>Security and scalability are the only 2 major reasons I can think of. I am interested to know how you secure file-based data unless you use ODBC, COM, etc., where there is no direct access to the files. Otherwise, the user has to have ReadWrite privs to the folder where the data reside.

First, security is a multi-issue issue.

The first issue is protection from the outside world. If you have a small to medium sized company (or a department within a very large company) that runs server software, if there is an internet connection on the network that server software has to be secured.

If the applications are company wide or department wide and we're dealing with a file-based database, we secure the entire file system from the outside world and our database is secured as well. On the other hand, if there is a database server running somewhere, this server needs to be secured separately (and usually by some trained DBA whereas the file database was secured by the same people who were trained to secure the rest of the network's resources).

Security in this general case is almost better for the file server. Another disadvantage is when holes are discovered in Oracle or SQL Server and the database server on the otherwise secured server becomes a problem.

The second security issue is individual application components, this can't be acheived easily by the above technique. But to be completely honest, I think this aspect of security is over rated. If you have a network secured from the outside and a company or department with a couple hundred users (unless you're a "security expert") you probably aren't so worried about employees finding a table file buried on the network and deleting it that you'll want to spend tens of thousands of dollars for that superflous functionality.

But obviouslly larger enterprises are, so is a file based data system dead in the water? Not exactly. If the applications that use this data have properly encapsulated business logic, it would be trivial to access the class through a Web Service, DCOM, .NET Remoting, or a home rolled server using a simple Adapter pattern. In this case (especially in the case of standards based Web Services) security at the application level is easily acheived and in straight forward manner (implemented by the application writers and not another DBA).

And using the file based system through a server like this brings scalability of both system to the same level.

>In addition to a traditional nightly backup, I also include the ability for my users to create ad-hoc backups within the app using DynaZip, but does it really include files that are open?

Yep. It will even correctly backup files while something like this is running:

Do While .T.
Insert Into TableBeingBackedUp (dt) values (DateTime())
EndDo

I haven't gotten any corrupt backups yet.