Code Luck

Validation and Agile Principles

2007-08-09T22:02:00.001-05:00

I had earlier posted a javascript version of the
trim method, since a prebuilt one is not available.
But while watching Peter blum's DNRTV episode,
he showed that a prebuilt Trim method is available only when the method is used as (set as)a client side validator of the customvalidato control.

txtVal .value = ValidatorTrim(txtVal.value);

To hook up an additional control to the
ControlTovalidate use:

ValidatorHookupControlID("secondcontrolClientID",
"clientIDOfTheCustomValidator");

All credit goes to Peter Blum and DnrTV, blogging only for future reference purposes.

Also, ValidatorEnable(clientID) to enable/disable validators on the client side.

What I find funny is that these functions don't find a mention in the Professional series of
asp.net not have I come across these in forums/blogs I browsed up till now. I wonder how one is supposed to find out helpful things like these.

Also here is a list of Agile principles mentioned by Venkat on DrntV episode on agile design

DRY - Don't repeat yourself
YAGNI - You aren't gonna need it
OCP - Open Closed Principle
LSP - Liskov's substitution principle
DIP - Dependency inversion principle ( used in creating enumerators for various classes such as ArrayList, queue...)

Will expand on these as time goes.

Amazing shows, hail dnrtv.

Using HTTP Handler for dynamic image generation

2007-07-16T17:17:00.000-05:00

I was working on a project recently that needed bar charts to be created dynamically. We were not using sql reporting for this project. The bar chart needed to be changed/ updated based on certain criteria chosen from date controls, dropdowns etc.

One of the ways to achieve this is to create the image server side, store it on the disk on server and set the ImageUrl property of the image on the page to that saved image and send it to the browser.
This approach works but leads to addditional maintenance tasks, such as cleaning up old images, managing disk space etc...

One of the short comings of the asp.net image control Vs the image control in WinForms is that it lacks a property called "Bitmap" which allows you to assign a dynamically generated bitmap to the image control.

The only property exposed is the "ImageUrl".

I heard about http handlers and modules in podcats from polymorphic podcasts where Miguel Castro was explaining the use of HttpHandler to process certain file types.

Here is a formal definition from msdn : "An ASP.NET HTTP handler is the process (frequently referred to as the "endpoint") that runs in response to a request made to an ASP.NET Web application. The most common handler is an ASP.NET page handler that processes .aspx files. When users request an .aspx file, the request is processed by the page via the page handler.

HTTP handlers have access to the application context, including the requesting user's identity (if known), application state, and session information. When an HTTP handler is requested, ASP.NET calls the ProcessRequest method on the appropriate handler. The handler's ProcessRequest method creates a response, which is sent back to the requesting browser. As with any page request, the response goes through any HTTP modules that have subscribed to events that occur after the handler has run."

Scott Hanselman says : "Remember, an HttpHandler is the kind of thing you want to use when an HttpRequest is going to return a file or image to the browser. Basically anything other than a standard page. True, you could use a page, remove all the HTML from the ASPX part, and return stuff in Page_Load, but that's not really what pages are for, right? Also, Pages are themselves an HttpHandler (returned by PageHandlerFactory) so why not write your own HttpHandler?"

The processRequest for our bar chart image handler looks like this.

public void ProcessRequest (HttpContext context)
{
mPresenter = new ChartsPresenter(this);
ProcessQueryString(context);
DrawBarChart(context);
}

When the bitmap generation is completed, we output the bitmap in this fashion

context.Response.ContentType = "image/gif";
bitmap.Save(context.Response.OutputStream,
System.Drawing.Imaging.ImageFormat.Gif);

We associate the ImageUrl property of the image to the http handler created to output the bar chart. Here is an abstract base class for creating http handlers that return proper error codes in case of problems. Phil Haack wrote it.

Databind dropdowns to Enums

2007-07-11T15:15:00.000-05:00

Here is how you do it.

   20     private enum ReportTypes : int

   21     {

   22         ByVendor = 1,

   23         ByCategory = 2,

   24         ByType = 3

   25     }
   35     protected void Page_Load(object sender, EventArgs e)

   36     {

   37         if (!IsPostBack)

   38         {

   44             ddlReportTypes.DataSource = Enum.GetNames(typeof(ReportTypes));
   45             ddlReportTypes.DataBind();

   46         }

   47     }

   48     protected void ddlReportTypes_SelectedIndexChanged(object sender, EventArgs e)

   49     {

   50         ReportTypes rType =

   51             (ReportTypes)Enum.Parse(typeof(ReportTypes), ddlReportTypes.SelectedValue);

   52         switch (rType)

   53         {

   54             case ReportTypes.ByVendor:

   56                 break;

   57             case ReportTypes.ByCategory:

   60                 break;

   61             case ReportTypes.ByType:

   62                 break;

   63         }

   64     }

Web.Config Gotcha

2007-07-04T14:21:00.000-05:00

Midway into the project we sometimes realize that the intellisense in the web.config has vanished all of a sudden. The culprit being this line.


  10 <configuration xmlns="http://schemas.microsoft.com/.NetConfiguration/v2.0">

Removing the xmlns attribute from the configuration tag brings back the intellisense for the Web.Config.

  10 <configuration>

I saw this on one of the dnrtv shows, so credit goes to the author Miguel Castro.

Setting up Windows Authentication for Intranet Websites

2007-07-03T16:14:00.000-05:00

 Recently I was put on a project that needed to harness the built in windows security for user authentication. Idea was to allow access only tousers of subscribed to certain groups. Once authenticated, based on the group the user is subscribed to, I needed to perform custom actions.

The configuration started with the Web.Config. I added the authentication andauthorization sections to the Web.Config, specifying the authentication type and the groups authorized to access the site.

We deny access to anonymous users. Also, with the "Impersonate clause" we tell ASP.NET

to run using the permission/priveledges of the authenticated user

instead of the default asp_net user.

   37         authentication mode="Windows"

   38         authorization

   39             allow roles="MSDomain\Buyers,MSDomain\Clerks,MSDomain\Receivers"

   40             deny users="*"

   41         authorization

   42         identity impersonate="true"

In order to be able to find out whether a user belongs to a particular group and to get a list of groups a user is subscribed to, we needed to

specify a "roleManager" config section and set the default provider to "AspNetWindowsTokenRoleProvider". Until this is done, the any code written

to check whether the user is part of a group/list of groups will not work.

"Role Manager" helps us manage groups(roles) and perform group based authorization

in the applicaion. We need the role manager to help us identify the groups of which the authenticated user is a part of and perform actions like wise.

