I am using javascript,can anyone see my connection string on client side?

[Shaikh Rais]

In Asp.net Page

<script type="text/javascript"><!-- 
            
            function Showlogin(){popup.Show();}
            
            function Showloginx()
            {
                var s,usr,pass;
               
                var connection = new ActiveXObject("ADODB.Connection");
                
                [B]var connectionstring="Connection string";[/B]
                s="exec auser '" + tbLogin.GetText() + "','" + tbPassword.GetText() + "'";
                

		connection.Open(connectionstring);
                


		var rs = new ActiveXObject("ADODB.Recordset");
                
                rs.Open(s , connection);
                rs.MoveFirst
                if(rs.eof)
                {                  
                    alert("Invalid User ID Or Password")
                }
                else
                {
                    popup.Hide();
                }

                rs.close;
                connection.close;
                
                //popuplogin.Hide();

            }
            
//--></script>

[johny10151981]

From my understanding i can say no one is seeing your connection string.

But my question is this way necessary and convenient at all?

[Shaikh Rais]

i am building a e commerce application, my add to cart button work on JavaScript and JavaScript execute on client side, so the script must be at client side, and if someone want to search for the script in temp folder or another system location, and he got the connection sting, means it can access my data directly, and i will be in big trouble,

[johny10151981]

If the user name and password is not given by the user and given by you, then it mean it is the most stupid design on earth.

Who is providing the password? you or the client. If client provide the password architecture wont allow to see the password. but if the password is given by you that mean any one can see your username and password form any simple browser. Now can you give me a more detail about what are you trying to do?

[gits]

doing such passwordvalidat ion clientside is worthless at all - a medium skilled user could simply modify the script and login without any username or password ... and even putting a simple alert would show the connection-string ... just avoid such things and always check auths serverside.

Besides that ActiveX could just be used with IE only - so in case the app should ever run in another browser the code would even need to be adapted ... and best adapted to run serverside in that case ...

[Shaikh Rais]

Actually Connection string is DSN:129.21.23.1 ;DatabaseName;d buser;dbpass;pr ovider
and if anyone get it, any one can change data of my database without any problem

[gits]

as was said already - you shouldn't publish that to the client ... with javascript in fact you do that.