Search code examples
c#mysql.netwinformsdecompiler

How to make safe connection with C# to a MySQL without showing any info when decompiling

So I have ran into huge problem. So the problem is following, when I compile my C# project, that contains a function to connect to a MySQL server, my string for connection is visible when decompiling my project with ILSpy.

My function goes like this 

void ConnectToDatabase()
{
    string myConnectionString;
    myConnectionString = "Server=sql7.freemysqlhosting.net;UID==**********;Pwd==**********;Database=**********;";

    try
    {
        conn = new MySql.Data.MySqlClient.MySqlConnection(myConnectionString);
        secondconn = new MySql.Data.MySqlClient.MySqlConnection(myConnectionString);
        secondconn.Open();
        secondconn.ChangeDatabase("information_schema");

        conn.Open();
        ConnectionEstablished(true);
    }

But this is the problem enter image description here

Is there any work around for this? Even if I went trough server side connection to check things for MySQL, how could I connect without spitting out my info.

Thanks.

Solution

  • You could use a webservice to provide a config file or a connection string to a trusted machine on rogram startup. You could then either prompt the User for user credentials to the Webservice or use a certificate. This way the actual Database Password is not "stored" on the User Machine and you could ban Machines/Users/Certificates centrally. Please beware the usual webservice security measures apply (Use HTTPs, Use Strong Crypto, Do not self rolled crypto, Use Session etc)