Challa DotNet FAQ's Blog

How to Optimize Stored Procedure in sql server

2011-10-10T15:08:00.001+05:30

· Include SET NOCOUNT ON statement.

· Use schema name with object name.

· Do not use the prefix “sp_” in the stored procedure name.

· Use IF EXISTS (SELECT 1) instead of (SELECT *).

· Use the sp_executesql stored procedure instead of the EXECUTE statement.

· Try to avoid using SQL Server cursors whenever possible.

· Keep the Transaction as short as possible.

· Use TRY-Catch for error handling.

Include SET NOCOUNT ON statement: With every SELECT and DML statement, the SQL server returns a message that indicates the number of affected rows by that statement. This information is mostly helpful in debugging the code, but it is useless after that. By setting SET NOCOUNT ON, we can disable the feature of returning this extra information. For stored procedures that contain several statements or contain Transact-SQL loops, setting SET NOCOUNT to ON can provide a significant performance boost because network traffic is greatly reduced.

CREATE PROC dbo.ProcName
AS
SET NOCOUNT ON;
--Procedure code here
SELECT column1 FROM dbo.TblTable1
-- Reset SET NOCOUNT to OFF
SET NOCOUNT OFF;
GO

Use schema name with object name: The object name is qualified if used with schema name. Schema name should be used with the stored procedure name and with all objects referenced inside the stored procedure. This help in directly finding the complied plan instead of searching the objects in other possible schema before finally deciding to use a cached plan, if available. This process of searching and deciding a schema for an object leads to COMPILE lock on stored procedure and decreases the stored procedure’s performance. Therefore, always refer the objects with qualified name in the stored procedure like

SELECT * FROM dbo.MyTable -- Preferred method
-- Instead of
SELECT * FROM MyTable -- Avoid this method
--And finally call the stored procedure with qualified name like:
EXEC dbo.MyProc -- Preferred method
--Instead of
EXEC MyProc -- Avoid this method

Do not use the prefix “sp_” in the stored procedure name: If a stored procedure name begins with “SP_,” then SQL server first searches in the master database and then in the current session database. Searching in the master database causes extra overhead and even a wrong result if another stored procedure with the same name is found in master database.

Use IF EXISTS (SELECT 1) instead of (SELECT *): To check the existence of a record in another table, we uses the IF EXISTS clause. The IF EXISTS clause returns True if any value is returned from an internal statement, either a single value “1” or all columns of a record or complete recordset. The output of the internal statement is not used. Hence, to minimize the data for processing and network transferring, we should use “1” in the SELECT clause of an internal statement, as shown below:

IF EXISTS (SELECT 1 FROM sysobjects
WHERE name = 'MyTable' AND type = 'U')

Use the sp_executesql stored procedure instead of the EXECUTE statement.
The sp_executesql stored procedure supports parameters. So, using the sp_executesql stored procedure instead of the EXECUTE statement improve the re-usability of your code. The execution plan of a dynamic statement can be reused only if each and every character, including case, space, comments and parameter, is same for two statements. For example, if we execute the below batch:

DECLARE @Query VARCHAR(100)
DECLARE @Age INT
SET @Age = 25
SET @Query = 'SELECT * FROM dbo.tblPerson WHERE Age = ' + CONVERT(VARCHAR(3),@Age)
EXEC (@Query)

If we again execute the above batch using different @Age value, then the execution plan for SELECT statement created for @Age =25 would not be reused. However, if we write the above batch as given below,

DECLARE @Query NVARCHAR(100)
SET @Query = N'SELECT * FROM dbo.tblPerson WHERE Age = @Age'
EXECUTE sp_executesql @Query, N'@Age int', @Age = 25

the compiled plan of this SELECT statement will be reused for different value of @Age parameter. The reuse of the existing complied plan will result in improved performance.

Try to avoid using SQL Server cursors whenever possible: Cursor uses a lot of resources for overhead processing to maintain current record position in a recordset and this decreases the performance. If we need to process records one-by-one in a loop, then we should use the WHILE clause. Wherever possible, we should replace the cursor-based approach with SET-based approach. Because the SQL Server engine is designed and optimized to perform SET-based operation very fast. Again, please note cursor is also a kind of WHILE Loop.
Keep the Transaction as short as possible: The length of transaction affects blocking and deadlocking. Exclusive lock is not released until the end of transaction. In higher isolation level, the shared locks are also aged with transaction. Therefore, lengthy transaction means locks for longer time and locks for longer time turns into blocking. In some cases, blocking also converts into deadlocks. So, for faster execution and less blocking, the transaction should be kept as short as possible.
Use TRY-Catch for error handling: Prior to SQL server 2005 version code for error handling, there was a big portion of actual code because an error check statement was written after every t-sql statement. More code always consumes more resources and time. In SQL Server 2005, a new simple way is introduced for the same purpose. The syntax is as follows:

BEGIN TRY
--Your t-sql code goes here
END TRY
BEGIN CATCH
--Your error handling code goes here
END CATCH

Best Sql Server Interview Questions 2000/2005/2008 : Part 1

2011-10-04T14:12:00.000+05:30

1. Difference between DBMS and RDBMS

DBMS – Data Base Management System	RDBMS –Relational Data Base Management System or Relational DBMS
DBMS has to be persistent, that is it should be accessible when the program created the data ceases to exist or even the application that created the data restarted. A DBMS also has to provide some uniform methods independent of a specific application for accessing the information that is stored.	RDBMS adds the additional condition that the system supports a tabular structure for the data, with enforced relationships between the tables. This excludes the databases that don’t support a tabular structure or don’t enforce relationships between tables.
DBMS does not impose any constraints or security with regard to data manipulation it is user or the programmer responsibility to ensure the ACID PROPERTY of the database	RDBMS defines the integrity constraint for the purpose of holding ACID PROPERTY. RDBMS may be or may not be Client Server Database System.
Ex: DBMS – File System, XML	Ex: RDBMS – SQL Server, Oracle

2. Difference between Normalization and De-normalization

Normalization	De-normalization
Database normalization is a data design and organization process applied to data structures based on rules that help building relational databases. In relational database design, the process of organizing data to minimize redundancy is called normalization. Normalization usually involves dividing a database into two or more tables and defining relationships between the tables. The objective is to isolate data so that additions, deletions, and modifications of a field can be made in just one table and then propagated through the rest of the database via the defined relationships.	De-normalization is the process of attempting to optimize the performance of a database by adding redundant data. It is sometimes necessary because current DBMSs implement the relational model poorly. A true relational DBMS would allow for a fully normalized database at the logical level, while providing physical storage of data that is tuned for high performance.
Normalization is a technique to move from lower to higher normal forms of database modeling.	De-normalization is a technique to move from higher to lower normal forms of database modeling in order to speed up database access.

3. What is Difference between DELETE and TRUNCATE Commands?

DELETE	TRUNCATE
Delete command removes the rows from a table on the basis of the condition that we provide with a WHERE clause. DELETE can be used with or without a WHERE clause	Truncate will actually remove all the rows from a table, and there will be no data in the table after we run the truncate command. Can’t apply where condition on Truncate
DELETE removes rows one at a time and records an entry in the transaction log for each deleted row. Delete is slower than Truncate	TRUNCATE removes the data by deallocating the data pages used to store the table’s data, and only the page deallocations are recorded in the transaction log. Truncate is faster
DELETE does not reset Identity property of the table.	TRUNCATE removes all the rows from a table, but the table structure, its columns, constraints, indexes and so on remains. The counter used by an identity for new rows is reset to the seed for the column.
Possible	You cannot use TRUNCATE TABLE on a table referenced by a FOREIGN KEY constraint.
It can be rolled back.	Using T-SQL – TRUNCATE cannot be rolled back unless it is used in TRANSACTION. OR TRUNCATE can be rolled back when used with BEGIN … END TRANSACTION using T-SQL.
DELETE is DML Command.	TRUNCATE is a DDL Command.

4. How is ACID property related to Database?

ACID (an acronym for Atomicity Consistency Isolation Durability) is a concept that Database Professionals generally look for while evaluating databases and application architectures. For a reliable database, all this four attributes should be achieved.

Atomicity: is an all-or-none proposition.

Consistency: guarantees that a transaction never leaves your database in a half-finished state.

Isolation: keeps transactions separated from each other until they are finished.

Durability: guarantees that the database will keep track of pending changes in such a way that the server can recover from an abnormal termination.

5. What are the Different Normalization Forms?

1NF: Eliminate Repeating Groups

Make a separate table for each set of related attributes, and give each table a primary key. Each field contains at most one value from its attribute domain.

2NF: Eliminate Redundant Data

If an attribute depends on only part of a multi-valued key, then remove it to a separate table.

3NF: Eliminate Columns Not Dependent On Key

If attributes do not contribute to a description of the key, then remove them to a separate table. All attributes must be directly dependent on the primary key.

BCNF: Boyce-Codd Normal Form

If there are non-trivial dependencies between candidate key attributes, then separate them out into distinct tables.

4NF: Isolate Independent Multiple Relationships

No table may contain two or more 1:n or n:m relationships that are not directly related.

5NF: Isolate Semantically Related Multiple Relationships

There may be practical constrains on information that justify separating logically related many-to-many relationships.

ONF: Optimal Normal Form

A model limited to only simple (elemental) facts, as expressed in Object Role Model notation.

DKNF: Domain-Key Normal Form

A model free from all modification anomalies is said to be in DKNF.

Remember, these normalization guidelines are cumulative. For a database to be in 3NF, it must first fulfill all the criteria of a 2NF and 1NF database.

6. Triggers inside Stored procedure

Got a query from users like, “Is it possible to use trigger inside stored procedure. If not why? If yes how?”

My answer is “No”

We can’t use trigger inside stored procedure because trigger is an object which is binded with table objects.

1. The inherent property of the trigger is to fire automatically if any condition breaks and it’s associated with DML operations. But we are trying to create and initiate it from the stored procedure.

2. It will loose its property as a System object.

My answer is “Yes”

1. To provide an alternative way, Microsoft provides us a new concept named CLR integration in sql server 2005.

2. We can create Managed trigger and wrap it in the stored procedure.

7. What is a View?

If we have several tables in a db and we want to view only specific columns from specific tables we can go for views. It would also suffice the needs of security some times allowing specific users to see only specific columns based on the permission that we can configure on the view. Views also reduce the effort that is required for writing queries to access specific columns every time.

8. What is an Index?

An index is a physical structure containing pointers to the data. Indices are created in an existing table to locate rows more quickly and efficiently. It is possible to create an index on one or more columns of a table, and each index is given a name. The users cannot see the indexes; they are just used to speed up queries. Effective indexes are one of the best ways to improve performance in a database application. A table scan happens when there is no index available to help a query. In a table scan, the SQL Server examines every row in the table to satisfy the query results. Table scans are sometimes unavoidable, but on large tables, scans have a terrific impact on performance.

9. What is an Identity?

Identity (or AutoNumber) is a column that automatically generates numeric values. A start and increment value can be set, but most DBAs leave these at 1. A GUID column also generates unique keys.

10. What is a Linked Server?

Linked Servers is a concept in SQL Server by which we can add other SQL Server to a Group and query both the SQL Server databases using T-SQL Statements. With a linked server, you can create very clean, easy–to-follow SQL statements that allow remote data to be retrieved, joined and combined with local data.

Stored Procedures sp_addlinkedserver, sp_addlinkedsrvlogin will be used to add new Linked Server.

11. What is a Cursor?

A cursor is a database object used by applications to manipulate data in a set on a row-by-row basis, instead of the typical SQL commands that operate on all the rows in the set at one time.

In order to work with a cursor, we need to perform some steps in the following order:

· Declare cursor

· Open cursor

· Fetch row from the cursor

· Process fetched row

· Close cursor

· Deallocate cursor

12. What is Collation?

Collation refers to a set of rules that determine how data is sorted and compared. Character data is sorted using rules that define the correct character sequence with options for specifying case sensitivity, accent marks, Kana character types, and character width.

13. Types of Indexes

· Clustered Index

· Non-Clustered Index

14. Difference between Clustered Index and Non-Clustered Index.

Clustered Index	Non-Clustered Index
A clustered index is a special type of index that reorders the way in which records in the table are physically stored.	It won’t touch the structure of the table.
Only one clustered index can be created for a table.	For a table, we can create 249 non clustered index.
The leaf nodes of a clustered index contain the data pages.	The leaf node of a nonclustered index does not consist of the data pages. Instead, the leaf nodes contain index rows.
By default, primary key will create clustered index on the table.	By default, Unique key will create clustered index on the table.

15. Difference between Stored Procedure and Trigger

Stored Procedure	Trigger
Defination: A stored procedure is a collection of precompiled SQL statements that have been previously created and stored in the server database.	Defination: It will fire automatically when ever DML operations performed on the table or view. Triggers are basically used to implement business rules.
Supports Input and Output parameters	Not support
Stored procedures are explicitly executed by invoking a CALL to the procedure	Triggers are implicitly executed
Procedures can’t execute Triggers	Triggers can execute stored procedures

16. Difference between Stored Proc and Function

Stored Proc	Function
Data manipulations are possible with in the procedure	Not Possible
Supports XML FOR clause	Not supports
If there is an error in SP it just ignores the error and moves to the next statement.	If there is an error in UDF its stops executing.
SP’s can make permanent changes to server environments	Can’t
Can’t	UDF can be used in the SQL statements anywhere in the WHERE/HAVING/SELECT section
Supports all data types	Text, ntext, image and timestamp data types are not supported.
	Defination: User-defined Functions allow defining its own T-SQL functions that can accept zero or more parameters and return a single scalar data value or a table data type.

17. Difference between Primary key and Unique key?

Primary key	Unique key
It won’t allow null value	It will accept null value but only one
Only one primary key can be created for the table	Any number of Unique key can be created for the table.
Primary Key creates a clustered index on the column.	Unique Key creates a non-clustered index on the column.
Ex: Create table with Primary Key: `CREATE TABLE` `Authors` `(` `AuthorID` `INT` `NOT NULL` `PRIMARY KEY,` `Name` `VARCHAR(100) NOT NULL` `)`	Ex: Alter table to add unique constraint to column: `ALTER TABLE` `Authors` `ADD CONSTRAINT` `IX_Authors_NameUNIQUE(Name)`

18. Difference between Temp tables and Table variables in Sql Server

1) Transaction logs are not recorded for the table variables. They are variables and thus aren't bound to a transaction.

Temp tables behave same as normal tables and are bound by transactions.

2) Any procedure with a temporary table cannot be pre-compiled, while an execution plan of procedures with table variables can be statically compiled in advance. Pre-compiling a script gives a major advantage to its speed of execution. This advantage can be dramatic for long procedures, where recompilation can be too pricy.

3) Table variables exist only in the same scope as variables. Contrary to the temporary tables, they are not visible in inner stored procedures and in exec (string) statements. Also, they cannot be used in an insert/exec statement.

4) As a rule of thumb, for small to medium volumes of data and simple usage scenarios you should use table variables.

5) If we use Temporary Table in a stored procedure, we should drop it at the end. It is not necessary in the case of Table variable.

A simple example shows this difference quite nicely:

BEGIN TRAN

declare @var table (id int, data varchar(20) )

create table #temp (id int, data varchar(20) )

insert into @var

select 1, 'data 1' union all

select 2, 'data 2' union all

select 3, 'data 3'

insert into #temp

select 1, 'data 1' union all

select 2, 'data 2' union all

select 3, 'data 3'

select * from #temp

select * from @var

ROLLBACK

select * from @var

if object_id('tempdb..#temp') is null

select '#temp does not exist outside the transaction'

We see that the table variable still exists and has all it's data unlike the temporary table that doesn't exists when the transaction rollbacked.

19. What are Different Types of Join?

Cross Join: A cross join that does not have a WHERE clause produces the Cartesian product of the tables involved in the join. The size of a Cartesian product result set is the number of rows in the first table multiplied by the number of rows in the second table. The common example is when company wants to combine each product with a pricing table to analyze each product at each price.

Inner Join: A join that displays only the rows that have a match in both joined tables is known as inner Join. This is the default type of join in the Query and View Designer.

Outer Join: A join that includes rows even if they do not have related rows in the joined table is an Outer Join. You can create three different outer join to specify the unmatched rows to be included:

· Left Outer Join: In Left Outer Join, all the rows in the first-named table, i.e. “left” table, which appears leftmost in the JOIN clause, are included. Unmatched rows in the right table do not appear.

· Right Outer Join: In Right Outer Join, all the rows in the second-named table, i.e. “right” table, which appears rightmost in the JOIN clause are included. Unmatched rows in the left table are not included.

· Full Outer Join: In Full Outer Join, all the rows in all joined tables are included, whether they are matched or not.

Self Join: This is a particular case when one table joins to itself with one or two aliases to avoid confusion. A self join can be of any type, as long as the joined tables are the same. A self join is rather unique in that it involves a relationship with only one table. The common example is when company has a hierarchal reporting structure whereby one member of staff reports to another. Self Join can be Outer Join or Inner Join.

20. What are Primary Keys and Foreign Keys?

Primary keys are the unique identifiers for each row. They must contain unique values and cannot be null. Due to their importance in relational databases, Primary keys are the most fundamental aspect of all keys and constraints. A table can have only one primary key.

Foreign keys are a method of ensuring data integrity and manifestation of the relationship between tables.

21. What is a candidate key?

A table may have more than one combination of columns that could uniquely identify the rows in a table; each combination is a candidate key. During database design you can pick up one of the candidate keys to be the primary key. For example, in the supplier table supplierid and suppliername can be candidate key but you will only pick up supplierid as the primary key.

