Move whole site to a new folder

[stranger123]

Hi,

For example, I have put index.asp and all my files in

http://127.0.0.1/MySite/,

that is in
D:\Inetpub\

http://wwwroot\MySite\

Now, I am thinking to create a new folder
D:\Inetpub\

http://wwwroot\Secrete\

and cut-paste index.asp and all my files into the new folder. In the old folder, I am going to create some shadow files with the same names pointing to corresponding files in the new folder. For example, in the old folder, I will have index.asp with only one line
<!--#include file="<%=server.MapPath("..\Secrete\" & Request.servervariables("SCRIPT_NAME"))%>"-->

In this way, the users still come into the older folder but all and real files in the new folder.

Do you think the idea is OK? Is there anything wrong? Any suggestion?

Thank you in advance.

 

[Sheco]

The #INCLUDE directive is processed before any ASP logic so you can not use Server.MapPath (or anthing else) with an #INCLUDE.

However, you may be able to approximate the behavior with the Server.Transfer and/or Server.Execute methods.

 

[stranger123]

Sheco,

You are right, we cannot do <!--#include file="<%=...%>"-->.
However, people tald me put the .inc files in the folder outside MySite....how to include them?
I will check Server.Execute methos....

 

[Nagrom]

If all you want to do is let the users come to the old URL and hit the new location it would be better to just create a virtual directory on the web server with the old folder name that actually points to the new folder. That way you don't have to worry about creating files to redirect the user to the new pages - they'll be hitting them directly.

 

[damber]

stranger123,

Having read your other 2 posts recently, it sounds like you are acting on advice that will make your life more difficult.

you don't need to move your include files outside of your webroot. Simply rename them to .asp instead of .inc - and ensure everything is inside <% %>. This is no more a security risk than any other .asp file.

Having security information in the file is not ideal but is no more a risk in this situation than if you had the file outside of the websites root directory. Ideally you wouldn't keep unencrypted passwords (e.g. connection string details) in any of the files on the web server (anywhere). But in many cases this is acceptable - especially if your using a local file based db, like MS Access - which could be cracked in a few minutes if the attacker could read the file anyway.

Do keep the database outside of the website root directory though - as this will improve security.

A smile is worth a thousand kind words. So smile, it's easy!