Nine methods to prevent mdb database downloads

First Article: It turns out that changing MDB to ASP can prevent download. Download the data. asp file using flashget and save it as the data. MDB file. You can find that the file is intact with access!

1. Use your imagination to modify the database file name
However, If attackers obtain the database path through a third-party channel, they can download the database. Therefore, the confidentiality is the lowest.

2. Change the database name suffix to Asa, ASP, etc.
This method must be used with some settings. Otherwise, the situation at the beginning of this article will appear.
(1) Add binary fields.
(2) If you add <% or %> to this file, IIS will parse the file according to the ASP syntax, and then reports the 500 error, which cannot be downloaded. However, it is useless to simply add <% in the text or remarks field of the database, because access will process the content, it will exist in the database in the form of <%, invalid! The correct method is to store <% Into the OLE object field, so that our goal can be achieved.
Method:
First, use NotePad to create a text file whose content is <%.
Next, use access to open your database file, create a new table, create a name, add an OLE object field to the table, add a record, and insert the text file created earlier, if the operation is correct, you can see a new record named "data packet. You can.

3. Add "#" before the Database Name
You only need to add # To the front Name of the database file, and then modify the database address in the database connection file (such as Conn. asp. The principle is to download the part can only recognize # before the first name, for the next automatic removal, such as you want to download: http://www.pcdigest.com/date/#123.mdb (if there is ). Both IE and flashget are http://www.test.com/date/index.htm (index. asp, default. jsp, etc. You are on the IIS settings of the home page Documentation)
In addition, some spaces in the database file name also play a similar role, because of the special nature of the HTTP protocol for address resolution, space will be encoded as "%", such as http://www.test.com/date/123; 456.mdb, download http://www.test.com/date/123 % 456.mdb. Our directory does not have the 123% 456. MDB file at all, so the download is also invalid. After such a modification, even if you expose the database address, it is generally impossible for others to download it!

4. Encrypted Database
First, choose tools> Security> encryption/Decryption database, and select the database (for example, employer. MDB), and then click OK. Then, the window "Save the database encrypted and saved as: employer1.mdb" appears. Then employer. MDB will be encoded and stored as employer1.mdb .. note that the above actions are not to set a password for the database, but to encode the database files to prevent others from using other tools to view the contents of the database files.
Next, we encrypt the database. First, we open the encoded employer1.mdb, and select the "exclusive" mode when opening it. Choose tools> Security> set database password from the menu, and enter the password. In this way, even if someone else gets the employee 1.mdb file, he cannot see the employee 1.mdb without a password.
After encryption, modify the database connection page, for example:
Conn. Open "driver = {Microsoft Access Driver (*. mdb)}; uid = admin; Pwd = Database Password; DBQ = database path"
After this modification, even if the database is downloaded, it cannot be opened by others (provided that the password on your database connection page is not leaked)
However, it is worth noting that the encryption mechanism of the Access database is relatively simple, and it is easy to decrypt even if a password is set. The database system creates an encryption string and stores the password entered by the user in *. the MDB file starts from the address "& h42. Therefore, a good programmer can easily create dozens of rows of small programs to easily obtain the password of any access database. Therefore, as long as the database is downloaded, its information security remains unknown.

5. Store the database outside the web directory or store the database connection file in another virtual directory.
If your web directory is E:/webroot, you can put the database in the E:/data folder and modify the database connection address: ".. /data/Database Name ", so that the database can be called normally, but cannot be downloaded, because it is not in the web directory! This method is generally not suitable for users who buy virtual space.

6. Use the ODBC data source.
In programming such as ASP, if conditions are met, try to use the ODBC Data Source. Do not write the database name in the program. Otherwise, the database name will be lost along with the password of the ASP source code. For example: dbpath = server. mappath (".. /123/ABC/asfadf. mdb ")
Conn. Open "driver = {Microsoft Access Driver (*. mdb)}; DBQ =" & dbpath
It can be seen that even if the database name gets weird, the hidden directory goes deeper, and the ASP source code is easily downloaded after the password is lost. If you use an ODBC data source, you will not have this problem: Conn. open "ODBC-DSN name", but this is more annoying, if the directory is moved, you have to re-set the data source, more convenient way please see the 7, 8 method!

7. Add the extended MDB ing of database names such as MDB
This method is implemented by modifying the IIS settings. This method is suitable for friends who have control over IIS and is not suitable for users who buy virtual hosts (unless the Administrator has already set it ). I think this method is the best at present. The database of the entire site can be modified to prevent downloading. You do not need to modify the code to prevent download even if the target address is exposed.
In IIS properties --- main directory --- configuration --- ing --- application extension, add the application parsing of the. MDB file. Note that the selected DLL (or EXE) here does not seem arbitrary. If you choose improperly, the MDB file can still be downloaded. You are advised not to select ASP. dll. You can perform multiple tests on your own.
Download the database, such as the http://www.test.com/data/dvbbs6.mdb, after this modification. (404 or 500 errors)

8: advantages of using. net
The wooden bird on the Internet wrote a "WBAl anti-leech tool" to prevent illegal file downloads ". Specific can login http://www.9seek.com/WBAL;
However, it only prevents non-local downloads and does not provide a real anti-download function. However, this method is almost the same as Method 5. You can modify the. NET file to achieve local download!

Only 7th and 8 of these methods are uniformly modified. After a configuration is modified, the database of the entire site can be prevented from being downloaded. The other methods need to modify the Database Name and connection file respectively, it is troublesome, but this is also the only option for virtual host friends!

In fact, 6th methods should be extended by 5th methods, which can implement special functions, but are not supported. net host or for fear of setup troubles, we still use the 5th method directly. By default, the 6th methods can still be copied and connected to the same host's forum or message book for publishing, then you can click Download (because the reference page is from the same host)

9. use NTFS partition File Permission settings (by percyboy)
We already know that ASP. NET uses ADO. Net to access the database and can access the ACCESS database through the oledb connection-one of our very common low-end databases. This article discusses several error prompts that may be seen in ASP. NET, from which you can see database files created by Access 2000 and Access XP. Different error prompts will appear when access errors occur. Hope to help you. Another key point is to use this article to give you a new understanding of the NTFS permission settings for Access database files in ASP. NET.