Question

I’ve seen so many people keep their connection strings in the web.config file, instead of hard coding it. But I find it very dangerous, especially in cases where the same connection string is used for all users. This means anyone who’s got access to the web config file can easily get the username and password to the database and do all kinds of serious things. Is being able to modify the connection string without digging into the code worth this trade off? Is there any other benefit of keeping connection string in configuration file?

Answer 1

Web.config based connectionstring as seems is unsafe, because one can read it. But think about it, if a person can read your web.config, means he can edit any file on your server anyways as he probably already hack or gain access to file. So, it really doesn’t matter much. But to ensure some more safety you can do following:

1. Encrypt your Connection String and put that encrypted string in Web.config and then Decrypt it and read through a DLL file.

2. Create a DLL and put Connection String in that DLL, later add reference to that DLL and use connection string.

However using Web.config will allow you to change connection string based on your need. Like I have to run site at 5 different server, for development, testing production purpose, so I put different web.config everywhere rather than changing Code all time. So, based on your need and how your server is configured one or other method is always good or bad.