2 problems with an online Access database

[johnmr]

I am developing a very simple little app online that is giving me 2 main areas of trouble. Basically, all this app does is take information from a form and put it into an access db which is located on a web server (it also sends out an email to the admin when the form is submitted, but that is working fine). So there is one page that is the form and it is pointed at a second page that does the insert to the db, sends the email and then displays a Thank You message. I set up a ODBC connection on the web server to the database that seems to be working fine ( I can run a SELECT query against it and get info out of it - I put one dummy record in the db just for testing).

I'm having 2 main problems as follows:

Permissions - the sys admin is hesitant to open up the folder that contains the DB (and nothing else) to allow for write/read control to the anonymous internet user account. Just to test it, he did and I was able to run the query on the page (although I had problems with inserting - see problem 2 below). The sys admin suggested that I "use different credentials" to access this db in this folder and set up a separate user account/password for this purpose on this folder. 2 questions:
1.) how dangerous is it to allow read/write access for the anonymous internet user account?
2. what kind of code (.asp) could I use to access the DB using the separate user account the sys admin set up?

Insert to the DB not working - When I do run this page, it seems to run fine, with seemingly no errors, but when I do a SELECT query against it, none of the data is there. here is the code I am using:

<%
Dim objConn
Set objConn = Server.CreateObject("ADODB.Connection")
objConn.ConnectionString = "DSN=RVU_contact_db"
objConn.Mode = 3
objConn.Open

strSQL = "insert into `contacts`(first_name,last_name,email,phone,address,city,state,zip,subject,message,department) " _
		& "values ('" & request.form("first_name") & "','" & request.form("last_name") & "','" & request.Form("email") & "','" & request.form("phone") & "','" & request.form("address") & "','" & request.Form("city") & "','" & request.form("state") & "','" & request.form("zip") & "','" & request.Form("subject") & "','" & request.form("message") & "','" & request.form("department") &  "')"
	objConn.execute strSQL
	objConn.Close
%>

I notice that there is a .ldb that seems to stay open in that folder, even when I do a objConn.Close, and I don't seem to be able to delete this off the server.

Any ideas on how to solve these problems? Any help on any of the above greatly appreciated.

Sincerely

johnmr

*

 

[DannySeager]

In my experience there's no problem giving the internet guest account access to that folder... disable folder listings on it though.

As you're using a server side scripting language the users will not be able to simply view the code of the page and find out where the database is located...

Create a "strange" folder name for the DB and keep it in there... don't store it in a folder called "Data" or "database" or something obvious.

I would also not keep the connection string in the main page... create a new page and store it in there... the use a server side include to let the page use it... that way if you do have to change it then you only change the one page.

I would also go for a DSN-less connection... they are marginally quicker. You can find details on these from http://www.connectionstrings.com

Then all you should need to do to open the connection is

Set objConn = Server.CreateObject("ADODB.Connection")
objConn.Open YourConnectionString

YourConnectionString = the connection string you defined on the page you have included by server side includes.

I would add

Response.write strSQL

at the end of your code so you can debug your SQL.