Msdn article about role management says:

"The main benefits of using role manager are that it allows you to look up users' roles without writing and maintaining code. Additionally, the

role providers offer a consistent way for you to check the role membership of your users, regardless of the underlying data store. Therefore,

if your role store were to change tomorrow, you would only need to change the configuration settings to make your code work."

 roleManager enabled="true" defaultProvider="WindowsTokenRoleProvider" >


The default role providers are as follows:

1. SqlRoleProvider
 - role information kept in SQL Server
2. WindowsTokenRoleProvider
 - read-only provider that retrieves role information for a 
   Windows user account based on the account's Windows security 
   group membership
3. AuthorizationStoreRoleProvider
 - used if your application uses Authorization Manager (AzMan)In my case, all I needed was to redirect user to corresponding portion of the site depending on their role, hence read-only role provider was

sufficient.

Msdn article says "The Windows security system acts as role store for this

provider, so no additional configuration is required to set up the role store"

Once the user is authenticated, we need to check if the user is part of a particular group, if yes, then perform the custom action.

Below is the code required to validate whether a user is part of a inranet group.

  120         if (User.IsInRole   (WindowsGroupSettings.SettingFor.Buyers))

  121         {

  122             if (this.LoadPricesForBuyer != null)

  123             {

  124                 _buyerName = User.Identity.Name;

  125                 LoadPricesForBuyer(this, EventArgs.Empty);

  126             }

  127         }


To get a list of groups a user is part of use the following code:

  140         if (!IsPostBack)

  141         {

  142             gvRoles.DataSource = Roles.GetRolesForUser(User.Identity.Name);

  143             gvRoles.DataBind();

  149         }

Notice that I have used the WebNavigator, MVP pattern in this project. :)

I am having a torrid time fighting the fonts/html in post that contain code copied using copySourceAsHtml,

especially code containing tags.

ASP.Net FormView Control.

2007-06-28T12:13:00.001-05:00

I was posed with the problem of a showing a list of data, displaying the details of a particular enry in the list and letting the user edit/update the entry, all on one page. I have seen such an scenario implemented with gridview with an "Edit" button as a column on the gridview and displaying the details on a modal popup. the modal popup would be either a "showModalDialog" based window or an Telerik RadWindow.

I wanted to specifically avoid having popups due to cross browser issues (did not have Telerik suite available for this project). To implement all of this functionality on a page I decided to user the Master-Detail mode with either the GridView-DetailsView or the GridView-FormView.

I srated off with a DetailsView by using TemplateFields for editable fields. soon, I realized the I had no control over the layout of the DetailsView and since I wanted to keep evething in the 1024X768 boundry, I decided on using the FormView.

FormView is very much like the DetailsView, it displays data item by item with paging support. What it offers you over the DetailsView is the ability to control the layout of the elements of the Detail and it also aleviates the need to implement an TemplateField for eahc and every field that needs to be edited.

It basically has an ItemTemplate & an EditTemplate, the contents/layouts of which are totally in the developers control.

  319         asp:FormView ID="fvExceptionDetails" runat="server"/asp:

  320         AllowPaging="true" DataKeyNames="Oid"

  321         OnModeChanging="fvExceptionDetails_ModeChanging"

  322         OnPageIndexChanging="fvExceptionDetails_PageIndexChanging"

  323         OnItemUpdating="fvExceptionDetails_ItemUpdating">

  324             ItemTemplate

  325             /ItemTemplate

  326             EditTemplate

  327             /EditTemplate

  328         FormView>

Since I am well versed with the event model of the GridView, I felt FormView would be similar to use and implement. But it is a bit different than the GridView and here are the events that need to handled in order for the FormView to work.

Each entry in the list displayed in the GridView was associated with zero or more detail entries that needed too be displayed in the FormView. Hence use of paging was obvious choice and had to have an handler in place for the PageIndexChanging event.

  261     protected void fvExceptionDetails_PageIndexChanging(object sender,

  262         FormViewPageEventArgs e)

  263     {

  264         fvExceptionDetails.PageIndex = e.NewPageIndex;

  265         DataBindExceptionDetails();

  266     }

The ItemTemplate had a LinkButton that had an CommandName="Edit" that when pressed should transform the FormView in the "Edit" Mode. so had to handle the ModeChanging event. Since I had did not want the user to move to anoher while editing, I disabled the Paging when in this mode. Also, I found that it was critical to DataBind() again in this even handler.

One thing to note would be that, in order to be able to access any of the elements inside the EditItemTemplate, the FormView has to be in that mode before you try and find the control using .FindControl("txtComment"). Hence the first statement in the ModeChanging event handler is the the .ChangeMode() method call.

  267     ///

  268     /// event invoked only when mode changed through UI.

  269     ///

  270     ///

  271     ///

  272     protected void fvExceptionDetails_ModeChanging(object sender,

  273         FormViewModeEventArgs e)

  274     {

  275         fvExceptionDetails.ChangeMode(e.NewMode);

  276         if (e.NewMode == FormViewMode.Edit)

  277         {

  278             fvExceptionDetails.AllowPaging = false;

  279         }

  280         else

  281         {

  282             fvExceptionDetails.AllowPaging = true;

  283         }

  284         if (e.NewMode != FormViewMode.Insert)

  285         {

  286             DataBindExceptionDetails();

  287         }

  288         SetJSonclickAttribute();

  289     }

The EditTemplate contained 2 buttons at the end, namely the "Update" and "Cancel". In order to implement the "Update" functionality I had to have implement the ItemUpdating event handler.

  322     protected void fvExceptionDetails_ItemUpdating(object sender,

  323         FormViewUpdateEventArgs e)

  324     {

  325         //perform update logic here.

  326         fvExceptionDetails.ChangeMode(FormViewMode.ReadOnly);

  327         fvExceptionDetails.AllowPaging = true;

  328;/span>         DataBindExceptionDetails();

  329     }

I hope this implementation detail helps. One thing to note would be that I was not using an ObjectDataSource/SqlDataSource to populate the Detailsview.

ASP.Net Page Cycle

2007-06-24T14:31:00.000-05:00

Understanding the ASP.Net page cycle is important and helpful in cases where you need to make changes to a control/ add a conrol/ change the master page at runtime, etc..

Here is the sequence of events and a brief description of the critical ones. I haven't had the chance to use of all of them as yet.

Order top to bottom

PreInit (method: Page_PreInit)

Themes and master pages are applied between PreInit and Init, hence PreInit is the last place to programtically modify the selected theme/masterpage. When implmenting "Nested Master pages" while maintaining the ability to see pages in design mode in VS 2005, one needs to set the the change the page's current master page ( the base master page) to the nested master page using this event.

Init

This event is called before any state is restored from the
client response. It is used to prepare the Page for processing the request. Dynamic controls can be added in this event.

InitComplete

Child controls are created between this event and the "InitComplete" event if it is a postback. Also, Control/View State is loaded if it is a postback.

