Print Page | Close Window

Security

Printed From: Web Wiz Forums
Category: Web Wiz Web App Support Forums
Forum Name: Web Wiz Forums
Forum Description: Support forum for Web Wiz Forums application.
URL: https://forums.webwiz.net/forum_posts.asp?TID=337
Printed Date: 29 March 2026 at 12:27am
Software Version: Web Wiz Forums 12.08 - https://www.webwizforums.com


Topic: Security
Posted By: glumbert
Subject: Security
Date Posted: 20 February 2003 at 2:09am

I would just like to warn everyone that if you are using a DSN-less connection, your forum can easily be hacked. If the database is stored in a folder accessible to the web, then the database can be downloaded, and your passwords etc. changed. It happened to my site today. If you can, use a DSN connection with the database stored in a folder which cannot be accessed from the web. Also, the hacker found my forum via google using the search phrase 'web wiz forum' and I noticed that a number of other people were hacked as well.



-------------
glumbert.com



Replies:
Posted By: trendecide
Date Posted: 20 February 2003 at 5:09am

This isn't good.  Thanks for the warning.  Good thing I'm on SQL server 2000 instead of Access.  DSN isn't much slower than DSN-less unless you have lots of simultaneous users... which you should move to a SQL database if that's the case.  Glumbert is right.

Wear a condom... USE DSN!!  Safety First!



-------------
Love, Peace and Chicken Grease!


Posted By: WebWiz-Bruce
Date Posted: 20 February 2003 at 6:50am

You don't need to use a DSN connection.

If you had read the documentation that came with the forum you will have found that this issue is covered.

It is strongly suggestested that you rename the database and move it to a folder that is not accessible through a web browser. For this you don't need to use a DSN connection, a DSN-less connection can be used and all you have to do is change the path in the common.asp files to where the database is located.

If people where to read the documentation then these things wouldn't happen!!!!

Also as many of you don't, version 7 addresses this issue by one-way encrypting all passwords, so it doesn't matter if someone downloads the database, they can't get the passwords.



-------------
https://www.webwiz.net/web-wiz-forums/forum-hosting.htm" rel="nofollow - Web Wiz Forums Hosting
https://www.webwiz.net/web-hosting/windows-web-hosting.htm" rel="nofollow - ASP.NET Web Hosting



Print Page | Close Window

Forum Software by Web Wiz Forums® version 12.08 - https://www.webwizforums.com
Copyright ©2001-2026 Web Wiz Ltd. - https://www.webwiz.net