Server.MapPath connection string question.

[Dave]

I have two sites:

[url]www.site_A.com[/url] & [url]www.site_A_news.com[/url]

Site_A is in d:\webs\site_a & uses an Access DB in
d:\webs\site_a\data\db.mdb

Site_A_news is in d:\webs\site_a\site_a_news also requires access to
that Access Database.

How should I setup the connection string so both webs can share the same
database?

[TomB]

I assume this is the same server since you didn't say otherwise.
site_a should continue as is.
site_a_news should use D:\webs\site_a\data\db.mdb in its connection string.

A different (likely better) solution would be to move the database to
d:\database\db.mdb and both site_a and site_a_news can get to it from there.

MSDE would likely be even better.

TomB


"Dave" <1@1.ca> wrote in message
news:uCjtu%23DOEHA.2780@TK2MSFTNGP09.phx.gbl...

> I have two sites:
>
> [url]www.site_A.com[/url] & [url]www.site_A_news.com[/url]
>
> Site_A is in d:\webs\site_a & uses an Access DB in
> d:\webs\site_a\data\db.mdb
>
> Site_A_news is in d:\webs\site_a\site_a_news also requires access to
> that Access Database.
>
> How should I setup the connection string so both webs can share the same
> database?

[Dave]

Yes, same server - sorry. And I agree, MSDE would be better, but I do
not have that option at the moment.

Right now, I have both setup to use the full path
D:\webs\site_a\data\db.mdb in their connection strings...

Any reason why I should NOT do that?

Why do many example of DSN Less connection strings use Server.MapPath?

Any performance gains by doing that? Security considerations?



TomB wrote:

> I assume this is the same server since you didn't say otherwise.
> site_a should continue as is.
> site_a_news should use D:\webs\site_a\data\db.mdb in its connection string.
>
> A different (likely better) solution would be to move the database to
> d:\database\db.mdb and both site_a and site_a_news can get to it from there.
>
> MSDE would likely be even better.
>
> TomB
>
>
> "Dave" <1@1.ca> wrote in message
> news:uCjtu%23DOEHA.2780@TK2MSFTNGP09.phx.gbl...
>

>>I have two sites:
>>
>>[url]www.site_A.com[/url] & [url]www.site_A_news.com[/url]
>>
>>Site_A is in d:\webs\site_a & uses an Access DB in
>>d:\webs\site_a\data\db.mdb
>>
>>Site_A_news is in d:\webs\site_a\site_a_news also requires access to
>>that Access Database.
>>
>>How should I setup the connection string so both webs can share the same
>>database?

>
>
>

[Dave]

Yes, same server - sorry. And I agree, MSDE would be better, but I do
not have that option at the moment.

Right now, I have both setup to use the full path
D:\webs\site_a\data\db.mdb in their connection strings...

Any reason why I should NOT do that?

Why do many example of DSN Less connection strings use Server.MapPath?

Any performance gains by doing that? Security considerations?



TomB wrote:

> I assume this is the same server since you didn't say otherwise.
> site_a should continue as is.
> site_a_news should use D:\webs\site_a\data\db.mdb in its connection string.
>
> A different (likely better) solution would be to move the database to
> d:\database\db.mdb and both site_a and site_a_news can get to it from there.
>
> MSDE would likely be even better.
>
> TomB
>
>
> "Dave" <1@1.ca> wrote in message
> news:uCjtu%23DOEHA.2780@TK2MSFTNGP09.phx.gbl...
>

>>I have two sites:
>>
>>[url]www.site_A.com[/url] & [url]www.site_A_news.com[/url]
>>
>>Site_A is in d:\webs\site_a & uses an Access DB in
>>d:\webs\site_a\data\db.mdb
>>
>>Site_A_news is in d:\webs\site_a\site_a_news also requires access to
>>that Access Database.
>>
>>How should I setup the connection string so both webs can share the same
>>database?

>
>
>

[Aaron Bertrand - MVP]

> Right now, I have both setup to use the full path

> D:\webs\site_a\data\db.mdb in their connection strings...
>
> Any reason why I should NOT do that?

Yes, because when you move to a different server, that folder might not
exist. And you won't be able to just create a folder on the D: drive of an
ISP's server.

> Why do many example of DSN Less connection strings use Server.MapPath?

Because many people host their sites on remote servers, where they have FTP
access but not local hard disk access. So if they need to make changes to
the database, it is certainly much easier to use FTP (which usually starts
at the same root as the web site) than to request the MDB file from the host
and then ask them to replace it when you've made your changes.

