Securing Your Application

You have various ways to add security to your application. You can implement one or more of these techniques, depending on the type of security that is required for your application. For example, you can assign passwords to the database and/or to the code, and you can encrypt the database. Let’s look at each of these concepts in more detail.

Adding a Database Password

One way to add security to your database is to require a user to input a password before the database can be opened. This is called file-level security. After the database file has been opened by specifying the correct password, the user can do anything to the database unless the other security features are implemented.

You have at least two ways to set a database password. One way is to select the Database Tools ribbon Encrypt with Password option. You will be prompted to enter a password for the database. Another way to set a database password is programmatically using VBA code. For example, you can execute SQL statements against the database to set, change, and remove a database password. Here are sample SQL statements for each of these options:

  'SQL statement for setting password for first time (from NULL to some value) strSQL = "ALTER DATABASE PASSWORD [newpassword] NULL" 'SQL statement for changing the database password strSQL = "ALTER DATABASE PASSWORD [anotherpassword] [newpassword]" 'SQL statement for setting password back to NULL (no password) strSQL = "ALTER DATABASE PASSWORD NULL [anotherpassword]" 'For any of these statements, would also need code to execute the SQL statement 'against the database. For example, you could use ADO to execute these statements 'against the database. 

After a database password has been assigned, whenever any user tries to open the database, a dialog similar to the one shown in Figure 12-10 is displayed. Before the database can be opened, the user must specify the correct database password.

Figure 12-10

Adding a Password for VBA Code

Adding a password to the database as described in the prior section does not keep the user from seeing your source code. Since Access 2000, you have to secure the VBA source code separately by locking the project from viewing and providing a password. To add a password for the VBA code, open the Visual Basic Editor. Then, select Tools ProjectName Properties. Select the Protection tab, as shown in Figure 12-11.

Figure 12-11

Specify the Lock Project For Viewing option, and fill in a password that must be specified in order to view the source code. After you click OK, the specified password will be required in the future before the source code can be viewed or modified.

Another way to improve security through various file security features includes creating an ACCDE file. Please see the section later in this chapter that discusses ACCDE files.

Encrypting a Database

Even after you add to your application the security features discussed so far, your application is still not totally secure. Someone could still view the contents of the database with a tool that can view partitions on disk and decipher data. If you are worried about someone being able to decipher the data from a disk utility, you should consider encrypting the database.

To do so, select the Database Tools ribbon and then Encode Database in the Database Tools group. Access then prompts you to specify a password. After you click OK, the entire database will be encrypted. In order for you to use the application after it has been encrypted, Access will have to decrypt the information. This means that encrypting the database will slow down performance as much as 20%. If this performance degradation is a problem for your application, decryption is not a good option.