Re: Database Access
- From: "EvanK" <EvanK@xxxxxxxxxxxxxxxxxxxxxxxxx>
- Date: Fri, 3 Jun 2005 06:18:02 -0700
Do you create the group in SQL Server on the NT Domain?
"Bob Barrows [MVP]" wrote:
> EvanK wrote:
> > I am trying to connect to a SQL database
>
> What version?
>
> > from a client script to
> > validate a user login and password.
>
> Why client script? This is a very insecure method. You are leaving yourself
> open to cross-site scripting exploits.
>
> This operation should be done in server-side code in an asp page.
>
> > I don't want to embed a username
> > and password in the script and I also don't want to use an ODBC data
> > source because I don't want to need to create it on individual
> > workstations. I used the code below for the connection but to no
> > avail. I also get the error message that tells me that there is no
> > datasource found and no default driver specified.
> >
> > var oCN = new ActiveXObject("ADODB.Connection") ;
> > var oRS = new ActiveXObject("ADODB.Recordset") ;
> >
> > oCN.open ("Server=MyServer;Database=MyDB;User=Me;Pwd=MyPwd'") ;
>
> I thought you did not want to embed the user name and password in the script
> ....?
>
> > oRS.open ("Select * from MyTable",oCN) ;
>
> 1. You are going to run into security issues: users are going to be prompted
> about retrieving data from another domain. You will have to instruct them to
> add your site to their trusted zone to avoid this.
>
> 2. Is this an intranet? I'm going to assume it is, otherwise connections to
> the database server would not be possible from client machines.
>
> You can see examples of valid connection strings at
> www.connectionstrings.com, You will want the sqloledb connection string. If
> you are intent on doing this from client-side code, I strongly suggest you
> use Integrated Authentication. The connection string will look like this:
>
> conn_string="Provider=sqloledb;" & _
> "Data Source=MyServer;Initial Catalog=MyDb;" & _
> "Integrated Security=SSPI"
>
> This will require granting all your users access to the database via their
> Windows logins. Fortunately, you can create a group, assign all the users to
> that group, and grant access in SQL Server to that group. See SQL Books
> Online (BOL) for more information.
>
> Bob Barrows
> --
> Microsoft MVP - ASP/ASP.NET
> Please reply to the newsgroup. This email account is my spam trap so I
> don't check it very often. If you must reply off-line, then remove the
> "NO SPAM"
>
>
>
.
- Follow-Ups:
- Re: Database Access
- From: Bob Barrows [MVP]
- Re: Database Access
- References:
- Database Access
- From: EvanK
- Re: Database Access
- From: Bob Barrows [MVP]
- Database Access
- Prev by Date: Re: Database Access
- Next by Date: Re: Sending an SMTP Email
- Previous by thread: Re: Database Access
- Next by thread: Re: Database Access
- Index(es):
Relevant Pages
|
