Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

How would people use MySQL in C#, or really any other managed application? Couldn't someone simply decompile the application and find out the password/etc. for the database?

share|improve this question

1 Answer 1

up vote 9 down vote accepted

You should never put the password in the code. In general your connection settings live outside the compiled application code; for C# that would generally be in an app.config XML file, encrypted if need be.

But either way, if the application is able to make direct connections to the database, it has to know the password, and there is nothing you can do to stop the user recovering that information. If your model is relying on a client-side datum remaining secret, you're doomed. You'd need to reconsider where you are putting the security checks, for example by putting database access at the server-side, with only per-user application passwords at the client-side.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.