Visual Basic

Re: Prevent hacking of connection string over the internet

30-Sep-21 7:37

Hello,
I am making a VB.NET forms application and need to connect with SQL Server over the internet using the following connection string:

Data Source=190.190.200.100,1433;Network Library=DBMSSOCN;Initial Catalog=myDataBase;User ID=myUsername;Password=myPassword;

From what I could glean from the internet, apparently this kind of connection string is vulnerable to being hacked. Thus what should I do to encrypt this string and also enable decryption only at the remote server.
Whenever I search the internet, I only come across ways to encrypt web.config and app.config. This apparent security flaw does not seem to be covered anywhere.

Thanks in advance,

Khalid.

Dave Kreskowiak30-Sep-21 9:06

Re: Prevent hacking of connection string over the internet

30-Sep-21 9:06

An SQL server should never be directly exposed to the internet. You normally expose the database functionality through a securable web service and your application talks to the web service to handle all the database work.

Asking questions is a skill
CodeProject Forum Guidelines
Google: C# How to debug code
Seriously, go read these articles.

Dave Kreskowiak

Member 1537744030-Sep-21 9:20

Re: Prevent hacking of connection string over the internet

30-Sep-21 9:20

Dave Kreskowiak wrote:
n SQL server should never be directly exposed to the internet. You normally expose the database functionality through a securable web service and your application talks to the web service to handle all the database work.

Ok, can you point me to a webpage or post regarding how to go about this?

I am sorry if my questions appear rather naive but this is the first time I am going about this whole thing.

Khalid.

Dave Kreskowiak30-Sep-21 10:10

Re: Prevent hacking of connection string over the internet

30-Sep-21 10:10

Any tutorials on "VB.NET create web api". Then you need the client side, so "VB.NET consume web api".

Asking questions is a skill
CodeProject Forum Guidelines
Google: C# How to debug code
Seriously, go read these articles.

Dave Kreskowiak

Member 153296137-Oct-21 9:09

Re: Prevent hacking of connection string over the internet

7-Oct-21 9:09

Dave Kreskowiak wrote:
An SQL server should never be directly exposed to the internet

Sort of. SQL Azure is accessible over the internet.

Dave Kreskowiak7-Oct-21 9:11

Re: Prevent hacking of connection string over the internet

7-Oct-21 9:11

True, but your normal SQL Server doesn't have the defenses in front of it like an Azure SQL instance does.

Asking questions is a skill
CodeProject Forum Guidelines
Google: C# How to debug code
Seriously, go read these articles.

Dave Kreskowiak

Member 153296137-Oct-21 9:11

Re: Prevent hacking of connection string over the internet

7-Oct-21 9:11

Member 15377440 wrote:
this kind of connection string is vulnerable to being hacked

Not sure what you are asking.

1. Is the string able to be hacked? No, because it sits in app.config and hopefully you have that on a secure server.
2. Can the SQL server be hacked? Yes, anything can be hacked. But, you can certainly secure it. Sql Azure is accessible via IP address.

Is your sql server not in the same place as where your forms application will be running?

Member 1537744010-Oct-21 8:00

Re: Prevent hacking of connection string over the internet

10-Oct-21 8:00

Member 15329613 wrote:
1. Is the string able to be hacked? No, because it sits in app.config and hopefully you have that on a secure server.

If I am understanding this correctly, my app.config file will be on my development/deployment machine. Should not be an issue as long as I am accessing my SQL Server database on the same machine.
My fear is that if I want to keep my SQL Server database in the cloud and try to connect with it through a connection string, that string could be easily be read by a third party over the internet.
Thus, how do I ensure that my connection string containing the database credentials cannot be hacked while being sent over the internet.
If I encrypt the app.config file on my local machine, is that enough to secure this issue. How will the jumbled connection string be de-crypted at the remote server?

Member 15329613 wrote:
Is your sql server not in the same place as where your forms application will be running?

Presently it is on the same machine, but as I said above, my plan is to keep in the cloud eventually.

BTW, thank you for addressing my query, else in most cases, people simply write some cryptic answers which lead nowhere!

