Protecting VBA Code by using a Password

The best ways to protect and secure your Modules and VBA code are to compile the database into MDE format (see the section "The MDE Database Format Revisited" in this chapter), to use the Hidden property (Chapter 3), and to use workgroup security in Access 97 (see Chapter 8). If you are not sure about the MDE format, consider using the VBA project password to protect your VBA code.

As I discussed in Chapter 8, it is possible to lock your modules by using workgroup security and DAO commands so that people cannot open the module directly from the Database window. In Access 97, this method provided to be good security for your code, but with the advent of Access 2000, the separation of the database from the Visual Basic Environment (VBE) meant that the code was far more accessible. Microsoft's solution for this issue was to allow you to place a password on the VBA project.

To add a password to your VBA project, follow these steps:

1. Open your database and switch to the VBE (by pressing ALT+F11).

2. Choose Tools ˜ ProjectName Properties.

3. Select the Protection tab, shown in Figure 11-9.

   
   Figure 11-9: Protecting the VBA project by a password.

4. Select the Lock Project for Viewing check box and fill in the password fields. Remember to write down the password somewhere safe. Click OK.

From now on, the first time that anyone wants to view VBA code after opening the database, he or she will be asked to enter the password. This protection also applies to the VBA code for any form or report. If you find entering this password irritating , you can clear the Lock Project for Viewing check box to allow anyone to open the VBE, as though a password weren't entered. That way, when you release the database, you can select the check box again and the same password will protect the VBA project.

Unfortunately, the Password Crackers are at it Again

If you are starting to feel comfortable about the protection offered by your VBA code password, hop off your horse because the code crackers have sorted out this one as well. In Figure 11-10, I demonstrate one of the tools from which it took just a second or so to recover the VBA password from an encrypted database. As a result, I would use the VBA password as a deterrent and generally would apply it only when I was about to post my front-end database to the live environment. That said, because the VBA password does not hinder your users, the password will deter most intruders and is certainly better than no password at all. Therefore, if you have a lot of code to protect, consider using this password.

Figure 11-10: Password-cracking software figures out your VBA project password.

Other Code Protection Options

If you "just must" protect your code and cannot use the MDE format for the complete front-end database, you have to step up a notch or two in the difficulty stakes. The first option is to move some of the modules to another database and then produce an MDE library. Another alternative is to create an ActiveX object or a COM add-in. You can then reference those objects from your within your VBA environment. See the "Further Reading" section at the end of this chapter for information on how to reach links to continue to read on these topics.

User Story  

Why not sell your source code? If you are worried about whether someone will use your software to produce an alternative product, consider this approach, which I stumbled on with my graphical data mining shareware. One day when I was considering options for selling my software, I decided to heed the advice of a number of programmers who had asked for the source code of the database. Given that sales weren't going to keep me in cappuccino, I decided to charge for the source code as an extra. This option soon improved the sales and let prospective buyers know that they wouldn't be hung out to dry if my company stopped supporting the software. This approach also had the benefit of letting potential thieves know that they would also have to sell the source code that they modified and thereby reduce their chances of profiting from their misdemeanors. An example of a popular Access vendor that has taken this "open source" approach is Database Creations.