Return to
HomePage
ASPNET2SecurityFAQs

---

Question: How to do I use SQL authentication for connecting to SQL Server?

Answer:

If you cannot use Windows authentication to SQL Server, you must use SQL authentication.
To use SQL authentication:
* Use a least-privileged user ID to connect to SQL.
* Use a strong password for the SQL user account.
* Protect the channel between the Web server and database server because credentials are passed in an unencrypted format. For example, use SSL or IPSec.
* Protect the SQL connection string, which contains plaintext credentials.
If you connect to a SQL Server database using credentials (user name and password), your connection string looks like the following.

		 [SqlConnectionString] = "Server=YourServer\Instance;
		                      [Database=YourDatabase;uid=YourUserName;]
		                      pwd=YourStrongPassword;"  
	

More Information

For more information on using SQL authentication for accessing SQL server, see “How To: Connect to SQL Server Using SQL Authentication in ASP.NET 2.0.” at http://msdn.microsoft.com/library/en-us/dnpag2/html/PAGHT000010.asp
For more information on protecting database connection strings, see “How To; Encrypt Configuration Sections Using DPAPI” at http://msdn.microsoft.com/library/en-us/dnpag2/html/PAGHT000005.asp and “How TO: Encrypt Configuration Sections Using RSA” at http://msdn.microsoft.com/library/en-us/dnpag2/html/PAGHT000006.asp

---

Return to
HomePage
ASPNET2SecurityFAQs