> Any performance gains by doing that? Security considerations?

Performance isn't an issue really, unless you're putting the file onto a
different physical drive, or a SAN or a NAS, which will perform either
better or worse than the current hard disk. Choosing a different folder on
the same drive won't have any impact. Some might argue that there is a
performance implication in calling server.mappath, but you'd be hard pressed
to demonstrate a noticeable difference even at high volumes.

asp.general removed from cross-post list.

[TomB]

The downside to having your database within your site, is that a user could
type in the url to the database and download it.
[url]http://site_a/data/db.mdb[/url]
To fix, you can rename the database db.asp

I think the main reasons for using Server.MapPath are
a) if it's sample code they don't know where you are going to put it
b) if you move the site to a new server, or a new directory, the link is
relative so it won't break.

Tom B

"Dave" <1@1.ca> wrote in message
news:ujWcKNEOEHA.3264@tk2msftngp13.phx.gbl...

> Yes, same server - sorry. And I agree, MSDE would be better, but I do
> not have that option at the moment.
>
> Right now, I have both setup to use the full path
> D:\webs\site_a\data\db.mdb in their connection strings...
>
> Any reason why I should NOT do that?
>
> Why do many example of DSN Less connection strings use Server.MapPath?
>
> Any performance gains by doing that? Security considerations?
>
>
>
> TomB wrote:
>

> > I assume this is the same server since you didn't say otherwise.
> > site_a should continue as is.
> > site_a_news should use D:\webs\site_a\data\db.mdb in its connection

string.

> >
> > A different (likely better) solution would be to move the database to
> > d:\database\db.mdb and both site_a and site_a_news can get to it from

there.

> >
> > MSDE would likely be even better.
> >
> > TomB
> >
> >
> > "Dave" <1@1.ca> wrote in message
> > news:uCjtu%23DOEHA.2780@TK2MSFTNGP09.phx.gbl...
> >

> >>I have two sites:
> >>
> >>[url]www.site_A.com[/url] & [url]www.site_A_news.com[/url]
> >>
> >>Site_A is in d:\webs\site_a & uses an Access DB in
> >>d:\webs\site_a\data\db.mdb
> >>
> >>Site_A_news is in d:\webs\site_a\site_a_news also requires access to
> >>that Access Database.
> >>
> >>How should I setup the connection string so both webs can share the same
> >>database?

> >
> >
> >

[Aaron Bertrand - MVP]

Sorry, forgot about the security implications. Yes, storing it in a hard
location instead of relative *can* mean that your MDB file is a little more
secure from prying eyes. However, see [url]http://www.aspfaq.com/2454[/url] for some
other information.

--
Aaron Bertrand
SQL Server MVP
[url]http://www.aspfaq.com/[/url]




"Dave" <1@1.ca> wrote in message news:40A2592C.7050401@1.ca...

> Yes, same server - sorry. And I agree, MSDE would be better, but I do
> not have that option at the moment.
>
> Right now, I have both setup to use the full path
> D:\webs\site_a\data\db.mdb in their connection strings...
>
> Any reason why I should NOT do that?
>
> Why do many example of DSN Less connection strings use Server.MapPath?
>
> Any performance gains by doing that? Security considerations?
>
>
>
> TomB wrote:
>

> > I assume this is the same server since you didn't say otherwise.
> > site_a should continue as is.
> > site_a_news should use D:\webs\site_a\data\db.mdb in its connection

string.

> >
> > A different (likely better) solution would be to move the database to
> > d:\database\db.mdb and both site_a and site_a_news can get to it from

there.

> >
> > MSDE would likely be even better.
> >
> > TomB
> >
> >
> > "Dave" <1@1.ca> wrote in message
> > news:uCjtu%23DOEHA.2780@TK2MSFTNGP09.phx.gbl...
> >

> >>I have two sites:
> >>
> >>[url]www.site_A.com[/url] & [url]www.site_A_news.com[/url]
> >>
> >>Site_A is in d:\webs\site_a & uses an Access DB in
> >>d:\webs\site_a\data\db.mdb
> >>
> >>Site_A_news is in d:\webs\site_a\site_a_news also requires access to
> >>that Access Database.
> >>
> >>How should I setup the connection string so both webs can share the same
> >>database?

> >
> >
> >

[Dave]

Thanks Tom.

One final question.. how could the web user download the db? How would
(could) they find out the path?