PreLoad

Load

Most commonly used event. It is used to initialize control values on a GET request (!IsPostBack). It is called after
the control/view state has been restored in the Init event on a POST request (IsPostBack) before control passes to the specific event that caused the postback.

LoadComplete

To be used to move code from the PreRender event,
the place to make last minute changes to controls.

PreRender

Used to make any post-event modifications to the controls (Last place to make a change before they get rendered). Recently, I created an editable gridview consiting of 2 columns, one a "State" dropdown and the other "Type" dropdown whose content needed to be changed based on the state selected. I had a Telerik RadAjaxPanel around the Grid and wanted to change the content of the "type" dropdown based on the selection in the "State" dropdown. I had specifically used the PreRender event to tie the "State" dropdown to the "Type" dropdown for every row in the Grid.

PreRenderComplete

Render

UnLoad

Safari Beta 3 for PC released

2007-06-12T08:02:00.000-05:00

I am excited, Apple has released Safari Beta 3 for the Windows. Though it crashed on my machine and I still haven't been able to see it run on my machine, I did see it running on my colleague's win xp box.

A substantial amount of education related community use the mac's and we had a lot of requests to make the sites "Safari" compatible.

This is a big player entering the pc browser market and should make things interesting.

Get it at Safari Beta 3 for PC

Asp.net Release mode Request timeout

2007-06-09T11:10:00.000-05:00

On one of the projects, the administrator triggered of an event that created a flat file based on the contents of a database. This task needed around 10-20 minutes to complete. The task completed fine when in debug mode but never in release mode.

Upon talking to an Architect in the company it dawned upon me that there ASP.NET has something called "Request Timeout" (seperate than Session timeout) and this varies between the debug and the release mode. For the debug mode, the duration is a year while for release mode the request timeout is 90 seconds. Hence the abrupt request termination.

He pointed me to this:
Code Better: Peter Gekko: Timeout of an asp.net page

In short the code looks like this:

  279     protected override void OnInit(EventArgs e)

  280     {

  281         timeOut = Server.ScriptTimeout;

  282         // Give it 5 hour = (3600 * 5) = 18000 seconds

  283         Server.ScriptTimeout = 18000;

  284     }

This task can be completed using an ASP.NET Async page or by spawning a separate thread/process. I will make a post on that experience. Till then, this is workable.

Javascript gotcha

2007-06-08T09:14:00.000-05:00

I recently ran into an issue with JavaScript where the script tag was ended with

Please overlook the missing "<" at the start of the script tags, since blogger understandingly has issues with script tags.

script src="../jscalender-1.0/calender.js" />
script src="../jscalender-1.0/calender/look.js" />
script src="../jscalender-1.0/calender/feel.js" />
script language="javascript" type="text/javascript">
function showCalender()
{
}
/script>

In spite of the rendered page containing the above script blocks, the showCalender function was not found and I kept getting a runtime javascript error: Object not found.

IE provided no clues about what is happening, finally when I looked at the source in Firefox with the color scheme, it dawned upon me that only the first script tag is being recognized while the rest are being ignored.

When I changed them to:

script src="../jscalender-1.0/calender.js"> /script>
script src="../jscalender-1.0/calender/look.js" > /script>
script src="../jscalender-1.0/calender/feel.js" > /script>
script language="javascript" type="text/javascript">
function showCalender()
{
}
/script>

So the moral is, close the JavaScript tags with /script> even though the /> might work in certain cases, it baffles you in cases like this.

Books and Tree Surgeon

2007-06-02T17:48:00.000-05:00

I am almost about to finish Joel on software. It is a fun book for developer and actually puts a smile on your face. I really liked his style of writing and presenting this experiences.

He says on recruiting, he only looks for 2 qualities in "Smart" and "gets things done".

I also like his "Joel Test" for evaluating employers. Quoting him:

1.Do you use source control?
2.Can you make a built in one step?
3.Do you make daily builds?
4.Do you have a bug database?
5.Do you fix bugs vefore writing new code?
6.Do you have an up-to-date schedule?
7.Do you have a spec?
8.Do programmers have a quite working conditions?
9.Do you use the best tools money can buy?
10.Do you have testers?
11.Do new candidates write code during their interview?
12.Do you do hallway usability testing?

Also interesting is his idea about "hallway usability testing", which I actually implemented on a recent project. Its amazing how much input you get from fellow developers, their criticism, ideas to make the ap better. Hallway testing will stay with me forever.

I recently bought Code Complete, Jeff Atwood swears by this book. I want to read this book, its a big one. He considers it as the bible for all software developers.

I went to Barnes and nobles to read a book called Head First Design Patterns, I really liked the book and concepts were explained so beautifully. I just read about the "Strategy Pattern" and loved the way they presented the materials. I liked the line "Just because you know every OO concept doesnt mean you know how to use they".
some of the concepts I can still remember are

Encapsulate everything that changes
Use Composition over inheritance
Code to Interfaces and not implementations.

I came accross an amazing tool called "Tree Surgeon" which creates a development tree for you. just give it a project name and "voila" it creates a development tree for your project. One of the criticism asp.net received from David Heinemeier Hansson was that asp.net gives you a clean slate when you start with a new project. One has to be knowledgeble enough to setup the testing framework, business layer, build project. If you are new to .Net and not fortunate enough to have a good mentor, you would probably end up with a bloated project. Tree Surgeon does all that for you.

I am going to try and use it in some home project, probably a project to do an existing project using the MVP pattern. I will report my findings.

It will also introduce me to NAnt build system. I have only been using VS 2005 for building my projects uptill now.

IIS User

2007-06-01T08:50:00.000-05:00

It might be a 101 but this week it struck me that the user under which IIS runs differs in WinXP and Win 2003. I was always under the impression that IIS runs under the local aspnet account (hostname\ASPNET).

Well, it turns out that it runs under ASPNET in XP (which most developers have) but runs under "Network Service" in Win 2003 which most servers have. I was setting an old website for maintainance purposes and the IIS user needed write permission to a certain folder (for ActiveReports PDFs to be written) .

Cassini, the internal web server for VS 2005 seemed to have access to that folder fine. I then setup a virtual dir for this project on my local IIS and gave ASPNET user write access and it worked. It took me a while to realise that under Win 2003, IIS runs under "Network Service".

Anyways, here is an article about it.

How To: Use the Network Service Account to Access Resources in ASP.NET

Mozilla Blogspot Issue

2007-05-23T11:29:00.000-05:00

I am having this weird issue with Mozilla not able to display the html spurted out by CopySourceAsHtml utility and it happens only with the first post with html created by CopysourceAsHtml.

IE displays the posts correctly. Will have to look into this.

