ISAPI server extensions are DLLs. They work in the process space of the server. Concurrent requests made to an ISAPI extension are handled by separate threads. Therefore, the code in an ISAPI extension must be thread-safe.
Situation
Database access methods that use COM to handle initialization are not thread-safe. The specific problem lies in initializing the COM libraries in one thread and then using another thread to access the data. The current implementation of the Microsoft ODBC Desktop Drivers falls into this category. These drivers (dBase, Microsoft Visual FoxPro, Microsoft Access, Microsoft Excel, Paradox, and Text) that ship with Visual C++, use the Microsoft Jet 3.0 database engine, which is not thread-safe. Also, Data Access Objects (DAO) is a COM-based API, so it does not run reliably in the multithreaded environment of an ISAPI extension.
There may be other database access methods which are not thread-safe.
Resolution
To access a database from an ISAPI server extension, use an ODBC driver that has been designed and tested for multithreaded use. Microsoft's ODBC drivers for Microsoft SQL Server 6.x are an example.
The MFC ODBC database classes are thread-safe as of MFC 4.2. Be sure that any ODBC database driver you use with these classes is also thread-safe.
Applications that use the MFC ODBC database classes prior to version MFC 4.2 need to have the database code placed inside a critical section to ensure that only one thread accesses the MFC database code at a time. For more information, see class CCriticalSection.
Currently, the MFC DAO database classes are not thread-safe because they use the DAO COM-based objects.