Improving Web Application Security: Threats and - CGISecurity

Chapter 14: Building Secure Data Access 389Exception ManagementException conditions can be caused by configuration errors, bugs in your code, ormalicious input. Without proper exception management, these conditions can revealsensitive information about the location and nature of your data source in addition tovaluable connection details. The following recommendations apply to data accesscode:● Trap and log ADO.NET exceptions.●●Ensure database connections are always closed.Use a generic error page in your ASP.NET applications.Trap and Log ADO.NET ExceptionsPlace data access code within a try / catch block and handle exceptions. When youwrite ADO.NET data access code, the type of exception generated by ADO.NETdepends on the data provider. For example:● The SQL Server .NET Framework data provider generates SqlExceptions.●●The OLE DB .NET Framework data provider generates OleDbExceptions.The ODBC .NET Framework data provider generates OdbcExceptions.Trapping ExceptionsThe following code uses the SQL Server .NET Framework data provider and showshow you should catch exceptions of type SqlException.try{// Data access code}catch (SqlException sqlex) // more specific{}catch (Exception ex) // less specific{}