Need some Advice about Web Development Using an Access DB

[cchen]

I've been asked to do a small project for my office and I'm running into walls every direction I look.
We have a database in Access, and the boss doesn't want to port it to anything else like mysql.

I've been asked to create a simple online system so that people can enter in information so that it goes directly into the database. The only servers we have are unix, and we really don't have control over them.

I'm comfortable with developing in any language, whether it be asp, php, jsp, perl, etc. The only problem is the DB. The only solution I can see is to setup IIS on one of the computers here and host the database on there. But then I was thinking, if I'm going to do that, I might as well just use ASP and run the pages off the server too.

What do you guys think? The boss is ok with the IIS idea, I'm just afraid of the possible security concerns. We may be storing other people's credit card numbers...

 

[EagleKeeper]

I was playing with a project this past spring where Apache was being used with MySQL.

PHP interface between the user and the DB. DB was ported over easily from an Access DB.

My biggest headache was not having a decent PHP knowledge.

 

[cchen]

Yeah, I know porting wouldn't be very difficult but its just the preference of the office to stick with what they know, which is Access

 

[AmigaMan]

If this is a publicly accessible site, there is no way I would let my boss run with the IIS/Access idea unless you had a full time IIS admin who knew what they were doing. Either that or you could outsource the hosting. If you have someone who's good at admintrating IIS, then you should just do straight IIS/ASP/Access and be done with it. If not, then convince (slap on the back the head, bang his fingers with a hammer, etc...) your boss to switch to PHP & MySQL/Postgre.

 

[cchen]

I agree with your points, but I also agree with my boss. I'm the only computer literate person in this office. They barely know how to use access. The problem is that if I'm not around, and if someone needs to change something with the DB, there's no way anyone here will be able to use mysql.

I wouldn't be able to use PHP either.... the university's servers don't support any scripting languages.... which is why I have to go around them...

 

[bunker]

Originally posted by: cchen
I wouldn't be able to use PHP either.... the university's servers don't support any scripting languages.... which is why I have to go around them...

If you can't use PHP then how the hell are you going to use ASP? I assume what you currently have to use is an Apache server?

 

[Drakkon]

You want to possibly store CC #'s in an ACCESS DB???!?! Thats like putting out the welcome mat and inviting people to steal them...
So anways the solution i made up for my company when it came to someone saying "we must use access" blah blah...BS...you can take a mySQL, oracle, etc database and link it up to a psuedo access db and have the ability to add record, create reports, etc all from within access while mySQL or whatever is doing all the true storage and security. Then its easy enough to create a web interface as well. I'd stick to php/perl/apache myself if i were you...ASP and IIS is an ever evolving beast that you will never get the best of. Although i have to admit IIS6.0 seems pretty well locked down.

 

[torpid]

Originally posted by: Drakkon
You want to possibly store CC #'s in an ACCESS DB???!?! Thats like putting out the welcome mat and inviting people to steal them...
So anways the solution i made up for my company when it came to someone saying "we must use access" blah blah...BS...you can take a mySQL, oracle, etc database and link it up to a psuedo access db and have the ability to add record, create reports, etc all from within access while mySQL or whatever is doing all the true storage and security. Then its easy enough to create a web interface as well. I'd stick to php/perl/apache myself if i were you...ASP and IIS is an ever evolving beast that you will never get the best of. Although i have to admit IIS6.0 seems pretty well locked down.

How would that help? Then your Access DB is just as insecure as it was before.

Is this an extranet or an intranet? What is the security concern if it's an intranet? This sounds like one of those bosses who thinks programming is like arranging furniture. "just put a form up here, put the db there, have them talk to each other. should take about 10 minutes".

 

[cchen]

Originally posted by: bunker

Originally posted by: cchen
I wouldn't be able to use PHP either.... the university's servers don't support any scripting languages.... which is why I have to go around them...

If you can't use PHP then how the hell are you going to use ASP? I assume what you currently have to use is an Apache server?

Run the ASP pages off the IIS server

 

[cchen]

Originally posted by: torpid

Originally posted by: Drakkon
You want to possibly store CC #'s in an ACCESS DB???!?! Thats like putting out the welcome mat and inviting people to steal them...
So anways the solution i made up for my company when it came to someone saying "we must use access" blah blah...BS...you can take a mySQL, oracle, etc database and link it up to a psuedo access db and have the ability to add record, create reports, etc all from within access while mySQL or whatever is doing all the true storage and security. Then its easy enough to create a web interface as well. I'd stick to php/perl/apache myself if i were you...ASP and IIS is an ever evolving beast that you will never get the best of. Although i have to admit IIS6.0 seems pretty well locked down.

How would that help? Then your Access DB is just as insecure as it was before.

Is this an extranet or an intranet? What is the security concern if it's an intranet? This sounds like one of those bosses who thinks programming is like arranging furniture. "just put a form up here, put the db there, have them talk to each other. should take about 10 minutes".

Extranet... Ppl will be entering in info which wili then be sent to the db...
I guess we could hold off on storing the CC #'s....

What's the problem with IIS? Even if I make it as secure as I can, what other issues do I have to deal with?

 

[Apathetic]

Ummm... I *HIGHLY* recommend you avoid Access like the plague. It won't scale and if you have multiple users WRITING to the database at the same time, it's only a matter of time before you corrupt the database. Access is NOT a multiuser database.

I realize you don't have a lot of say in this, but I just thought I'd let you know what you're walking into.

Dave

 

[EagleKeeper]

If you insist on having to use access, then develop a Com Object (DLL) that you can call from the ASP pages.

Have the Com object control the I/O to the DB.
This will allow to to support the need for multi-user access and still maintain some security of the system. The DB will not have to be exposed to the outside world.

 

[cchen]

So...... we decided to go in another direction and just host IIS on the intranet and develop the web apps for just internal use....

now.... does anyone have any good links to site that can show me how to properly set up IIS for intranet use and disable access to the internet?

 

[MrChad]

Originally posted by: cchen
So...... we decided to go in another direction and just host IIS on the intranet and develop the web apps for just internal use....

now.... does anyone have any good links to site that can show me how to properly set up IIS for intranet use and disable access to the internet?

That's not really an IIS configuration issue. Your networks firewall should keep it from being accessible from the outside world. If you need it open externally, you put it out on the DMZ.