Today I’m going to share with you if you get stuck trying to learn IoC and implement it into your own ASP.NET MVC application.

I’ll not going to write a deep content about IoC but somehow I will share the short brief of the concept of IoC and how you can easily implement IoC in your ASP.NET MVC application using MVCContrib.

First of all, let’s share together what is IoC? and what it is for?

IoC stands for “Inversion of Control” which sometime it had been named as DI or “Dependency Injection”.

Actually, both is the same, just a different name.

IoC or DI is the concept that looks like how you code your application to make it support for plug-in architecture.

Such as the old days WinAmp which it can output multiple result from audio files such as…

• Output a sound to speaker (playing music)
• Output a sound to MP3 (encoding)
• Output a sound to WAV (decoding)

and blah blah blah…

There are several plug-ins for WinAmp as a DLL, when you need some new to make WinAmp to output to, you just coding a new DLL and implement what you want there.

This way, when you code the main app, you will never know or never care of what the output will do, it (main app) just output the sound stream to the output plug-in.

This is a good pattern and fit for ASP.NET MVC approach as it’s a real separation-of-concern.

And here is a snippet code of how you can implement this type of application. (plug-in enabled)

- Create an Interface for the output such as …
[csharp]

public interface IPlayerOutput
{
void Play(byte[] soundStream);

void Pause();

void Resume();

void Stop();
}
[/csharp]
- In the main app, you should add reference to IPlayerOutput interface and using it like this…
public void btnPlayClicked(object sender)

{

IPlayerOutput *output = new XXX; //Replace XXX with the code to create an instance of the chosen plug-in – usually populate from .DLL files within the output plug-in folder

output.Play(YYY); //Replace YYY with a stream of audio file

}
- This way, the main app will never care of what the output plug-in will do, it just send the audio stream to.

- When you want to code for a send-to-speaker plug-in, you just implement the IPlayerOutput interface and write code to send-to-speak there such as…
public class SpeakerOutput : IPlayerOutput

{

public void Play(byte[] stream)
{

// 1. Decode the audio stream

// 2. Send RAW to speaker

}
}
- If you want to code for WAV output plug-in, just do the same thing but different in the Play function such as…

public class WavOutput : IPlayerOutput

{

public void Play(byte[] stream)

{

// 1. Decode the audio stream as WAV format

// 2. Save WAV data to disk

}
}

- Then, you can let user choose which DLL to be used and load it into the IPlayerOutput interface within the main app. Voila!

So… How it is related to IoC?

Actually, it is the same concept as the plug-in architecture.

The main point is to make each components of application loosely coupled.

To make it simple, IoC is the concept to make your application’s layers independent as much as possible.

You can do IoC by coding like the above set of code in your application. However, it will take you sometime to do yourself.

And that’s why Castle Windsor come into place… They already created this type of things for you!

Anyway, I will not show here how it is being used by generic application. Instead of, I will use Castle Windsor in combination with MVCContrib to do IoC in ASP.NET MVC application.

All I can say is… “It is very easy to do, not that hard like what the concept did”.

To be continued on Part #2…

What is SEO-friendly URL?

It’s a URL that search engine love and will result in a better ranking for your web pages/site.

Let’s say you have an accounting system software and your product URL is http://www.xxx.com/product.aspx?Id=432 //Search engine will never know what the product is all about. They just saw Id=432 which doesn’t make sense for them. Actually, it also doesn’t make sense for human as well.

The SEO-friendly URL is a ‘wrapped’ URL to let people/robot read and know what this URL is all about. Let’s say about the above Product which have a new URL as http://www.xxx.com/product/AccountingSoftware

Search engine will know that this URL is all about Accounting software, then they will forward some traffic to your site with the “Accounting software” keyword.

In the PHP/Apache platform, the developer will usually use URL rewrite module easily. Almost every web hosting support this.

Unlike ASP.NET/IIS which is less flexible for configuration. You have to enable some URL rewrite ISAPI libraries which almost every web hosting don’t allow you to do that.

The good news is after ASP.NET MVC was released, it has a built-in routing feature which let you implement a SEO-friendly URL easily without messing up with IIS ISAPI.

You can provide many samples on Google, or even on Microsoft ASP.NET MVC website as well. See –> ASP.NET MVC –> Learn –> Routing and you will see how it’s easy to implement.

I’ll not provide a sample code here as I just want to mention that now you can easily implement SEO-friendly URL with ASP.NET.

Just try and leave me some messages if you got a problem implement it.

See ya babe!

Today I come to share with you how I choose a javascript library to be used on my new project.

I’m not talk about choosing just an AJAX library but I want some ‘full’ set of library which including both AJAX core and user interface core.

Here are my choices before consideration…

• jQuery
• YUI (Yahoo User Interface)
• ExtJs

Sorry that I didn’t included other libraries because I’m not impressed with any other at all.

First, jQuery, this is by far the best AJAX + effect library for me personally. I really love it because it produces a ‘short’ script. Especially when compared to YUI.

However, what jQuery lack of is UI components. You have to find out 3rd party for yourself.