Dave Kreskowiak10-Oct-21 8:10

Re: Prevent hacking of connection string over the internet

10-Oct-21 8:10

Member 15377440 wrote:
If I encrypt the app.config file on my local machine, is that enough to secure this issue.

NO! Not even close. Think about it. If your code can decrypt the connection string, so can someone else.

Asking questions is a skill
CodeProject Forum Guidelines
Google: C# How to debug code
Seriously, go read these articles.

Dave Kreskowiak

Member 1532961311-Oct-21 2:10

Re: Prevent hacking of connection string over the internet

11-Oct-21 2:10

If you deploy your database to Azure SQL, for example, it will be secure. You only need to encrypt your app.config if you are worried about someone getting onto the machine that has your app.config.

When .Net code makes the connection using the connection string it does it in a secure manner. You do not need to do more.

Member 1537744011-Oct-21 9:22

Re: Prevent hacking of connection string over the internet

11-Oct-21 9:22

Member 15329613 wrote:
When .Net code makes the connection using the connection string it does it in a secure manner. You do not need to do more.

Ok, so does this mean that if I deploy the database on some other platform, I have to take additional measures to secure the connection string or does .NET code ensures this security in all cases?

And if it does not secure the string for other platforms(other than Azure), what measures do I need to take to prevent such a hack on the connection string?

Member 1532961311-Oct-21 10:56

How do I read XML File and put it in Datagridview and update it back to XML File

11-Oct-21 10:56

The string is secure as long as know one can get to the machine. If you put your database out on the internet with your own install of sql you'll have to google how to secure it. If you use Sql Azure, it is already secured but there are additional securities you can add to it.

OMG_Live25-Sep-21 9:00

OMG_Live

25-Sep-21 9:00

How do I read XML File and put it in Datagridview and how do I search the content of specific text and re-update the modified the text to all lines and update it back to XML File from Datagridview ?

Here is my XML File content.

<shares>
<country name="india" exchanges="NSE,BSE">
<symbol name="Wipro Technologies" nseid="WIPRO" bseid="12371">

<yahoowatchlist name="Sharesa">
<watchlistlist>
<watchlist name="Sharesa">
<watch symbol="DLF" exchange="NSE">
<watch symbol="ICICIBANK" exchange="NSE">
<watch symbol="INFY" exchange="NSE">
<watch symbol="NSEBANK" exchange="NSE">
<watch symbol="NSEI" exchange="NSE">
<watch symbol="RELIANCE" exchange="NSE">
<watch symbol="SBIN" exchange="NSE">

<mcxdirect>

<worldstockwatchlists>
<worldstockwatchlist name="watch-1">
<stock symbol="MSFT">
<stock symbol="GOOG">
<stock symbol="AAPL">
<stock symbol="INTC">
<stock symbol="^IXIC">
<stock symbol="^GSPC">

<currentworldstockwatch name="watch-1">
<forex>
<watch symbol="USDINR=X">
<watch symbol="EURUSD=X">
<watch symbol="USDJPY=X">
<watch symbol="USDCAD=X">
<watch symbol="USDCNY=X">
<watch symbol="USDCHF=X">
<watch symbol="USDSGD=X">

<fnodirect>

<symbolmapping>
<mapping symbol="BANKNIFTY30SEP2136000CE" name="36000CE" exchange="">
<mapping symbol="BANKNIFTY30SEP2136000PE" name="36000PE" exchange="">

<ncdexdirect>

<currency>

<directlist type="COMMODITY" active="Watch-1">
<directwatch name="Watch-1">
<symbol name="ALUMINIUM-1">
<symbol name="CRUDEOIL-1">
<symbol name="GOLD-1">
<symbol name="LEAD-1">
<symbol name="NATURALGAS-1">
<symbol name="NICKEL-1">
<symbol name="SILVER-1">
<symbol name="ZINC-1">

<directlist type="FNO" active="Watch-1">
<directwatch name="Watch-1">
<symbol name="BANKNIFTY">
<symbol name="BANKNIFTY-1">
<symbol name="NIFTY-1">

<directlist type="CD" active="Watch-1">
<directwatch name="Watch-1">
<symbol name="EURINR-1">
<symbol name="GBPINR-1">
<symbol name="JPYINR-1">
<symbol name="EURUSD-1">
<symbol name="USDJPY-1">
<symbol name="USDINR-1">

<directlist type="WO" active="Watch-1">
<directwatch name="Watch-1">
<symbol name="BANKNIFTY30SEP2136000CE">
<symbol name="BANKNIFTY30SEP2136000PE">

My Question :

How do I import above XML File to Datagridview ?

