连接字符串

连接字符串最全的网站:http://www.connectionstrings.com/

SQL Server 2005连接字符串：

1. Data Source=myServerAddress;Initial Catalog=myDataBase;User Id=myUsername;Password=myPassword;
2. Data Source=myServerAddress;Initial Catalog=myDataBase;Integrated Security=SSPI|True;

• 尽量使用windows身份验证，而不是SQL Server验证

1. 安全容易管理。
2. 不需要在连接字符串串中设置用户名和密码。
3. 可以通过密码策略保证安全。
4. 密码不会通过明文在网络中传递。

关于连接字符串的安全:

 

1.防止连接字符串的注入攻击

       ///连接字符串生成器
        System.Data.SqlClient.SqlConnectionStringBuilder sqlConnectionStr = new System.Data.SqlClient.SqlConnectionStringBuilder();
        sqlConnectionStr.DataSource = "db";
        sqlConnectionStr.InitialCatalog = "table";
        ///指定为windows验证
        sqlConnectionStr.IntegratedSecurity = true;
        ///设置线程池
        sqlConnectionStr.Pooling = true;
        sqlConnectionStr.MinPoolSize = 5;
        sqlConnectionStr.MaxPoolSize = 20;
        ///加密
        sqlConnectionStr.Encrypt = true;
        ///支持异步处理
        sqlConnectionStr.AsynchronousProcessing = true;
        /// 设置超时时间
        sqlConnectionStr.ConnectTimeout = 40;

关于更多Cryptography加密解密: http://msdn.microsoft.com/zh-cn/library/z8ye046c(v=VS.80).aspx

   /// <summary>
    /// 手动加密  using System.Security.Cryptography;
    /// </summary>
    /// <param name="conStr"></param>
    /// <returns></returns>
    public string ConnectionStrEncryptor(string conStr)
    {
        string returnVal = string.Empty;
        byte[] str = Encoding.UTF8.GetBytes(conStr);
        MemoryStream ms = new MemoryStream(str);
        TripleDESCryptoServiceProvider tdesp = new TripleDESCryptoServiceProvider();
        TripleDESCryptoServiceProvider tDESalg = new TripleDESCryptoServiceProvider();
        CryptoStream cs = new CryptoStream(ms, tdesp.CreateEncryptor(tDESalg.Key, tDESalg.IV), CryptoStreamMode.Read);
        StreamReader sr = new StreamReader(cs);
        returnVal = sr.ReadToEnd();
        cs.Dispose();
        sr.Dispose();
        return returnVal;
    }

3.原文地址: http://www.dreamincode.net/code/snippet2585.htm

/// <summary>
    /// 加密Web.config文件的某些部分
    /// </summary>
    /// <param name="section">加密的节点(eg.: connectionStrings, appSettings)</param>
    /// <param name="provider">
    /// 加密提供使用：
    /// RsaProtectedConfigurationProvider
    /// DpapiProtectedConfigurationProvider 
    /// 
    /// 使用示例:
    /// string section = "connectionStrings";
    /// string provider = "RsaProtectedConfigurationProvider";
    /// EncryptWebConfigSection(ref section,ref provider);
    /// 使用RsaProtectedConfigurationProvider加密web.config文件的connectionStrings节点
    ///</param>
    public static void EncryptWebConfigSection(ref string section, ref string provider)
    {
        //我使用这段代码出现:未能映射路径“/”
        //open the web.config
        Configuration webConfig = WebConfigurationManager.OpenWebConfiguration(System.Web.HttpContext.Current.Request.ApplicationPath);
        //get the section we want to encrypt
        ConfigurationSection encryptSection = webConfig.GetSection(section);
        //make sure it isnt already encrypted
        if (encryptSection != null && !(encryptSection.SectionInformation.IsProtected))
        {
            //encrypt the section
            encryptSection.SectionInformation.ProtectSection(provider);
            //save the new web.config file
            webConfig.Save();
        }

    }

    /// <summary>
    /// 解密
    /// </summary>
    /// <param name="section">需要解密的节点</param>
    public static void DecryptWebConfigSection(ref string section)
    {
        //open our web.config file
        Configuration webConfig = WebConfigurationManager.OpenWebConfiguration(System.Web.HttpContext.Current.Request.ApplicationPath);
        //get the section we wish to decrypt
        ConfigurationSection decryptSection = webConfig.GetSection(section);
        //make sure it's valid and encrypted
        if (decryptSection != null && decryptSection.SectionInformation.IsProtected)
        {
            //decrypt the section
            decryptSection.SectionInformation.UnprotectSection();
            //save the new web.config file
            webConfig.Save();
        }
    } 

使用 ASP.NET IIS 注册工具 (Aspnet_regiis.exe) 加密或解密 Web 配置文件的各节,具体访问下面连接

加密和解密配置节

Technorati 标签: web.conf,配置文件加密