So, I decide to move on YUI which currently have a bunch of UI components included.

What I can say about YUI is I really impressed with it. It has a BUNCH of UI included in the library which you can select to use or bypass.

However, most of the script produced by YUI is so ‘long’ when compared to jQuery.

So, now, I hold on both YUI and jQuery and finding for a better library in the market.

I finally found ExtJs.

Try yourself and let me know how you feel about it.

I feel the ‘MOST’ impress with ExtJs.

Cool UI and effect and I decided to use it in combination with jQuery.

This will help me reduce much time to develop my project.

Technical details will be continued in the next part while I’m developing my project.

Talk soon,

Seree W.

Did you ever use ASP.NET validation controls?

If you never heard or never use it before, see on the toolbox at the “validation” group.

Those are all validation controls.

- RequiredFieldValidator

- RangeValidator

- CompareValidator

- RegularExpressionValidator

- CustomValidator

- ValidationSummary

The main point of this control group is to be used to validate the input form entered by user before doing any postback.

But why?

As we can implement validation easily in code-behind.

Right?

It had to say Yes and No.

Yes, because validation coding in server-side (code-behind) is easier to code.

No, because while you know at the client that the data is invalid. Why you will let user postback to server?

Waste of bandwidth.

Totally waste!

This is the main reason why you have to use validation controls in your web forms.

Because it’ll help to reduce the unnecessary roundtrip between client and web server.

This will not affect much on the application that consumes less resource.

But it will be a big pain on the application that consumes much resource.

So, when you are dealing with input form.

Always use validation controls!

I know it will help you much.

Today, let’s see what .NET was provided to developer like us about cryptography.

In this post, I’ll talk about a brief of cryptography. How .NEt handle it and how many way to do some cryptographic in .NET.

For sample of implementation, I’ll cover it all from basic encryption to decryption, hashing, using message authentication code (MAC), hash-based message authentication code (HMAC) and even Digital signature. But it’ll continue to the next part.

Here we’ll focus to the cryptography in System.Security.Cryptography namespace.

.NET has divided cryptography into three main functionality basis.

1. Basic cryptography – See about encrypt & decrypt.

2. Hashing algorithm – See about hash calculation.

3. Digital signature – See about digital signature to be used in data transfer on network.

Let’s talk a brief one-by-one. Begin with basic cryptography.

1. Basic Cryptography

It’s like what its name saids. It’s totally a basic function on cryptography. With basic cryptography like this, it have been divided into two sub models.

1.1 Symmetric Key

Someone call this “Secret Key” but in theoritical, it usually named as “Symmetric Key” in term.

With this model, the person who want to encrypt the data required a single key called “Secret Key” in encryption process. Someone call this key as “Private Key”. It’s equal in meaning.

When people want to decrypt the data, they need to use the “Secret Key” that used to encrypt the data.

This all means both encryptor and decryptor should have the same “Secret Key” to work properly.

This wasn’t much secured because you need to give away the “Key” to public people to encrypt the data and send back to you. So with this model, we’ll have a higher risk to be attacked by man-in-the-middle method. As he may know the “Key” that we distributes. This known as weakness of symmetric key model.

1.2 Asymmetric Keys

Someone call this “Public Key Cryptographic System” or “PKCS”. As you may seen its name “Asymmetric Keys”. See the “Keys” not a “Key”. This extra “s” means we’ll have more than one key in this model. This requires a pair of keys.

The first one we call it “Public Key” and the second one is “Private Key”.

“Public Key” will be distributed to public people who want to encrypt the data and send back to us.

The only thing you should know about “Public Key” is that it should be used to encrypt data only. It’s unable to decrypt the data that have been encrypt by itself.

When you want to decrypt it, you should use “Private Key” only. This means, the data collector will keep “Private Key” alone and no need to distribute “Private Key” to anyone except himself.

This model will lowering the risk of man-in-the-middle attack. It’s all because the data collector people not need to distribute “Private Key”. So, It’s much easier to keep it confidential.

All we’ve talk is about the basic cryptography. The next part I’ll cover into the next topic. Hashing algorithm in brief.

I’ll try to finish all brief on MAC, HMAC and Digital signature in the next part. After that, we’ll play with the sample code in real world case study. And not theoritically-based at all, because I hate theoritically sample!

See yah next part.

I have a project that have to use this code….

var con = document.getElementById(“menu”);

con.style.left = “10″;

con.style.top = “20″;

When I run this code in Internet Explorer 6, 7.

I got it working like I want!

But when I try with Mozilla FireFox.

It never works!

Man! I hate DOM, if I have enough money. I’ll buy Microsoft and stop Internet Explorer project to reduce browser compatibility issues.

I try to use FireBug to change the css real-time, it does work very well.

The key point of this issue is that YOU MUST APPEND the property with UNIT!

I changed the code to…

con.style.left = “10px”;

con.style.top = “20px”;

And now it works!

Gotcha!

Simple & Stupid, right?