22. What is User-defined Functions? What are the types of User-defined Functions that can be created?

User-defined Functions allow defining its own T-SQL functions that can accept zero or more parameters and return a single scalar data value or a table data type.

Different Types of User-Defined Functions created are as follows:

Scalar User-defined Function:

A scalar user-defined function returns one of the scalar data types. Text, ntext, image and timestamp data types are not supported. These are the type of user-defined functions that most developers are used to in other programming languages.

Inline Table-Value User-defined Function:

An Inline table-value user-defined function returns a table data type and is an exceptional alternative to a view as the user-defined function can pass parameters into a T-SQL select command and in essence provide us with a parameterized, non-updateable view of the underlying tables.

Multi-Statement Table-Value User-defined Function:

A multi-statement table-value user-defined function returns a table, and it is also an exceptional alternative to a view as the function can support multiple T-SQL statements to build the final result where the view is limited to a single SELECT statement. Also, the ability to pass parameters into a T-SQL select command or a group of them gives us the capability to in essence create a parameterized, non-updateable view of the data in the underlying tables. Within the create function command, you must define the table structure that is being returned. After creating this type of user-defined function, It can be used in the FROM clause of a T-SQL command unlike the behavior encountered while using a stored procedure which can also return record sets.

23. What is Dirty Read?

A dirty read occurs when two operations, say, read and write occur together giving the incorrect or unedited data. Suppose,

A changed a row but did not committed the changes.

B reads the uncommitted data but his view of the data may be wrong so that is Dirty Read.

24. Why can’t I use Outer Join in an Indexed View?

Rows can logically disappear from an indexed view based on OUTER JOIN when you insert data into a base table. This makes incrementally updating OUTER JOIN views relatively complex to implement, and the performance of the implementation would be slower than for views based on standard (INNER) JOIN.

25. What is the Correct Order of the Logical Query Processing Phases?

The correct order of the Logical Query Processing Phases is as follows:

1. FROM
2. ON
3. OUTER
4. WHERE
5. GROUP BY
6. With {CUBE | ROLLUP}
7. HAVING
8. SELECT
9. DISTINCT
10. TOP
11. ORDER BY

Send Mail with multiple attachments in asp.net

2011-09-26T17:06:00.000+05:30

Use below code to Send multiple attachments in Email

.ASPX

<%@ Page Language="C#" AutoEventWireup="true" CodeFile="SendMail.aspx.cs" Inherits="SendMail" %>

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
    <title></title>

</head>
<body>
    <table cellspacing="0" cellpadding="3" width="100%" bgcolor="navy" border="0">
        <tr>
            <td align="center">
                <span class="titl">ASP.NET Email</span>
            </td>
        </tr>
    </table>
    <br />
    <div align="center">
        <asp:Label ID="lblMessage" runat="server" Font-Names="Arial" Width="540" Visible="False"></asp:Label></div>
    <br />
    <div align="center">
        <form id="Form1" name="form2" method="post" enctype="multipart/form-data" runat="server">
        <table cellspacing="0" cellpadding="4" bgcolor="navy" border="0">
            <tr>
                <td>
                    <table cellspacing="3" cellpadding="4" width="540" bgcolor="white">
                        <tr>
                            <td valign="middle" align="right" width="80">
                                From:
                            </td>
                            <td>
                                <asp:TextBox ID="txtSender" TabIndex="1" runat="server" MaxLength="100" Width="386px"
                                    CssClass="width386" Font-Names="Arial"></asp:TextBox>
                            </td>
                        </tr>
                        <tr>
                            <td valign="middle" align="right" width="80">
                                To:
                            </td>
                            <td>
                                <asp:TextBox ID="txtReceiver" TabIndex="1" runat="server" MaxLength="100" Width="386px"
                                    CssClass="width386" Font-Names="Arial"></asp:TextBox>
                            </td>
                        </tr>
                        <tr>
                            <td valign="middle" align="right">
                                Subject:
                            </td>
                            <td>
                                <asp:TextBox ID="txtSubject" TabIndex="2" runat="server" MaxLength="200" Width="386px"
                                    CssClass="width386" Font-Names="Arial"></asp:TextBox>
                            </td>
                        </tr>
                        <tr>
                            <td valign="middle" align="right">
                                Format:
                            </td>
                            <td>
                                <asp:RadioButtonList ID="rblMailFormat" TabIndex="3" runat="server" RepeatColumns="2"
                                    RepeatDirection="Horizontal">
                                    <asp:ListItem Value="text" Selected="True">text</asp:ListItem>
                                    <asp:ListItem Value="html">html</asp:ListItem>
                                </asp:RadioButtonList>
                            </td>
                        </tr>
                        <tr>
                            <td valign="top" align="right">
                                Message:
                            </td>
                            <td height="84">
                                <p>
                                    <asp:TextBox ID="txtBody" TabIndex="4" runat="server" Columns="40" Rows="5" TextMode="MultiLine"
                                        Width="451px" CssClass="width386" Font-Names="Arial"></asp:TextBox></p>
                            </td>
                        </tr>
                        <tr>
                            <td>
                            </td>
                            <td>
                                <asp:FileUpload ID="FileUpload1" runat="server" style="margin-left: 0px"
                                    Width="445px" />
                            </td>
                        </tr>
                        <tr>
                            <td align="center" colspan="2">
                                <asp:Button ID="btnSend" TabIndex="9" runat="server" Width="100px" Text="Send" OnClick="btnSend_Click">
                                </asp:Button>
                            </td>
                        </tr>
                    </table>
                </td>
            </tr>
        </table>
        </form>
        <h1>
        </h1>
    </div>
</body>
</html>

.ASPX.CS

using System;
using System.Drawing;
using System.Net.Mail;

public partial class SendMail : System.Web.UI.Page
{
    protected void btnSend_Click(object sender, EventArgs e)
    {
        try
        {
            // Create a new blank MailMessage
            MailMessage email = new MailMessage();

            // Set the properties of the MailMessage to the values on the form
            if (rblMailFormat.SelectedItem.Text == "text")
                email.IsBodyHtml = false;
            else
                email.IsBodyHtml = true;

            email.From = new MailAddress(txtSender.Text);
            email.To.Add(new MailAddress(txtReceiver.Text));
            email.Subject = txtSubject.Text;
            email.Body = txtBody.Text;
            string strFileName = FileUpload1.PostedFile.FileName;
            //adding attachements from browse & upload
            Attachment attach = new Attachment(strFileName);
            // Follow the same trick for multiple attachment
            email.Attachments.Add(attach);
            //Set the SMTP server
            SmtpClient smtp = new SmtpClient("localhost");
            // send the email
            smtp.Send(email);

            // Reset the form
            txtSender.Text = "";
            txtReceiver.Text = "";
            txtSubject.Text = "";
            txtBody.Text = "";

            // Dispaly a friendly message telling the user
            // his email has been sent
            lblMessage.Visible = true;
            lblMessage.ForeColor = Color.Black;
            lblMessage.Text = "Your email has been sent";
        }
        catch (Exception ex)
        {
            lblMessage.Visible = true;
            lblMessage.ForeColor = Color.Red;
            lblMessage.Text = ex.ToString();
        }
    }
}

How do I change the SMTP port number dynamically in asp.net

2011-09-26T13:12:00.000+05:30

Use below method to set dynamic port while sending the email using SMTP

public static void SendMailwithDynamicPort(string strSmtpHost, int strPort, string strMessageBody, string strFrom, string strTo, string strSubject)
        {
            // Create and configure the smtp client
            SmtpClient smtpClient = new SmtpClient();
            if (strSmtpHost != null && strSmtpHost.Length > 0)
            {
                smtpClient.Host = strSmtpHost;
            }
            smtpClient.Port = strPort; // you can read from config
            smtpClient.DeliveryMethod = SmtpDeliveryMethod.Network;

            MailMessage mailMessage = new MailMessage();
            mailMessage.Body = strMessageBody;
            mailMessage.From = new MailAddress(strFrom);
            mailMessage.To.Add(strTo);
            mailMessage.Subject = strSubject;
            mailMessage.Priority = MailPriority.Normal;//to set the email property

            smtpClient.Send(mailMessage);
        }

or through Web.Config also we can set port number

<configuration>
  <!-- Add the email settings to the <system.net> element -->
  <system.net>
    <mailSettings>
      <smtp>
        <network 
             host="relayServerHostname" 
             port="portNumber"
             userName="username"
             password="password" />
      </smtp>
    </mailSettings>
  </system.net>

  <system.web>
    ...
  </system.web>
</configuration>

How to get the users IP those who are accessing your website using asp.net

2011-09-26T12:28:00.001+05:30

Use below code to get the IP of your website users:

<%@ Page Language="C#" %>
<html xmlns="http://www.w3.org/1999/xhtml">
<head runat="server">
    <title>Client IP...</title>
    <meta http-equiv="Expires" content="-1">
    <meta http-equiv="Cache-Control" content="no-cache">
    <meta http-equiv="Pragma" content="no-cache">

<%
            string _strClientIP = string.Empty;
            string[] _strforwardedIpsList;

            // Get exact IP address if proxy available
            string _strServerVariable = HttpContext.Current.Request.ServerVariables["HTTP_X_FORWARDED_FOR"];

            if (!string.IsNullOrEmpty(_strServerVariable))
            {
                _strforwardedIpsList = _strServerVariable.Split(new char[] { ',' }, StringSplitOptions.RemoveEmptyEntries);
                _strClientIP = _strforwardedIpsList[_strforwardedIpsList.Length - 1];
            }
            else
            {
                // Get Proxy IP address
                _strClientIP = HttpContext.Current.Request.UserHostAddress;

                if (string.IsNullOrEmpty(_strClientIP))
                    _strClientIP = HttpContext.Current.Request.ServerVariables["REMOTE_ADDR"];
            }

            Response.Write(_strClientIP);

%>
</head>
<body>
    <form id="testForm">
    </form>
</body>
</html>

"Cannot get IIS pickup directory" SMTP exception in asp.net

2011-09-23T15:12:00.000+05:30

Use below code to resolve the issue

smtp.DeliveryMethod = SmtpDeliveryMethod.NetWork

instead of

smtp.DeliverMethod=smtpDeliverMethod.pickUpis....

Host WCF service with multiple host environment using multiple protocol

2011-09-21T11:40:00.000+05:30

Introduction

In the world of distributed application, many technologies has been introduced, implemented and used like DCOM, CORBA,…etc.
And after that, a new concept has been adapted,it was the web services. Web service is simple to develop and implement without paying attention to firewall issues and as a result, communication between systems has been simplified.
The problem while developing a web service is you need to host it inside a web server like IIS or Apache using http or wshttp protocols, and this is the only option you have.
WCF has solved this issue, by providing the possibility to host your service in a different application process using also various protocols.
In this article I’ll show how you can achieve this.
The sample code includes a simple WCF service, console windows host, windows service host, IIS6 host, II7 host and client console windows application built in VS 2008 Standard edition and .NET 3.0.

Background

As we know if you adopt web services architecture for your system, you need the flowing:
- create a service like a component library using [WebService] and [WebMethod] attributes
- host it inside a web server like IIS
- generate a proxy (interface or contract) from the WSDL
- distribute this proxy to clients application who needs to call and use this web service.

Multiple Host and Protocol Support with WCF

Microsoft has introduced the WCF concept in order to make distributed application development and deployment simple.

Hosting Environment	Supported protocol
Windows console and form application	HTTP,net.tcp,net.pipe,net.msmq
Windows service application (formerly known as NT services)	HTTP,net.tcp,net.pipe,net.msmq
Web server IIS6	http, wshttp
Web server IIS7 - Windows Process Activation Service (WAS)	http, wshttp, net.tcp, net.pipe, net.msmq

Create a test service

Here I have created a very simple service called “FirstWcfService.Service” as in the following listing -1 :

// Listing -1 IService.cs file
using System;
using System.Runtime.Serialization;
using System.ServiceModel;
namespace FirstWcfService
{
    [ServiceContract]
    public interface IService
    {
   
        [OperationContract]
        string Hello(); 
    }
}
// Service.cs file
using System;
namespace FirstWcfService
{
    public class Service : IService
    {
        public string Hello()
        {
            return ("Hello WCF");
        }
    }
}

As we can see, this service contains only on operation contract (Hello), this operation will return simple string “Hello WCF”.

Hosting our service

As I have mentioned in the begging of my article, with the arrival of WCF, now we have multiple options to host this service.
In each hosting environment, we need to provide an endpoint for this service and also we need to reference it, in order the client application can reach this service.
What does that mean practically, it means we have to create a configuration file for our hosted service.

Option 1 – windows console host application

1 - I created here a classic console application (picture 1) and then I hosted my service as in the following listing – 2:

//Listing – 2 Program.cs
using System;
using System.Collections.Generic;
using System.Text;
using System.ServiceModel;
using System.ServiceModel.Description;
namespace FirstWcfServiceHostConsoleApp
{
    class Program
    {
        static void Main(string[] args)
        {
          
using (ServiceHost host = new ServiceHost(typeof(FirstWcfService.Service)))
            {
                host.Open();
                Console.WriteLine("Press <Enter> to terminate the Host application.");
                Console.ReadLine();
            }
           
        }
    }
}

In order to host a WCF service inside a console application we need a minimum of work. Let us examine the code in the above listing:
This code ServiceHost host = new ServiceHost(typeof(FirstWcfService.Service)
creates an instane of our service.
This line host.Open() makes the service ready for access inside the hosting enviroemnt.
2- Secondly I have created a configuration file with a minimum configuration options as in the following listing - 3:

//Listing – 3 App.config
<?xml version="1.0"?>
<configuration>
  <system.serviceModel>
    <services>
      <service name="FirstWcfService.Service" behaviorConfiguration="ServiceBehavior">
        <!-- Service Endpoints -->
        <endpoint address="FirstWcfService" binding="netTcpBinding" 
            contract="FirstWcfService.IService"/>
        <!-- This Endpoint is used for genertaing the proxy for the client -->
 <!-- To avoid disclosing metadata information, set the value below to false and
       remove the metadata endpoint above before deployment -->
        <endpoint address="mex" contract="IMetadataExchange" binding="mexTcpBinding" />
        <host>
          <baseAddresses>
            <add baseAddress="net.tcp://localhost:9100/"/>
          </baseAddresses>
        </host>
      </service>
    </services>
    <behaviors>
      <serviceBehaviors>
        <behavior name="ServiceBehavior">
          <serviceMetadata httpGetEnabled="false"/>
        </behavior>
      </serviceBehaviors>
    </behaviors>
  </system.serviceModel>
</configuration>

Option 2 – windows service host application

1 - I created here a classic windows service application and then I hosted my service as in the following listing – 4:

//Listing - 4, Program.cs

using System;
using System.ServiceProcess;
namespace Windows_Service
{
    static class Program
    {
        static void Main()
        {
            ServiceBase[] ServicesToRun;
            ServicesToRun = new ServiceBase[] { new WCFWindowsService() };
            ServiceBase.Run(ServicesToRun);
        }
    }
}

//Listing - 4, WCFWindowsService.cs
using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Diagnostics;
using System.ServiceProcess;
using System.ServiceModel;
namespace Windows_Service
{
    public partial class WCFWindowsService : ServiceBase
    {
       ServiceHost m_serviceHost;
        
protected override void OnStart(string[] args)
        {
            m_serviceHost = new ServiceHost(typeof(FirstWcfService.Service));
            m_serviceHost.Open();
        }
        
        protected override void OnStop()
        {
            if (m_serviceHost != null)
            {
                m_serviceHost.Close();
            }
            m_serviceHost = null;
        }
    }
}

In order to host a WCF service inside a windows service application, we need also a minimum of work by implementing the followings functions:
void OnStart(string[] args) and protected override void OnStop()
Let us examine the code in the above listing:
This code:

m_serviceHost = new ServiceHost(typeof(FirstWcfService.Service));
m_serviceHost.Open();

creates an instane of our service and then makes the service ready for access inside the hosting enviroment.
2 - To make this application working like a windows service, we should install it as in Listing – 5. This file is not related to WCF implementation, so I’m not going to explain what does this code does.

