Eight ways to prevent a database from being downloaded

Data | database | download

The methods provided below apply to users who use virtual host space and to users with IIS control!

　　 One: The purchase of virtual host space, suitable for no IIS control

1: Play Your imagination modify the database file name
This is the most basic. I don't think there are many people who don't bother to change their database file names right now. As for what to change into, you look at it, at least to ensure that the file name is complex, not speculative. Of course this time your database is located in the directory is not open Directory browsing permissions!

2: Database name suffix to ASA, ASP, etc.
This heard is very popular, but I tested many times, found that is not ideal, if you really want to play to prevent the role of download, to do some of the 2 into the field to add settings,---Word, complex and complicated (if you have a lot of database, this method is not very good)

3: Database name before adding "#"
Just add the first name of the database file to the #, and then modify the database address in the database connection file (such as conn.asp). The principle is to download the time can only identify #号前名的部分, for the back of the automatic removal, such as you want to download: http://www.pcdigest.com/date/(assuming existence). Whether it is IE or flashget and so on are http://www.pcdigest.com/date/index.htm (index.asp, default.jsp, etc. you set up in the IIS homepage document)

Additionally, preserving some spaces in the database file name also plays a similar role, because the HTTP protocol is specific to address resolution, and the space is encoded as "%", such as http://www.pcdigest.com/date/123 456.mdb, when downloaded http:// Www.pcdigest.com/date/123%456.mdb. And our directory is not 123%456.mdb this file, so the download is invalid such modifications, even if you expose the database address, under normal circumstances, others are also unable to download!

4: Encrypted database
Use Access to open your database in exclusive mode, after the tool-security-set database password, and then modify the database Connection page after encryption, such as:
Conn.Open "Driver={microsoft access Driver (*.mdb)};uid=admin;pwd= database password; dbq= database path
After this modification, the database cannot be opened even if it is downloaded (provided that the password on your database connection page is not compromised)
But it is noteworthy that Because the encryption mechanism of an Access database is relatively simple, decryption is easy even if a password is set. The database system forms an encrypted string by "XOR" the password entered by the user with a fixed key and stores it in the area where the *.mdb file starts at the address "&h42". So a good programmer can easily make a dozens of-line applet to get the password of any Access database easily. Therefore, as long as the database is downloaded, its information security is still unknown.

　　Second: Host control (of course, the setting of the virtual space can still be used here)

5: The database is placed outside the web directory
If your web directory is e:\webroot, you can put the database into the E:\data folder, in the E:\webroot database Connection page to modify the database connection address is: ". /data/database name ", so that the database can be called normally, but cannot be downloaded because it is not in the Web directory! This method is generally not suitable for users who buy virtual space.

6: Using an ODBC data source
In the ASP and other program design, if there is a condition, should try to use ODBC data source, do not write the database name in the program, otherwise, the database name with the ASP source code with the Official secrets of the Official secrets, such as: DBPath = Server.MapPath (". /123/abc/asfadf.mdb ")
Conn.Open "Driver={microsoft Access driver (*.mdb)};d bq=" & DBPath
Visible, even if the database name is strange, hidden directory again deep, the ASP source code compromised, also very easy to download down. If you use an ODBC data source, there will not be such a problem: Conn.Open "odbc-dsn name", but this is more annoying, the directory to move and then reset the data source, more convenient way to see the 7th, 8 law!

7: Extended mappings for database names such as MDB
This method is implemented by modifying the IIS settings, and is suitable for friends with IIS control and is not suitable for buying virtual host users (unless the administrator has already set them up). I think this method is the best at present. As long as you modify one place, the entire site's database can be prevented from being downloaded. No need to modify the code, even exposing the destination address can prevent downloads, such as diagram settings:

We add the application resolution of the. mdb file in the IIS properties---home directory---configuration---mapping---application extensions. Note that the selection of the DLL (or EXE, etc.) does not seem to be arbitrary, the choice of improper, this MDB file can still be downloaded, note that it is best not to choose Asp.dll. You can test it yourself.
After this modification, download the database such as: Http://192.168.1.5/HaoBbs/data/dvbbs6.mdb. Appears (404 or 500 Errors)

8: Use. NET's advantages
The wooden bird on the net has written a "Wbal anti-theft chain tool" to prevent illegal downloading of files. Concrete can be landed http://www.9seek.com/WBAL/;
But that only implemented to prevent non-local downloads, did not play a real download database functionality. But this method has been similar to the 5 law can be modified. NET files, to achieve local also can not download!

These methods, only the 7th and 8 are unified change, once modified configuration, the entire site of the database can be prevented from downloading, the other several to modify the database name and connection files, more trouble, but for the virtual host of friends can only be so!

In fact, the 6th method should be the 5th extension of the method, you can achieve special functions, But not for support. NET host or afraid of setting trouble, or directly using the 5th method, and by default, the 6th method, still can be connected to the same host by copying the forum or message published, and then you can click to download (because such a reference page is from the same host)

Each of these methods has its own length, please use it selectively. These methods are not absolute security, but also require webmasters to pay attention to the security of some systems, as well as write asp/asp.net/jsp code itself security, otherwise it is still possible to download or modify the database!