In a few days ago, I’ve just stuck with how to change “float” style in JavaScript and very confuse why it doesn’t work at all!

I’m using …

var obj = document.getElementById(“some1”);

obj.style.float = “left”;

No luck at all. I tried both on Internet Explorer and Firefox. Even I use Internet Explorer Toolbar and Firebug. I can change the style via that tools but no luck with JavaScript.

Silly?

I’m fool with DOM. I try to find a solution and suddenly found that.

In DOM, there are no “float” property but “cssFloat”.

Just change my code to …

var obj = document.getElementById(“some1”);

obj.style.cssFloat = “left”;

Really silly huh?

I just want to know that how do you do when you’re dealing with cross-browser web development.

Which tools you are using?

How do you handle those all buggies browser?

What experiences you faced?

As I’m dealing with cross-browser web development project where I generally strict with XHTML 1.0 standard. (As I’m using Microsoft Visual Studio 2005 and there is built-in XHTML 1.0 validator. Also, it has a built-in CSS validator too.)

I generally focus to most popular browsers including Internet Explorer 6.x, 7.x and Mozilla Firefox 2.x.

Below is my experiences and how I handle the project after I failed one. Yes, I failed one! Don’t get wrong like me! It waste your valuable time.

Internet Explorer 7.x, I love this one as it’s easiest to work with while I’m using Visual Studio 2005. For me, it’s not that hard to make Internet Explorer 7.x render HTML as I want.

Next, Firefox is ok but need some care to make it render HTML as you want.

Last, Internet Explorer 6.x is sucks for me as it made me headache over a few nights to get pass its rendering issues. Did you believe that if your pages crash. It might cause you’re using some standard CSS the wrong way (IE6 wrong way) such as float:left; Yes, it can crash most of IE6. Just try to googling for “IE6 float:left crash” and you gonna see the weird thing.

So, If you gonna begin on cross-browser web development. I suggests to go this way…

1. Open up your Visual Studio 2005, for your all pages (.aspx, .html). Set the HTML validator to “XHTML 1.0 Transitional”. This will let Visual Studio 2005 warn you when you not follow the XHTML 1.0 standard. Which is a good way to go. (Don’t go with later version of XHTML as It seems IE6 didn’t fully support it)

2. When working with CSS files. Set your CSS validator to “Internet Explorer 6.0″ or “CSS 1.0″. Don’t go later version for safety. Believe me, less version = less pain.

3. Using your targeted browsers to test your page layout in step-by-step. Do it strictly or you will entering the impossible to solve state after your hard work. I’m using IE7 as the main one. Then using Firefox in the same machine. For IE6, I go with Virtual PC. Yes, I’m working like this actually!

If you follow these 3 steps strictly. You will never get wrong with cross-browser issue like me. When I got this pain, I’ve to waste my time to re-architecture all pages layout.

More tips…

- If you’re using “float:left;” just follow with “display:inline;” to avoid the silly bug of IE6.

- If you’re in design state. Don’t go with table layout. Force yourself to go with table-less layout. Yes, I means using <DIV> instead of <TABLE>. Googling “tableless layout css” for more information. Strictly follow this! or you gonna hate IE later. Forget all about <TABLE>, it’s history now.

Conclusions

I’m very appreciated to receive all comments. Maybe your experiences or tips or …

Thanks you

Are you facing with the hell experiences when dealing with advanced web development?

First of all, We gonna clarify about what did I means for “advanced web development”.

For the sentence, I means that your web project are mostly dealing with client technologies. Such as those JavaScript, CSS, DOM, Ajax or even cross-browser compatibility issue. Those all are hard to track bugs and solve it.

After my bad experiences regards on this issue, I actually found that there are many useful tools that will help you much reduce the time to deal with them. Best lucks, most of all are FREE! Yes, right! It’s FREE! Don’t get me wrong.

Let’s see what I gonna suggests you to grab and use it on all of your web development project.

Internet Explorer Developer Toolbar

This tool will let you track all HTML element in your desired web page. Best of all, you can modify any CSS in real-time. Just as easy as you change CSS, the page get changed immediately. This tool is an add-on for Microsoft Internet Explorer 6.x, 7.x.

Let’s say it’s nearly a FireBug clone for Internet Explorer.

You can grab it here.

Fiddler

Don’t tell me you never heard about it! This tool will tell you how browser gonna load for your page. How many resources loaded? How about page’s size including their size. For my experiences, this is a cool tool but sometime it affect my IE to working in low stability.

You can grab it here.

For me. With these 2 tools, I can make my life much easier when doing general web development. But it’s not the same case if it’s an advanced web development!

Now I’ll face with cross-browser compatibility issue. Yes, if my web has a complex interface. They might not display the same in Internet Explorer or FireFox or even Safari.

So now, we gonna find some tools to deal with FireFox. (Sorry but I don’t mention to Safari)

FireBug

Ooh, If you play with FireFox long time enough. You should heard about FireBug. It just the same as Internet Explorer Developer Toolbar. But it’s definitely better by far.

Just grab it here and try out yourself.

