Re: how to hide oracle instance name within dbi code??

2006-04-13 Thread Luke Bakken
We have a requirement here that we can't hard code any oracle database instance name for security reasons. Is there any way we can pass the connection string (for example, the oracle tnsname alias), or put the instance name in a configuration file and somehow pass the information from the

RE: how to hide oracle instance name within dbi code??

2006-04-13 Thread Kong, Alan
Create your own module as exporter, db.pm for example, like something below. Place the file in any location specified in @INC, then call it in the perl program use db;. package db; BEGIN { use Exporter(); @ISA = qw(Exporter); @EXPORT = qw( $oUser $oPass $oString); }

Re: how to hide oracle instance name within dbi code??

2006-04-13 Thread Alexander Foken
If the public can see your code, they also can see where the configuration file is stored and how it is parsed. Nothing gained if they have read access to the configuration file. Think about using DBD::Proxy to connect to a proxy server running on a separate, well protected machine that

Re: how to hide oracle instance name within dbi code??

2006-04-13 Thread Alexander Foken
On 13.04.2006 16:42, Luke Bakken wrote: How can you do that in other languages? Good question. If you have strings in the executable file, they can be discovered. They could be encrypted, using something trivial like rot13 or xor, or even good encryption algortihms like 3DES, blowfish,

Re: how to hide oracle instance name within dbi code??

2006-04-13 Thread Peter J. Holzer
On 2006-04-13 09:59:02 -0400, Linda Ding wrote: We have a requirement here that we can't hard code any oracle database instance name for security reasons. [...] my $dbh = DBI-connect( 'dbi:Oracle:orcl', 'jeffrey', 'jeffspassword',

Re: how to hide oracle instance name within dbi code??

2006-04-13 Thread Peter J. Holzer
On 2006-04-13 17:01:25 +0200, Alexander Foken wrote: On 13.04.2006 16:42, Luke Bakken wrote: If you have strings in the executable file, they can be discovered. They could be encrypted, using something trivial like rot13 or xor, or even good encryption algortihms like 3DES, blowfish, etc.,

Re: how to hide oracle instance name within dbi code??

2006-04-13 Thread Ron Savage
On Thu, 13 Apr 2006 17:46:00 +0200, Peter J. Holzer wrote: Hi Peter $store-init(credential_file = '/var/lib/www/offline/webmail/dbi/connect_data'); And if for some reason you put the config file in a directory from which the client can run scripts, i.e. alongside *.cgi, you can call the file