CODEWITHSUNDEEP
c#database-connectionconnection-string
serdar
serdar

Reputation: 1628

Is it safe if I decide the DbConnection class by trial and error?

Suppose that I have a connection string (in fact it will be a user entry). Using this string I want to create an appropriate DbConnection class. It would be either an SqlConnection, or OleDbConnection or OracleConnection (maybe another one in the future).

Would it be safe if I follow the following procedure?

For each possible connection class, I will create it and then open and close the connection.

Upvotes: 0

Views: 47

Answers (2)

Ocelot20
Ocelot20

Reputation: 10800

This strikes me as a bad idea, especially since you don't specify why you expect one of these to fail and what the reason is to use the next connection. What if it's a valid SQL connection string, but the db is simply unreachable? It wouldn't make any sense at all to try to connect to an Oracle db at that point.

A better way would be to let them select the provider type, then give the user a form with only the connection string properties they are allowed to change (with proper validation).

Upvotes: 2

Will
Will

Reputation: 118

It would be not safe because you give an attacker the possibility to bruteforce all your database connections at once.

Upvotes: 0

Related Questions