thanks so much for the info! and i understand about the average joe, thats totally cool i'm actually server administrator but dont do ANY sort of programming, know a little about sql administration, and still learning. so this information was definitely helpfull.

i actually had done just about everything you mentioned above EXCEPT the odbc connector on the server running the php script. i created the sql user with dataread access and used sql authentication on odbc and that seemed to push through! is there any other read or view only access i can use for this new user?

everything seems to be working so far, my manager is just touching up the script now to pull certain data from sql. we took the route of your step # 2 above and that seemed to be good. now one more question though, how can we authenticate the user whos accessing the web page? we dont want to use windows authentication because theyd have to be a member of our domain and if we want clients accessing outside, that wont work. if you have any info on this, that would be appreciated.....

thanks very much for your help though!!