-
Hi all!
I am creating a database driven website in ASP with VB-Script and I would like to put
as little static and "secret" information in my code (like the name of the DSN, username,
password, locations of certain files) as possible. So I would like to use some sort
of INI-file.
I have 2 questions about that:
1. Is there a standard component I could use to read values from an INI-file?
2. How do I make my code in such a way, that noone can access my INI file over the net
either?
Thanx in advance!
-
A couple of ideas.
Depending on how much traffic your site will see you could consider using an Application variable inside your global.asa. This allows you to hide and share info. Inside global.asa you can create a sub called Application_OnStart and you can set any Application variables you want to use there, like so:.
Code:
Sub Application_OnStart
Application("ConnectionString") = "Provider=SQLOLEDB; Data Source=YourServer; Initial Catalog=YourDB; User ID=UserName; Password=YourPassword"
Application("ContactPerson") = "[email protected]"
End Sub
Then in your ASP you can open a connection and use the contact like:
Code:
conSomeConnection.Open Application("ConnectionString")
Response.Write "<P><A HREF=""mailto:" & Application("ContactPerson") & """>Contact Us</A></P>" & vbcrlf
I do mostly intranet development and use global.asa all the time without worry or problems. I've read that it can be burdensome on high traffic internet sites though. I would think that a high volume internet site might also have problems accessing an INI file too.
If you wanted to use some kind of INI file you could put it in a path that's outside your virtual path to stop web users from accessing it. For example, if your web site resides at and is mapped to c:\inetpub\wwwroot\yourproject then put the ini at c:\inetpub or somewhere else that isn't mapped thru your web server. In your ASPs you'd have to know exactly where your INIs are but at least they'd be secure.
Good luck,
Paul
-
Okay thanx, guess that's a way..
But we kinda wanted to start using INI-files here, for a few reasons:
1) Your code gets way more reusable
2) If the website moves, or the database name gets changed, or whatever, all you have to do is adjust the INI file
So my question once again is: Is there some sort of standard component, or does someone have a piece of code somewhere, which reads values from an INI-file?
-
Well, each of your 'web applications' can have a global.asa, so you can move it with your app if it needs to move. And, a global.asa works just like an INI file in that if your db changes all you have to do is change the value once in the global.asa. All of your pages will use the global.asa that resides in their directory and any changes to it are reflected immediately. I use global.asa for all my database driven ASPs and I develop them on a dev web server that uses a dev copy of SQL server and then move them to our production web server that uses a prod version of SQL server. All I have to do is make one small change to my global.asa to go live.
If you really want to use an INI file you might do a search here on them as I'm sure I've seen code posted for a common routine to handle them.
Cheers,
Paul
-
Okay, the only problem with the global.asa file is that it can be "hacked", in that there are ways to view its contents, and the whole idea of using an INI-file was to keep some information hidden from everyone.
-
Sorry, I'm on a small intranet and don't have to worry about hackers...for now. Can you give me some info on or point me to info on hacking ASPs and ASAs? I'd be interested in reading about it.
Thanks,
Paul