Compact Framework : Table Exist Method

2007-05-23T10:51:00.000-05:00

In PDA based database applications one has to sometimes pull database/tables from the host machine/server onto the PDA (such as specific insurance agent's collection data). The procedure used is Remote Data Access (RDA). Compact framework has a stripped down version of the framework and some functionality available in the full framework isn't present on it.

I had a condition where I needed to I needed to check if a certain table existed on the pda database and if not then pull it from the server. I needed a table exist method and wanted to avoid the try catch code block which I have seen in use to derive that a table doesn't exist if you get a exception on something like this
'select (count(*) from premiums;'

I knew there would be a cleaner way to know if a table exist in a database or not.

Here is the method :

We query the meta data and get a clean answer, no try/catch needed derive the answer.

  430         ///

  431         /// Queries the information schema to find whether a table exists or not

  432         ///

  433         ///

  434         ///

  435         private bool TableExists(string table)

  436         {

  437             bool retAnswer = false;

  438             try

  439             {

  440                 int exist = (int)ConnectionManager.DBInfoConnection.ExecuteScalar(

  441                     "SELECT count(*) FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_NAME='" + table + "'");

  442                 if (exist == 1)

  443                     retAnswer = true;

  444             }

  445             catch (Exception ex)

  446             {

  447                 GenericLogger.Error("Could not query database for list of tables", ex);

  448             }

  449             return retAnswer;

  450         }

Please ignore the non use of SqlParameters. I had to add this as a maintainence method in an

2-3 years old app and when you have to decide between your urge to make drastic(essential)

changes to a system and the number of hours that have been alotted

to this task, I think pragmatism wins.

Visual Studio Must have tools & blog roll

2007-05-20T11:26:00.000-05:00

If you are in ASP.NET development you are sure to stumble upon Scott Hanselman, the author of Professional ASP.NET 2.0. Recently I have started reading his blog reliously. Here is his list of tools and VS 2005 addins that are a must have and not to be missed.

Scott Hanselman's list of power tools

He has a important take on blogging. He rightfully contends that you will have returning audience only if your blog content is well formatted/indented and easy on the eyes.

I have started using the CopySourceAsHtml VS2005 plugin to do code blog posts. As you can see, I need to clean up old code posts on this blog and use the tool above to have the posts easy on the eyes.

I also like Jeff Atwood's writing, he says make it a habit to blog atleast once a week and make a commitement, since interpersonal and communication skills are so important and needs to honed with time. He writes on human factors in software development.

You can't miss Joel Spolsky author of the blog Joel on Software. His books are hilarious and fun to read.

I listen to Craig Shoemaker as often as I can. His show/blog is essential for every asp.net developer. He has the knack to explain beautifully the why/how/where approach for a solution.
Most podcasts/screencasts assume you know about things, while he explains things from the ground up.

One cannot miss the blog of the ASP.Net guru Scott Guthrie for ASP.Net tricks, tips, hacks, patches and advice.

I like to read blog by Jean Paul Boodhoo for knowledge about Test Driven Development and pattern based development.

I also sometimes refer to Scott Mitchel's blog. Scott, is a ASP.NET guru and consultant. He has an excellent series on "Working with Data in ASP.NET 2.0".

I will be editing this list this week, it is no way near completion.

Sanitization against Sql injection attacks.

2007-05-17T08:31:00.000-05:00

Here is what I use to sanitize my text input before inserting into DB. Most of the code is from a msdn article on how to avoid sql injection attacks.

   29         ///

   30         /// make search text input sql safe.

   31         ///

   32         ///

   33         ///

   34         private static string SafeSqlLikeClauseLiteral(string inputSQL)

   35         {

   36             // Make the following replacements:

   37             // '  becomes  ''

   38             // [  becomes  [[]

   39             // %  becomes  [%]

   40             // _  becomes  [_]

   42             string s = inputSQL;

   43             s = inputSQL.Replace("'", "''");

   44             s = s.Replace("[", "[[]");

   45             s = s.Replace("%", "[%]");

   46             s = s.Replace("_", "[_]");

   47             return s;

   48         }

   49         ///

   50         /// make text input sql safe

   51         ///

   52         ///

   53         ///

   54         private static string SafeSqlLiteral(string inputSQL)

   55         {

   56             return inputSQL.Replace("'", "''");

   57         }

   58         ///

   59         /// convert '' to ' when returning to the user, Remember, only to be used

   60         /// when returning strings to user.

   61         ///

   62         ///

   63         ///

   64         private static string Desanitize(string output)

   65         {

   66             return output.Replace("''", "'");

   67         }

Group Number in SQL Reporting Services

2006-11-29T10:39:00.000-06:00

Found this after lot of searching.

I was grouping data in a table in a SQL report. I could successfully add row numbers to the details of the group but was unable to add row numbers to group header.
Something like this

1 ClaimID1

1
2
3

2 ClaimID2

1
2
3
4
5

3 ClaimID3

1

The following expression helped adding the row number for the groups
=RunningValue(Fields!ClaimID.Value, CountDistinct, Nothing)

javascript Trim method

2006-11-03T10:34:00.000-06:00

Javascript has no trim() method that is required all the time.

This script will strip starting and ending spaces for you..

   72 // JScript File

   73 //javascript left & right trim similar to stringObj.Trim() in C#

   74 function trimAll(sString)

   75 {

   76     while (sString.substring(0,1) == ' ')

   77     {

   78         sString = sString.substring(1, sString.length);

   79     }

   80     while (sString.substring(sString.length-1, sString.length) == ' ')

   81     {

   82         sString = sString.substring(0,sString.length-1);

   83     }

   84     return sString;

   85 }

Detecting Session Timeout in Asp.Net

2006-10-03T17:34:00.000-05:00

Alas post after a while. I wanted to detect session timeouts and redirect the user to the logon page with the appropriate message.
I stumbled upto this code (it works) which helps detect a session timeout in asp.Net.

One needs to follow the common BasePage pattern and inherit all the pages from this common page.
All the common functions can be put in this page.

///
/// This overriden method helps handle Session timeouts.
/// Credit to author.
///
///

   84     /// <summary>

   85     /// This overriden method helps handle Session timeouts.