//Listing - 5, WCFWindowsServiceInstaller.cs
using System;
using System.Collections;
using System.Collections.Generic;
using System.ComponentModel;
using System.Configuration.Install;
using System.ServiceProcess;
// To install or uninstall this Windows service via cmd:
//
//C:\Program Files\Microsoft Visual Studio 9.0\VC>installutil.exe /u  yourpath/WCFWindowsService.exe
//C:\Program Files\Microsoft Visual Studio 9.0\VC>installutil.exe     yourpath/WCFWindowsService.exe
namespace Windows_Service
{
    [RunInstaller(true)]
    public partial class WCFWindowsServiceInstaller : Installer
    {
        public WCFWindowsServiceInstaller()
        {
            InitializeComponent();
            ServiceProcessInstaller processInstaller = new ServiceProcessInstaller();
            ServiceInstaller serviceInstaller = new ServiceInstaller();
            processInstaller.Account = ServiceAccount.LocalSystem;
            serviceInstaller.DisplayName = "WCF_WindowsService";
            serviceInstaller.Description = "WCF_WindowsService.";
            serviceInstaller.ServiceName = "WCF_WindowsService";
            serviceInstaller.StartType = ServiceStartMode.Manual;
            Installers.Add(processInstaller);
            Installers.Add(serviceInstaller);
        }
    }
}

3 - I have created a configuration file with a minimum configuration options as in the following listing - 6:

 //Listing - 6, App.config
<?xml version="1.0" encoding="utf-8" ?>
<configuration>
  <system.serviceModel>
    <services>
      <service name="FirstWcfService.Service" behaviorConfiguration="ServiceBehavior">
        <endpoint address="FirstWcfService" contract="FirstWcfService.IService"
             binding="netTcpBinding" />
        <!-- This Endpoint is used for genertaing the proxy for the client -->
        <endpoint address="mex" contract="IMetadataExchange" binding="mexTcpBinding" />
        <host>
          <baseAddresses>
            <add baseAddress="net.tcp://localhost:9000"/>
          </baseAddresses>
        </host>
      </service>
    </services>
    <behaviors>
      <serviceBehaviors>
        <behavior name="ServiceBehavior">
          <serviceMetadata httpGetEnabled="false"/>
        </behavior>
      </serviceBehaviors>
    </behaviors>
  </system.serviceModel>
</configuration>

Option 3 – IIS6 host application

1 - I created here a simple WCF Service web application and then I have referenced FirstWcfService in order to host it as in the following listing – 7:

 //Listing - 7, file Service.svc
<%@ ServiceHost Language="C#" Debug="true" Service="FirstWcfService.Service"%>

As see can see her, when we host a WCF service inside IIS, we do not need to create a host service and open it as we have done in the console and service windows application hosting, because IIS is responsible for creating the service and make it listening to clients calls, all we need just the above code inside a .svc file.
2- I have created a configuration file with a minimum configuration options as in the following listing -8:

//Listing - 8, Web.config
<?xml version="1.0"?>
<configuration>
  <system.serviceModel>
    <services>
      <service name="FirstWcfService.Service" behaviorConfiguration="ServiceBehavior">
        <!-- Service Endpoints -->
        <endpoint address="" binding="basicHttpBinding"
           contract="FirstWcfService.IService"/>
       <!-- This Endpoint is used for genertaing the proxy for the client --> 
<endpoint address="mex" binding="mexHttpBinding" contract="IMetadataExchange"/>
      </service>
    </services>
    <behaviors>
      <serviceBehaviors>
        <behavior name="ServiceBehavior">
          <!-- To avoid disclosing metadata information, set the value below to
              false and remove the metadata endpoint above before deployment -->
          <serviceMetadata httpGetEnabled="true"/>
          <!-- To receive exception details in faults for debugging purposes,
              set the value below to true.  Set to false before deployment to avoid
              disclosing exception information -->
          <serviceDebug includeExceptionDetailInFaults="false"/>
        </behavior>
      </serviceBehaviors>
    </behaviors>
  </system.serviceModel>
</configuration>

Option 4 – IIS7 (WAS) host application

1 - I created here a simple WCF Service web application using windows server 2008 (IIS7) and then I have referenced FirstWcfService in order to host it as in the following listing – 9:

//Listing - 9 file Service.svc
<%@ ServiceHost Language="C#" Debug="true" Service="FirstWcfService.Service"%>

2- I have created a configuration file with a minimum configuration options as in the following listing -10:

//Listing - 10, Web.config
<?xml version="1.0"?>
<configuration>
  <system.serviceModel>
    <services>
      <service name="FirstWcfService.Service" behaviorConfiguration="ServiceBehavior">
        <!-- Service Endpoints -->
        <endpoint address="" binding="netTcpBinding" contract="FirstWcfService.IService"
            bindingConfiguration="tcpbinding"/>
        <endpoint address="mextcp" binding="mexTcpBinding" contract="IMetadataExchange"/>
      </service>
    </services>
    <behaviors>
      <serviceBehaviors>
        <behavior name="ServiceBehavior">
          <!-- To avoid disclosing metadata information, set the value below to false
              and remove the metadata endpoint above before deployment -->
          <serviceMetadata httpGetEnabled="true"/>
          <!-- To receive exception details in faults for debugging purposes,
               set the value below to true.  Set to false before deployment to avoid
               disclosing exception information -->
          <serviceDebug includeExceptionDetailInFaults="false"/>
        </behavior>
      </serviceBehaviors>
    </behaviors>
    <bindings>
      <netTcpBinding>
        <binding name="tcpbinding">
          <!--<security mode="None"></security>-->
          <security mode="Transport">
            <transport clientCredentialType="Windows" protectionLevel="EncryptAndSign"/>
            <message clientCredentialType="Windows"/>
          </security>
        </binding>
      </netTcpBinding>
    </bindings>
  </system.serviceModel>
</configuration>

NOTE:As you can see here, I have done the same implementation as I did for option 3 while hosting my SCF service inside II6, the only difference is, I have configured my service to be callable using “net.Tcp” protocol inside IIS7 (WAS) instead of classic “basicHttp” protocol. I’m not going to explain the new architecture of IIS7, because this topic is out of scope in this article.
3- When you create a WCF service inside IIS7, by default this service has only http and wshttp enabled. I have configured my service to be callable using net.Tcp protocol as in the following steps:

A - in order to enable a new protocol like net.Tcp, we need to add it to our default web site tree via IIS Manager by clinking on “Edit Bindings”

B - Add the new protocol with the desired port also, I added 9200

C – Always from IIS Manager, add the net.Tcp to your WCf service by clicking on advanced settings:

D – write your desired protocol through Enabled protocols settings :

Create the client application

I created a simple client console application in order to show you how we can call our WCF service using multiple hosting options.
My client application looks like this:

Let’s examine this application:
1 – We need co create a proxy, to create a proxy we have tow possibilities:
Either from Visual studio by adding a service reference as below :

Or by using the SvcUtil.exe utility, as we have multiple hosting options, we can observe here that we need just to use one of the following created proxy :
• If you create the proxy from a service hosted inside a console application you make: SvcUtil.exe net.tcp://localhost:9100/mex /out:path\proxy.cs /n:*,localhost
• If you create the proxy from a service hosted inside a windows service application you make SvcUtil.exe net.tcp://localhost:9000/mex /out:path\proxy.cs /n:*,localhost
• If you create the proxy from a service hosted inside an IIS 6 you make SvcUtil.exe http://localhost/FirstWcfIISHost/Service.svc /out:path\proxy.cs /n:*,localhost
• If you create the proxy from a service hosted inside an IIS7 using tcp protocol you make SvcUtil.exe net.tcp://winserver2008:9200/FirstWcfHost/Service.svc/ out:path\proxy.cs /n:*,localhost

When you create your proxy for the first time, you can use the same proxy to call the same service inside different hosting environments.
Finally our proxy will be as the following listing – 11

// Listing - 11 proxy.cs file
namespace localhost
{
    
    
    [System.CodeDom.Compiler.GeneratedCodeAttribute("System.ServiceModel", "3.0.0.0")]
    [System.ServiceModel.ServiceContractAttribute(ConfigurationName="localhost.IService")]
    public interface IService
    {
        
        [System.ServiceModel.OperationContractAttribute(Action =
            "%22http://tempuri.org/IService/Hello%22">http://tempuri.org/IService/Hello",
            ReplyAction = "%22http://tempuri.org/IService/HelloResponse%22">http://tempuri.org/IService/HelloResponse")]
        string Hello();
    }
    
    [System.CodeDom.Compiler.GeneratedCodeAttribute("System.ServiceModel", "3.0.0.0")]
    public interface IServiceChannel : localhost.IService,
        System.ServiceModel.IClientChannel
    {
    }
    
    [System.Diagnostics.DebuggerStepThroughAttribute()]
    [System.CodeDom.Compiler.GeneratedCodeAttribute("System.ServiceModel", "3.0.0.0")]
    public partial class ServiceClient :
        System.ServiceModel.ClientBase<localhost.IService>, localhost.IService
    {
        
        public ServiceClient()
        {
        }
        
        public ServiceClient(string endpointConfigurationName) : 
                base(endpointConfigurationName)
        {
        }
        
        public ServiceClient(string endpointConfigurationName, string remoteAddress) : 
                base(endpointConfigurationName, remoteAddress)
        {
        }
        
        public ServiceClient(string endpointConfigurationName,
            System.ServiceModel.EndpointAddress remoteAddress) : 
                base(endpointConfigurationName, remoteAddress)
        {
        }
        
        public ServiceClient(System.ServiceModel.Channels.Binding binding,
            System.ServiceModel.EndpointAddress remoteAddress) : 
                base(binding, remoteAddress)
        {
        }
        
        public string Hello()
        {
            return base.Channel.Hello();
        }
    }
}

2- I have created a configuration file with a minimum configuration options as in the following listing -12:

//Listing - 12, App.config
<?xml version="1.0" encoding="utf-8" ?>
<configuration>
  <system.serviceModel>
    <client>
      <!-- calling the WCF service which is hosted inside windows console application -->
      <endpoint address="net.tcp://localhost:9100/FirstWcfService" binding="netTcpBinding"
          contract="localhost.IService" name="Windows_Console_Host_TcpBinding">
      </endpoint>
      <!-- calling the WCF service which is hosted inside IIS6 -->
      <endpoint address="%22http://localhost/FirstWcfIISHost/Service.svc%22">http://localhost/FirstWcfIISHost/Service.svc"
          binding="basicHttpBinding"
          contract="localhost.IService" name="IIS_Host_HttpBinding">
      </endpoint>
      <!-- calling the WCF service which is hosted inside windows service  -->
      <endpoint address="net.tcp://localhost:9000/FirstWcfService"
          binding="netTcpBinding"
          contract="localhost.IService" name="Windows_Services_Host_TcpBinding">
      </endpoint>
      <!-- calling the WCF service which is hosted inside IIS7 (WAS)  -->
      <endpoint address="net.tcp://winserver2008:9200/FirstWcfHost/Service.svc"
          binding="netTcpBinding"
          contract="localhost.IService" name="II7_WAS_Host_TcpBinding"
          bindingConfiguration="II7NetTcpBinding">
      </endpoint>
    </client>
    <bindings>
      <netTcpBinding>
        <binding name="II7NetTcpBinding">
          <!--<security mode="None"></security>-->
          <security mode="Transport">
                    <transport clientCredentialType="Windows"
                         protectionLevel="EncryptAndSign"/>
                    <message clientCredentialType="Windows"/>
                  </security>
        </binding>
      </netTcpBinding>
    </bindings>
  </system.serviceModel>
</configuration>

In this file I have configured my client in order to show you how we can call the same WCF service hosted in different environments. In realty you do not need all these endpoints, you need only one of these endpoints for your client, so your “app.config” would be as in following listing - 13:

<?x ml version="1.0" encoding="utf-8" ?>
<configuration>
  <system.serviceModel>
    <client>
      <!-- calling the WCF service which is hosted inside windows console application -->
      <endpoint address="net.tcp://localhost:9100/FirstWcfService" binding="netTcpBinding"
          contract="localhost.IService" name="Windows_Console_Host_TcpBinding">
      </endpoint>
    </client>
   </system.serviceModel>
</configuration>

3- I have implemented my client as in the following listing -14:

//Listing - 14, Program.cs
using System;
namespace FirstWcfServiceClientConsoleApp
{
    class Program
    {
        static void Main(string[] args)
        {
            try
            {
                #region Call the hosted service inside IIS6
                localhost.ServiceClient iis6proxy = new localhost.ServiceClient(
                    "IIS_Host_HttpBinding");
                Console.WriteLine("=====================");
                Console.WriteLine("Call the hosted service inside IIS6");
                Console.WriteLine(iis6proxy.Hello());
                Console.WriteLine("=====================");
                Console.WriteLine();
                #endregion
                #region Call the hosted service inside IIS7 (WAS)
                localhost.ServiceClient iis7proxy = new localhost.ServiceClient(
                    "II7_WAS_Host_TcpBinding");
                Console.WriteLine("=====================");
                Console.WriteLine("Call the hosted service inside IIS7 (WAS)");
                Console.WriteLine(iis7proxy.Hello());
                Console.WriteLine("=====================");
                Console.WriteLine();
                #endregion
                #region Call the hosted service inside Windows service application
                localhost.ServiceClient tcpWindowsSrviceproxy =
                    new localhost.ServiceClient("Windows_Services_Host_TcpBinding");
                Console.WriteLine("=====================");
                Console.WriteLine(
                    "Call the hosted service inside Windows service application");
                Console.WriteLine(tcpWindowsSrviceproxy.Hello());
                Console.WriteLine("=====================");
                Console.WriteLine();
                #endregion
                #region Call the hosted service inside Windows Console application
                localhost.ServiceClient tcpproxy = new localhost.ServiceClient(
                     "Windows_Console_Host_TcpBinding");
                Console.WriteLine("=====================");
                Console.WriteLine(
                    "Call the hosted service inside Windows Console application");
                Console.WriteLine(tcpproxy.Hello());
                Console.WriteLine("=====================");
                Console.WriteLine();
                Console.WriteLine("Press <Enter> to terminate the client application.");
                Console.ReadLine();
                #endregion
            }
            catch (Exception e)
            {
                Console.WriteLine(e.Message);
                Console.ReadLine();
            }
        }
    }
}

In the above code, we notice that in order to call a WCF service, we need to instantiate the proxy class like this :
localhost.ServiceClient iis6proxy = new localhost.ServiceClient("IIS_Host_HttpBinding");
and then we can call a function or method we are interested like this:
iis6proxy.Hello());

Putting all together and get the result

My final solution will be something like that:

Finally when we run the client application (FirstWcfServiceClientConsoleApp.exe) after verifying that all four hosting environments (IIS6, IIS7, windows service, windows console application) are running and listening, we get the following wonderful result:

As you can notice here, we have created a WCF service, hosted it in four different environments as below using different protocols :

- Windows a console application using tcp protocol
- Windows service process using tcp protocol
- IIS6 using http protocol
- IIS7 using tcp protocol

By changing only the endpoint on the client we have been able to access our WCF service and calling functions.
What I do like to precise here, different client applications (Windows, Intranet, Internet, Extranet, ..etc) can call the service in different hosting environments.

Remote IIS Debugging : Debug your ASP.NET Application which is hosted on "Remote IIS Server"

2011-09-16T12:48:00.000+05:30

Introduction :

Before starting with this article, I will request you to read my previous article Debug Your ASP.NET Application that Hosted on IIS : Process Attach and Identify which process to attach . This article will give you the basic understanding of Debugging ASP.NET Application that is hosted on Local Server, along with Process selection among multiple processes. And article was all about if you have IIS installed in local server, that means you have hosted your site on your local development environment or your Web server/ production server having visual studio installed. But this is not the real scenario.
Now coming back to this article, this article is all about the IIS remote debugging. You are developing your application in you local system which is hosted on remote web server and now you need to debug it. How will you do that ? This article will describe all the necessary steps like how to configure remote debugging, attaching process from remote server, start debugging etc. This is one of the most challenging task in ASP.NET.

Visual Studio Debugging Features for ASP.NET

We can have three different way to debug our application from Visual Studio. They are:

Visual Studio Internal Debugger
Local IIS Debugging
Remote IIS Debugging

Visual Studio Internal Debugger :

We are all aware of that visual studio is having its own internal ASP.NET debug engine which is used to debug our ASP.NET web application while we are developing it. The process which is used to debug the application within visual studio is WebDev.WebServer.Exe . ASP.NET Engine uses WebDev.WebServer.exe to debug the application.
Now if you want to know more details about it please read this .

Fig: Block Diagram for Visual Studio Internal Debugger

Local IIS Debugging :

I am explaining the whole scenario using following diagram.

Fig: Block Diagram for Debugging ASP.NET site from Local IIS Server

In local IIS debugging, IIS should be installed in the local system where we have visual studio installed. For debugging the application hosted on IIS from visual studio, we need to attach the worker process (w3wp.exe) with in visual studio. After that we will able to start the debugging of the web application.

Remote IIS Debugging :

This is the main topic which we should cover in this article. It is one of the best features and it is very much helpful when we do not have a IIS Server installed in local system or when we have to store the applications at a centralized location. The scenario comes when you are having with your application code in your system and the build which was deployed on different IIS server. Below diagrams shows the overall diagram for remote debugging.

Fig: Block Diagram for Remote debugging of ASP.NET Application

Remote debugging with Visual studio and Remote IIS is very easy to setup. The tool which is used to setup and configure the process is know as "msvsmon.exe". I have describe each and every steps to start, configure the msvsmon tool and debug the application. But before that just have a look on why should we need remote debugging.

Why Remote Debugging :

Before going into details, we need to know when we have to use remote debugging,

Local development server does not have IIS installed.
Development server and Build/Released/Hosting Server is different
Application located in centralized location.

Remote Debugging Tool

The tool which is used to remote debugging of the ASP.Net application know as "Msvsmon.exe" . The Remote Debugging tool (Msvsmon.exe) is a small windows based application that Visual Studio 2005 uses for remote debugging. It has very simple UI which makes it very simple to setup and configure During remote debugging, Visual Studio 2005 runs on one computer and the Remote Debugging Tool runs on the remote computer along with the application you are debugging.

Fig: Block Diagram for Remote debugging of ASP.NET Application with msvsmon

If we want to debug the application which is hosted on remote IIS, we have to start the msvsmon.exe to the remote server, and our development system is the debugger host where we will debug our code.

Start msvsmon.exe

Msvsmon.exe is installed to the following paths:

Install path\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86

First of all we need to Run the Application from the location and we will get following screen,

Fig: Initial startup of msvsmon.exe

At the time of starting of application the window will show the status message "Msvsmon started a new server named '<ServerName>'. Waiting for new connection". Which means Debugging monitor tool is ready to connect with some remote server. Now I can connect with this remote server and get the list of all process that is running on the server.

