include files not safe? 2

[stranger123]

Hello,

Say, an include file connection.inc has got something like
"provider=microsoft.jet.oledb.4.0; data source=......;Jet OLEDBatabase Password=......"
If somebody type

http://www.....com/connection.inc

he will know the secrete (if he can guess the include file name)!

Any idea?

 

[trollacious]

If you use an .asp extension for your include files, the script will be processed on the server before anything is sent, and any guessed file names won't provide sensitive data.


Lee

 

[stranger123]

Thank you. That is a good idea.
Do you think it is the same idea to use .asp for the .mdb file?

 

[DotNetGnat]

thats why it is not a good idea to keep any supporting files in the

http://wwwroot

folder...create a new folder and put all your files there...you can still access them in your code but the outsider has no access to them...

-DNG

 

[stranger123]

DotNetGnat,

Are you sure? I have just texted I can access an .asp in the sub-folder by typing the address in the browser.

 

[DotNetGnat]

what i meant is this...

lets say i have file called dbconn.inc with all the connections string that include username and password information...

now if i place this file in the inetpub/

http://wwwroot

folder...

anyone can type it like...

http://myservername/dbconn.inc

and can see the details...

but lets say i have created a new folder myfiles and put the file there...

now the path would be

inetpub/myfiles/dbconn.inc

so as you can see no outsider can ever reach this folder...they just cant type

http://myservername/...

hope you got the point...

-DNG

 

[stranger123]

I see what you mean now. Thanks a lot.

 

[DotNetGnat]

no problem...glad to help

-DNG

 

[travisbrown]

Do you think it is the same idea to use .asp for the .mdb file?

You can rename the extension on Access files with .asp for some of the Access drivers. I don't think it works for the Jet driver, though. I might be wrong; it's beena while since I've done this.

What DGN suggests, putting the the mdb and .inc in a folder outside the virtual folder, is the general practice.

 

[stranger123]

Thank you for all your suggestions. I am thinking move all files to the folder outside the vertual folder.....See my new post