TomB wrote:

> The downside to having your database within your site, is that a user could
> type in the url to the database and download it.
> [url]http://site_a/data/db.mdb[/url]
> To fix, you can rename the database db.asp
>
> I think the main reasons for using Server.MapPath are
> a) if it's sample code they don't know where you are going to put it
> b) if you move the site to a new server, or a new directory, the link is
> relative so it won't break.
>
> Tom B
>
> "Dave" <1@1.ca> wrote in message
> news:ujWcKNEOEHA.3264@tk2msftngp13.phx.gbl...
>

>>Yes, same server - sorry. And I agree, MSDE would be better, but I do
>>not have that option at the moment.
>>
>>Right now, I have both setup to use the full path
>>D:\webs\site_a\data\db.mdb in their connection strings...
>>
>>Any reason why I should NOT do that?
>>
>>Why do many example of DSN Less connection strings use Server.MapPath?
>>
>>Any performance gains by doing that? Security considerations?
>>
>>
>>
>>TomB wrote:
>>
>>

>>>I assume this is the same server since you didn't say otherwise.
>>>site_a should continue as is.
>>>site_a_news should use D:\webs\site_a\data\db.mdb in its connection

>
> string.
>

>>>A different (likely better) solution would be to move the database to
>>>d:\database\db.mdb and both site_a and site_a_news can get to it from

>
> there.
>

>>>MSDE would likely be even better.
>>>
>>>TomB
>>>
>>>
>>>"Dave" <1@1.ca> wrote in message
>>>news:uCjtu%23DOEHA.2780@TK2MSFTNGP09.phx.gbl. ..
>>>
>>>
>>>>I have two sites:
>>>>
>>>>[url]www.site_A.com[/url] & [url]www.site_A_news.com[/url]
>>>>
>>>>Site_A is in d:\webs\site_a & uses an Access DB in
>>>>d:\webs\site_a\data\db.mdb
>>>>
>>>>Site_A_news is in d:\webs\site_a\site_a_news also requires access to
>>>>that Access Database.
>>>>
>>>>How should I setup the connection string so both webs can share the same
>>>>database?
>>>
>>>
>>>

>
>

[TomB]

Usually just by sheer luck.
However, other things can happen.

a) Perhaps a user hits an error and the error message says something that
gives it away.
b) Your asp page doesn't get processed for some reason, and the source code
is displayed instead.
c) You accidentally allow directory browsing and don't have a default page.
d) Good guesswork.
e) Once a person posted a question on a newsgroup with their real email
address (the usual NOSPAM was in there) and because of the information they
provided, their database could easily have been downloaded. Note I've seen
this with SQL too, people posting straight from their source with IP of
their server, username and password. Invariably it's sa.

All in all it's pretty unlikely to happen. But it could.
TomB


"Dave" <1@1.ca> wrote in message
news:eyl0aGGOEHA.3016@tk2msftngp13.phx.gbl...

> Thanks Tom.
>
> One final question.. how could the web user download the db? How would
> (could) they find out the path?
>
> TomB wrote:

> > The downside to having your database within your site, is that a user

could

> > type in the url to the database and download it.
> > [url]http://site_a/data/db.mdb[/url]
> > To fix, you can rename the database db.asp
> >
> > I think the main reasons for using Server.MapPath are
> > a) if it's sample code they don't know where you are going to put it
> > b) if you move the site to a new server, or a new directory, the link is
> > relative so it won't break.
> >
> > Tom B
> >
> > "Dave" <1@1.ca> wrote in message
> > news:ujWcKNEOEHA.3264@tk2msftngp13.phx.gbl...
> >

> >>Yes, same server - sorry. And I agree, MSDE would be better, but I do
> >>not have that option at the moment.
> >>
> >>Right now, I have both setup to use the full path
> >>D:\webs\site_a\data\db.mdb in their connection strings...
> >>
> >>Any reason why I should NOT do that?
> >>
> >>Why do many example of DSN Less connection strings use Server.MapPath?
> >>
> >>Any performance gains by doing that? Security considerations?
> >>
> >>
> >>
> >>TomB wrote:
> >>
> >>
> >>>I assume this is the same server since you didn't say otherwise.
> >>>site_a should continue as is.
> >>>site_a_news should use D:\webs\site_a\data\db.mdb in its connection

> >
> > string.
> >

> >>>A different (likely better) solution would be to move the database to
> >>>d:\database\db.mdb and both site_a and site_a_news can get to it from