Configure Authentication Mode

Configuration of msvsmon tool is very easy. The main configuration is involves with the authentication mode. Msvsmon support two types of authentication

Windows Authentication
No-Authentication

Windows Authentication

Msvsmon provide highlevel security with the windows authentication mode. The user who want to debug the application remotely he should be authenticated, means he should have sufficient permission to access the debugging facility from the remote system. For Setup the Windows authentication mode, We have go "Tool" > "Options" . Following window will appear,

Fig: Setup and configure security settings

Now we have a permission button along with the windows authentication radio button. Using that, we can give permission to any user who belongs to that windows group. If we click on the Permission button, following screen will appear

Fig: Add user for windows authentication

By default, Administrator should have the permission for remote debugging, we can use add button to add new user and can give the Debug access or Deny the Debug persmission to any user. For example, I have added myself by just clicking on Add button and take the access control.

Fig: Add user for windows authentication

Now, I have give me the permission for debugging from remotely (from Debugger Host).

Fig: Debug permission for selected user

Similiarly we can select any user from Active Directory and can deny the request for remote debugging though the user is Windows authenticated user.
I have discussed about how to debug remotely with windows authentication mode in the process attache section.

No-Authentication

There is no security involved with this authentication mode. Any one can debug remotely, if the authentication mode is set to "No-Authentication". As this debugging mode is not at all secure, so it should be used only on secure network.

Fig: No-Authentication Mode Configuration

No Authentication mode only supports native debugging. You can also guess the behaviour from the warning message. We have a "

Allow any
            User to Debug

" check box. If we checked that one, any user can able to debug.
In the next section I have described, how to attach the process for remote debugging for both Windows and No Authentication Mode.

Attach Process from Remote System

Now, Remote Debugger is ready to accept a new connection to start remote debugging. And we have already gone through how to configure the msvsmon for both windows and No-Authentication mode. Now we will check how to connect with them and start debugging,
Before what we need to do, we have created a Web application and hosted it IIS where msvsmon is running, We need to connect it from our local system where we are having our code. Now lets have a look in the case of windows authentication mode

`"15">Process Attach - Windows Authentication Mode`

First of all we need to open the application from visual studio in our development system. Now we need to attach the process from remote server. Goto Tool > Attach Process

Fig: Attach Process From Visual Studio

When we will click on the "

Attach to 
		Process

" we will get the following screen .

Fig: Default Process List

Right now it is showing all the process that are currently running on the system. Now we need to connect it the remote system. Now I have already started a msvsmon with name "abhijit.jana" and it is waiting for a new connection.

Fig: msvsmon is running on remote host

Now, I am going to connect with the remote system from my local visual studio IDE. So, what we need to do. We have to give the remote server name to the Qualifier section in attach process window.

Fig: Connect with Remote host and get the list of process

Now, in the process list all the process are listed from remote server along with Worker Process ((w3wp.exe). Now this is the exact worker process which we need to attach with our code. One more thing, when we are getting the list of process from it means remote server is connected. Now if we check the msvsmon window, it will show another message that user is connected. Have a look into the screenshot

Fig: Debug monitor showing message of connection

Now, our application is ready to debug. just set a break point in your code and enjoy the debugging. Here is our web site [ Hosted on Remote IIS Server ] and which having a server side button, and I want to debug the application on the click of button.

Fig: Access site from Host URL

Now process is attached in our visual studio and I have set the breakpoint on the button click method. Here is outcome.

Fig: Debugger at breakpoint

So, let enjoy the debugging from remote server . Now lets have a look how will we remote debug in No-Authentication mode.
"16">Process Attach - No Authentication Mode
This is quite similar to windows authentication process attach. I have already discussed that, how to configure the No-Authentication mode in remote debugger. We have to attach the process similar way that I have discussed. There are some few changes. Transport mode should be selected to -Remote (Native only with no authentication) [ Check the Screen shots] .And we need to provide the qualifier "abhijit.jana: 4015". Have a look into screen shots,

Fig: Process Attach for No-Authentication Mode

So, now we need to attach the worker process and need to start debugging, on which I have already discussed. There is slight change in connect while remote debugging going on with No-Authentication mode. Debugging monitor will display a message on the window that debugging is running on no authentication mode.

Fig: Status message for No-Authentication Mode

So, this is all about how to debug you application from remote IIS server in both windows and No-Authentication mode.

Debugging For Multiple User

This is one of the most fantastic features of Msvsmon tool. Msvsmon debugging monitor tool allow multiple user to debug simultaneously. . Each instance of the remote debugger has a unique server name. As I have already shown that Server names are configurable, so we can give an instance of the remote debugger any server name. Now multiple user can able to access the same

Fig: General block diagram from Multiple Debugger instance

Some Important Tips while remote debugging

Visual Studio 2005 remote debugging components must be installed on the remote computer
we must reference the remote computer by using a computer name instead of an IP address.
The Web.config file for the ASP.NET application must not contain any errors, and the compilation element must have the debug attribute set to True.
Make sure that a firewall is not blocking remote debugging.
The security setting for the site must allow Integrated Windows authentication.
Make sure that the Remote Debugging Monitor is running on the remote server. If Msvsmon.exe is not running, then you will receive the error message.

Summary :

Now to finalize the things, just take a quick summary. msvsmon is an utility which provides the facility to debug the application which is hosted on remote IIS server. It provides two kind of authentication mode, Windows and No-Authentication Mode. In Case of windows authentication mode the user should need the permission to access the instance of remote debugger but on the other hand No-Authentication does not required and security permission.

Fig: Overall Summary

Hope this article will help you to learn about remote debugging.

Reference :

ASP.NET Debugging vs. IIS Debugging

2011-09-07T18:33:00.000+05:30

Overview

Generally we debug our ASP.NET web application from Visual Studio. Visual Studio has its own ASP.NET engine, which is capable enough to run and debug your web sites inside Visual Studio. However, if your site is hosted on IIS and you want to debug that site directly, how would you debug it? When we host sites on IIS, the Worker Process (w3wp.exe) is used to run the web application. We need to attach to this particular process from Visual Studio to debug the web application. This article describes the overall idea of debugging an application using this method. It also describes the Worker Process, Application Pool and selecting a particular process if there are multiple Worker Processes running on IIS, using iisapp.vbs. I hope you will enjoy this article and provide your valuable suggestions and feedback.

ASP.NET Debugging vs. IIS Debugging

Visual Studio has its own integrated debugging engine, which debugs our code when we run the application in Visual Studio. If we are developing a site and need to debug the code, we just set breakpoints and do the debugging (Note: In this article I do not describe how to set the debug mode).
When we run the application, execution breaks when certain a breakpoint is reached. It is very simple, because when an ASP.NET application is running in Visual Studio, it is under the control of the ASP.NET Engine which is integrated with Visual Studio. If you want to check which process is running for debugging, run the web application from Visual Studio: you will get a popup notification as shown below.

Fig. 1: Taskbar popup when debugging is started from Visual Studio

This indicates a process is starting to run the ASP.NET application. Double-click on the icon and a popup window will appear to show the details.

Fig. 2: Development Server process details

Behind the running process is WebDev.WebServer.exe. When We press F5 to run the application, this process starts to execute the it. If you want run the application from command prompt, you have to perform the following steps.

Steps to run a web application from the command prompt:

Open The Visual Studio command prompt
Run WebDev.WebServer

The following screen will come up. Check the Example section there.

Fig. 3: WebDev.WebServer usage notification

Now back to IIS debugging. IIS comes into the picture when we deploy or host the site. After deploying the site on IIS, if we want to debug the site there, we can't do it directly as in Visual Studio. IIS has its own Worker Process which takes care of all execution and maintenance of deployed web applications. I will describe the details of the Worker Process in a later section. So, if we have running process in IIS and we need to debug the application, first of all we have to attach to the correct process from Visual Studio. Before describing that, let's just have a look at the Worker Process and Application Pool.

What is the Worker Process?

The Worker Process (w3wp.exe) runs ASP.NET applications within IIS. All ASP.NET functionality runs under the scope of the Worker Process. When a request comes to the server from a client, the Worker Process is responsible for generating the request and response. Its also maintains the InProc session data. If we recycle the Worker Process, we will lose its state. For more information, read this article: A Low-Level Look at the ASP.NET Architecture

Application Pool

This is one of the most important things that you should create for your own application in a production environment. Application Pools are used to separate sets of IIS Worker Processes that share the same configuration. Application Pools enable us to isolate our web application for better security, reliability, and availability. The Worker Process serves as the process boundary that separates each Application Pool, so that when one Worker Process or application has an issue or recycles, other applications or Worker Processes are not affected.

Fig. 4: Relationship between Application Pool and worker process in IIS

Default Application Pool

The name of the default application of IIS 6.0 is DefaultAppPool. After hosting the site on IIS, if we check the properties of the virtual directory, we can to view that information as follows.

Start Menu → Run command → inetmgr
Expand DefaultWebSites or Other Web Sites, where you have created the virtual directory
Right Click on the virtual directory
Click on Properties

The following virtual directory properties screen will come up, showing the Application Pool name which is assigned to the selected site.

Fig. 5: Virtual directory properties showing Application Pool name

If you want to check the list of all Application Pools in IIS, you have to expand the Application Pool node on IIS Server.

Fig. 6: List of Application Pools

Now, each and every Application Pool should have the minimum of one Worker Process which takes care of the operation of the site which is associated with the Application Pool. Right-click on the Application Pool → go to the Performance tab, check near the bottom of the tab, there is a web garden section, and by default, the number of Worker Processes is 1. An Application Pool containing more than one Worker Process called a Web Garden.

Fig. 7: Application Pool properties showing Web garden

Creating and Assigning an Application Pool

Open the IIS Console, right-click on the Application Pools folder, select New

Fig. 8-1
Give the Application Pool ID and click OK.

Fig. 8-2
Now, right-click on the virtual directory and assign the newly created Application Pool to that virtual directory.

Fig. 8-3

Now, this web site will run independently, within StateServerAppPool, so any problem related to other applications will not affect this application. This is the main advantage of creating a separate Application Pool.

How to start?

What I have said up to now give you a good idea of Worker Processes and Application Pools. You should have a clear understanding on these before going on to the next part. Now I will show you how to debug a site which is hosted on an IIS Server.
For the demonstration, I have created a web site called SampleWebSite and hosted it on to my local IIS. Below is default page output.

Fig. 9: Sample web site

Which process to attach to?

Now, as I have already explained, the process name is w3wp.exe, so we can check it from our Task Manager whether or not the Worker Process is running.

Fig. 10: Task Manager showing the running IIS process

Now we are going to attach to the process. In Visual Studio, go to Debug → Attach to Process

Fig. 11: Opening the Attach to Process window

After clicking Attach to Process, the following screen will come up

Fig. 12: Attach to Process window, showing a single Worker Process running

Now we are able to see that the Worker Process is running, and we need to attach that process. Select the process and click on the Attach button. After that, look at the two images below:

Fig. 13-1: Process attached successfully

Fig. 13-2: Process not attached

Did you notice the breakpoint symbol? If the Worker Process attached successfully, within the code, the breakpoint symbol should be a solid circle. Otherwise it will have a warning icon as shown. For a single Worker Process, this scenario is not common. However, when we have multiple Worker Processes running on IIS, then we can have some confusion. I will discuss the same in a later section.
Now if we click the Debug button after successfully attaching to the process, execution will stop at the breakpoint.
Next, let's have a look at what to do if we have multiple Worker Processes running.

How to attach to one of many running Worker Processes

Now, when this scenario will come up? When we have multiple sites hosted on IIS, and those sites have their own Application Pool. Now, multiple Application Pools means multiple Worker Processes are running.
Here I have three Application Pools in my IIS. They are:

Default Application Pool
Generic Application Pool
State Server Application Pool

Now, my SampleWebSite is associated with the DefaultAppPool. Now, I want to attach the process to debug my SampleWebSite. Follow the same steps as before. Open the Process Attach window:

Fig. 14: List of multiple Worker Process

Just have a look, there are three Worker Processes currently running, and you have to attach one of them. But, you do not know which Worker Process is the default Application Pool's. What you do is, you select any one of them at random, let's say the one with process ID = 4308, and suppose it is not the Worker Process for the default Application Pool. So what will happen if you attach to a wrong process? Check the image below:

Fig. 15: Breakpoint when the process is not attached correctly

Getting a list of running Worker Processes

Now what is the solution for the previous case? Here is a quick tip:

Start → Run command → cmd
Change directory to \Windows\System32
Run the command: cscript iisapp.vbs

and wait for the output. Wow! You get a list of running Worker Process, Process ID and Application Pool Name!

Fig. 16: List of running Worker Processes with PID and Application Pool name

Attaching to the correct process

From here you can easily identify the correct Application Pool name and its process ID. Now, return to Visual Studio → Attach Process. Now you know that the process ID for Default Application Pool is 1772, so Attach to that process.

Fig. 17: Attach the correct process for debugging

Now, enjoy debugging!

Fig. 18: Breakpoint is ready

Summary

Sometimes we need to debug our application which is hosted on IIS. For that, we need to attach the running Worker Process to the Visual Studio. If we have multiple Worker Processes running on the IIS server, we can identify the appropriate Worker Process by using the command cscript iisapp.vbs.

How to raise client side (javascript) or server side (code behind) messages in asp.net

2011-09-07T16:37:00.000+05:30

Use below code to raise messages from javascript and code behind.

.ASPX

.ASPX.CS

using System;
using System.Web.UI;

public partial class RaisingMessages : System.Web.UI.Page
{
    protected void Page_Load(object sender, EventArgs e)
    {

    }
    protected void btnSubmit_Click(object sender, EventArgs e)
    {
        if (string.IsNullOrEmpty(txtLastName.Text.Trim()))
        {
            string script = "alert('Last Name should not be empty')";
            Type csType = GetType();
            // Server side alert message
            ScriptManager.RegisterStartupScript(Page, csType, "popuscript", script, true);
            return;
        }
    }
}

How to get the size of the Databases used in Sql server

2011-09-07T13:37:00.001+05:30

I was looking for an easy way to do this instead of opening up the property page of each database in management studio and looking at the size. First I found this store procedure sp_spaceused.
This is a very nice system store procedure that can give you the disk usage information of a database, a table or an index.

But when you use it to get database size you have to execute it within the database in question. It doesn’t take a database name as parameter. So it can be automated to run for each database using T-SQL. What I want is query that is able to list all database on the server together with the size they take up. So I wrote the following query to do that. It worked fine for me.

use master
declare @PageSize varchar(10)
select @PageSize=v.low/1024.0
from master..spt_values v
where v.number=1 and v.type='E'
select name as DatabaseName, convert(float,null) as Size
into #tem
From sysdatabases where dbid>4
declare @SQL varchar (8000)
set @SQL=''
while exists (select * from #tem where size is null)
begin
select @SQL='update #tem set size=(select round(sum(size)*'+@PageSize+'/1024,0) From '+quotename(databasename)+'.dbo.sysfiles) where databasename='''+databasename+''''
from #tem
where size is null
exec (@SQL)
end
select * from #tem order by DatabaseName
drop table #tem

Output

The first select statement is to get how many kilobytes a data page has. SQL Server allocates disk space in the unit of data page. Currently each SQL server data page contains 8k bytes. The number of data pages allocated to each database file is recorded in the sysfiles system table. With this information on hand the script creates a temporary table #tem and update the temporary table with size information which is gathered by querying the sysfiles table.

How To: Protect From Injection Attacks in ASP.NET

2011-09-06T18:17:00.000+05:30

Summary

This How To shows how you can validate input to protect your application from injection attacks. Performing input validation is essential because almost all application-level attacks contain malicious input.
You should validate all input, including form fields, query string parameters, and cookies to protect your application against malicious command injection. Assume all input to your Web application is malicious, and make sure that you use server validation for all sources of input. Use client-side validation to reduce round trips to the server and to improve the user experience, but do not rely on it because it is easily bypassed.
To validate input, define acceptable input for each application input field. A proven practice is to constrain input for length, range, format, and type. Use the list of acceptable characters to define valid input, instead of the list of unacceptable characters. Using the list of unacceptable characters is impractical because it is very difficult to anticipate all possible variations of bad input.
When you need to accept a range of HTML characters, make sure that you HTML-encode the data to make it safe prior to displaying it as output.

Objectives
Overview
Summary of Steps
Step 1. Use ASP.NET Request Validation
Step 2. Constrain Input
Step 3. Encode Unsafe Output
Step 4. Use Command Parameters for SQL Queries
Step 5. Verify that ASP.NET Errors Are Not Returned to the Client
Additional Resources

Objectives

Constrain input for length, range, format, and type.
Apply ASP.NET request validation during development to identify injection attacks.
Constrain input by using ASP.NET validator controls.
Encode unsafe output.
Help prevent SQL injection by using command parameters.
Prevent detailed error information from returning to the client.

Overview

You need to validate all untrusted input to your application. You should assume that any input from users is malicious. User input to your Web application includes form fields, query strings, client-side cookies, and browser environment values such as user agent strings and IP addresses.
Weak input validation is a common vulnerability that could allow your application to be exploited by a number of injection attacks. The following are common types of attacks that exploit weak or missing input validation:

SQL injection. If you generate dynamic SQL queries based on user input, an attacker could inject malicious SQL commands that can be executed by the database.
Cross-site scripting. Cross-site scripting (XSS) attacks exploit vulnerabilities in Web page validation by injecting client-side script code. This code is subsequently sent to an unsuspecting user's computer and executed on the browser. Because the browser downloads the script code from a trusted site, the browser has no way of determining whether the code is legitimate.
Unauthorized file access. If your code accepts input from a caller, a malicious user could potentially manipulate your code's file operations, such as accessing a file they should not access or exploiting your code by injecting bad data.

Note Injection attacks work over HTTP and HTTPS Secure Socket Layer (SSL) connections. Encryption provides no defense.

