Asp. NET Web site How to prevent Access databases from being downloaded

How to prevent Access database downloads is a very old topic, online discussion is also more. Here are some ways to prevent Access databases from being downloaded under asp.net.

Here we assume that the Access database name is Test.mdb.

1, put the database outside the Web directory

If your site directory is d:www, you can put the database into the D:data folder, and then modify the Web site program in the database connection string address section is: "D:datatest.mdb", so that the database can be called normally, but cannot download, because it is not in the site directory.

Suppose you configure the database connection string in Web.config. For example:

2, put the database under the App_Data system folder

Starting with the. Net2.0, there is a App_Data directory dedicated to storing data files, which can be used to put Access,sql Server Express, XML and other data files. The advantage of putting a database file in the App_Data folder is to prevent it from being downloaded. The file location of the connection string database can use the DataDirectory key to represent its physical path, thus eliminating the need to use Server.MapPath () conversion when fetching the connection string.

Suppose you configure the database connection string in Web.config. For example:

| Datadirectory| is the representative App_Data folder.

3. Renaming database files

Rename your Access *.asax: Because of the asp.net processing mechanism, the request is rejected directly by default. In this way, you can also rename Access to *.config,*.vb, *.cs, and so on.

4, configure IIS, Add. mdb file type mappings

The way to add an extension map of. mdb is by modifying the IIS settings. Just 2 steps.

1. Configure IIS to map the. mdb file type to the ASP.net ISAPI.

For example, in Windows 2003, click "Start"-"Run-" to enter "Inetmgr" and open Internet Services Manager. Right-click on a Web site-click Properties to eject the site's Properties dialog box. Clicking on the Home Directory tab and clicking on the "Configure" button will display the Application Configuration dialog box. Clicking Add adds a mapping, and a dialog box is displayed to enter the executable file: "c:windows microsoft.net Framework v2.0.50727 aspnet_isapi.dll", and enter the extension: ". mdb". As shown in the following figure

2. Configure the asp.net web.config file to map the. mdb file type to the HttpForbiddenHandler HTTP handler.

Maps the asp.net application. mdb file type to the HttpForbiddenHandler HTTP handle. In order to achieve this step, the following configuration must be added to the Web.config file

5. Add Access anti-download fields

The principle of the method is: When you change the database extension to. aspx format, the IIS server takes it as an ASPX program when you remotely access the file, and we previously inserted the tag in the Access database to execute, so the missing script close tag appears. 500 errors, others will not be able to download the Access database. If you are simply adding to the text or Memo field in the database