connection parameters in configuration file

[Fadi Yoosuf]

hi, I have a program which does some operations with database.(Single tier architecture) I will sometimes have to move the application to other systems having the database. In order to make the database connection parameters configurable, i am storing the params such as username, password etc. in an xml file. Is it the correct way to handle the situation? If so will it be safe to store the database password in an xml file? how can i solve the issue? If the application is meant for ordinary users(who may not have the database files), how can we approach the problem? Cconfiguration file will not be easy for him to edit no? Thank you Fadi

[Lost User]

Fadi Yoosuf wrote:

Is it the correct way to handle the situation?

There is no "correct way". It is a good idea to store it in a configuration-file, since it makes it easier to change.

Fadi Yoosuf wrote:

If so will it be safe to store the database password in an xml file?

Yes and no. It might be safe on a NTFS-partition, depending on the settings. Passwords are rarely written into a file as plain text, so you could encrypt it if you wanted more security.

Fadi Yoosuf wrote:

how can i solve the issue?

Switch to "Windows Authentication Mode", and you won't need to save a password. This would require just a small change in your connection-string. Use "integrated security" instead of the username/password combination.

I are troll :)

[Mycroft Holmes]

This is a standard approach and can be handled by using encrypted passwords, encrypting the config file or putting the password into the registry (not recommended these daya).

Never underestimate the power of human stupidity RAH

[Fadi Yoosuf]

Thank you very much for the info. But I wish to know one more thing. How huge applications like encyclopedias stores information? If they store in database, how is it possible to install them, without having the database server in the system?

[Mycroft Holmes]

Fadi Yoosuf wrote:

How huge applications like encyclopedias stores information?

These apps distribute a database with the app and are considered single user applications. A DB like SQL Express, Access or there are a few other small, single user databases out there.

Never underestimate the power of human stupidity RAH