The general approach for input validation is summarized here. You should apply this approach to any input that comes from the network, such as text boxes and other forms field input, query string parameters, cookies, server variables, and Web method parameters. Note that the strategy is to first allow only good input and then deny bad input. This is because you can easily define good input for your application, but you cannot realistically anticipate the format for all malicious input.
Check for valid input as follows:

Constrain: Check for known good data by validating the type, length, format, and range. To constrain input from server controls, use the ASP.NET validator controls. To constrain input from other sources, use regular expressions and custom validation.
Reject: Check for any known bad data and reject bad input.
Sanitize: Sometimes you also need to sanitize input and make potentially malicious input safe. For example, if your application supports free-format input fields, such as comment fields, you might want to permit certain safe HTML elements, such as <b> and <i>, and eliminate any other HTML elements.

Summary of Steps

To protect your ASP.NET application from injection attacks, perform the following steps:

Step 1. Use ASP.NET request validation.
Step 2. Constrain input.
Step 3. Encode unsafe output.
Step 4. Use command parameters for SQL queries.
Step 5. Verify that ASP.NET errors are not returned to the client.

The next sections describe each of these.

Step 1. Use ASP.NET Request Validation

By default, ASP.NET versions 1.1 and 2.0 request validation detects any HTML elements and reserved characters in data posted to the server. This helps prevent users from inserting script into your application. Request validation checks all input data against a hard-coded list of potentially dangerous values. If a match occurs, it throws an exception of type HttpRequestValidationException.
You can disable request validation in your Web.config application configuration file by adding a <pages> element with validateRequest="false" or on an individual page by setting ValidateRequest="false" on the @ Pages element.
If you need to disable request validation, you should disable it only on the affected page. An example of this is when you have a page with a free-format text field that accepts HTML-formatted input.

Confirm that ASP.NET Request Validation Is Enabled in Machine.config

Request validation is enabled by ASP.NET by default. You can see the following default setting in the Machine.config.comments file.

<pages validateRequest="true" ... />

Confirm that you have not disabled request validation by overriding the default settings in your server's Machine.config file or your application's Web.config file.

Test ASP.NET Request Validation

You can test the effects of request validation. To do this, create an ASP.NET page that disables request validation by setting ValidateRequest="false", as follows.

<%@ Language="C#" ValidateRequest="false" %>
<html>
 <script runat="server">
  void btnSubmit_Click(Object sender, EventArgs e)
  {
    // If ValidateRequest is false, then 'hello' is displayed
    // If ValidateRequest is true, then ASP.NET returns an exception
    Response.Write(txtString.Text);
  }
 </script>
 <body>
  <form id="form1" runat="server">
    <asp:TextBox id="txtString" runat="server" 
                 Text="<script>alert('hello');</script>" />
    <asp:Button id="btnSubmit" runat="server" OnClick="btnSubmit_Click" 
                 Text="Submit" />
  </form>
 </body>
</html>

When you run the page, "Hello" is displayed in a message box because the script in txtString is passed through and rendered as client-side script in your browser.
If you set ValidateRequest="true" or remove the ValidateRequest page attribute, ASP.NET request validation rejects the script input and produces an error similar to the following.

A potentially dangerous Request.Form value was detected from the client (txtString="<script>alert('hello...").

Note Do not rely on ASP.NET request validation. Treat it as an extra precautionary measure in addition to your own input validation.

Step 2. Constrain Input

To constrain input, follow these guidelines:

Use server-side input validation. Do not rely on client-side validation because it is easily bypassed. Use client-side validation in addition to server-side validation to reduce round trips to the server and to improve the user experience.
Validate length, range, format and type. Make sure that any input meets your guidelines for known good input.
Use strong data typing. Assign numeric values to numeric data types such as Integer or Double. Assign string values to string data types. Assign dates to the DateTime data type.

For Web form applications that obtain input through server controls, use the ASP.NET validator controls to constrain the input. For other sources of input data, such as query strings, cookies, and HTTP headers, constrain input by using the Regex class from the System.Text.RegularExpressions namespace.

Explicitly Check Input from Form Fields

To constrain form field input received through server controls, you can use the following ASP.NET validator controls:

RegularExpressionValidator. Use this control to constrain text input.
RangeValidator. Use this control to check the ranges of numeric, currency, date, and string input.
CustomValidator. Use this control for custom validation, such as ensuring that a date is in the future or in the past.

To validate form field input received through HTML input controls, perform validation in server-side code and use the Regex class to help constrain text input. The following sections describe how to constrain a variety of common input types.

Validating Text Fields

To validate text fields, such as names, addresses, and tax identification numbers, use regular expressions to do the following:
Constrain the acceptable range of input characters.
Apply formatting rules. For example, pattern-based fields, such as tax identification numbers, ZIP Codes, or postal codes, require specific patterns of input characters.
Check lengths.

Using a RegularExpressionValidator

To use a RegularExpressionValidator, set the ControlToValidate, ValidationExpression, and ErrorMessage properties to appropriate values as shown in the following example.

<form id="WebForm" method="post" runat="server">
  <asp:TextBox id="txtName" runat="server"></asp:TextBox>
  <asp:RegularExpressionValidator id="nameRegex" runat="server" 
        ControlToValidate="txtName" 
        ValidationExpression="^[a-zA-Z'.\s]{1,40}$" 
        ErrorMessage="Invalid name">
  </asp:regularexpressionvalidator>
</form>

The regular expression used in the preceding code example limits an input name field to alphabetic characters (lowercase and uppercase), space characters, the single apostrophe for names such as O'Dell, and the period. In addition, the field length is constrained to 40 characters.

Note The RegularExpressionValidator control automatically adds a caret (^) and dollar sign ($) as delimiters to the beginning and end of expressions if you have not added them yourself. You should add them to all of your regular expressions as good practice. Enclosing the expression in the delimiters ensures that the expression consists of the desired content and nothing else.

Using the Regex Class

If you are not using server controls (which means you cannot use the validator controls), or you need to validate input from sources other than form fields (such as from query string parameters or cookies), you can use a Regex class.
To use the Regex class

Add a using statement to reference the System.Text.RegularExpressions namespace.
Ensure that the regular expression is contained in the ^ and $ anchor characters (beginning of string, end of string).
Call the IsMatch method of the Regex class, as shown in the following code example.

// Instance method:
Regex reg = new Regex(@"^[a-zA-Z'.\s]{1,40}$");
Response.Write(reg.IsMatch(txtName.Text));

// Static method:
if (!Regex.IsMatch(txtName.Text,@"^[a-zA-Z'.\s]{1,40}$")) 
{
  // Name does not match expression
}

If you cannot cache your regular expression for frequent use, you should use the static IsMatch method where possible for performance reasons, to avoid unnecessary object creation.

Validating Numeric Fields

In most cases, numeric fields should be checked for type and range. To validate the type and range of a numeric input field that uses a server control, you can use a RangeValidator control. The RangeValidator supports currency, date, integer, double, and string data types.
To use a RangeValidator, set the ControlToValidate, Type, MinimumValue, MaximumValue, and ErrorMessage properties to appropriate values as shown in the following example.

<asp:RangeValidator 
       ID="RangeValidator1" 
       Runat="server" 
       ErrorMessage="Invalid range. Number must be between 0 and 255."
       ControlToValidate="rangeInput" 
       MaximumValue="255" 
       MinimumValue="0" Type="Integer" />

If you are not using a server control, you can validate a numeric range by converting the input value to an integer and then performing a range check. For example, to validate that an integer is valid, convert the input value to a variable of type System.Int32 by using the new Int32.TryParse method (introduced in the Microsoft .NET Framework version 2.0). This method returns false if the type conversion fails.

Int32 i;
if (Int32.TryParse(txtInput.Text, out i) == false)
{
  // Conversion failed
}

If you are using an earlier version of the .NET Framework, you can use Int32.Parse or Convert.ToInt32 inside a try/catch block and handle any exceptions of type FormatException that are thrown if the input value is not the correct type.
The following code shows how to perform a type and range check for an integer entered through an HTML text input control.

<%@ Page Language="C#" %>

<script runat="server">

  void Page_Load(object sender, EventArgs e)
  {
    if (Request.RequestType == "POST")
    {
      int i;
      if (Int32.TryParse(Request.Form["integerTxt"], out i) == true)
      {
        // TryParse returns true if the conversion succeeds
        if ((0 <= i && i <= 255) == true)
        {
          Response.Write("Input data is valid.");
        }
        else
          Response.Write("Input data is out of range");
      }
      else
        Response.Write("Input data is not an integer");
    }
  }
   
</script>

<html>
  <body>
    <form id="form1" action="NumericInput.aspx" method="post">
      <div>
        Enter an integer between 0 and 255:
        <input name="integerTxt" type="text" />
        <input name="Submit" type="submit" value="submit" />
      </div>
    </form>
  </body>
</html>

Validating Date Fields

You need to validate that date fields are of the correct type. In most cases, you also need to check them for range, for example to validate that they are in the future or past. If you use a server control to capture an input date, and if you also need to validate that a date falls within a specific range, you can use a RangeValidator control with its Type field set to Date. This control lets you specify a range by using constant date values. If you need to validate a date range based on today's date, for example to validate that a date is in the future or the past, you can use a CustomValidator control.
To use a CustomValidator control to validate a date, set the ControlToValidate and ErrorMessage properties and the OnServerValidate event to point to a custom method containing your validation logic. The following sample .aspx page code shows this approach.

<%@ Page Language="C#" %>

<script runat="server">

 void ValidateDateInFuture(object source, ServerValidateEventArgs args)
 {
   DateTime dt;

   // Check for valid date and that the date is in the future
   if ((DateTime.TryParse(args.Value, out dt) == false) || 
       (dt <= DateTime.Today))
   {
     args.IsValid = false;
   }
 }

</script>

<html>
  <body>
    <form id="form1" runat="server">
      <div>
        <asp:Label ID="Label1" Runat="server" 
                   Text="Future Date:"></asp:Label>
        <asp:TextBox ID="futureDatetxt" Runat="server"></asp:TextBox>
        <asp:CustomValidator 
              ID="CustomValidator1" Runat="server" 
              ErrorMessage="Invalid date. Enter a date in the future."
              ControlToValidate="futureDatetxt"  
              OnServerValidate="ValidateDateInFuture">
        </asp:CustomValidator>
        <br />
        <asp:Button ID="submitBtn" Runat="server" Text="Submit"  />
      </div>
    </form>
  </body>
</html>

Note The preceding code uses DateTime.TryParse, which is new to .NET Framework 2.0.

Sanitizing Free-Text Fields

To sanitize input, you make untrusted input safe by preventing it from being treated as code. For example, if your application handles user input that it cannot constrain or reads data from a shared database, you might need to sanitize the data or make the output safe when you write it on your page. Sanitize data prior to output by using HttpUtility.HtmlEncode.

Allowing Restricted HTML Input

If your application needs to accept a range of HTML elementsfor example through a rich text input field such as a comments fieldturn off ASP.NET request validation and create a filter that allows only the HTML elements that you want your application to accept. A common practice is to restrict formatting to safe HTML elements such as <b> (bold) and <i> (italic). Before writing the data, HTML-encode it. This makes any malicious script safe by causing it to be handled as text, not as executable code.
To allow restricted HTML input

Disable ASP.NET request validation by the adding the ValidateRequest="false" attribute to the @ Page directive.
Encode the string input with the HtmlEncode method.
Use a StringBuilder and call its Replace method to selectively remove the encoding on the HTML elements that you want to permit.

The following .aspx page code shows this approach. The page disables ASP.NET request validation by setting ValidateRequest="false". It HTML-encodes the input and selectively allows the <b> and <i> HTML elements to support simple text formatting.

<%@ Page Language="C#" ValidateRequest="false"%>

<script runat="server">

  void submitBtn_Click(object sender, EventArgs e)
  {
    // Encode the string input
    StringBuilder sb = new StringBuilder(
                            HttpUtility.HtmlEncode(htmlInputTxt.Text));
    // Selectively allow  and <i>
    sb.Replace("&lt;b&gt;", "<b>");
    sb.Replace("&lt;/b&gt;", "");
    sb.Replace("&lt;i&gt;", "<i>");
    sb.Replace("&lt;/i&gt;", "");
    Response.Write(sb.ToString());
  }
</script>

<html>
  <body>
    <form id="form1" runat="server">
      <div>
        <asp:TextBox ID="htmlInputTxt" Runat="server" 
                     TextMode="MultiLine" Width="318px"
                     Height="168px"></asp:TextBox>
        <asp:Button ID="submitBtn" Runat="server" 
                     Text="Submit" OnClick="submitBtn_Click" />
      </div>
    </form>
  </body>
</html>

Validate Query String Values

Validate query string values for length, range, format, and type. You usually do this by using a combination of regular expressions to:

Constrain the input values.
Set explicit range checks.
Specify the explicit type checks performed by converting the input value to its equivalent .NET Framework type and handling any ensuing conversion errors.

The following code example shows how to use the Regex class to validate a name string passed on a query string.

void Page_Load(object sender, EventArgs e)
{
  if (!System.Text.RegularExpressions.Regex.IsMatch(
       Request.QueryString["Name"], @"^[a-zA-Z'.\s]{1,40}$"))
    Response.Write("Invalid name parameter");
  else
    Response.Write("Name is " + Request.QueryString["Name"]);
}

Validate Cookie Values

Values maintained in cookies, such as query string parameters, can easily be manipulated by a client. Validate cookie values in the same way as you would for query string parameters. Validate them for length, range, format, and type.

Validate File and URL Paths

If your application has to accept input file names, file paths, or URL paths, you need to validate that the path is in the correct format and that it points to a valid location within the context of your application. Failure to do this can result in attackers persuading your application into accessing arbitrary files and resources.

Validating File Paths

To prevent a malicious user manipulating your code's file operations, avoid writing code that accepts user-supplied file or path input. For example:

If you must accept file names as input, use the full name of the file by using System.IO.Path.GetFileName.
If you must accept file paths as input, use the full file path by using System.IO.Path.GetFullPath.

Using MapPath to Prevent Cross Application Mapping

If you use MapPath to map a supplied virtual path to a physical path on the server, use the overload of Request.MapPath that accepts a bool parameter so that you can prevent cross-application mapping. The following code example shows this technique.

try
{
  string mappedPath = Request.MapPath( inputPath.Text, 
                                       Request.ApplicationPath, false);
}
catch (HttpException)
{
  // Cross-application mapping attempted
}

The final false parameter prevents cross-application mapping. This means that a user cannot successfully supply a path that contains ".." to traverse outside of your application's virtual directory hierarchy. Any attempt to do this results in an exception of type HttpException.
If you use server controls, you can use the Control.MapPathSecure method to retrieve the physical path to which the virtual path is mapped. Control.MapPathSecure uses code access security and throws an HttpException if the server control does not have permissions to read the resulting mapped file. For more information, see Control.MapPathSecure in the .NET Framework SDK documentation.

Using Code Access Security to Restrict File I/O

An administrator can restrict an application's file I/O to its own virtual directory hierarchy by configuring the application to run with Medium trust. In this event, .NET code access security ensures that no file access is permitted outside of the application's virtual directory hierarchy.
You configure an application to run with Medium trust by setting the <trust> element in Web.config or Machine.config.

<trust level="Medium" />

Validating URLs

You can filter for a valid URL format using a regular expression, such as the following.

^(?:http|https|ftp)://[a-zA-Z0-9\.\-]+(?:\:\d{1,5})?(?:[A-Za-z0-9\.\;\:\@\&\=\+\$\,\?/]|%u[0-9A-Fa-f]{4}|%[0-9A-Fa-f]{2})*$

This constrains the input, but it does not validate whether the URL is valid in terms of the application boundaries. You should check whether the target is valid in the context of your application. For example, does it point to an authorized server that you expect your application to communicate with?

Step 3. Encode Unsafe Output

If you write text output to a Web page, encode it using HttpUtility.HtmlEncode. Do this if the text came from user input, a database, or a local file.
Similarly, if you write URLs that might contain unsafe characters because they have been constructed from input data or data from a shared database, use HttpUtilty.UrlEncode to make them safe.
Avoid the mistake of encoding the data early. Make sure you encode at the last possible opportunity before the data is displayed to the client.

Use HtmlEncode to Encode Unsafe Output

The HtmlEncode method replaces characters that have special meaning in HTML to HTML variables that represent those characters. For example, < is replaced with < and " is replaced with ". Encoded data does not cause the browser to execute code. Instead, the data is rendered as harmless text, and the tags are not interpreted as HTML.
To illustrate the use of HtmlEncode, the following page accepts input from the user and allows potentially unsafe HTML characters by setting ValidateRequest="false". Before writing the input back to the user, the code calls HttpUtility.HtmlEncode on the supplied input text. This renders any potentially unsafe HTML as harmless text.

<%@ Page Language="C#" ValidateRequest="false" %>

<script runat="server">
  void submitBtn_Click(object sender, EventArgs e)
  {
      Response.Write(HttpUtility.HtmlEncode(inputTxt.Text));
  }
</script>

<html xmlns="http://www.w3.org/1999/xhtml" >
  <body>
    <form id="form1" runat="server">
      <div>
        <asp:TextBox ID="inputTxt" Runat="server" 
             TextMode="MultiLine" Width="382px" Height="152px">
        </asp:TextBox>
        <asp:Button ID="submitBtn" Runat="server" Text="Submit" 
                    OnClick="submitBtn_Click" />
      </div>
    </form>
  </body>
</html>

To see the effect of the HTML encoding, place the preceding page in a virtual directory, browse to it, enter some HTML code in the input text box, and click Submit. For example, the following input is rendered as text.

