javelin
12-09-2002, 07:05 PM
OK, I have an access DB that I need people to be able to update through a website. How do I do this securely? If I give the anonymous web user write access to this folder wouldn't it be vulnerable? The db is updated through an asp page. Any help would be appreciated, thanks in advance.
Wolfy
12-09-2002, 10:03 PM
If you need a database to be updated from a webpage, then the Anonymous user is going to need write access to the database, yes it is a security risk, but it cannot be avoided.
A few steps you can take to secure it a little more, include;
Locating the database in another directory out of or 'above' the www root to make it harder to 'find'.
Accessing the database through an ODBC connection, with a password is another option.
Only assign the write permission to the individual database file, not the entire directory.
An Access database is a cheap and easy solution, but it's not always the best or most secure. ;)
RackMy.com
12-10-2002, 12:36 AM
You can also password protect the DB, that helps.
javelin
12-10-2002, 10:47 AM
Thanks a lot for your suggestions, I appreciate the responses.