   86     /// </summary>

   87     /// <param name="e"></param>

   88     override protected void OnInit(EventArgs e)

   89     {

   90         base.OnInit(e);

   93         //It appears from testing that the Request and Response both share the

   94         // same cookie collection.  If I set a cookie myself in the Reponse, it is

   95         // also immediately visible to the Request collection.  This just means that

   96         // since the ASP.Net_SessionID is set in the Session HTTPModule (which

   97         // has already run), thatwe can't use our own code to see if the cookie was

   98         // actually sent by the agent with the request using the collection. Check if

   99         // the given page supports session or not (this tested as reliable indicator

  100         // if EnableSessionState is true), should not care about a page that does

  101         // not need session

  102         if (Context.Session != null)

  103         {

  104             //Tested and the IsNewSession is more advanced then simply checking if

  105             // a cookie is present, it does take into account a session timeout, because

  106             // I tested a timeout and it did show as a new session

  107             if (Session.IsNewSession)

  108             {

  109                 // If it says it is a new session, but an existing cookie exists, then it must

  110                 // have timed out (can't use the cookie collection because even on first

  111                 // request it already contains the cookie (request and response

  112                 // seem to share the collection)

  113                 string szCookieHeader = Request.Headers["Cookie"];

  114                 if ((null != szCookieHeader) && (szCookieHeader.IndexOf("ASP.NET_SessionId") >= 0))

  115                 {

  116                     //string url = "~/Default.aspx?x=" + RedirectMessage("Session Timed out.");

  117                     //Response.Redirect(url);

  118                     Session["TimeoutMessage"] = "Your Session timed out";

  119                     Response.Redirect("~/Default.aspx");

  120                 }

  121             }

  122         }

  123     }

Object Databases, Part I

2006-09-28T10:48:00.000-05:00

The choice of the backing store in a large project is almost always a political decision that's already been made for you. If your company already has a farm of Oracle 9 databases, well... that automatically becomes your choice. Rarely does a single consultant or developer get to pick a database solution. It's almost always a case of, "This is what we have; deal with it."

So chances are high that I'll never ever get to use Object Databases in a project situation, given their poor market penetration. However, here is an excellent comparison of Object Databases versus traditional RDBMS systems from DevX.

I am playing around with an Object Database called db4o, which is licensed under GPL for non-commerical use. More on that later.

Configuration using Jakarta Commons

2006-09-25T14:57:00.000-05:00

I've played around quite a bit with the Jakarta Commons libraries over time and over several projects. Among these, the Jakarta Commons Configuration library is extremely useful.

Very often, we encounter a particular crosscutting concern when developing medium to large scale projects: that of managing user and/or application preferences. This seemingly simple task often leads to much wasted and duplicated effort when the development team should really be focusing on core project tasks. The Commons Configuration library can come to the rescue in such situations.

Managing user/application preferences can get complex depending on the requirements. Consider:

(1) The project may start out storing configuration information in simple ".properties" files, but later, some genius might want to migrate everything to XML files. In such instances, you want the property accessor calls abstracted out enough so that the migration can take place with minimal, localized code change and without breaking property accessor calls which might be sprinkled throughout the codebase.

(2) You might want to support a hierarchy of property sources. For example, you might have an application-wide property source that provides the default values, but allow each user to specify his or her own property file to override the defaults. In other words, you need to support multi-source, composite configurations.

(3) You will in some cases want to support nested and/or list-based properties in your properties files.

(4) You will want to synchronize access to shared properties files in case of concurrent updates.

(5) You might want to provide an "autosave" feature or an "auto reload" feature when a preference/property is updated.

Well, the Jakarta Commons Configuration library goes a long way in providing a very flexible framework for configuration/preferences management. It supports ".properties" file based configurations and XML files. The accessor syntax for the XML files is XPath-like and can get quite intricate, I noticed.

A wonderful feature is the provision of configuration change listeners which can listen for changes to a properties file and respond appropriately. Any Java class can set itself up as a listener to a Configuration object, which fires the required events.

I have yet to compare the Jakarta Configuration library with the Preferences API in Java, but from a cursory glance, it seems to me like the Preferences API does not even come close in power. Also, the .Net System.Configuration classes seem to be much more specific in the sense that they seem to concentrate on providing access to the .Net framework config files like machine.config and web.config and not so much on supplying a flexible and generic configuration management framework.

Wishlist: A nice addition to the Commons Configuration library might be access methods to configuration data stored in relational databases and hierarchical stores like LDAP, but that is probably asking for too much.

More powerful collections

2006-09-21T08:57:00.000-05:00

If the Java Collections Framework is too limiting for you, then you should check out the open source Jakarta Commons Collections from the Apache project.

It adds several important extensions such as ordered maps, bi-directional maps, bags (i.e. multi-sets), Fifo queues, and certain other convenience features like iterators and transformation primitives.

I believe .Net has a multiset implementation in its System.Collections.Specialized namespace, but no bidi maps. Also Jakarta Collections adds a type-check primitive to ensure that only objects of a certain type get stored in a collections, though I don't think this removes the overhead of boxing and unboxing that you typically encounter in generic collections that store data as "Objects". Type-safe collections that don't do boxing and unboxing will necessarily speed up operations on large collections, but the only way to have that seems to be the C++ templates, .Net generics, or Java 5 generics. The trade0ff with generics is of course binary code bloat leading to larger executables, not to mention more intricate syntax.

10 Things You Shouldn't Do with SQL Server

2006-09-20T10:12:00.000-05:00

I came across this old post about some 'Don't' with SQL server. I found it helpful and elightening about some facts.
http://www.sqljunkies.com/Article/92CC4817-604D-4344-8BE0-4490F8ED24B6.scuk

Here are some snippets from it.

1. SCOPE_IDENTITY() Vs @@IDENTITY

@@IDENTITY will return the last identity value entered into a table in your current session (this is limited to your session only, so you won't get identities entered by other users). While @@IDENTITY is limited to the current session, it is not limited to the current scope. In other words, if you have a trigger on a table that causes an identity to be created in another table, you will get the identity that was created last, even if it was the trigger that created it. Now this isn't bad, as long as you ensure that things are done in the correct order. Where this can get ugly is when there is an application revision and a new trigger gets added that gets fired from your stored procedure. Your code didn't anticipate this new trigger, so you could now be getting an incorrect value back.

SCOPE_IDENTITY(), like @@IDENTITY, will return the last identity value created in the current session, but it will also limit it to your current scope as well. In other words, it will return the last identity value that you explicitly created, rather than any identity that was created by a trigger or a user defined function.

2. Prefix Stored Procedures with "sp_"

It is strongly recommended that you do not create any stored procedures using sp_ as a prefix. SQL Server always looks for a stored procedure beginning with sp_ in this order:
The stored procedure in the master database.

The stored procedure based on any qualifiers provided (database name or owner).

The stored procedure using dbo as the owner, if one is not specified.

Therefore, although the user-created stored procedure prefixed with sp_ may exist in the current database, the master database is always checked first, even if the stored procedure is qualified with the database name.

I took time and broke the tradition of prefixing the stored procs with sp_ and renamed all my stored procs by removing the prefix, also replaced @@IDENTITY with SCOPE_IDENTITY() for future maintainance purposes.

For Pros these might be 101s, but his article explained by exactly not to do some things, rather than just putting it down as a rule on the holy grail.