> >
> > there.
> >

> >>>MSDE would likely be even better.
> >>>
> >>>TomB
> >>>
> >>>
> >>>"Dave" <1@1.ca> wrote in message
> >>>news:uCjtu%23DOEHA.2780@TK2MSFTNGP09.phx.gbl. ..
> >>>
> >>>
> >>>>I have two sites:
> >>>>
> >>>>[url]www.site_A.com[/url] & [url]www.site_A_news.com[/url]
> >>>>
> >>>>Site_A is in d:\webs\site_a & uses an Access DB in
> >>>>d:\webs\site_a\data\db.mdb
> >>>>
> >>>>Site_A_news is in d:\webs\site_a\site_a_news also requires access to
> >>>>that Access Database.
> >>>>
> >>>>How should I setup the connection string so both webs can share the

same

> >>>>database?
> >>>
> >>>
> >>>

> >
> >

[Dave]

Good points, thanks Tom. I'll adjust accordingly :)

TomB wrote:

> Usually just by sheer luck.
> However, other things can happen.
>
> a) Perhaps a user hits an error and the error message says something that
> gives it away.
> b) Your asp page doesn't get processed for some reason, and the source code
> is displayed instead.
> c) You accidentally allow directory browsing and don't have a default page.
> d) Good guesswork.
> e) Once a person posted a question on a newsgroup with their real email
> address (the usual NOSPAM was in there) and because of the information they
> provided, their database could easily have been downloaded. Note I've seen
> this with SQL too, people posting straight from their source with IP of
> their server, username and password. Invariably it's sa.
>
> All in all it's pretty unlikely to happen. But it could.
> TomB
>
>
> "Dave" <1@1.ca> wrote in message
> news:eyl0aGGOEHA.3016@tk2msftngp13.phx.gbl...
>

>>Thanks Tom.
>>
>>One final question.. how could the web user download the db? How would
>>(could) they find out the path?
>>
>>TomB wrote:
>>

>>>The downside to having your database within your site, is that a user

>
> could
>

>>>type in the url to the database and download it.
>>>[url]http://site_a/data/db.mdb[/url]
>>>To fix, you can rename the database db.asp
>>>
>>>I think the main reasons for using Server.MapPath are
>>>a) if it's sample code they don't know where you are going to put it
>>>b) if you move the site to a new server, or a new directory, the link is
>>>relative so it won't break.
>>>
>>>Tom B
>>>
>>>"Dave" <1@1.ca> wrote in message
>>>news:ujWcKNEOEHA.3264@tk2msftngp13.phx.gbl...
>>>
>>>
>>>>Yes, same server - sorry. And I agree, MSDE would be better, but I do
>>>>not have that option at the moment.
>>>>
>>>>Right now, I have both setup to use the full path
>>>>D:\webs\site_a\data\db.mdb in their connection strings...
>>>>
>>>>Any reason why I should NOT do that?
>>>>
>>>>Why do many example of DSN Less connection strings use Server.MapPath?
>>>>
>>>>Any performance gains by doing that? Security considerations?
>>>>
>>>>
>>>>
>>>>TomB wrote:
>>>>
>>>>
>>>>
>>>>>I assume this is the same server since you didn't say otherwise.
>>>>>site_a should continue as is.
>>>>>site_a_news should use D:\webs\site_a\data\db.mdb in its connection
>>>
>>>string.
>>>
>>>
>>>>>A different (likely better) solution would be to move the database to
>>>>>d:\database\db.mdb and both site_a and site_a_news can get to it from
>>>
>>>there.
>>>
>>>
>>>>>MSDE would likely be even better.
>>>>>
>>>>>TomB
>>>>>
>>>>>
>>>>>"Dave" <1@1.ca> wrote in message
>>>>>news:uCjtu%23DOEHA.2780@TK2MSFTNGP09.phx.gbl. ..
>>>>>
>>>>>
>>>>>
>>>>>>I have two sites:
>>>>>>
>>>>>>[url]www.site_A.com[/url] & [url]www.site_A_news.com[/url]
>>>>>>
>>>>>>Site_A is in d:\webs\site_a & uses an Access DB in
>>>>>>d:\webs\site_a\data\db.mdb
>>>>>>
>>>>>>Site_A_news is in d:\webs\site_a\site_a_news also requires access to
>>>>>>that Access Database.
>>>>>>
>>>>>>How should I setup the connection string so both webs can share the

>
> same
>

>>>>>>database?
>>>>>
>>>>>
>>>>>
>>>

>
>