| Another article from csdn Article Database security is the biggest headache for people playing on websites. Let's take a look at this article. See if it is useful to you !~~ I have read it! Today, I see the ACCESS database security Article again. Every time I see this article, I want to say the last two sentences. There are several popular sayings:
I. Cryptographic
Give the database a random and complex name to avoid being guessed to be downloaded. This method is very popular in the past, because everyone has their own Code Very confident. However, with the error message indicating that the database address is leaked, the database is illegally downloaded. This method is used by fewer and fewer users.
Ii. "#" Type
Add the # sign to the database name. When a request is sent from a URL, # Is a separator between the request address and the request parameter. If the database name is known, the request is directly sent, for example: bytes. You can also download it directly if you use a download tool such as flashget.
Iii. asp
This is a professional but safe practice. It is also a popular practice. However, many people only make half of the work, but change the data name to ASP, in this case, you can directly download the database using a download tool such as flashget. The correct method is as follows:
Step 1: create a field in the database with random names. The type is OLE object, and the content is set to single-byte "<% ", (ASP code chrb (ASC ("<") & chrb (ASC ("%") running result)
Step 2: Change the database name to ASP
In this way, if you directly request the database from the URL, the system will prompt "the script separator is missing", and the download is denied, because this method is troublesome, I found a small piece of code on the Internet to complete the OLE object insertion, as long as the database name is set, then you can run it in the same directory as the database.
Full code:
<%
DB = "D. mdb" "changed here to your database address
Set conn = server. Createobject ("ADODB. Connection ")
Connstr = "provider = Microsoft. Jet. oledb.4.0; Data Source =" & server. mappath (db)
Conn. Open connstr
Conn.exe cute ("create table notdownload (notdown oleobject )")
Set rs = server. Createobject ("ADODB. recordset ")
SQL = "select * From notdownload"
Rs. Open SQL, Conn, 1, 3
Rs. addnew
RS ("notdown"). AppendChunk (chrb (ASC ("<") & chrb (ASC ("% ")))
Rs. Update
Rs. Close
Set rs = nothing
Conn. Close
Set conn = nothing
%>
After this code is run, a nodownload table is generated in the database, and the field in the table is notdown. If a data table with the same name already exists in the Database, change nodownload in the Code to the name you want.
Iv. Asa type
The true meaning of this method is to use IIS to protect the ASA file, so that the database file cannot be directly downloaded from the URL, but this method is misunderstood as long as the file suffix is changed to Asa. You must know that IIS only applies to global. the ASA file name is protected by requests. Therefore, this method can only set the database name to global. and set it to global. it is better not to place the ASA in the root directory of the host or virtual directory, otherwise it will be normally global by IIS. asa file. The third and fourth types are relatively secure. The database cannot be downloaded unless IIS has a vulnerability in viewing ASP or asa source code. |