Conclusion

There are many more tools available for your advanced web development today. But I select a few tools as to reduce your brain-conflict by too many tools. Believe me that you can stick with these tools and produce a high quality web site.

Bye

Last week I’ve found this quiz from my consultant customer. He has a scenario to let me help as a short describe here.

How do I select some records from SQL Server randomly?

It seems to be an easy question but what we can do if SQL Server doesn’t directly support this functionality! So, I decide to read on SQL Server’s online help to find out the solution and result on SQL Server don’t have any function that can select records randomly.

Now I’m thinking about Joe Celko, the person who you know when thinking about SQL puzzle or quiz. Just thinks to him but didn’t try to contact him cause I still believe this quiz gonna be too easy for him to implement.

So, I just continue on research…

After that, I seen many various methods to implement this functionality but most of them are implement at application level. Means your application just select all records and randomize some number then select the records randomly by indexing access. That I thinks not efficiency. Certainly, you feel the same as me or you’ll not reading until this. ^_^

In last weekend, while I’m finding for the best solution for this case. My friend come along to my home and talking about SQL Server and blah blah blah… and then he gave me an idea to solve this case. For god sake, this is a solution not an idea!

How the solution be and how it works?

The key just stay in NEWID() function!

For all people who don’t know what is NEWID() function. This is a built-in function in SQL Server that will generate a unique string which will not the same on each call. Just try it in SQL Server by executing this command. “SELECT NEWID()“.

Gotcha! It’s what someone called “unique identifier”, “GUID” or somethings else.

So now, how can I use this function to select records randomly?

It’s easy as someone may already clear on this case when I said on NEWID(). Just use it in ORDER BY clause!

SELECT * FROM Books ORDER BY NEWID()

You got it now. How easily!

Please keep in mind that, these tips can be effectively used after you’ve completed develop your web application too. As it doesn’t required much effort to re-design or re-programming. I’ll release another tips series that can be done before development begin too as It’s very effective than these tips.

Let’s roll out your hand now.

Tip 1 : Turn off debugging (Very effective)

This tip is for ASP.NET only, just go to your web.config and finding <compilation> then change debug=”false”

This will increase your web application performance dramatically!

What’s behind the scene?

When you change debug flag to false. All web resources (WebResource.axd?xyz) will be cached by browser while not when debug flag is true. Also, any script related with ASP.NET will be decreased in size. The output assembly will reduce on size too.

Don’t thinks much, when you go to production stage. Just turn it off!

Tip 2 : Turn off un-necessary ViewStates (Very effective)

This be able to do with ASP.NET only and will dramatically decrease your output HTML size! and you can do it just like turn off debug flag at the above.

Find out your ASP.NET standard control tags and check to see whether its state needed to be kept on every page lifecycle? If not, change the attribute “EnableViewState” to “false”. Do it all for every ASP.NET controls in your pages.

What’s behind the scene?

ViewState was used to keep the state on every page lifecycle. They implement by adding some characters into your output HTML. You can see it by view source at the browser and finding for ViewState keyword. You then see the unreadable characters in the output HTML. There is where the control’s state be kept. This tip can reduce much size on the output HTML!

Tip 3 : Re-organize objects in the page

Re-organize, I means revise the order of objects in your pages. Move your unnecessary objects (objects in my meaning is everything that reside on HTML including HTML tags, script, CSS, …) to the bottom of the page. Such as move your big script into the bottom of the page. This will let browser render the layout first then load big scripts later. In some case, very effective!. In one of my project, I can use this method to reduce around 12-15 seconds by re-organize objects in the page.

Tip 4 : Wrap up your inline/external script into a big external file

This means if you have write your javascript inline in the page. You may consider to wrap it up into one single external file. (assume myscripts.js)

Also, If you have many external files. (many .js) You may consider to combine all of them in to one big file instead of.

What’s behind the scene?

Browser can cache the external script file. (.js) and combine them into one single file will benefits on reducing the number of roundtrip when browser need to do cache validation.

Tip 5 : Change your HTML formatting style into CSS style

Throw away the old HTML formatting style such as <FONT…>,<COLOR…>, etc…

Replace with CSS formatting style that use class based. Define the formatting class then apply it to any tag you want.

eg.

.hilight
{
font-family:tahoma;
font-size:small;
color:white;
}

When any tags want to use this format, just apply to it.

eg.

<span class=”hilight” …>…</span>

Then combine your all classes into one big CSS file. (.css) This will gain the benefits like what Tip 6 did. Browser will cache it and reduce the number of roundtrip when browser do some cache validation.

Tip 6 : Use progressive rendering on your <TABLE>

If your targeted browser is Mozilla FireFox, just skip this tip as FireFox will do it naturally. But for Internet Explorer? No luck today. We’ve to do it ourselves to let Internet Explorer do progressive rendering. Before we go,

What’s progressive rendering?