Run script and say hello <script>alert('hello');</script>

It produces the following safe output.

Run script and say hello <script>alert('hello');</script>

If you remove the call to HtmlEncode and simply write back the input, the browser executes the script and displays a message box. Malicious script could pose a significant threat.

Use UrlEncode to Encode Unsafe URLs

If you need to write URLs that are based on input that you do not fully trust, use HttpUtility.UrlEncode to encode the URL string.

HttpUtility.UrlEncode( urlString );

Step 4. Use Command Parameters for SQL Queries

To help prevent SQL injection, use command parameters for SQL queries. The Parameters collection provides type checking and length validation. If you use the Parameters collection, input is treated as a literal value and SQL does not treat it as executable code. An additional benefit of using the Parameters collection is that you can enforce type and length checks. Values outside of the range trigger an exception.

Use Parameters Collection When You Call a Stored Procedure

The following code fragment illustrates the use of the Parameters collection when calling a stored procedure.

SqlDataAdapter myCommand = new SqlDataAdapter("AuthorLogin", 
                                     myConnection);
myCommand.SelectCommand.CommandType = CommandType.StoredProcedure;
SqlParameter parm = myCommand.SelectCommand.Parameters.Add(
                                       "@LoginId", SqlDbType.VarChar, 11);
parm.Value = Login.Text;

Use Parameters Collection When Building Your SQL Statements

If you cannot use stored procedures, you can still use parameters, as shown in the following code fragment.

SqlDataAdapter myCommand = new SqlDataAdapter(
"SELECT au_lname, au_fname FROM Authors WHERE au_id = @au_id", myConnection);
SQLParameter parm = myCommand.SelectCommand.Parameters.Add(
                           "@au_id" ,SqlDbType.VarChar, 11);
Parm.Value = Login.Text;

For more information about how to prevent SQL injection,
see How To: Protect From SQL Injection in ASP.NET.

Step 5. Verify that ASP.NET Errors Are Not Returned to the Client

You can use the <customErrors> element to configure custom, generic error messages that should be returned to the client in the event of an application exception condition.
Make sure that the mode attribute is set to "remoteOnly" in the web.config file as shown in the following example.

<customErrors mode="remoteOnly" />

After installing an ASP.NET application, you can configure the setting to point to your custom error page as shown in the following example.

<customErrors mode="On" defaultRedirect="YourErrorPage.htm" />

Additional Resources

For more information about how to protect your application from injection attacks, see the following documents:

TextBox with TextMode="MultiLine" is not woking in asp.net

2011-09-06T13:58:00.002+05:30

By default TextBox won't support Maxlength when we set TextMode="MultiLine".
To support maxlength we have to call javascript function to restrict the number of characters.

Below example solve the above problem :

<script type="text/javascript">

function AdditionalInfoRestriction() {
var txtAddInfo = document.getElementById('<%=txtAdditionalInformation.ClientID %>');
try {

                         // 255 is maxlength of the textbox
                        if (txtAddInfo.value.length > 255) {
                            var cont = txtAddInfo.value;
                            txtAddInfo.value = cont.substring(0, 254);
                            return false;
                        }
                    }
                    catch (e) {
                    }
                }

</script>

<asp:TextBox CssClass="txt" ID="txtAdditionalInformation"
onkeyup="return AdditionalInfoRestriction();"
Width="440px" TextMode="MultiLine" MaxLength="250" runat="server">
</asp:TextBox>

How to access the data from Resource file from code behind or javascript in asp.net

2011-09-06T13:45:00.000+05:30

.aspx

<%@ Page Language="C#" AutoEventWireup="true" CodeFile="RaisingMessages.aspx.cs"
    Inherits="RaisingMessages" %>

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head runat="server">
    <title>Validation</title>

    <script type="text/javascript">

        function ValidatePage() {
            var fName = document.getElementById("txtFirstName");
            var lName = document.getElementById("txtLastName");

            if (fName.value == "") {
                // access resource file from javascript
                alert('<%= Resources.MessageResource.Mandatory_FirstName %>');
                return false;
            }
            else if (lName.value == "") {
                alert('Message from resource file : ' + '<%= Resources.MessageResource.Mandatory_LastName %>');
                return false;
            }
            return true;
        }
    </script>

</head>
<body>
    <form id="form1" runat="server">
    <table>
        <tr>
            <td>
                <asp:Label ID="lblFirstName" runat="server" Text="First Name"></asp:Label>
            </td>
            <td>
                <asp:TextBox ID="txtFirstName" runat="server"></asp:TextBox>
            </td>
        </tr>
        <tr>
            <td>
                <asp:Label ID="lblLastName" runat="server" Text="Last Name"></asp:Label>
            </td>
            <td>
                <asp:TextBox ID="txtLastName" runat="server"></asp:TextBox>
            </td>
        </tr>
        <tr>
            <td colspan="2">
                <asp:Button ID="btnSubmit" runat="server" Text="Submit"
                    OnClientClick="return ValidatePage();" onclick="btnSubmit_Click" />
            </td>
        </tr>
        <tr>
            <td colspan="2">
                <asp:Label ID="lblResult" runat="server" Text=""></asp:Label>
            </td>
        </tr>
    </table>
    </form>
</body>
</html>

.aspx.cs

protected void btnSubmit_Click(object sender, EventArgs e)
    {
        // access resource file from code behind
        lblResult.Text = Resources.MessageResource.Result_Msg + ": First Name : " +    txtFirstName.Text.Trim() + ": Last Name : " + txtLastName.Text.Trim();
    }

Resource File

How to make your website off line using app_offline.htm

2011-08-29T16:15:00.003+05:30

If you place a file with this name (app_offline.htm) in the root of a web application directory, ASP.NET 2.0 will shut-down the application, unload the application domain from the server, and stop processing any new incoming requests for that application. ASP.NET will also then respond to all requests for dynamic pages in the application by sending back the content of the app_offline.htm file (for example: you might want to have a “site under construction” or “down for maintenance” message).

This provides a convenient way to take down your application while you are making big changes or copying in lots of new page functionality (and you want to avoid the annoying problem of people hitting and activating your site in the middle of a content update). It can also be a useful way to immediately unlock and unload a SQL Express or Access database whose .mdf or .mdb data files are residing in the /app_data directory.

Once you remove the app_offline.htm file, the next request into the application will cause ASP.NET to load the application and app-domain again, and life will continue along as normal.

Sample app_offline.htm

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" >
<head>
    <title>Application Offline</title>
    <style type="text/css">

    div {
        background-color:#ffffcc;
        padding-top:10px;
        padding-bottom:10px;
        padding-left:10px;
        padding-right:10px;
        border-style:solid;
        border-color:Black;
        border-width:1px;
    }

    </style>
</head>
<body>
    <div>
        This application is currently offline. To enable the application, remove the
        app_offline.htm file from the application root directory.
    </div>
</body>
</html>

Advantages and Disadvantages of Frames

2011-08-26T14:45:00.003+05:30

A frames page itself contains no visible content, it contains instructions on which pages to show simultaneously and how they will be displayed within the browser window . Think of it as a clear overlay, much like a paneled window frame - except this window frame allows you to look into different rooms of the house. A frames page can contain references to many other pages, but usually they consist of references to pages to be used as the header, the content, a left hand menu bar and a perhaps a footer bar. When a hyperlink is clicked in one frame, say the left hand navigation window, it will open a page in the content window, or the target frame.

This makes site-wide changes easy to implement (especially when used in conjunction with Cascading Style Sheets) as you can change the items such as the menu bar and logo for your site in one page, and that will update the entire site.

Using a frame for the header (top) area or navigation bar of your pages will also make it static (fixed) so visitors can easily access menus etc... no more scrolling back up the page.

All this sounds great, but there are a number of points you need to consider before implementing a framed site, especially when using WYSIWYG (What You See Is What You Get) web page editors .

1) Many search engines cannot index framed sites. Because the home page is merely a frame, with very little content or hyperlinks to follow, search engine spiders may stop dead on the page and have 'nothing to report'. A way around this is the proper implementation of Meta tags and use of the "noframes" tag.

2) If a search engine does manage to spider your site, visitors from search engines may land on the content pages, rather than the full-framed version, i.e. they may arrive on your site and all they will see is the menu bar.

Search Engines

Search engines don't deal with frames well. Some search engines can't follow framed pages at all, but even the best search engines will have problems. More importantly, many search engines choose not to index frames because they are so problematic.

Although search engines can theoretically index frames well enough, there is no way to reliably organize them in a database and display them in results pages using the correct framesets. Remember that search engines find individual pages with the relevant content, and then have to work backwards to determine which frameset each page belongs to. How would they do that? Answer: They can't, so they don't try.

In theory, for very small databases, there might be some way to track and record framesets. This would be impractical for large search engines, but it would also be hopelessly unreliable. For example, if a page appears in two different framesets, how would a search engine know which frameset to use when that page is returned in a result? What happens when a page is moved from one frameset to another, or placed in a frameset temporarily — how would the search engines know? There are many other such problems which make frames unsuitable for search result pages.

So.... search engines can't reconstruct framesets from individual pages. The only option is to show the pages isolated (independent of their frameset). Therefore most search listings to framed pages result in broken framesets.
The situation with search engines will not change for two reasons:

The root of the problem is with frames themselves, not the search engines, so there is little hope that search engines will "get better" at dealing with them.
Frames are out of fashion, especially amongst the types of site the search engines are trying to target, so the problems associated with frames are not a priority for search engines.

Note: Search engines index the "noframes" content of a frameset, which is why search engines will often show a site's description as: "Sorry, your browser doesn't support frames so you are unable to view this website". That's not going to attract many visitors! You can get around this to some extent by providing better noframes content, but it's more work and will never have the same results as standard pages.

3) Non-frames capable browsers. Fortunately, only 1% of visitors browsers fall into this category. Once again the use of the 'noframes' tag will assist, but to be used effectively you basically need to create two sites, one framed, one not - the "time saving" is suddenly gone.

4) Bookmarking. A visitor cannot bookmark a specific page in your site without requiring additional customised scripting for each page. Even then there is a risk of visitors landing on the content frame, with no navigation frames to view.

5) Visitor opinion. Many find frames annoying.

6) Copyright issues. You'll need to ensure that all links within your site that point to external sources open in a new window to avoid copyright wrangles. There have been legal precedents in relation to this issue. Many site owners object to their content appearing in someone else's frame, to the point that special "frame busting" code is used.

7) Internal linking. Special attention will need to be paid to your internal links to ensure that any page pointing to, for example, the home page opens as a "whole page", otherwise the framed home page will appear in the target window, causing confusion to visitors.

8) Printing issues. Visitors need to take further steps within their print settings to ensure the information they want is printed correctly. In most cases, a full page cannot be printed as displayed on the screen, only in sections corresponding to the frame.

9) Scroll bars, divider bars. If your framed site uses a number of frames, scroll bars can prove to be unsightly. These can be removed, but check compatibility with other popular browsers. (See further resources at the end of this article).

10) External linkages to your site. If other sites wish to link to specific pages in your site, it is more difficult for them to do so.

11) Refresh/Reload problems. Again, special care needs to be taken with coding otherwise when a visitor tries to refresh a particular page, they may be taken back to the original frameset. A common problem.

Working with frames in asp.net

2011-08-26T14:30:00.000+05:30

Introduction

Any developer who has had the dubious task of developing a Web site utilizing frames knows it can be an uphill battle. Many argue that frames should be avoided at all costs, while others realize how they can benefit a Web site's user interface. When my team had to develop a Web site that displayed pdf's in a management dashboard, we knew frames were the way to go. Unfortunately, we were not sure how to best work with frames in ASP.NET. When I used my list of normal search engines/newsgroups, I could not find much in the way of useful information. Here is one reply I got when asking how to best work with frames in .NET:

Ok, My list of suggestion for Frames.

Frames are Evil

The Devil created Frames

If you are having a problem related to the Target, refer to item 1

If you are trying to refresh data in a particular frame, refer to 1

I think you get the idea. The fact of the matter is frames can provide an aesthetically pleasing site, which in many situations is more user-friendly. This of course is only the case if you avoid the pitfalls of frames, such as multiple scroll bars and too many frame windows. I will not address these pitfalls in this article because there is certainly an over-abundance of information/opinions on that subject. In my opinion frames have gotten a bad reputation from users because so many developers misused them. On the other hand they have a well deserved reputation from the developer side because in the past they were very difficult to work with. The purpose of this article is to show you that this is no longer the case. I will also present one alternative to using frames, called Smart Navigation.

In the end we solved the problem of working with frames by utilizing a mix of JavaScript code and the Attributes property of .NET Web Forms. This is essentially the key behind working with frames in .NET.
Frames and Frame Alternatives

Although this article will be used to address the usage of frames in .NET, it is important to talk about the use of frames and some alternatives. My team has developed the majority of our sites without frames because they did not fit into a model in which they were required. We use frames when we need to present the users with a control or set of controls that maintain a certain state, while another part of the page needs to load a file in or some other type of control(s). The MSDN site illustrates a good use of frames in its library section: http://msdn.microsoft.com/library/default.asp In the past we have also used frames to control screen refresh. On an ASP 2.0 or 3.0 page, the entire page would refresh any time you needed to perform a server side event. One alternative to solving the screen refresh issue in ASP.NET is Smart Navigation. This tag can be set at page level through page properties, or at site level through web.config. With this turned on, only the controls within the form tag will be refreshed. So if you have other images, headers, etc., the users will not get screen flicker. It is important to note that behind the scenes ASP.NET is using Iframes, so this will only work on IE5.0 and greater browsers. The use of inline frames allows for this targeted refresh because each frame is treated independently. The following link will provide you with more information on Iframes and some issues related to them: http://www.cs.tut.fi/~jkorpela/html/iframe.html

To see how Smart Navigation can be used, let's take a look at an example.


<%@ Page Language="vb" AutoEventWireup="false" 
Codebehind="smart_tag.aspx.vb" Inherits="asptoday_frames.smart_tag" 
smartNavigation="True"%>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML>
	<HEAD>
		<title>smart_tag</title>
		<meta content="Microsoft Visual Studio.NET 7.0" 
name="GENERATOR">
		<meta content="Visual Basic 7.0" name="CODE_LANGUAGE">
		<meta content="JavaScript" name="vs_defaultClientScript">
		<meta content="http://schemas.microsoft.com/intellisense/ie5"    
name="vs_targetSchema">
	</HEAD>
	<body MS_POSITIONING="GridLayout">
		<form id="frmImage" style="Z-INDEX: 101; LEFT: 6px; POSITION: 
absolute; TOP: 18px" runat="server">
<asp:button id="btnRefresh" style="Z-INDEX: 104; LEFT: 19px; POSITION: 
absolute; TOP: 13px" runat="server" Text="Refresh"></asp:button><asp:label id="lblRefresh" 
style="Z-INDEX: 105; LEFT: 96px; POSITION: absolute; TOP: 18px" 
runat="server"></asp:label></form>
		<IMG style="Z-INDEX: 103; LEFT: 27px; WIDTH: 507px; POSITION: 
absolute; TOP: 87px; HEIGHT: 259px" height="259" alt="" src="test.GIF" 
width="507">
		<IMG style="Z-INDEX: 102; LEFT: 16px; WIDTH: 507px; POSITION: 
absolute; TOP: 78px; HEIGHT: 259px" height="259" alt="" src="test.GIF" 
width="507">
	</body>
</HTML>

Code Behind


using System;
using System.Collections;
using System.Collections.Generic;
using System.Data;
using System.Diagnostics;
public class smart_tag : System.Web.UI.Page
{
	private System.Web.UI.WebControls.Button withEventsField_btnRefresh;
	protected System.Web.UI.WebControls.Button btnRefresh {
		get { return withEventsField_btnRefresh; }
		set {
			if (withEventsField_btnRefresh != null) {
				withEventsField_btnRefresh.Click -= btnRefresh_Click;
			}
			withEventsField_btnRefresh = value;
			if (withEventsField_btnRefresh != null) {
				withEventsField_btnRefresh.Click += btnRefresh_Click;
			}
		}
	}

	protected System.Web.UI.WebControls.Label lblRefresh;
	private void Page_Load(System.Object sender, System.EventArgs e)
	{
		this.lblRefresh.Text = "";
	}

	private void btnRefresh_Click(System.Object sender, System.EventArgs e)
	{
		this.lblRefresh.Text = "Page Refreshed";
	}
	public smart_tag()
	{
		Load += Page_Load;
	}
}

At the top of the page we are setting smartNavigation="True" so that the only the lblRefresh and btnRefresh make a roundtrip to the server. I have added two images at the bottom of the page to illustrate the difference that smart navigation makes. If you set smartNavigation = False, you will notice some flashing of the images, even when running local to the Web server. IFrames can be useful in forcing refresh of only part of the screen, but it cannot fully replace the functionality that comes with working with regular frames. The biggest drawback with Iframes is that you cannot implement two separate form tags in the same page, which may be required for some sites.
Questions Regarding Frames
The main problem that most people have when working with frames is cross-frame communication. There are several consistent questions I see on frames including:

How do I pass data to another frame?
How do I refresh a specific frame?
This issue is compounded when you start dealing with pop-up windows.

The Solution
Solving the above described problems has become much easier with some basic knowledge of the windows and frames properties in javascript and the ASP.NET Attributes property. In this article I am going to break my code up into several sections, starting with a very easy to follow hello world style example. After that I will address working with pop-ups, adding a very useful HTML control into the mix.
The Code

Goal #1: Pass data between left and right frames
UI Design
Before I get into the code, it is important that you receive the visual of the two frames that we will be working with:
CODE
For the purpose of brevity, I will exclude code automatically generated by Web forms.
To start we have the simple default.htm page that will contain our two aspx pages.


