Question

I wish to ship SQL server database file with my application. I am very very new to SQL.

1) I do not know how to protect this file from being opened.

2) If this file is emailed, can anybody read it?

3) Is there any possibility of protecting it like Access database is password protected so even emailed, no one can open it.

Thanks
Furqan

Answer 1

Regular SQL Server database files (.mdf, .ldf) aren’t intended to be shipped with your application and installed locally – they are intended to be used on a SQL Server instance, running in a secure environment where typical users don’t have physical access to the files per se.

As such, .mdf/.ldf files cannot really be protected by a password or anything like that – you can define users and their permissions, but that only applies to the permissions inside the database – not the database file(s) itself.

For your scenario, I guess you’d be better off with SQL Server Compact Edition – an in-process (just a bunch of DLL’s), one-file-for-your-entire-database (*.sdf) kind of database – much more closely an Access replacement than the full-fledged SQL Server.

The documentation clearly states:

SQL Server Compact Edition was
designed from the beginning assuming
the user had access to the physical
file. Without an additional security
mechanism, the user could bypass your
application and use tools such as
MSQuery to view and edit the raw data.
SQL Server Compact Edition supports
the ability to password protect and
encrypt the data file, thereby
limiting access to your application
which embeds the password. The
password protection of the database
file adds a layer of protection that
travels with the file, making it
harder to access the data in the event
a rogue user obtains the file.

Read more about SQL Server Compact 3.5 and you might also want to check out the SQL Server Compact blog which discusses the latest developments (SQL Server Compact 4.0 is in testing right now).