In nature, when Internet Explorer found <TABLE> tag that generally be used to arrange the page’s layout. Internet Explorer will need to …

- Determine the table’s size by determine every cell’s size first

- Rendering entire table

This means, when Internet Explorer can’t determine the cell’s size then it will slow on rendering. Such as the case that you have a complex content in some cells that can’t be determine the content’s size. So, Internet Explorer should wait until all content be loaded and it’ll be able to determine the cell’s size now then it will render table later.

So, this will generate a very slow rendering for Internet Explorer when it found many complex content within the table.

Now, we should known the key that made Internet Explorer so slow rendering on table. Because it needs to know every cell’s size first!

So, what will happen if we can fix the size of cell?

Absolutely, it’ll render much faster and this is what we call “Progressive Rendering”. So now, how can I do it?

Here are the steps…

1. Apply CSS attribute called “table-layout:fixed” to <TABLE>.

2. Enter the <TABLE>’s width in style-sheet.

Here is what we’ll get…

<TABLE style=”table-layout:fixed;width:780px;” …> …

3. Enter each column’s width by using <colgroup> tag and style-sheet class.

For style-sheet,

.col1 {width: 31px;}
.col2 {width: 118px;}
.col3 {width: 109px;}
.col4 {width: 140px;}
.col5 {width: 376px;}
.col6 {width: 9px;}
.col7 {width: 200px;}
.col8 {width: 17px;}
.col9 {width: 1px;}

For <TABLE> tag,

<table style=”table-layout:fixed;width:780px;”>
<colgroup>
<col class=”col1″ />
<col class=”col2″ />
<col class=”col3″ />
<col class=”col4″ />
<col class=”col5″ />
<col class=”col6″ />
<col class=”col7″ />
<col class=”col8″ />
<col class=”col9″ />
</colgroup>

<tr>…
…

4. That’s all!

Tip 7 : Don’t slice your image too many!

Wow, go to the previous time. Web developer try to do their page to response faster by slicing a large image into many small images and use table to lay it out. It’s good for the pass, but in my opinion. It’s bad for now if you slice the images too much.

Why?

You may know that the browser such as Internet Explorer has a main thread to load for main page and 2 children threads to load related resources from the main page. So, what will happen If you have too much resources in the page? Even all of the resources are small. It loads very fast, but how about the roundtrip occurred? I seen many cases that too many small files will be loaded much slower than a few medium files.

So, just try and prove yourself that too many resource files can be pain to your page than a less but larger in size.

Conclusion

In the next time, I’ll write the optimization check-list that you can do it in design stage and can gain much benefits than these methods. I’ll include how-to do things like what PageFlake, NetVibes did. Highly interactive with fast response time. Ajax!

After my last few Transact-SQL training courses, one of my trainee had ask me on this scenario and I thinks it should be useful for most of people who are not concern much about SQL query performance which produce better processing time when compared to generic coding to query the result. You may not clear about what I’m writing now. Just see the following scenario.

Assume I have a table named [Book] which has the following structure.

- BookId as int – identity(1,1) – Primary key
- Title as varchar(100)
- Price as int

Then I assume that manager want a report just like this.

Title	Price	Price Range
Advanced SQL	25	Expensive
Intermediate C#	12	Cheap

You should see the column “Price Range” which do not reside in the table structure. Continue, I assume that if the price is expensive than 20 then I count as “Expensive” price range. If the price is less than 15 then I count as “Cheap”.

How should you do this report?

Most of my trainee do the following method.

1. Create an application then query for the columns [Title, Price].

2. They create a new column in report. In case of ASP.NET, they add a new template column into GridView.

3. In querying event for every record. (Such as Item data bound) They coding to check the condition whether the current record is expensive or cheap then output it.

Are there a better solution?

Certainly, If you focus on SQL query optimization. You should got a point to improve the performance of this process.

Let’s see the key.

Do you know about “CASE WHEN” statement in SQL?

Try to figure this query. Especially at the high-light.

SELECT Title, Price,
CASE
WHEN price > 20 THEN ‘Expensive’
WHEN price BETWEEN 15 AND 20 THEN ‘Medium’
ELSE ‘Cheap’
END
As ‘Price Range’
FROM [Book]

With this method, you never do some additional tasks like “adding template column” and “coding for price range”. You just binding this query to the GridView. I call this method “Column morphing” as with this method, you can create new column without structured on the table’s schema and can set the value in the column with any logical that SQL statement support.

So, does it better than the first method?

Definitely sure. Both on performance and less task effort. You can do more about “Column morphing” with the integration of sub-query. Just like the following case.

SELECT Title, Price,
CASE
WHEN Price > (SELECT AVG(Price) FROM [Book]) THEN ‘More than average’
WHEN Price = (SELECT AVG(price) FROM [Book]) THEN ‘Equal to average’
ELSE ‘Less then average’
END
As ‘Price Range’
FROM [Book]

Even more flexible when integrate with correlated sub-query. See the following more advanced case.

SELECT Title, Price,
CASE
WHEN Price > b.avgPrice THEN ‘More than average’
WHEN Price = b.avgPrice FROM [Book]) THEN ‘Equal to average’
ELSE ‘Less then average’
END
FROM [Book], (SELECT AVG(price) AS ‘avgPrice’ FROM [Book]) b

The last query will produce the same result as the previous one. (see if the current record is expensive than the average price or not) Except what each method actually process is very different.