And also I would like to know, how do I edit the content of any child node text and re-update it to XML for all lines?

Example :

With this reference, I need to modify the text content for the following node

<symbolmapping>
<mapping symbol="BANKNIFTY30SEP2136000CE" name="36000CE" exchange="">
<mapping symbol="BANKNIFTY30SEP2136000PE" name="36000PE" exchange="">

I need to search 30SEP21 and replace 01OCT21 it to all lines. Please suggest me how d I do this as I am new to this.

Re: How do I read XML File and put it in Datagridview and update it back to XML File

CHill607-Oct-21 7:48

CHill60

7-Oct-21 7:48

Start your research with these CodeProject articles
Reading XML Data into a DataTable Using ASP.NET[^] (You can then use the datatable to populate the DataGridView
Reading and Writing XML in C#/VB.Net[^]

VBA Calling a Sharepoint list Rest API failed.

BEN CHEN 202119-Sep-21 7:48

BEN CHEN 2021

19-Sep-21 7:48

Hi,
I have below code to calling SharePoint REST API through VBA in Excel but I got the Erorr: 2147024891, System.UnauthorizedAccessException. Any idea how to fix this issue?
.

Sub Button3_Click()
    strUrl = "https://abc.sharepoint.com/sites/QA/_api/lists/getbytitle('TestingInformation')/items"
With CreateObject("MSXML2.ServerXMLHTTP.6.0")
  .Open "GET", strUrl, False
  .Send
  Content = .ResponseText
End With
   MsgBox Content
End Sub

Re: VBA Calling a Sharepoint list Rest API failed.

Richard Deeming19-Sep-21 22:51

Richard Deeming

19-Sep-21 22:51

That's an error from the server, which suggests that you're not authorized to retrieve the requested information.

NB: If the server requires authentication, you will need to use SetRequestHeader to send the appropriate authentication header. How you do that will depend on the required authentication scheme. For example, "basic" authentication requires a Base64-encoded combination of the username and password.

"These people looked deep within my soul and assigned me a number based on the order in which I joined."
- Homer

ListDirectoryDetails

Drno Strz18-Sep-21 9:07

Drno Strz

18-Sep-21 9:07

Hallo,
can I ask a question about agilitypack here?
From this website
https://update.kbv.de/ita-update/
I need a listing of the directories and files (ListDirectoryDetails under FTP). From this I would like to make a TreeView. This is fully programmed in C# and has been populated with FTP up to now. I am missing the file list on this website with HTTP. Is there a code snippet somewhere for this problem with the agilitypack?

Best regards
Norbert

RedDk18-Sep-21 14:55

RedDk

18-Sep-21 14:55

Perhaps these might be of use:
"ListDirectoryDetails"@cp[^]

Drno Strz18-Sep-21 22:33

Drno Strz

18-Sep-21 22:33

Thanks. With FTP everthing has gone very well so far. But now the server has been switched off and access is only possible via HTTP(s). Please visit this website Index of /ita-update
How do I get the directories and file links for a offline TreeView with the HtmlAgilityPack? There does not seem to be any other way with Vb.Net

Best regards
Norbert

Mycroft Holmes19-Sep-21 13:10

Mycroft Holmes

19-Sep-21 13:10

So the server admin turned off FTP and I don't think you can get the server directories via HTTPS. Unless you install a tool on the server with higher permissions that will supply the directories to the browser (HTTPS) you are probably not going to be able to do what you want.

Caveat - I have limited knowledge of this area so a better answer may come along.

Never underestimate the power of human stupidity -
RAH
I'm old. I know stuff - JSOP

Dave Kreskowiak19-Sep-21 13:39