<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<html>
	<head>
		<title>How to Work with frames in .Net</title>
		<meta name="vs_defaultClientScript" content="JavaScript">
		<meta name="vs_targetSchema" 
content="http://schemas.microsoft.com/intellisense/ie5">
		<meta name="GENERATOR" content="Microsoft Visual Studio.NET 
7.0">
		<meta name="ProgId" content="VisualStudio.HTML">
		<meta name="Originator" content="Microsoft Visual Studio.NET 
7.0">
	</head>
	<frameset border="1" frameborder="1" framespacing="0" 
cols="30%,70%">

<frame name="left frame" src="leftframe.aspx"/>
<frame name="right frame" src="rightframe.aspx"/>

</frameset>
</html>

Next is the left frame page, which will contain a mix of javascript and VB.NET code. The mix of this code will enable us to pass a text string from a textbox on the left frame to a textbox in the right frame.


using System;
using System.Collections;
using System.Collections.Generic;
using System.Data;
using System.Diagnostics;
public class leftframe : System.Web.UI.Page
{
	protected System.Web.UI.WebControls.Button btnTright;
	protected System.Web.UI.WebControls.Button btnPop;

	protected System.Web.UI.WebControls.TextBox txtTright;
	private void Page_Load(System.Object sender, System.EventArgs e)
	{
		//enclose the add attributes in the not is post back block, so they
		// are called to be added only once.
		if (!IsPostBack) {
			btnTright.Attributes.Add("onclick", "javascript:tranRight(txtTransferRight.value)");
			btnPop.Attributes.Add("onclick", "javascript:openWindow()");
			//remove file name from session
			Session.Remove("fileName");
		}

	}
	public leftframe()
	{
		Load += Page_Load;
	}

}

The key to working with frames is the Attributes property along with its Add method, which allows us to dynamically insert calls to javascript functions, passing in our server side control's data. The Attributes property allows you to declare any event handler that is associated with a specific Web control. Any of the attributes that you add to the controls collection will be rendered at run time. For a text box you could add a call to the textchanged event. Note, if you do make reference to an unsupported event, it will be ignored by the browser. For now you can ignore the session remove, which will be needed for a later part of this article. Here is the HTML code that exists for the left frame page.


<%@ Page Language="vb" AutoEventWireup="false" 
Codebehind="leftframe.aspx.vb" Inherits="asptoday_frames.leftframe"%>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML>
	<HEAD>
		<title>leftframe</title>
		<meta content="Microsoft Visual Studio.NET 7.0" 
name="GENERATOR">
		<meta content="Visual Basic 7.0" name="CODE_LANGUAGE">
		<meta content="JavaScript" name="vs_defaultClientScript">
		<meta content="http://schemas.microsoft.com/intellisense/ie5" 
name="vs_targetSchema">
	</HEAD>
	<body MS_POSITIONING="GridLayout">
<form id="frmTransterRight" method="post" runat="server">
<asp:button id="btnTransferRight" style="Z-INDEX: 101; LEFT: 23px; 
POSITION: absolute; TOP: 100px" runat="server" Text="Send to right frame" 
Width="131px"></asp:button><asp:textbox 
id="txtTransferRight" style="Z-INDEX: 102; LEFT: 26px; POSITION: absolute; TOP: 
64px" runat="server" Width="170px" Height="24px">Text to go to right 
frame</asp:textbox><asp:button id="btnPop" style="Z-INDEX: 103; 
LEFT: 24px; POSITION: absolute; TOP: 136px" runat="server" Text="Open Pop-Up" 
Width="129px"></asp:button></form>
<script language="javascript">		

//this function takes a value (ltext) and transmits that to the left hand frame

function tranRight(ltext)
{
   parent.frames(1).document.forms("frmReceive").item("txtReceive").value = ltext;	
}
</script>
</body>

Notice the tranRight javascript function, which will enable us to transfer the text in the left frame to the right frame. The tranRight function is called from the click event of the btnTransferRight button Parent.Frames(1) indicates we are targeting the right frame, while Parent.Frames(0) is the current page that the code is getting initialized from. When the btnTransferRight button is clicked, only the left frame will be re-rendered because the button's event is set to run client side.

With that simple code, we have established basic interaction between our frames.
Goal #2: Pass text between pop-up and right frame
In this section we will pass text from a pop-up screen launched from the left frame to a textbox in the right frame. UI Design The "Send Via QS" button will trigger the event that will transmit the text. The lower section of this UI will be addressed in Goal#3

UI Code
The first key is the code which allows this pop-up to be launched from the left frame. This is a line in the original left frame codebehind listed as part of example #1:

 
btnPop.Attributes.Add("onclick", "javascript:openWindow()")

This is the JavaScript which launches this pop-up:


function openWindow() 
{ msgWindow=window.open("popup.aspx","", 
"fullscreen=no,toolbar=no,status=yes,menubar=yes,scrollbars=no,resizable=no,
directories=no,location=no,width=500,height=400"); 
if (msgWindow.opener == null) msgWindow.opener = self; }

Now that we have established the launch of the popup, we can look at the pageload event of the popup Web form.


using System;
using System.Collections;
using System.Collections.Generic;
using System.Data;
using System.Diagnostics;
public class popup : System.Web.UI.Page
{
	protected System.Web.UI.HtmlControls.HtmlInputButton btnLfile;
	protected System.Web.UI.WebControls.Button btnWFrame;
	protected System.Web.UI.WebControls.Button btnHframe;
	protected System.Web.UI.WebControls.TextBox txtPop;

	protected System.Web.UI.HtmlControls.HtmlInputFile myFile;
	private void Page_Load(System.Object sender, System.EventArgs e)
	{
		//enclose the add attributes in the not is post back block, so they
		// are called to be added only once.
		if (!IsPostBack) {
			btnSendQS.Attributes.Add("onclick", "javascript:openpdf(txtPop.value)");
			btnSendSession.Attributes.Add("onclick", "javascript:openviacache()");
		}
	}
	public popup()
	{
		Load += Page_Load;
	}
}

Once again we are adding attributes to two of the buttons which call javascript functions. The first button is the one we will concentrate on for the time being. As you can see we are passing in the value of the txtPop textbox. Here is the javascript which transmits the text.


function transferText(strTxtTransfer) { 
window.opener.parent.frames[1].location.href = "rightframe.aspx?strText="+ strTxtTransfer; window.close(); }

By using window.opener.parent we are able to reference the original frame, so we then in turn can reference the right frame to transmit the data to (by inserting and index of 1). The text itself is encased within a query string. This query string is then read by the right frame on load of the page and presented within that page's textbox.
Goal #3 Use HTML input control in pop-up to load user file to server and then launch pdf in right fr
In this section we will be using the HTML input control to load a pdf file to the Web server and then subsequently call for the load of that pdf into the right frame. The HTML input control, which is provided with .NET, makes file uploading far more simple by presenting users with the standard Windows file browsing window. UI Design

UI Code


<form id="Form1" method="post" encType="multipart/form-data" 
runat="server">

The first section of code to review is the HTML in the pop-up.aspx page. In the form you must add the Tag encType="multipart/form-data". This will allow the HTML input control to work.


 private void btnLoadFile_ServerClick(System.Object sender, System.EventArgs e)
{
	//Grab the file name from its fully qualified path at client 
	string strFileName = myFile.PostedFile.FileName;
	// only the attched file name not its path
	string strShortFile = System.IO.Path.GetFileName(strFileName);
	//Save uploaded file to server @ rootweb\pdf_files and add to session
	myFile.PostedFile.SaveAs(Server.MapPath(".") + "\\pdf_files\\" + strShortFile);
	Session.Add("fileName", Server.MapPath(".") + "\\pdf_files\\" + strShortFile);
}

This codebehind for the loadfile button saves the file up to the server and stores the name and location in session. This was the reason for the clearing of session that was seen in the codebehind of the left frame page. The browse button is what presents the user with the standard Windows Explorer file selection box and fills in the lower text box. This functionality is all encapsulated in the HTML input control. Below is the HTML and JavaScript that exists behind the pop-up aspx page.


<%@ Page Language="vb" AutoEventWireup="false" Codebehind="popup.aspx.vb" 
Inherits="asptoday_frames.popup"%>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML>
	<HEAD>
		<title>popup</title>
		<meta content="Microsoft Visual Studio.NET 7.0" 
name="GENERATOR">
		<meta content="Visual Basic 7.0" name="CODE_LANGUAGE">
		<meta content="JavaScript" name="vs_defaultClientScript">
		<meta content="http://schemas.microsoft.com/intellisense/ie5" 
name="vs_targetSchema">
	</HEAD>
	<body MS_POSITIONING="GridLayout">
		<form id="frmPopUp" method="post" encType="multipart/form-data" 
runat="server">
			<asp:label id="Label1" style="Z-INDEX: 106; LEFT: 26px; 
POSITION: absolute; TOP: 90px" runat="server" Height="20px" ForeColor="Red" 
Font-Bold="True" Width="280px">Session 
Example</asp:label><asp:label id="lblSession" style="Z-INDEX: 
107; LEFT: 26px; POSITION: absolute; TOP: 117px" runat="server" Height="20px" 
ForeColor="DimGray" Font-Bold="True" Width="459px" Font-
Size="Smaller">Click Browse, Find PDF file, click load file and then the 
send via session button</asp:label> 
			<INPUT id="btnLoadFile" style="Z-INDEX: 100; LEFT: 334px; 
WIDTH: 79px; POSITION: absolute; TOP: 148px; HEIGHT: 23px" type="button" 
value="LoadFile " runat="server">
			<asp:button id="btnSendSession" style="Z-INDEX: 101; 
LEFT: 18px; POSITION: absolute; TOP: 179px" runat="server" Width="112px" 
Text="Send Via Session"></asp:button><asp:button 
id="btnSendQS" style="Z-INDEX: 102; LEFT: 266px; POSITION: absolute; TOP: 41px" 
runat="server" Width="113px" Text="Send Via 
QS"></asp:button><INPUT id="myFile" style="Z-INDEX: 103; 
LEFT: 18px; WIDTH: 311px; POSITION: absolute; TOP: 148px; HEIGHT: 22px" 
type="file" size="32" name="myFile" runat="server">
			<asp:textbox id="txtPop" style="Z-INDEX: 104; LEFT: 25px; 
POSITION: absolute; TOP: 43px" runat="server" Width="225px">Transmit to 
right frame</asp:textbox><asp:label id="lblQS" style="Z-INDEX: 
105; LEFT: 32px; POSITION: absolute; TOP: 13px" runat="server" ForeColor="Red" 
Font-Bold="True" Width="251px">Query String 
Example</asp:label></form>
		<script language="javascript">			

function transferText(strTxtTransfer)
{
window.opener.parent.frames[1].location.href = "rightframe.aspx?strText="+ strTxtTransfer;
window.close();
}


function openviacache()
{
window.opener.parent.frames[1].location.href = "rightframe.aspx";
window.close();
}
		</script>
	</body>
</HTML>

A refresh of the right frame is called from the "Send Via Cache" button, which has an onclick event call to the openviacache JavaScript function. This function calls for the re-load of the right frame page. We want the page to reload so the code in the page load event of the right hand frame page will execute. The code behind of the right frame page looks for the fname session key and loads a pdf in the page based on that filename. In this block of code, I first test to make sure the file passed from session is a pdf. This is because I am using Response.contentType so that the browser can interpret the file as a pdf and display it properly in the browser.


using System;
using System.Collections;
using System.Collections.Generic;
using System.Data;
using System.Diagnostics;
public class rightframe : System.Web.UI.Page
{

	protected System.Web.UI.WebControls.TextBox txtFleft;
	private void Page_Load(System.Object sender, System.EventArgs e)
	{
		//Put user code to initialize the page here

		string strTxtTransfer = Request.QueryString.Get("strText");
		//first find out if this page is getting called from the send via qs button by looking for a query string
		if (!string.IsNullOrEmpty(strTxtTransfer)) {
			this.txtReceive.Text = strTxtTransfer;
		// if session fname is populated and the file is a pdf load the pdf
		} else if (!string.IsNullOrEmpty((Session["filename"])) & Strings.Right((Session["filename"]), 3) == "pdf") {
			Response.Expires = 0;
			Response.Buffer = true;
			Response.Clear();
			Response.ContentType = "application/pdf";
			Response.WriteFile(Session["filename"]);
			Response.End();
		//if session has a value and it is not a pdf send an error message
		} else if (!string.IsNullOrEmpty((Session["filename"])) & Strings.Right((Session["filename"]), 3) != "pdf") {
			var _with1 = this.txtReceive;
			_with1.ForeColor = Color.Red;
			_with1.Text = "sorry you must choose a pdf file to display";
		}
	}
	public rightframe()
	{
		Load += Page_Load;
	}
}

The final result looks like this:

How to avoid copy, paste and backspace error on AsyncFileUpload control in asp.net

2011-08-25T19:03:00.002+05:30

Use below code to avoid above problems

<ajax:AsyncFileUpload runat="server" ID="flTripImages"

OnClientUploadStarted="SetTermAgrement" OnUploadedFileError="flTripImages_UploadedError" OnClientUploadComplete="EnableCheckBox"
OnUploadedComplete="flTripImages_UploadedComplete"
oncontextmenu="return false;" />

use oncontextmenu="return false;" to avoid the contextmenu on the upload control, this will take care of above problems

Passing a control.ClientID to a javascript function in asp.net

2011-08-24T12:03:00.000+05:30

Use below code to pass control client id to javascript function:

<asp:TextBox ID="demo1" runat="server"></asp:TextBox>
<img src="images/cal.gif" onclick="javascript:NewCssCal('<%= demo1.ClientID %>')"
style="cursor: pointer" alt="sdf" />

how to implement facebook like button in asp.net pages or master page

2011-08-24T11:35:00.001+05:30

1) One way to add the like button on your site.go to this page,
http://developers.facebook.com/docs/reference/plugins/like-box
just enter your facebook details then press on the "Get Code" button, u will get the copy & paste code like below.

This is an example:

<iframe src="http://www.facebook.com/plugins/likebox.php?href=http%3A%2F%2Fwww.facebook.com%2Fplatform&width=292&colorscheme=light&show_faces=true&border_color&stream=true&header=true&height=427" scrolling="no" frameborder="0" style="border:none; overflow:hidden; width:292px; height:427px;" allowTransparency="true"></iframe>

2) Another way To implement facebook like button copy & paste the below code replace "MahindraHomestays" with "your facebook id"

Wikileaks releases some of the Top Black Money Holders from India

2011-08-19T15:28:00.000+05:30

How To: Prevent Cross-Site Scripting in ASP.NET

2011-08-17T13:35:00.001+05:30

Applies To

ASP.NET version 1.1
ASP.NET version 2.0

Summary

This How To shows how you can help protect your ASP.NET applications from cross-site scripting attacks by using proper input validation techniques and by encoding the output. It also describes a number of other protection mechanisms that you can use in addition to these two main countermeasures.

Cross-site scripting (XSS) attacks exploit vulnerabilities in Web page validation by injecting client-side script code. Common vulnerabilities that make your Web applications susceptible to cross-site scripting attacks include failing to properly validate input, failing to encode output, and trusting the data retrieved from a shared database. To protect your application against cross-site scripting attacks, assume that all input is malicious. Constrain and validate all input. Encode all output that could, potentially, include HTML characters. This includes data read from files and databases.

Objectives

Understand the common cross-site scripting vulnerabilities in Web page validation.
Apply countermeasures for cross-site scripting attacks.
Constrain input by using regular expressions, type checks, and ASP.NET validator controls.
Constrain output to ensure the browser does not execute HTML tags that contain script code.
Review potentially dangerous HTML tags and attributes and evaluate countermeasures.

Overview

Cross-site scripting attacks exploit vulnerabilities in Web page validation by injecting client-side script code. The script code embeds itself in response data, which is sent back to an unsuspecting user. The user's browser then runs the script code. Because the browser downloads the script code from a trusted site, the browser has no way of recognizing that the code is not legitimate, and Microsoft Internet Explorer security zones provide no defense. Cross-site scripting attacks also work over HTTP and HTTPS (SSL) connections.
One of the most serious examples of a cross-site scripting attack occurs when an attacker writes script to retrieve the authentication cookie that provides access to a trusted site and then posts the cookie to a Web address known to the attacker. This enables the attacker to spoof the legitimate user's identity and gain illicit access to the Web site.
Common vulnerabilities that make your Web application susceptible to cross-site scripting attacks include:

Failing to constrain and validate input.
Failing to encode output.
Trusting data retrieved from a shared database.

Guidelines

The two most important countermeasures to prevent cross-site scripting attacks are to:

Constrain input.
Encode output.

Constrain Input

Start by assuming that all input is malicious. Validate input type, length, format, and range.

To constrain input supplied through server controls, use ASP.NET validator controls such as RegularExpressionValidator and RangeValidator.
To constrain input supplied through client-side HTML input controls or input from other sources such as query strings or cookies, use the System.Text.RegularExpressions.Regex class in your server-side code to check for expected using regular expressions.
To validate types such as integers, doubles, dates, and currency amounts, convert the input data to the equivalent .NET Framework data type and handle any resulting conversion errors.

For more information about and examples of how to constrain input, see How To: Protect From Injection Attacks in ASP.NET.

Encode Output

Use the HttpUtility.HtmlEncode method to encode output if it contains input from the user or from other sources such as databases. HtmlEncode replaces characters that have special meaning in HTML-to-HTML variables that represent those characters. For example, < is replaced with < and " is replaced with ". Encoded data does not cause the browser to execute code. Instead, the data is rendered as harmless HTML.
Similarly, use HttpUtility.UrlEncode to encode output URLs if they are constructed from input.