In the 1st method, the average price calculation will be processed in every record. Think that If you have 100 records then it will calculate 100 times. Pain or not?

But the 2nd method will do the different. As you seen in the correlated sub-query. (which I’ve high-lighted as brown) You see that I put the average price calculation after FROM clause. This will force SQL parser to calculate the average price once and kept in alias table ‘b‘. This will generate much better in case of you’ve so much number of record to process.

Conclusion

It’s good to do what you can in SQL query as they’ve been optimized by database engine-self. If possible, provide as stored procedure is the best way to do as it will provide the fastest performance since the execution plan of query will be cached in memory. Got fast!

Now I’ll talking about a technique that script kiddies widely used to attack to the first wall of your application. If you’re a rookie for security topics on development then you may never heard about this before. In my .NET courses training experiences, most of my trainees never know about this issue before and they feel very surprises when I’ve hacked into their system in no time.

What is SQL injection?

Straightly, It’s something like you try to inject some unexpected characters into SQL querying process to gain the out-of-case result.

Let’s see it in more detail!

What should you do If you want to coding your application to authenticate user’s credential that kept in database?

So easy, right? I’m just querying the result from database with this simple SQL query and a few line of code.

Dim strSQL As String = “Select COUNT(*) From Members WHERE LoginName=’” & txtLoginName.Text & “‘ AND Password=’” & txtPassword.Text & “‘”

Dim cmd As New SqlCommand(strSQL, con)

cmd.ExecuteScalar()

It works perfectly! but how the it’ll handle if a hard core user input something unexpected into login name just like the following

xyz’ OR ’1′=’1

When it concatenate into SQL string. It’ll result in to…

Select COUNT(*) From Members
WHERE LoginName=’xyz’ OR ’1′=’1‘ AND Password=’1234‘

Yeah, you can see that OR ’1′=’1′ which always result in TRUE. So, the hard core user can authenticate to the application without knowing of any user’s login name or password.

How can I prevent SQL injection?

Yeah, it’s very easy to do. Just use the technique named as “Parameterized Query”.

OMG! What’s about it? I never heard about those “Parameterized Query”.
You get me in trouble again!

Not that serious, It’s very easy to implement this technique as .NET alraedy provide the framework for you. Just do the following two steps.

1. When you want to create the dynamic SQL query string just like this case. You should use parameter instead of concatenate the variables yourself.

Select COUNT(*) From Members WHERE LoginName=@LoginName AND Password=@Pwd

We call @LoginName and @Pwd as parameter.

2. Before executing the command. Please specify the value for each parameter first.

cmd.Parameters.AddWithValue(“@LoginName“, txtLoginName.Text)

cmd.Parameters.AddWithValue(“@Pwd“, txtPassword.Text)

cmd.ExecuteScalar()

When the command was executed. All parameters will be transformed into the value that suitable for the data type of those database. The good things you get here is that. For string (varchar) data type, generally it should open and close with single quote ” ‘ “. (You can see this code of the first code block) But not for parameterized query, as it will do automatically internal. So, you don’t have to pay your attention to those data type symbol for each database. (Especially datetime data type) and another point, the generated SQL query will never been attacked by SQL injection anymore as it know now how to handle those type of technique.

This is all about that!

For more information about SQL injection, please visit here.

I’m here to say that most of ASP.NET books on the market didn’t provide you the effective way to use authentication cookies.

Assume that when you’re working with form-based authentication. (Setting in web.config) When we do some manual authentication method, we imports System.Web.Security and using FormsAuthentication.RedirectFromLoginPage(“userName”, false). The ASP.NET authentication engine will automatically create a cookie to persist authenticate status. This cookies was used to identify the user have been signed in or not. So, when we want to store some of user’s profile. How do we do it?

We can coding to create new cookie object to store those profile but we already known that ASP.NET authentication engine already created the cookie when signed in. The question should be “How do we access this cookie? Is it possible?”.

Certainly, you can do it. Please review the following code.

In your login button’s click event.

if(AuthSucceeded){

HttpCookie cookie = FormsAuthentication.GetAuthCookie(txtLoginName.Text, false);

FormsAuthenticationTicket ticket = FormsAuthentication.Decrypt(cookie.Value);

FormsAuthenticationTicket newticket = new FormsAuthenticationTicket(ticket.Version, ticket.Name, ticket.IssueDate, ticket.Expiration, ticket.IsPersistent, “Secret|Role|CustomVar1″, ticket.CookiePath);

cookie.Value = FormsAuthentication.Encrypt(newticket);

Context.Response.Cookies.Set(cookie);

}

The above code was used to create an authenticated cookie with custom profile/data. (“Secret|Role|CustomVar1″)

When we need to extract the custom profile/data, we do with the following code.

FormsIdentity ident = (FormsIdentity)User.Identity;string strCustomData = ident.Ticket.UserData.ToString();

With this method, we don’t need any separated cookies to store the authenticated user’s profile anymore.