Velocity Templates

2006-09-19T11:55:00.000-05:00

HTML templating has always appealed to me. For most database-backed web pages, dynamic generation of the entire page--especially the static parts that don't change--is a bit of a bother. Conceptually, a HTML page can be seen as a combination of static bits that don't change often and dynamic bits that change often depending on data coming from a backend data store. A good example is a roster of students signed up for a course. The static bits in this page might be the navigation bars, course information, faculty information, etc. while the list of students might be an incremental and dynamic HTML table that grows/shrinks as students sign up or drop the course.

Generating the static parts of the above page in say, a servlet, is a pain. A simple edit like a change in a faculty's phone number will require a code change if the generation of the static parts is embedded in code. Templates solve this problem by abstracting the static parts out in a template file which looks like a HTML file but with the addition of placeholders for dynamic content. In the case of Velocity, the dynamic content is generated by a Java program or a servlet. The dynamic content is then merged with the template to produce the final output to the client. An edit to a prof's phone number now becomes a simple edit in a text editor to the template. No code change is required.

Velocity facilitates a separation of concerns. Web designers can work with the template (provided they don't mess with the dynamic content), while business logic gurus can take care of serving up the dynamic data in the page.

In my opinion, the separation is not very clean because it is quite easy to distribute the dynamic placeholders all over the template, making the template look like a horrible mess of HTML tags and Velocity tags. Web Designers might recoil in horror at working with such a template. But if some discipline is exercised in the structuring of the templates, it can be an useful tool.

One concern that might be expressed is that the merging of templates is a relatively slower operation than generating the page by hand. The good news is that some of that loss in speed can be mitigated by turning on template caching in a properties file that Velocity supplies for configuration purposes. If the data does not change between requests, the output page is fetched from the cache instead of being merged and re-generated.

Note: Velocity is a generic template engine and therefore can be used for any sort of templating task, not just HTML templates. For example, it can be used for sending out bulk mail with a mail merge sort of feature by utilizing email templating.

Google Web Toolkit

2006-09-14T09:10:00.000-05:00

The idea behind the Google Web Toolkit is simple.

When building rich-n-thin clients using DHTML and AJAX, many people have noticed that Javascript standardization in browsers is--how shall we say it--piss-poor. Differences in event handling, divergent error handling, DOM quirks; it's a party. Throw in the fact that Javascript is loosely typed and you will soon start pulling your hair out by the handfuls.

The Google Web Toolkit offers this proposition: Write your AJAX apps in Java and then compile the code into Javascript. You get the benefits of programming in a strongly typed, true OO language and also some protection from browser quirks since they are abstracted out for you by the GWT.

Note that you can't use the entire set of Java libraries while coding a GWT app, of course. You can only use a subset that can be translated into Javascript. For example, it is crazy to use the threading classes and expect that to be translated into Javascript. But quite a few classes from the java.lang and java.util are available for you to use. Personally, I wasn't very impressed with this. For example, why can't I use the Drag and Drop Java API and have the resulting code translated into browser-agnostic Javascript? More and more AJAX apps are providing drag-n-drop support; it would have been nice to have this support in GWT.

Where GWT really shines is in the custom wrapper classes that are provided for you. The DOM has been completely abstracted out for you. So have events, cookies, timers, the top level browser window, the history list. A HTTPRequest object serves as an interface to the XMLHTTPRequest to make AJAX calls in a cross-browser way. There are classes for JSON parsing, XML parsing, and making RPC calls.

Also, the list of widgets provided is impressive: a Grid, a FlexTable (a dynamically growing/shrinking table), a Tree, a TabPanel, among others. It really beats coding these common UI elements in pure DHTML and Javascript.

What really speeds up the development cycle is that you can code up a storm in Java and then run your app in a "hosted" mode which is like a local Java runtime. If your application runs in hosted mode, it is guaranteed to run in "web" mode, which means it will run cross-browser. Once you have your code tweaked in hosted mode, it is a simple matter to run a compile shell script (provided by the GWT) to translate the Java to Javascript.

Shortcomings of GWT: Sometimes you have to get down and dirty with Javascript because the GWT doesn't quite manage to encapsulate everything for you behind a Java facade. A good example is lack of support for drag and drop. Or something like, say the Observer/Observable classes in Java--surely that could have been translated to Javascript. I know that pure Javascript libraries exist that implement the Observer pattern.

Personal opinion: I think GWT is here to stay, unless the next version of ECMAScript i.e. version 4, makes toolkits like the GWT philosophically redundant.

Note: I believe the Microsoft community has something similar to the GWT called Script# that uses C# as the front-end language instead of Java.

asp:RangeValidator gotcha!!!

2006-09-06T13:51:00.000-05:00

I was using rangevalidator in my user controls.

the ranges I was setting was

0 - 49
0 - 100

For some reason, the validator for (0-100) range was validating only 0 & 100 and invalidating the rest. It wasn't clear to me why it wasn't working for 0-100 while it was working for 0-49.

Both being part of same user control there was no discrepancy in settings of the control.

After searching on the net I found that one has to set the "Type" property of the asp:RangeValidator to "Integer" apart from setting the "MaximumValue" and "MinimumValue", in order for it to consistantly work for any range of integers.

Other Type options are

Currency
Date
Double
Integer
String

Generic Business layer

2006-09-05T22:04:00.000-05:00

On my current project I have discovered a nice way to write generic database access code in the business layer.
Most database access operations are

a. returning DataTable of results (for binding with
objectdatasource & other controls)

b. Inserting/updating data

c. returning a single value (execute scalar)

The approach I have been following is to reduce the number of places where I write database code (code reuse) so as to make it maintainable and make necessary changes in a few places instead in all of the business layer.

e.g

  148 public class DBHandler

  149 {

  150     private static DataTable GenericGetDataTable(string storedProc,

  151     params SqlParameters[] parameters)

  152     {

  153         DataTable retTable = null;

  154         string connStr = Configuration.AppSettings["ConnectionString"];

  155         using (SqlConnection conn = new SqlConnection(connstr))

  156         {

  157             conn.open();

  158             SqlCommand cmd = new SqlCommand(storedProc, conn);

  159             foreach (SqlParameter para in parameters)

  160             {

  161             cmd.Parameters.Add(para);

  162             }

  163             cmd.CommandType = CommandType.StoredProcedure;

  164             .

  165             .

  166             .

  167             .

  168             conn.close();

  169         }

  170         return retTable;

  171     }

  172     public static DataTable GetBooks( int publicationID, string authorName)

  173     {

  174         SqlParameter pubID = new SqlParameter("@pubID", publicationID);

  175         SqlParameter authName = new SqlParameter("@authName", authorName);

  176         return GenericGetDataTable("sp_getAllBooks", pubID, authName);

  177     }

  178     public static DataTable GetPapers(int journalID, int year)

  179     {

  180         SqlParameter jourID = new SqlParameter("@journalID", journalID);

  181         SqlParameter jYear = new SqlParameter("@year", year);

  182         return GenericGetDataTable("sp_getAllPublications", jourID, jYear);

  183     }

  184     .

