Separate class for database connection

Question

Hi Is it good from security point of view to create a separate class for connection and use it? or save the connection string in web.config file... Which is the best method?

Suthish Nair · Answer

Best ways always will not be the best :).. The problem with storing connection strings in web.config is whenever you update the web.config all the sessions get cleared/Killed which results in throwing out the users from web site. So this can be avoided by using an .xml file for storing user credentials. Remember to do file encryption/decryption if security is a concern.

Jiteendra Sampathirao · Answer

sql server XXXXXXXXXXX Mysql ZZZZZZZZZZZ Retrive the values based on column.

Suthish Nair · Answer

ok refer an example.. 1. xml file (1.xml).. Password=**;User id=**;Data Source=**;Connection Lifetime=** 2. fetch the ConnectionString Label1.Text = GetConnectionStringKey(ConnectionString) 3. method to read the xml file Lot of ways to read the xml. Different ways of reading an XML file You can store any config settings and later retrieve..

Muralidharan Deenathayalan · Answer

Create a xml file and store the connection string. XmlDocument xmlDoc = new XmlDocument(); xmlDoc.Load(@C:\ConnectionString.xml); XmlNode xn = xmlDoc.SelectSingleNode(ConnectionString); connStr = xn.InnerText; Later you can use the connStr variable in your application.

Kavita B · Answer

@Suthish If we store the connection string in XML file... How to access it? I never tried it before so plzzz help

Jiteendra Sampathirao · Answer

Hi As suthish said .xml file is the very best option to store connection string value. But most of the people store the connection string in web.config file...

Muralidharan Deenathayalan · Answer

The best way storing the connection string in web.config rather than creating a separate class/mainintaing into a constant. Moreover you can encrypt the connectionstring and you can store it into the configuration files also. http://www.codeproject.com/KB/aspnet/webconfig.aspx http://chiragrdarji.wordpress.com/2008/08/11/how-to-encrypt-connection-string-in-webconfig/

Ankit Nandekar · Answer

save connection in web.config its good practice. These have some benefits : Every time a connection string changes for instance migrating from development to production environment you'll need to change everywhere; By using a constant you just need to change a single place. But in this case when your string needs to be changed you'll need to recompile it. Same as above without that recompile part. You can to develop your application and other people set that database connection to you