Tricky: ASP and Remote SQL Access

Hello All,

Have a bit of a tricky one here, and wondering if anyone could help me out.  The problem involves allowing my ISP hosted ASP 3.0 pages to access and internal SQL server database.  Does anyone know how this can best (if at all) be done?

From wat we have come up with, there are two possible solutions:

1. Configure our firewall so that only our ISP can get through on SQL port to query, but that does not provide enough security as SQL level access will send passwords in clear text (not acceptable for required security level), and this may at the same time expose our production database.
2. Create some kind of Web service (an ASP page) that locally queries the database, and have our external ASP page query the internal page (is this even possible?).  This would allow for the only opening up ports from our ISPs IP to our webserver for HTTP traffic. (Again, hosting the actual external page ourselves is not an option due to bandwidth considerations).

The second idea seems preferable, but i have no idea how i'd go about it.  Any ideas?  Any help or advice on either of the above two options (or in general) would be greatly appreciated, as i know it would be very difficult to not know more than i do!!

Many Thanks,
Steve

microsoft http xml can open up pages on remote servers and get the output page into a variable:

<%
GotothisURL = "The url to go to"

Set GetConnection = CreateObject("Microsoft.XMLHTTP")

GetConnection.Open "get", GotothisURL, False
on error resume next
GetConnection.Send

output = GetConnection.responseText

response.write(output)
Set GetConnection = Nothing
%>

That would make the external page connect to the internal page and run it. you could give it some functionality using the querystring:

<%
GotothisURL = "http://host.com/deletefromdb.asp?ID=" & request.querystring("ID")

Set GetConnection = CreateObject("Microsoft.XMLHTTP")

GetConnection.Open "get", GotothisURL, False
on error resume next
GetConnection.Send

output = GetConnection.responseText

response.write(output)
Set GetConnection = Nothing
%>

To stop other sites from doing this put this script at the top of your page:

<%
dim ref
ref=request.serverVariables("HTTP_REFERER")

if not ref="The page you want to be able to do this e.g.http://isp.com/delete.asp" Then
response.end
End If
%>

That would send a blank page to other sites/scripts that tried to use this method.

P.s Micorosoft http xml lets the server process the asp script before so it will allow you to Query and perform simple changes.

Martin.