  185     .

  186     .

  187     .

  188     // similarly for INSERT & Execute Scalar methods

  189     private static object GenericExecuteScalar(string storedProc,

  190     params SqlParameters[] parameters)

  191     {

  193     }

  194     private static int GenericInsert(string storedProc,

  195     params SqlParameters[] parameters)

  196     {

  198     }

  199 }

Here we use the params SqlParameters[] parameters to accept variable number of arguments in turn enabling us to write generic methods.
This way we minimize the places where we write database access code. I think I achieved a lot of code reuse by this aproach.

One would say that why not have ONE generic public method in DBHandler (for each operation) that accepts a storedProc & parameters. The only argument I have against this approach is that, with this approach my "page behinds" (controllers) will be clouded by names of stored procedures and SqlParameters statements. I think this would cause more maintainance depending on all the places from where it is called. I think it wouldn't be completely MVC complaint.

In this approach, only the changes need to made to the DBHandler class and specific methods if needed.

I have also realised from reading some posts from microsoft gurus that they are prominently using "using () { }" in their database access operations in order to dispose of the connection objects.

Good & tested RegularExpression for validating passwords?

2006-08-28T18:05:00.000-05:00

Any sample tested and working Regular expression for validating the password?

I was using
RequiredFieldValidator
ID="RequiredFieldValidator1" runat="server"
ErrorMessage="Please enter password" ControlToValidate="txtPassword" Display="none">

RegularExpressionValidator
ID="regValPassword" runat="server"
ErrorMessage="Enter valid password" Display="None"
ControlToValidate="txtPassword" ValidationExpression="^\w{3,12}$">

for basic filtering

any better thoughts for allowing 8-12 char passwords with special characters too?

I found some scripts on the net but they didn't seem to work with

asp.net's RegularExpressionValidator

Thoughts welcome.

Setting up SSL in ASP.Net 2.0

2006-08-28T17:25:00.000-05:00

Today I was given the task of setting up SSL support for a ASP.Net website.
Here are the steps I had to take

1. Install IIS 6.0 Resource Kit,
http://www.microsoft.com/downloads/details.aspx?FamilyID=56FC92EE-A71A-4C73-B628-ADE629C89499&displaylang=en

which contains "Selfssl.exe".

SelfSSL (SelfSSL.exe) can help you generate and install a self-signed SSL certificate. Because the SelfSSL tool generates a self-signed certificate that does not originate from a trusted source, use the SelfSSL tool only in the following scenarios:
• When you have to create a security-enhanced private channel between your server and a limited, known group of users
• When you have to troubleshoot third-party certificate problems

2. Create a certificate for use, similar to this
selfssl.exe /N:CN=testMachine /K:1024 /V:7 /S:1 /P:443
where

/K:key size Specifies the key length. Default is 1024.
/V:validity days Specifies the validity of the certificate. Default is 7 days.
/S:site id Specifies the id of the site. Default is 1 (Default Site).
/P:port Specifies the SSL port. Default is 443.

3. Go to your IIS MMC-> "Default Website" and right click for "Properties". Go to the "Directory Security" tab and under "Secure Communication" associate the recently created certificate to the server certificate. Now all websites under the "Default Website" will have this Server certificate.

4. Browse to your virtual directory under the "Default website" and right click for "Properties".Go to the "Directory Security" tab and under "Secure Communication" click "Edit".
Then check the "Require Secure Channel" checkbox.

Now the entire site will be under ssl and the url that would be needed to use will need "https" and not "http".

But we also need to take care of the default redirecting to the start page if someone uses "http" instead of "https". If this feature is not implemented then the user will see a 403;4 page and will have to manually change the "http" to "https".

The following steps are needed to enable default redirection to the secure start page.
Please refer
http://weblogs.asp.net/pwilson/archive/2004/12/23/331455.aspx
for details
1. In your project, create a basic html page "Redirect.htm" with the following code

body onload="Redirect()"

[javascript]
function Redirect()
{
window.location = "https://testMachine/SllTest/SignOn.aspx";
}
[/javascript]

Note: Replace javascript with script tags and put braces before and after "body" tag

2. Browse to your virtual directory under the "Default website" and right click for "Properties". Click the "Custom Errors" tab and select the "403;4" error. Then click "Edit Properties" and set the error page to "Redirect.htm" in you r project directory.

3. Browse to your virtual directory under the "Default website" and rightclick on "Redirect.htm" and in the "Directory Security" click "edit" and turn off "Require Secure Channel" for this page.

So now our Redirect.htm is the only page that is unsecured and all it does is to redirect the user to the sign in page.

Happy SSLing. ;)

Cool Collaboration

2006-08-25T10:18:00.000-05:00

If you don't want to plunk down the money for Microsoft Sharepoint, you can get by with TikiWiki for some quick and easy collaboration among members of a project team. Tiki is an open-source Wiki software that I installed yesterday on my work laptop (A Dell XPS Pentium-M 2.0 GHz machine with 1GB RAM).

Tiki is powered by PHP4 and needs a web server and a database. I went with IIS 6 and MySQL 5.

The installation procedure is similar to something like Wordpress--it is possible to buy Tiki hosting space from an ISP, or install it locally.

First, download and install PHP. You can register PHP with IIS either as an ISAPI extension or as a CGI module. ISAPI is faster and more secure, but I went with CGI (which is simpler to install).

Next, you need to create a database user and a database schema in MySQL for Tiki. I used MySQL Administrator which comes with MySQL 5. You can use phpMyAdmin also if you like administering your MySQL over the web.

Next, extract the Tiki software in a directory on the local file system, and create a virtual directory (I called it "tiki") in IIS that points to the location of your Tiki installation.

Next, point your browser to http://[your web server]/tiki/tiki-install.php and setup of your Wiki will commence.

I loved the features offered by this software. I hesitate to call it simply "Wiki" software because it offers much more out of the box. I am still exploring, but it offers, in addition to the Wiki capabilities:

(1) Blogs, which is a nice touch if a particular member wants a soapbox of his/her own.
(2) Articles (by topic)
(3) Quizzes
(4) Forums (They included a complete forum/BB software??)
(5) Surveys (I have yet to toy with this)
(6) A group calendar
(7) Group chat
(8) FAQs
(9) Newsletters
(10) A workflow engine.

Whew!

The Wiki software allows your site to be customized with themes and menus. And there is mail notification for changes. As if all this wasn't enough, Tiki is extensible with custom modules written in PHP. For example, there is a calculator mod, a world clock mod, a mod for WebDAV access to your Wiki, a mod that imports some cool avatars, etc.

