How would people use MySQL in C#, or really any other managed application? Couldn't someone simply decompile the application and find out the password/etc. for the database?
Add a comment
|
1 Answer
You should never put the password in the code. In general your connection settings live outside the compiled application code; for C# that would generally be in an app.config XML file, encrypted if need be.
But either way, if the application is able to make direct connections to the database, it has to know the password, and there is nothing you can do to stop the user recovering that information. If your model is relying on a client-side datum remaining secret, you're doomed. You'd need to reconsider where you are putting the security checks, for example by putting database access at the server-side, with only per-user application passwords at the client-side.