Hope this help you get step ahead on your ASP.NET skill.

Today I’ll give you a quick guide on how to create RSS Feed channel from your existing data. Before we go to the implementation, let’s see a brief overview of What is RSS, Feed or Atom?

RSS, Feed or Atom is a format name of the method for latest generation webmaster to feed their own updated contents into external web sites or any external applications. I focus to the word updated contents because this is a point of the method. (Now I’ll call it RSS and no more Feed or Atom) The content that provide RSS Feed channel almost often updated.

RSS content can be read by any RSS reader software such as Internet Explorer 7.0, Mozilla FireFox, Microsoft Outlook or any third party. Sometime it called “Feed reader” or “Aggregator” instead of “RSS reader”. Most of RSS reader can monitoring the RSS Feed channel and seeing if there are any changes occurred in the content when compared to previous time. This is very useful when some user don’t want to spend too much time to load any UI as it takes so much time than actual contents. If you still don’t get an idea and you have some RSS reader installed, you can try it online here. (Sorry, but the content of the feed is in Thai language. Just prove to get you idea)

For webmaster or developer like us, If you want to build your web site to stay tuned with Web 2.0 trend. You should build RSS Feed channel to your web application to let external applications consume your data and get more traffics.

In technically terms. RSS, Feed or Atom are all just an XML file that had their own format which RSS reader can be read. You can see the sample of XML structure here. (Just RSS 2.0)

So, how can we coding to build up RSS Feed channel from the existing data? It’s very easy, easier than you thinks!

Let’s examine the RSS 2.0 specification first.

<?xml version=”1.0″?>
<rss version=”2.0″>
<channel>
<title>Latest Know-How</title>
<link>http://www.knowhowdd.com/</link>
<description>Latest knowhow from www.knowhowdd.com</description>
<language>en-us</language>
<pubDate>Tue, 10 Jun 2003 04:00:00 GMT</pubDate>
<managingEditor>rss@knowhowdd.com</managingEditor>
<webMaster>webmaster@knowhowdd.com</webMaster>

<item>
<title>Custom ASP.NET Membership Provider</title> <link>http://www.knowhowdd.com/ShowKnowhow.aspx?khId=11</link>
<description>How to create your own custom ASP.NET authentication membership provider</description>
<pubDate>Tue, 03 Jun 2003 09:39:21 GMT</pubDate>
</item>

<item>
<title>Custom ASP.NET Role Provider</title>
<link>http://www.knowhowdd.com/ShowKnowhow.aspx?khId=25</link>
<description>How to create your own custom ASP.NET authentication role provider</description>
<pubDate>Fri, 30 May 2003 11:06:42 GMT</pubDate>
</item>

</channel>
</rss>

What I’ve hi-lighted in blue are header and footer sections which describe itself meaning. Next, what I’ve hi-lighted as red is body which contains your content items.

So, our development task is just to generate this XML stream from the existing data. It’s really easy to complete this task as .NET already provide a great XML class library. Let’s begin coding with VB.NET.

First of all, import some necessary namespaces.

Imports System.Text
Imports System.Xml

Then go to the code block where you want to generate the RSS Feed and coding to build header section just like the following…

‘Clear response
Response.Clear()

‘Write the beginning of RSS content
Response.ContentType = “text/xml”
Dim xtwFeed As New XmlTextWriter(Response.OutputStream, Encoding.UTF8)
xtwFeed.WriteStartDocument()
xtwFeed.WriteStartElement(“rss”)
xtwFeed.WriteAttributeString(“version”, “2.0″)
xtwFeed.WriteStartElement(“channel”)
xtwFeed.WriteElementString(“title”, “KnowHowDD.com – Latest Know-How on group : ” & g.Title)
xtwFeed.WriteElementString(“link”, “http://www.knowhowdd.com”)
xtwFeed.WriteElementString(“description”, “The latest know-how from KnowHowDD.com”)
xtwFeed.WriteElementString(“copyright”, “Copyright 2006 – 2007 KnowHowDD.com. All rights reserved.”)

The header section was completed now, then we’ll begin to build the body section of the RSS feed. Normally I’ll loop through the collection of data which I want to provide as RSS Feed channel.

‘Loop through all records to generate RSS body
For Each kh As KnowHowEntity In knowHows
‘Write body (Extract from database)
xtwFeed.WriteStartElement(“item”)
xtwFeed.WriteElementString(“title”, kh.Title)
xtwFeed.WriteElementString(“description”, kh.Description)
xtwFeed.WriteElementString(“link”, “http://www.knowhowdd.com/ShowKnowHow.aspx?knowHowId=” & kh.KnowHowId)
xtwFeed.WriteElementString(“pubDate”, kh.PubDate.ToString(“dd/MM/yyyy hh:mm:ss”))
xtwFeed.WriteEndElement()
Next

Now, the body section was completely built. Let’s complete the footer section.

