Hi there, I have a website connected to a MS SQL database via ASP connection strings.

 

I want the general public to be able to view the data pulled out from the database and displyed on the website whilst also allowing the site owner to be allowed to edit the inventory in a

 

domain.com/admin/ folder.

 

What permssions and roles do I need to allow.

 

I have created two users in my hosts control panel

 

usera and userb

 

I want usera to only be able to view the website (not edit/delete etc.)

 

and userb to be able to have full admin rights.

 

As it stands both have db_owner privilleges.

 

Do I keep userb on this but amend usera to be just db_datareader and nothing more?

 

In my code I would then link to two different connection paths (one for live site, one for /admin)

 

Any help most welcome, am usually used to just MS Access databasses

Anybody?

Hi Webchap, if usera is the general public/surfers then you dont set anything up in the cpanel - they dont need it.

There are a couple of ways to achieve what you want,

1/ Apache - setting up in cpanel a members/admin area using htaccess passwords

2/ Use the database to store username, password and auth levels of administrators.

 

Either way will work but for me the database is the more logical and easier to manage (in my opinion!)

 

Is that what you are aiming for or have I misinterpretted you?!

Hi Webchap, if usera is the general public/surfers then you dont set anything up in the cpanel - they dont need it.

There are a couple of ways to achieve what you want,

1/ Apache - setting up in cpanel a members/admin area using htaccess passwords

2/ Use the database to store username, password and auth levels of administrators.

 

Either way will work but for me the database is the more logical and easier to manage (in my opinion!)

 

Is that what you are aiming for or have I misinterpretted you?!

 

Thanks for the reply. Yes there is already a users table in the database and in the /admin area the first page they come to is a login page. The username and password are entered and they can then enter the admin area and update the site.

 

I once had an SQL Injection attack on a site though so instead of having one connection string for the whole site (surfers and admins) I created two database users. Just wanted to make sure I was doing it right.

That seems a more than logical idea