Summary of Steps

To prevent cross-site scripting, perform the following steps:

Step 1. Check that ASP.NET request validation is enabled.
Step 2. Review ASP.NET code that generates HTML output.
Step 3. Determine whether HTML output includes input parameters.
Step 4. Review potentially dangerous HTML tags and attributes.
Step 5. Evaluate countermeasures.

Step 1. Check That ASP.NET Request Validation Is Enabled

By default, request validation is enabled in Machine.config. Verify that request validation is currently enabled in your server's Machine.config file and that your application does not override this setting in its Web.config file. Check that validateRequest is set to true as shown in the following code example.

<system.web><pages buffer="true" validateRequest="true" /></system.web>

You can disable request validation on a page-by-page basis. Check that your pages do not disable this feature unless necessary. For example, you may need to disable this feature for a page if it contains a free-format, rich-text entry field designed to accept a range of HTML characters as input. For more information about how to safely handle this type of page, see Step 5. Evaluate Countermeasures.
To test that ASP.NET request validation is enabled

Create an ASP.NET page that disables request validation. To do this, set ValidateRequest="false", as shown in the following code example.

<%@ Page Language="C#" ValidateRequest="false" %>
<html>
 <script runat="server">
  void btnSubmit_Click(Object sender, EventArgs e)
  {
    // If ValidateRequest is false, then 'hello' is displayed
    // If ValidateRequest is true, then ASP.NET returns an exception
    Response.Write(txtString.Text);
  }
 </script>
 <body>
  <form id="form1" runat="server">
    <asp:TextBox id="txtString" runat="server" 
                 Text="<script>alert('hello');</script>" />
    <asp:Button id="btnSubmit" runat="server"   
                OnClick="btnSubmit_Click" 
                Text="Submit" />
  </form>
 </body>
</html>

Run the page. It displays Hello in a message box because the script in txtString is passed through and rendered as client-side script in your browser.
Set ValidateRequest="true" or remove the ValidateRequest page attribute and browse to the page again. Verify that the following error message is displayed.
```
A potentially dangerous Request.Form value was detected from the client (txtString="<script>alert('hello...").
  
```
This indicates that ASP.NET request validation is active and has rejected the input because it includes potentially dangerous HTML characters.

Note Do not rely on ASP.NET request validation. Treat it as an extra precautionary measure in addition to your own input validation.

Step 2. Review ASP.NET Code That Generates HTML Output

ASP.NET writes HTML as output in two ways, as shown in the following code examples.

Response.Write
<% =

Search your pages to locate where HTML and URL output is returned to the client.

Step 3. Determine Whether HTML Output Includes Input Parameters

Analyze your design and your page code to determine whether the output includes any input parameters. These parameters can come from a variety of sources. The following list includes common input sources:

Form fields, such as the following.

Response.Write(name.Text);
Response.Write(Request.Form["name"]);
Query Strings
Response.Write(Request.QueryString["name"]);

Query strings, such as the following:

Response.Write(Request.QueryString["username"]);

Databases and data access methods, such as the following:
```
SqlDataReader reader = cmd.ExecuteReader();
Response.Write(reader.GetString(1));
  
```
Be particularly careful with data read from a database if it is shared by other applications.

Cookie collection, such as the following:

Response.Write(
Request.Cookies["name"].Values["name"]);

Session and application variables, such as the following:

Response.Write(Session["name"]);
Response.Write(Application["name"]);

In addition to source code analysis, you can also perform a simple test by typing text such as "XYZ" in form fields and testing the output. If the browser displays "XYZ" or if you see "XYZ" when you view the source of the HTML, your Web application is vulnerable to cross-site scripting.
To see something more dynamic, inject <script>alert('hello');</script> through an input field. This technique might not work in all cases because it depends on how the input is used to generate the output.

Step 4. Review Potentially Dangerous HTML Tags and Attributes

If you dynamically create HTML tags and construct tag attributes with potentially unsafe input, make sure you HTML-encode the tag attributes before writing them out.
The following .aspx page shows how you can write HTML directly to the return page by using the <asp:Literal> control. The code takes user input of a color name, inserts it into the HTML sent back, and displays text in the color entered. The page uses HtmlEncode to ensure the inserted text is safe.

<%@ Page Language="C#" AutoEventWireup="true"%>

<html>
  <form id="form1" runat="server">
    <div>
      Color:&nbsp;<asp:TextBox ID="TextBox1" runat="server"></asp:TextBox><br />
      <asp:Button ID="Button1" runat="server" Text="Show color" 
         OnClick="Button1_Click" /><br />
      <asp:Literal ID="Literal1" runat="server"></asp:Literal>
    </div>
  </form>
</html>

<script runat="server">
  private void Page_Load(Object Src, EventArgs e)
  {
    protected void Button1_Click(object sender, EventArgs e)
    {
      Literal1.Text = @"<span style=""color:" 
        + Server.HtmlEncode(TextBox1.Text)
        + @""">Color example</span>";
    }           
  }
</Script>

Potentially Dangerous HTML Tags

While not an exhaustive list, the following commonly used HTML tags could allow a malicious user to inject script code:

<applet>
<body>
<embed>
<frame>
<script>
<frameset>
<html>
<iframe>
<img>
<style>
<layer>
<link>
<ilayer>
<meta>
<object>

An attacker can use HTML attributes such as src, lowsrc, style, and href in conjunction with the preceding tags to inject cross-site scripting. For example, the src attribute of the <img> tag can be a source of injection, as shown in the following examples.

<img src="javascript:alert('hello');">
<img src="java&#010;script:alert('hello');">
<img src="java&#X0A;script:alert('hello');">

An attacker can also use the <style> tag to inject a script by changing the MIME type as shown in the following.

<style TYPE="text/javascript">
  alert('hello');
</style>

Step 5. Evaluate Countermeasures

When you find ASP.NET code that generates HTML using some input, you need to evaluate appropriate countermeasures for your specific application. Countermeasures include:

Encode HTML output.
Encode URL output.
Filter user input.

Encode HTML Output

If you write text output to a Web page and you do not know if the text contains HTML special characters (such as <, >, and &), pre-process the text by using the HttpUtility.HtmlEncode method as shown in the following code example. Do this if the text came from user input, a database, or a local file.

Response.Write(HttpUtility.HtmlEncode(Request.Form["name"]));

Do not substitute encoding output for checking that input is well-formed and correct. Use it as an additional security precaution.

Encode URL Output

If you return URL strings that contain input to the client, use the HttpUtility.UrlEncode method to encode these URL strings as shown in the following code example.

Response.Write(HttpUtility.UrlEncode(urlString));

Filter User Input

If you have pages that need to accept a range of HTML elements, for example through some kind of rich text input field, you must disable ASP.NET request validation for the page. If you have several pages that do this, create a filter that allows only the HTML elements that you want to accept. A common practice is to restrict formatting to safe HTML elements such as bold (<b>) and italic (<i>).
To safely allow restricted HTML input

Disable ASP.NET request validation by the adding the ValidateRequest="false" attribute to the @ Page directive.
Encode the string input with the HtmlEncode method.
Use a StringBuilder and call its Replace method to selectively remove the encoding on the HTML elements that you want to permit.

The following .aspx page code shows this approach. The page disables ASP.NET request validation by setting ValidateRequest="false". It HTML-encodes the input and then selectively allows the <b> and <i> HTML elements to support simple text formatting.

<%@ Page Language="C#" ValidateRequest="false"%>

<script runat="server">

  void submitBtn_Click(object sender, EventArgs e)
  {
    // Encode the string input
    StringBuilder sb = new StringBuilder(
                            HttpUtility.HtmlEncode(htmlInputTxt.Text));
    // Selectively allow  <b> and <i>
    sb.Replace("&lt;b&gt;", "<b>");
    sb.Replace("&lt;/b&gt;", "");
    sb.Replace("&lt;i&gt;", "<i>");
    sb.Replace("&lt;/i&gt;", "");
    Response.Write(sb.ToString());
  }
</script>

<html>
  <body>
    <form id="form1" runat="server">
      <div>
        <asp:TextBox ID="htmlInputTxt" Runat="server" 
                     TextMode="MultiLine" Width="318px"
                     Height="168px"></asp:TextBox>
        <asp:Button ID="submitBtn" Runat="server" 
                     Text="Submit" OnClick="submitBtn_Click" />
      </div>
    </form>
  </body>
</html>

Additional Considerations

In addition to the techniques discussed previously in this How To, use the following countermeasures as further safe guards to prevent cross-site scripting:

Set the correct character encoding.
Do not rely on input sanitization.
Use the HttpOnly cookie option.
Use the <frame> security attribute.
Use the innerText property instead of innerHTML.

Set the Correct Character Encoding

To successfully restrict valid data for your Web pages, you should limit the ways in which the input data can be represented. This prevents malicious users from using canonicalization and multi-byte escape sequences to trick your input validation routines. A multi-byte escape sequence attack is a subtle manipulation that uses the fact that character encodings, such as uniform translation format-8 (UTF-8), use multi-byte sequences to represent non-ASCII characters. Some byte sequences are not legitimate UTF-8, but they may be accepted by some UTF-8 decoders, thus providing an exploitable security hole.
ASP.NET allows you to specify the character set at the page level or at the application level by using the <globalization> element in the Web.config file. The following code examples show both approaches and use the ISO-8859-1 character encoding, which is the default in early versions of HTML and HTTP.
To set the character encoding at the page level, use the <meta> element or the ResponseEncoding page-level attribute as follows:

<meta http-equiv="Content Type" 
      content="text/html; charset=ISO-8859-1" />

OR
<% @ Page ResponseEncoding="iso-8859-1" %>

To set the character encoding in the Web.config file, use the following configuration.

<configuration>
   <system.web>
      <globalization 
         requestEncoding="iso-8859-1"
         responseEncoding="iso-8859-1"/>
   </system.web>
</configuration>

Validating Unicode Characters

Use the following code to validate Unicode characters in a page.

using System.Text.RegularExpressions;
. . .

public class WebForm1 : System.Web.UI.Page
{
  private void Page_Load(object sender, System.EventArgs e)
  {
    // Name must contain between 1 and 40 alphanumeric characters
    // and (optionally) special characters such as apostrophes  
    // for names such as O'Dell

    if (!Regex.IsMatch(Request.Form["name"],
               @"^[\p{L}\p{Zs}\p{Lu}\p{Ll}\']{1,40}$"))
      throw new ArgumentException("Invalid name parameter");

    // Use individual regular expressions to validate other parameters
    . . .
  }
}

The following explains the regular expression shown in the preceding code:

^ means start looking at this position.
\p{ ..} matches any character in the named character class specified by {..}.
{L} performs a left-to-right match.
{Lu} performs a match of uppercase.
{Ll} performs a match of lowercase.
{Zs} matches separator and space.
'matches apostrophe.
{1,40} specifies the number of characters: no less than 1 and no more than 40.
$ means stop looking at this position.

Do Not Rely on Input Sanitization

A common practice is for code to attempt to sanitize input by filtering out known unsafe characters. Do not rely on this approach because malicious users can usually find an alternative means of bypassing your validation. Instead, your code should check for known secure, safe input. Table 1 shows various safe ways to represent some common characters.

Table 1: Character Representation

Characters	Decimal	Hexadecimal	HTML Character Set	Unicode
" (double quotation marks)	&#34	&#x22	"	\u0022
' (single quotation mark)	&#39	&#x27	'	\u0027
& (ampersand)	&#38	&#x26	&	\u0026
< (less than)	&#60	&#x3C	<	\u003c
> (greater than)	&#62	&#x3E	>	\u003e

Use the HttpOnly Cookie Option

Internet Explorer 6 Service Pack 1 and later supports an HttpOnly cookie attribute, which prevents client-side scripts from accessing a cookie from the document.cookie property. Instead, the script returns an empty string. The cookie is still sent to the server whenever the user browses to a Web site in the current domain.

Note Web browsers that do not support the HttpOnly cookie attribute either ignore the cookie or ignore the attribute, which means that it is still subject to cross-site scripting attacks.

The System.Net.Cookie class in Microsoft .NET Framework version 2.0 supports an HttpOnly property. The HttpOnly property is always set to true by Forms authentication.
Earlier versions of the .NET Framework (versions 1.0 and 1.1) require that you add code similar to the following to the Application_EndRequest event handler in your application Global.asax file to explicitly set the HttpOnly attribute.

protected void Application_EndRequest(Object sender, EventArgs e) 
{
  string authCookie = FormsAuthentication.FormsCookieName;
  foreach (string sCookie in Response.Cookies) 
  {
    // Just set the HttpOnly attribute on the Forms 
    // authentication cookie. Skip this check to set the attribute 
    // on all cookies in the collection

    if (sCookie.Equals(authCookie))
    { 
      // Force HttpOnly to be added to the cookie header
      Response.Cookies[sCookie].Path += ";HttpOnly";
    }
  }
}

Use the <frame> Security Attribute

Internet Explorer 6 and later support a new security attribute for the <frame> and <iframe> elements. You can use the security attribute to apply the user's Restricted Sites Internet Explorer security zone settings to an individual frame or iframe. By default, the Restricted Sites zone does not support script execution.
If you use the security attribute, it must be set to "restricted" as shown in the following.

<frame security="restricted" src="http://www.somesite.com/somepage.htm"></frame>

Use the innerText Property Instead of innerHTML

If you use the innerHTML property to build a page and the HTML is based on potentially untrusted input, you must use HtmlEncode to make it safe. To avoid having to remember to do this, use innerText instead. The innerText property renders content safe and ensures that scripts are not executed.
The following example shows this approach for two HTML <span> controls. The code in the Page_Load method sets the text displayed in the Welcome1 <span> element using the innerText property, so HTML-encoding is unnecessary. The code sets the text in the Welcome2 <span> element by using the innerHtml property; therefore, you must HtmlEncode it first to make it safe.

<%@ Page Language="C#" AutoEventWireup="true"%>

<html>
  <body>
    <span id="Welcome1" runat="server"> </span>
    <span id="Welcome2" runat="server"> </span>
  </body>
</html>

<script runat="server">
  private void Page_Load(Object Src, EventArgs e)
  {
    // Using InnerText renders the content safe–no need to HtmlEncode
    Welcome1.InnerText = "Hello, " + User.Identity.Name;

    // Using InnerHtml requires the use of HtmlEncode to make it safe
    Welcome2.InnerHtml = "Hello, " + 
                        Server.HtmlEncode(User.Identity.Name);
  }
</Script>

Challa DotNet FAQ's Blog

How to Optimize Stored Procedure in sql server

Best Sql Server Interview Questions 2000/2005/2008 : Part 1

Send Mail with multiple attachments in asp.net

How do I change the SMTP port number dynamically in asp.net

How to get the users IP those who are accessing your website using asp.net

"Cannot get IIS pickup directory" SMTP exception in asp.net

Host WCF service with multiple host environment using multiple protocol

Introduction

Background

Multiple Host and Protocol Support with WCF

Create a test service

Hosting our service

Option 1 – windows console host application

Option 2 – windows service host application

Option 3 – IIS6 host application

Option 4 – IIS7 (WAS) host application

Create the client application

Putting all together and get the result

Remote IIS Debugging : Debug your ASP.NET Application which is hosted on "Remote IIS Server"

ASP.NET Debugging vs. IIS Debugging

Steps to run a web application from the command prompt:

How to raise client side (javascript) or server side (code behind) messages in asp.net

How to get the size of the Databases used in Sql server

How To: Protect From Injection Attacks in ASP.NET

Summary

Contents

Objectives

Overview

Summary of Steps

Step 1. Use ASP.NET Request Validation

Confirm that ASP.NET Request Validation Is Enabled in Machine.config

Test ASP.NET Request Validation

Step 2. Constrain Input

Explicitly Check Input from Form Fields

Validating Text Fields

Using a RegularExpressionValidator

Using the Regex Class

Validating Numeric Fields

Validating Date Fields

Sanitizing Free-Text Fields

Allowing Restricted HTML Input

Validate Query String Values

Validate Cookie Values

Validate File and URL Paths

Validating File Paths

Using MapPath to Prevent Cross Application Mapping

Using Code Access Security to Restrict File I/O

Validating URLs

Step 3. Encode Unsafe Output

Use HtmlEncode to Encode Unsafe Output

Use UrlEncode to Encode Unsafe URLs

Step 4. Use Command Parameters for SQL Queries

Use Parameters Collection When You Call a Stored Procedure

Use Parameters Collection When Building Your SQL Statements

Step 5. Verify that ASP.NET Errors Are Not Returned to the Client

Additional Resources

TextBox with TextMode="MultiLine" is not woking in asp.net

How to access the data from Resource file from code behind or javascript in asp.net

How to make your website off line using app_offline.htm

Advantages and Disadvantages of Frames

Search Engines

Working with frames in asp.net

How to avoid copy, paste and backspace error on AsyncFileUpload control in asp.net

Passing a control.ClientID to a javascript function in asp.net

how to implement facebook like button in asp.net pages or master page

Wikileaks releases some of the Top Black Money Holders from India

How To: Prevent Cross-Site Scripting in ASP.NET

Applies To

Summary

Objectives

Overview

Guidelines

Constrain Input

Encode Output

Summary of Steps

Step 1. Check That ASP.NET Request Validation Is Enabled

Step 2. Review ASP.NET Code That Generates HTML Output

Step 3. Determine Whether HTML Output Includes Input Parameters

Step 4. Review Potentially Dangerous HTML Tags and Attributes