Hide Connection's ConnectionString Property

[StrangerInBeijing]

My boss asked me for a way to enable developers to create applications against our database, without ever having to know the user name or password for the database.

So I came up with the idea to create a single dll, with one class that create a connection object, and return this connection to any calling application.

My idea was that the user (developer) can get a valid connection, without having to worry about the location, user id, or password of the database.

Stupid me...forgot the connection got a ConnectionString Property.

So a developer can just say
sqlconnection mycon = aaconn.createconnection();
string x = mycon.connectionstring;


any better ideas or a way to hide a connectionstring property?

[Shuja Ali]

Do you guys use Production database for development purposes also? IF no then why would your boss not want developers to see the connectionstring?

I guess the boss itself will be stupid to say that developers shouldn't know the Username or password for the database.

[StrangerInBeijing]

Yes, we do use a production database. I guess I will change the user name and password for this database (which is currently the same as the live server) , so developers does not have to see the real username and password.

Boss not stupid. This is China mate. Going home, installing SQL on your machine, connect it to the live database, and download all the data in our database is easy. And stealing and selling software, data etc in this place is a way of living. You cannot even trust your own workers.

FYI: Yesterday I went to a computer market. I bought Win XP SP2 over the counter. It was a rewritable cd, with Win XP SP 2 English written on it with pen. I paid 10 yuan (about 1.70 USD!)...speak for itself.

[jmcilhinney]

You would have to create a DLL through which the other developers make their connections to your database. You could then provide methods that they could call and pass their data access objects to, within which you would create the required connection, perfrom the task and then remove any reference to your library's internal connection. It's rather long-winded but I don't see how you could do it any other way.

[Shuja Ali]

Yes I agree with JM. Separate the DataAccess layer from the UI and write all your data access code in that layer. You will just provide methods like add/delete/update, etc to the consumer of the class and hide all functionality of a connection object, etc.

[StrangerInBeijing]

I just realized that the connection.connectionstring does not include the password.

So...one dll to only connect to server. Going to give this to my boss and teach him to change the constant properties if needed and build it. Then he can arrange with the host to change the password whenever he feel like it, and give me the new dll.

A second dll get it's connection from the above one, and is a whole class library of functionaily to interact with the database.

Eventually, the "not so good" developers can just create pages as they wish, but must interact with the database via the second class library.

Yeah..sounds good.

Thanks for the input