ASP.NET MVC wants me to save the SQL Server database files in the App_Data folder - should I?

Question

When creating a new database with SQL Server Express 2005, the database files (.mdf and .ldf) are saved by default to C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data .

However, with the tutorials I've seen for ASP.NET MVC (like Nerd Dinner), it seems common practice to store database files in the App_Data folder of an ASP.NET project.

Questions

• Is there any value for the App_Data folder, or is it just a convenient place to store database files if you use the Visual Studio constructor to create a new database?
• Will there be any negative consequences if I do not use or even delete the App_Data folder?

Update

One thing I still don't get. If the server has a production database, why do you want to replace this database with what is in App_Data. Wouldn't you usually want to have update scripts that you run in the production database when you release a new version of the application? Even for initial deployment, I would rather create a database script than a physical copy of the files. In addition, when using SQL Server (Express) databases, copying is not enough. You must separate the database to manipulate the files, and then reconnect when you are done.

So, I have to say that the App_Data point is still eluding me. Can someone enlighten me?

Answer 1

You can remove App_Data without any negative consequences, but when it exists (by folder name) on the ASP.NET website, it has the special ability of the site to prohibit a direct link to download its contents - this is a security feature to protect your database It is downloaded directly over the Internet (for example, via a web browser), even if it exists on the website. However, your application can still access the files in the App_Data folder, as well as other website content.

Microsoft states the following:

Note. The contents of the application folder, with the exception of the App_Themes folder, are not served in response to Web requests, but they can be accessed from the application code.

Microsoft describes its special ASP.NET folder structures including App_Data here .

Answer 2

There are several advantages to placing database files in the App_Data folder:

• As already mentioned, this folder is protected from users viewing it directly on the Internet. This also applies to placing the database in folders outside your website.
• You can “xcopy deploy” your application by copying the entire folder from your local development machine to your hosting website.
• The various components in Visual Studio can offer additional help creating your application using your database files. For example, you can double-click the SQL Server Express MDF file and automatically open it in Server Explorer so that you can change the database schema or view its data.

Answer 3

There is absolutely no need to use the App_Data folder. This is just a convenient place to store database files with your site. The decision to use it or not is more a matter of preference / policy than anything else.

Answer 4

yes, when you just use the express database that will exist inside your website, it is best to use the app_data folder. The main reason is that asp.net isapi implicitly knows that it is not making any requests for files from this directory. The same goes for the app_code folder. There is no reason to believe that you should, but its good practice to be reasonable.

Here you can also store sensitive xml, access dbs and any other data files for added security.

I used it only for local development, before pointing web.config to an instance of SQL server, and not to db files.