Last updated: August 25, 2026.
Classic ASP applications normally connect to SQL Server through ADO. Use a supported SQL Server driver, enable encryption, and keep credentials outside files that can be downloaded or committed to source control.
OLE DB connection with SQL authentication
<%
Dim connectionString, conn
connectionString = _
"Provider=MSOLEDBSQL;" & _
"Server=tcp:sql01.example.com,1433;" & _
"Database=ApplicationDb;" & _
"UID=app_user;PWD=replace_with_secret;" & _
"Encrypt=Mandatory;TrustServerCertificate=No;"
Set conn = Server.CreateObject("ADODB.Connection")
conn.Open connectionString
%>Windows authentication
connectionString = _
"Provider=MSOLEDBSQL;" & _
"Server=sql01.example.com;" & _
"Database=ApplicationDb;" & _
"Integrated Security=SSPI;" & _
"Encrypt=Mandatory;TrustServerCertificate=No;"The IIS application-pool identity must have permission to connect to SQL Server. This avoids storing a database password in the ASP application.
ODBC Driver 18 connection
connectionString = _
"Driver={ODBC Driver 18 for SQL Server};" & _
"Server=tcp:sql01.example.com,1433;" & _
"Database=ApplicationDb;" & _
"Uid=app_user;Pwd=replace_with_secret;" & _
"Encrypt=yes;TrustServerCertificate=no;"Connection checklist
- Install the selected driver on the IIS server and match its 32-bit or 64-bit architecture to the application pool.
- Use a dedicated login with only the permissions the application needs.
- Use a certificate trusted by the web server; do not disable certificate validation in production.
- Open the SQL Server port only between required hosts.
- Use parameterized
ADODB.Commandobjects for values supplied by users.
Microsoft lists the available keywords in its OLE DB Driver connection-string reference.
Building a database-backed web application? PHPRunner can generate secure data-entry and reporting pages for SQL Server and other databases.