Databse Results

T

Thomas A. Rowe

The way that I accomplish this, and it has a lot to do with my host's server
configuration...

1. I use a System DSN, and the database is stored outside of the web root.
2. Both domains are hosted under the same web account.

Example, where both domains are on the same account and shared the Portfolio
database:

http://www.ecom-data.com/Portfolio/Portfolio.asp
http://www.ycoln-design.com/DesignPortfolio/Portfolio.asp

Now, if I wanted to share a database between two separate hosting accounts,
then I would have to ask my host to grant permissions for one domain to
access the database on the other domain/account.

There is another way, and that is to link to a page in the web with the
database to retrieve the result, however the users would see the URL to the
site.
--

==============================================
Thomas A. Rowe (Microsoft MVP - FrontPage)
WEBMASTER Resources(tm)

FrontPage Resources, WebCircle,
MS KB Quick Links, etc.
==============================================
 
T

Thomas A. Rowe

It would be a breach of security, if you could just create a connection to a
database in another website, unless the sites are under a single user
account and on the same server.

--

==============================================
Thomas A. Rowe (Microsoft MVP - FrontPage)
WEBMASTER Resources(tm)

FrontPage Resources, WebCircle,
MS KB Quick Links, etc.
==============================================
 
T

Thomas A. Rowe

Are you saying that if you and I had websites on the same server, that you
could create a connection to my database, given that you know the name and
path, within my web?

If so, then that is a breach in security!
--

==============================================
Thomas A. Rowe (Microsoft MVP - FrontPage)
WEBMASTER Resources(tm)

FrontPage Resources, WebCircle,
MS KB Quick Links, etc.
==============================================
 
M

MD Websunlimited

No, no no and yes, I'm saying that.

A web server can also be a file server, most are. Consider that if we both use the same file server then we both can have access to
the same files. It is the ACL's of the OS that enforce security not the web server software. Therefore, two different websites could
be given access to the same database and in fact the database could reside on a different machine altogether.

Another way to look at it is:

I believe you said that your database resides outside of your web tree, which is excellent. As such when you use ASP to access the
database the userid and password, actually the SID, assigned to you is checked against the ACLs of the folder / files. If you're on
the ACL then you're granted access. A different web site could also access the same database files but the SID is different but it
is in the ACL also for the database folder / files and access is allowed again.

In short, security is at the file system level not the web site.


HTH,

--
Mike -- FrontPage MVP '97-'02
http://www.websunlimited.com
Need to add Meta Tags to your web pages NOW with Google Bot controls.
http://www.websunlimited.com/order/Product/MTM2002/mtm2002_help_dir.htm
FrontPage Add-ins Since '97 2003 / 2002 / 2000 Compatible
 
T

Thomas A. Rowe

I answer the question based on the user being hosted in a shared hosting
environment.

If any host allows one website to see or access another website's database
within same or across servers without first having the host set the required
permission, then this is a breach in security. This also applies to MS SQL
server, as well.

I have not said that it couldn't be done, but it does requires having the
correct permissions, and it doesn't matter if the database is within or
outside of the website space.

--

==============================================
Thomas A. Rowe (Microsoft MVP - FrontPage)
WEBMASTER Resources(tm)

FrontPage Resources, WebCircle,
MS KB Quick Links, etc.
==============================================


MD Websunlimited said:
No, no no and yes, I'm saying that.

A web server can also be a file server, most are. Consider that if we both
Click to expand...
use the same file server then we both can have access to
the same files. It is the ACL's of the OS that enforce security not the
Click to expand...
web server software. Therefore, two different websites could
be given access to the same database and in fact the database could reside
Click to expand...
on a different machine altogether.
Another way to look at it is:

I believe you said that your database resides outside of your web tree,
Click to expand...
which is excellent. As such when you use ASP to access the
database the userid and password, actually the SID, assigned to you is
Click to expand...
checked against the ACLs of the folder / files. If you're on
the ACL then you're granted access. A different web site could also access
Click to expand...
the same database files but the SID is different but it
 
M

MD Websunlimited

Ah a qualifier that has little or no value to this debate; but a nice tactic.

Even in a shared hosting environment it is possible as most WPP's today allow the webmaster to control user permissions via a
control panel. Therefore as the webmaster I can grant access to the other website via the control panel. Note: most WPP's use a RAID
disk farm server or servers to host the files of the web servers. Normally all are mapped to the same logical disk drive in the user
accounts, thus all users appear to be on the same web servers disk.

This debate was started by your statement, "It would be a breach of security, if you could just create a connection to a
database in another website, unless the sites are under a single user account and on the same server.". I believe that I've proven
that statement to be incorrect and I need to get something productive done. You have the last word if you wish.

Have fun, challenge yourself,

--
Mike -- FrontPage MVP '97-'02
http://www.websunlimited.com
Stop Spam Email Mining from your web pages with SpamStopper
http://www.websunlimited.com/order/product/SpamStopper/spam_stopper_help_dir.htm
FrontPage Add-ins Since '97 2003 / 2002 / 2000 Compatible
 
T

Thomas A. Rowe

I have yet to come across a web host that allows that level of access to
their servers via any type of control panel, etc.

I will stand by my statement!

Sorry to here you have to go do something productive, as I have been
steadily working on a project all this time.

--

==============================================
Thomas A. Rowe (Microsoft MVP - FrontPage)
WEBMASTER Resources(tm)

FrontPage Resources, WebCircle,
MS KB Quick Links, etc.
==============================================


MD Websunlimited said:
Ah a qualifier that has little or no value to this debate; but a nice tactic.

Even in a shared hosting environment it is possible as most WPP's today
Click to expand...
allow the webmaster to control user permissions via a
control panel. Therefore as the webmaster I can grant access to the other
Click to expand...
website via the control panel. Note: most WPP's use a RAID
disk farm server or servers to host the files of the web servers. Normally
Click to expand...
all are mapped to the same logical disk drive in the user
accounts, thus all users appear to be on the same web servers disk.

This debate was started by your statement, "It would be a breach of
Click to expand...
security, if you could just create a connection to a
database in another website, unless the sites are under a single user
Click to expand...
account and on the same server.". I believe that I've proven
that statement to be incorrect and I need to get something productive
Click to expand...
done. You have the last word if you wish.
 
Top