I have a java servlet that connects to a MySQL database. My problem is that i'm concerned about my password being hacked and people can login to my SQL server and start playing with my DB. Right now I have my user/pass hardcoded in the java file. even though that gets compiled into a class file - i'm concerned that the class file can be downloaded and decompiled. Is there a better/more secure way to do this? thanks

As long as tomcat is set up correctly, servlets cant be downloaded. Usually, usernames and passwords are stored in a properties file.. because its easier to maintain.

like gpp said, if u set tomcat up corretcly..u'll be ok. also, if you are afraid of your password being snoopedo ut, u should be using the SSL sockets in tomcat https, instead of http,when logging in, that will encrypt your user/pass so even if someoen does sniff it out, they'll get encryption instead of passwords. On a side note, think about using property sheets instead of hardcoding your user/pass.