You should definitely place it in a directory somewhere else so that the
visitor can't download the database.
If a user tries
www.yoursite.com/db/project.mdb after guessing (or hacking)
he will get the access database just like any other file.
If you develop with the connection string in an Application variable, like
Application("connStr"), you can easily change the location of the database
or underlying product (migrating from access to sql server isn't difficult).
If you use access you will find some situations where it doesn't scale:
- When 5-10 people are concurrently doing write activities to the db
- In my experience the access file gets corrupt every few months if it's
under stress
Access is a nice environment to develop in. If you need robust power and
already do know databases its better to work with the free products MSDE
or SQL Express.
The former missed a good graphical interface but that's solved now with SQL
Express.
HTH
Cheers,
Tom Pester