ODBC security?

[Alisa]

Does anyone have an opionion of the relative security risk of the following two options:
Access FE distributed on local machine with ODBC connection to SQL Server over the internet
vs.
Completely web based application (i.e., no MS Access)


I am just starting to research this, so if you don't have an opinion, but know of some good places to look, I would appreciate that as well.

 

[KenHigg]

MS Access over the web is going to be a real bad option, even with a sql back end. I suggest asp.net 2 or higher. or Cold Fusion...

 

[Alisa]

MS Access over the web is going to be a real bad option, even with a sql back end. I suggest asp.net 2 or higher. or Cold Fusion...

Can you elaborate? What would be bad about it?

 

[KenHigg]

One of the primary issues is going to be performance and that has to do with the basic nature of the net. I won't try to explain any of it because I barely understand it myself. I would suggest you build some test apps and set them up to run over the net and see what happens -

 

[Alisa]

ok, I'm not at a point that I can actually test anything yet. Do you think that a web-based app would be significantly faster than ODBC, considering the backend is going to be the same either way, and assuming I will use a lot of techniques to speed things up like stored procedures, ADO instead of DAO, etc.?

 

[KenHigg]

Yes a web based app will perform better. I'm sure there will be scenarios where an access/odbc/net app would suffice. Another issue you will encounter trying to do Access /odbc over the net is deployment. You'll have to maintain the app on each workstation that needs access to the data. That in itself is a good reason to do a web app. All they need is the url and a username/login and it's deployed -

 

[Alisa]

Yes a web based app will perform better. I'm sure there will be scenarios where an access/odbc/net app would suffice. Another issue you will encounter trying to do Access /odbc over the net is deployment. You'll have to maintain the app on each workstation that needs access to the data. That in itself is a good reason to do a web app. All they need is the url and a username/login and it's deployed -

Yes I agree with you overall. The idea was to do something sooner - i.e., keeping the FE in Access and just moving the BE would be faster than doing everything at once. Thanks for your thoughts.

 

[KenHigg]

If you do experiment with Access over the net to sql db please post back how it goes.

 

[georgedwilkinson]

Please beware: don't use dynamic SQL when deploying via the web. It is fraught with security issues (i.e. people can take over your database from their web page). Make sure to bind all your variables.

 

[Alisa]

If you do experiment with Access over the net to sql db please post back how it goes.

Yes I definitely will.