‘Write the ending of RSS content
xtwFeed.WriteEndElement()
xtwFeed.WriteEndElement()
xtwFeed.WriteEndDocument()
xtwFeed.Flush()
xtwFeed.Close()
Response.End()

Easy or not, now it’s completed and we all got RSS Feed channel in our Web 2.0 style application!

This is my first post on blog about Microsoft .NET development. So, let me say a little sorry about my bad English.
Let’s go to those day that C/C++ language dominating Visual Basic all the time. If I can remember it takes more than ten years now since Visual Basic for DOS (1.0). In this blog I’ll show the various perspective and conclude about these two languages of choices for developer to be chosen for Microsoft .NET development.

Let’s take a look after them!

Comparison begin, who will win?

For Visual Basic, this language had dominated the development community due to it’s ease of use, short learning curve, rich GUI(s) and many more reasons. As It’s really easy for people to learn and begin programming in no time!
Personally, I’ve used Visual Basic since version 3.0. In those time it still using 3.5″ diskettes for setup. The first time I try it, I’m wondering how they can made GUI programming very easy. But I never use it in any commercial applications as those time the application built from Visual Basic is so slow when comparing to any C++ based compiler. So, I’m sticking with Borland C++ and Visual C++. A few years quickly passed, I’ve a chance to try Visual Basic again but now for 5.0. It had been improved so much! Very impresses to me. However, Its performance still generate the reason that I should not use it cause of it’s so slow when comparing to C++ based. But that time I’m really think that its WYSIWYG is very good and will increase my productivity significantly. So, I decide to learn it in a little deep details. At last, I still consider to stick with C++ based as the speed really made me sick about it. But now I’m finding some tools that has a cool WYSIWYG but based on C++. So, now I got a really cool tools. Borland C++ Builder.
I used Borland C++ Builder instead of Microsoft Visual C++ with MFC for a couple of years until what Microsoft said it’ll be the next generation of software development platform named Microsoft .NET. So, now I got a chance to try again on Visual Basic. Now in version 7.0 aka VB.NET. When compared to C++ application with Win32API it still slow in nature. But the productivity was very high now for .NET. So, I use just a few days to decide to go on .NET platform instead of any Win32API or J2EE platform and using both C# and VB.NET until today.
In my experiences regards on both languages. VB.NET has higher productivity in means of a few line of code and less task effort when developing than C#. So, I call it higher productivity. C# also high productivity but in my opinion, VB.NET is better on this topic. But there are somethings you should know about VB.NET and C# when comparison is begin. I written below as one-by-one…

Performance
No one win! as it’ll produce the same output as based on Microsoft CLR. (Common Language Runtime) So, who think that C# will take ahead from VB.NET on performance. It does not!

Number of line
In my experiences, VB.NET may written less number of line in the same task but in most case It should be equal as they using the same class library.

3rd party components
Equality.

3rd party tools
C# is better as some refactoring/intellisense tools support only for C#.

OOP
Now both of them is fully OOP. In .NET 1.1, VB.NET can’t do operator overloading but in .NET 2.0, it fully support!

My personal conclusion
For my experiences, I preferred VB.NET on small to medium scale of project but C# for large. As on the internet community, I found many C# developers was better than VB.NET. I should not be 100% but for my idea. I think that VB.NET is easies for learning. So, VB.NET may not clearly understand much about architecture and programming logic. But in case of C#, it may not that case as It’s a long time well structured from the past.
At last, it up to you and the application will produce a good or bad result will be based on your understanding of problem domain, solution and your logic. So, don’t bother much about languages!

Clearly no winner between VB.NET and C# but Microsoft!

I’m one of those guys who already tried and tired on ajaxify the application to fully working in Ajax basis. Until the day I found one of a great Ajax control suite named Telerik RadControls for ASP.NET. It was combined by various ASP.NET UI controls. Most of the controls, I can say nearly 100% already ajaxified for your instant using without deep knowledge on Javascript writing.

I found that my productivity was much increased by this suite and their support are great as I never seen this support anywhere even the more famous controls suite like Infragistics NetAdvantage, ComponentArt, ComponentOne or any other else. You can get quick response back within 24 hours with many samples on your desired case. So, for me It doesn’t a hard decision to afford it for 1 year subscription. After I’ve purchased, I found the bonus are very impressive as Telerik give us many interesting things than I thought. In my case, I purchase Telerik RadControls for ASP.NET with subscription for 1 year. I got Telerik RadControls for WinForms too. After purchase date around three months, Telerik releases new version of Telerik RadControls for WinForms with WPF. (Windows Presentation Foundation) and they give me too! What’s a kindly guy! In next six months, I found that the product was continuously updated around 4 times with many new features. Again, when they release their Telerik Reporting product. I also got it from current subscription and I thinks this reporting product are compact, fast and very easy on deployment. (I kicked out Crystal Reports, Microsoft Reporting Services and even DevExpress’ one – Every products I listed here are required to install some special executables into web server but Telerik’s just use XCOPY method)

If you are finding for a great Ajax controls suite. I can say that you will got the point when working with Telerik’s suite. Very very impressive!