Hello All,

Have a bit of a tricky one here, and wondering if anyone could help me out.  The problem involves allowing my ISP hosted ASP 3.0 pages to access and internal SQL server database.  Does anyone know how this can best (if at all) be done?

From wat we have come up with, there are two possible solutions:

1. Configure our firewall so that only our ISP can get through on SQL port to query, but that does not provide enough security as SQL level access will send passwords in clear text (not acceptable for required security level), and this may at the same time expose our production database.
2. Create some kind of Web service (an ASP page) that locally queries the database, and have our external ASP page query the internal page (is this even possible?).  This would allow for the only opening up ports from our ISPs IP to our webserver for HTTP traffic. (Again, hosting the actual external page ourselves is not an option due to bandwidth considerations).

The second idea seems preferable, but i have no idea how i'd go about it.  Any ideas?  Any help or advice on either of the above two options (or in general) would be greatly appreciated, as i know it would be very difficult to not know more than i do!!

Many Thanks,
Steve

Does anyone have any ideas?  Help me pleeeeaasssee!!!

Steve

microsoft http xml can open up pages on remote servers and get the output page into a variable:

<%
GotothisURL = "The url to go to"

Set GetConnection = CreateObject("Microsoft.XMLHTTP")

GetConnection.Open "get", GotothisURL, False
on error resume next
GetConnection.Send

output = GetConnection.responseText

response.write(output)
Set GetConnection = Nothing
%>

Thanks Mart,

That is definitely a good start.  Im not 100% sure i have my brain around it, thats all.  Does such a method allow me to both Query and perform simple changes on an SQL database?  Also, is there anyway to secure this to stop anyone from connecting to our server and running these pages, etc?  Does this mean that actual access of database along with the user interaction, etc, is performed on an internal page, and the external page just acts as a container or shell? Finally, does this mean that all functionality is restricted to that contained in the internal page, or can the external page also host interactive functionality?

Many thanks to anyone with more help,

Regards,
Steve

That would make the external page connect to the internal page and run it. you could give it some functionality using the querystring:

<%
GotothisURL = "http://host.com/deletefromdb.asp?ID=" & request.querystring("ID")

Set GetConnection = CreateObject("Microsoft.XMLHTTP")

GetConnection.Open "get", GotothisURL, False
on error resume next
GetConnection.Send

output = GetConnection.responseText

response.write(output)
Set GetConnection = Nothing
%>

To stop other sites from doing this put this script at the top of your page:

<%
dim ref
ref=request.serverVariables("HTTP_REFERER")

if not ref="The page you want to be able to do this e.g.http://isp.com/delete.asp" Then
response.end
End If
%>

That would send a blank page to other sites/scripts that tried to use this method.

P.s Micorosoft http xml lets the server process the asp script before so it will allow you to Query and perform simple changes.

Martin.