I like.

ViewState, SessionState and Application State 101

2006-08-24T10:26:00.000-05:00

Here are a few things I learnt about  ViewState, SessionState and ApplicationState today.

ViewState property is used to save data in a hidden field on a page. Because, ViewState stores data on a page, it is limited to items that can be serialized. Complex items have to converted to & from strings.

ViewState info from one webform isunreadable to other webforms
Property
        ICollection ViewState.Values
Method:
       ViewState.Add(string key, object value)

One should limit the access points to Application & Session State and basically create page level variables to store data from these and write back to them at the end.

Maintaining Session state affects performance.

Application state variables are available throughout a current process but not accross processes. If an app is scaled to multiple servers or multiple processors within a server, each process has its own application state.

In Visual C#, be sure to test whether the state variable is null or not before using methods like ToString() on it.

Mechanisms for communication between webforms

Context.Handler object (Use this object to retrieve public members of one webform's class from a subsequently displayed web form.
Query strings
Cookies
ViewState
Session state
Application State

SqlDataSource Vs ObjectDataSource

2006-08-24T09:10:00.000-05:00

Here are the arguments
From: http://www.theserverside.net/news/thread.tss?thread_id=29919

Unsuspecting programmers, it is claimed, will use the SqlDataSource control and unknowingly commit the unforgivable architectural sin of mixing their user interface, business logic, and data access layers.

The SqlDataSource control enables you to represent a database connection, and common database commands, declaratively. Simply by declaring an instance of the SqlDataSource control in a page, you can represent SELECT, INSERT, UPDATE, and DELETE commands which can be executed against a database.

SqlDataSource control is considered "really, really bad" is that it encourages programmers to flatten what should be many into one. The SqlDataSource control mixes business logic and data access layers into the user interface layer.

Mixing the data layer with the UI is a BAD idea, period. Sure there may be times when you can get away with it, but the eventual unmanageability of it will greatly outweigh the short-term productivity gain. Creating logical layers of abstraction doesn't require physical separation of layers. Just moving the DAL into a separate class is a good idea because it gives you a single place to look for code dealing with the database. In the SqlDataSource scenario, if you change a stored procedure that is used on more than one page, you have to track down every page to make the change. This is bad design incarnate.

Behind the scenes the SqlDataSource control generates the ADO.NET classes (Datasets, SqlCommand, etc.) that is necessary to access the data defined in the control's markup. But what about reuse? If I'm calling a stored procedure with several parameters through a series of page requests, it would be nice to get some reuse from the parameter collection ala Data Access Application Block's parameter caching.

The ObjectDataSource control however does provide an architecturally sound way to bind web page controls to a middle-tier (logical, not necessarily physical) layer. So, for those web developers out there who want the ease of use that comes with declarative data binding, I recommend they use the ObjectDataSource control and forego the SqlDataSource control altogether.

I think as a best practice, one should always use ObjectDataSource since it allows us to seperate the business layer logic from the UI and follows the MVC.

I came accross this because I wanted to sort a GridView. I was assigning a DataTable returned by a method to the GridView's datasource. If we create a explicit DataSource object and bind the GridView to it then the gridview is able to talk to the datasource and takes care of the sorting/paging.

The object datasource helped me to grab data from a stored procedure and hence with zero sql code in the UI and kep it clean.

HTML::Embperl

2006-08-23T09:52:00.000-05:00

Perl is a powerful language. And it can be terribly concise. I believe there are competitions that award prizes for the most concise (and most illegible, of course) Perl programs.

Perl also fits a niche. If you are a sysadmin-type scripting sort of person, it is the tool for you. The core language has powerful text-processing facilities; and packages exist for everything else such as database access, XML parsing, whathaveyou.

But if you thinking of programming-in-the-large, forget about it. Object oriented support is available from Perl 5, but the syntax is clumsy and looks tacked on as an afterthought. CGI programming? You are probably better off with PHP.

But I digress.

I recently saw and played with HTML::Embperl, which is a Perl package that lets you insert Perl code snippets in your HTML. Think JSP, but with Perl instead of Java. On the surface, seems like a good thing. The power of Perl directly from your Web pages, without having to worry about having to explicitly program to a CGI interface. But "the surface" often misleads.

Quite frankly, the philosophy (not to mention the syntax) of Embperl made me cringe. Over the years, I have come to appreciate the good things that happen when you separate concerns. Embperl--not unlike carelessly programmed JSP--throws seperation of concerns out the window.

Frameworks are often derided. Frameworks like Struts or Wicket try to separate concerns and this leads to a steep and complex learning curve. Embperl goes in the opposite direction and this makes it tempting for some, especially for smaller projects. But if there is one thing that I have learned, it is this: There *are* no small projects. Even the smallest project has a way of growing and bloating past its original intent.

I would personally put my money on the frameworks.

Asp.Net Session timeout about to happen Warning?

2006-08-19T18:16:00.000-05:00

Any idea about how to implement the autoclose Session timeout windows that some bank websites imlement?

I have been playing with giving the user an alert before a session timeout in a secure website.Here is a basic method that I found.
/*************************************************************************/

int int_MilliSecondsTimeOut = (this.Session.Timeout * 60000) - 120000;
string str_Script = @"
function Reconnect()
{
alert('Session is about to Timeout in 2 minutes.\n Please complete work and submit');
}
window.setInterval('Reconnect()'," + int_MilliSecondsTimeOut.ToString() + @");
";
Page.RegisterClientScriptBlock("Reconnect", str_Script);

/*************************************************************************/

This javascript method gets called 2 minutes before a Session timeout but it needs user attention and doesn't autoclose (render useless after timeout period expires) and log the user out.

One way could be using Form Authentication in Asp.Net.

Ideas welcome.

P.S.

javascript Script tages seems to be banned in blogger, while yahoo 360 blogs allow it. ;)

I think applying HtmlEncode() solves the security and page beaking issue. I think that what nneeds to be done whenever projects which use FCKeditor have to do in order to allow users to create text with html tags in it.

ASP.NET Custom Error Pages

2006-08-19T16:07:00.000-05:00

I came across this article about ASP.NET custom error pages while trying to trap exceptions before the user sees them. I needed to implement a global exception handler plus a way to redirect the user to a generic error page in case of uncaught exceptions.

http://www.aspnetresources.com/articles/CustomErrorPages.aspx

This helped in trapping uncaught application, Page exceptions

Point to Note
ctx.Server.ClearError();

should be commented in
global.asax
OnError event of base page

in case we want the user to be redirected to a custom error page as set in web.config

Test

2006-08-09T12:32:00.000-05:00

Test Post. Nothing here to see.

•	When you have to create a security-enhanced private channel between your server and a limited, known group of users
•	When you have to troubleshoot third-party certificate problems