Prevent Access database download in asp.net

How to prevent Access database downloading is a very old topic, and there are many discussions on the Internet. Here we give several methods to prevent the Access database from being downloaded under ASP.NET.

We assume here that the Access database name is test.mdb.

1. Place the database outside the WEB directory

If your website directory is D:www, you can put the database in the folder D:data, and then modify the database connection string address in the website program to : "D:datatest.mdb", so that the database can be called normally, but it cannot be downloaded because it is not in the website directory.

Assume that the database connection string is configured in web.config. For example:

 <connectionStrings>
        <add name="Access" connectionString="Provider=Microsoft.Jet.OLEDB.4.0;data source=d:\data\test.mdb" providerName="System.Data.OleDb" />
    </connectionStrings>

2. Place the database under the App_Data system folder

Starting from .Net2.0, there is an App_Data directory to specifically store data files. It can be used to store Access, SQL Server Express, XML and other data files. The advantage of placing the database file in the App_Data folder is that it can prevent it from being downloaded. For the file location of the connection string database, you can use the DataDirectory key to represent its physical path, so that you no longer need to use Server.MapPath() conversion when obtaining the connection string.

Assume that the database connection string is configured in web.config. For example:

 <connectionStrings>
        <add name="Access" connectionString="Provider=Microsoft.Jet.OLEDB.4.0;data source=|DataDirectory|test.mdb" providerName="System.Data.OleDb" />
    </connectionStrings>

|DataDirectory| represents the app_data folder.

3. Rename the database file

Rename your Access *.asax: Because in the processing mechanism of ASP.NET, by default, such a request is directly rejected. Following this idea, you can also rename Access to *.config, *.vb, *.cs, etc.

4. Configure IIS and add .mdb file type mapping

Add .mdb extension mapping. This method is achieved by modifying IIS settings. Just 2 steps.

1. Configure IIS to map the .mdb file type to ASP.NET ISAPI.

Taking Windows 2003 as an example, click "Start" -> Run -> Enter "inetmgr" and press Enter to open the "Internet Service Manager". Right-click on a website -> click "Properties" to pop up the properties dialog box of this site. Click the "Home Directory" tab and click the "Configure" button, the "Application Configuration" dialog box will be displayed. Click "Add" to add a mapping. A dialog box will be displayed, asking you to enter the executable file: "C:WINDOWS Microsoft.NET Framework v2.0.50727 aspnet_isapi.dll"; enter the extension: ".mdb". As shown in the figure below

2. Configure the web.config file of asp.net and map the .mdb file type to the HttpForbiddenHandler HTTP handler.

Enable asp.net application .mdb file type to be mapped to HttpForbiddenHandler HTTP handle. In order to achieve this step, the following configuration must be added to the Web.config file

 <httpHandlers>
            <add verb="*" path="*.mdb" type="System.Web.HttpForbiddenHandler" />
   </httpHandlers>

5. Add the ACCESS anti-download field

The principle of this method is: change the extension of the database to .aspx format, and access it remotely When this file is entered, the IIS server will execute it as an aspx program. We previously inserted the "" tag. can be executed, so a 500 error of "missing script closing tag" will appear, and others will not be able to download the ACCESS database. It is useless to simply add "

1. First create a table and enter the following content in the SQL command window: "create table [notdown]([notdown] oleobject)"

Then click "!" (Run) in the toolbar, like this , a "notdown" table will be created in the current database, with the field name "notdown" and the field type "OLE object". As shown in Figure 1

2. Change the content in the SQL query window to the following command: "insert into [notdown](notdown) values ​​(0x3C25)"

This sentence means to "insert into [notdown](notdown) values ​​(0x3C25)"

Insert "0x3C25" data into the "notdown" field ("0x3C25" is the hexadecimal notation of the character "

After the execution is completed, check the "table" in the database again, and you will find that there is an additional "notdown" table. After opening, the field displays "long binary data" as shown in Figure 3

🎜🎜

admin10000.com The anti-download data table notdown has been prepared here. You can directly download and paste it into your own database for use. notdown data table

Tip 1: Whether it is an ASP website or an ASP.NET website, if you directly change the Access database suffix to .asp and .aspx, you can use download tools such as FlashGet to copy it correctly, and it will not prevent downloads. effect.
Tips 2: The fifth method is usually used in ASP+ACCESS websites.