Question

i am making a simple c#.net winform application with a form1, which will connect to sql server.

i want that before establishing a connection to sql server , the application asks the user to enter the login name & password to connect.

for this what should i do:

take the login name & password in two text boxes & pass them the to the connection string
or
should i pass them to the app.config file & then use the string from app.config file in the form1.cs?

will this be ok with the security issues? if not, then what are the other ways of implementing this task?

Answer 1

I would do this:

• use a SqlConnectionStringBuilder component
• define things like server name, database name etc. from your app.config
• that component also has two properties for user name and password – fill those from a dialog box where you prompt the user for this information
• that SqlConnectionStringBuilder then gives you the proper connection string to use for connecting to your SQL Server

Update:

My suggestion would be to store the basic connection string like this:

<configuration>
  <connectionStrings>
     <add name="MyConnStr" 
          connectionString="server=A9;database=MyDB;" />
  </connectionStrings>
</configuration>

Then load this “skeleton” connection string (which is incomplete – that alone won’t work!) into your SqlConnectionStringBuilder:

string myConnStr = ConfigurationManager.ConnectionStrings["MyConnStr"].ConnectionString;

SqlConnectionStringBuilder sqlcsb = new SqlConnectionStringBuilder(myConnStr);

Then grab the user name and password from the user in a dialog box and add those to the connection string builder:

sqlcsb.UserID = tbxUserName.Text.Trim();
sqlcsb.Password = tbxPassword.Text.Trim();

and then get the resulting, complete connection string from the SqlConnectionStringBuilder:

string completeConnStr = sqlcsb.ConnectionString;

using(SqlConnection _con = new SqlConnection(completeConnStr))
{
   // do whatever you need to do here....
}