mrkev16-Aug-04 10:16
Chodici Mrkev16-Aug-04 10:16 
GeneralRe: 3 database questions Pin
Christian Graus16-Aug-04 11:32
protectorChristian Graus16-Aug-04 11:32 
GeneralRe: 3 database questions Pin
Colin Angus Mackay18-Aug-04 5:33
Colin Angus Mackay18-Aug-04 5:33 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.