coldfusion CMS Frameworks Flex Ajax

Asynchronous webservice response.

noreply@blogger.com (Kalyan Dhar) — Tue, 29 Jul 2014 11:58:00 -0400

I hope you all are doing well.

After a very long time I am going to post this article. I switched to a different technology.

Within last two years I worked on android and few Java related things. Now again I moved to CF.

Recently I faced one issue with my client Process we built one webservice which accept large XML file from client and process it parallel. While processing large data 1^st we faced challenges with the memory.

It was a quick fix we used Sax parser instead of DOM.

But recently we faced one issue that when client is sending large files in every 5 minutes our process is not able to process that file within 5 mins. So we are not receiving very next file.

To resolve that I change our webservice from synchronous to Asynchronous mode.

In Asynchronous mode we are sending them response after getting file and processing that file in backend so we are not missing any files.

This solution is really worked for me. If you are having same kind of issue this solution may help you to come up from your situation.

To do that I used ColdFusion event gateway feature.

Event gateway lets CFML code send a message to CFC methods asynchronously. This event gateway lets you initiate processing by a CFC method without waiting for it to complete or return a value.

By default, ColdFusion delivers the message to a CFC method named onIncomingMessage. You can specify any method name, however, in the SendGatewayMessage method's data parameter.

3 Steps to create gateway

· Create a CFC with an onIncomingMessage method. Put the CFC in an appropriate directory for your application. For example, you can put it in the cf_root\WEB-INF\cfusion\gateway\cfc directory on J2EE configurations, in the cf_root\gateway\cfc directory on server configurations, or in a subdirectory of these directories. ColdFusion is installed with mappings to these cfc gateway directories.

· The onIncomingMessage method must take a CFEvent structure that contains input information in its Data field, and processes the contents of the Data field as needed.

· Use the Gateways page in the ColdFusion Administrator to add an instance of the CFML event gateway type. Specify the following:

o A unique Gateway ID.

o The path to the CFC that you created in step 1.

o The startup mode. Select Automatic startup mode to start the event gateway when ColdFusion starts up.

o Do not specify a configuration file.

· Start the event gateway instance.

Using Gateway

· Write CFML code that uses SendGatewayMessage functions to send messages in structures to the event gateway instance ID that you specified in CFAdmin. The SendGatewayMessage function returns true if the gateway successfully queues the message in the ColdFusion Gateway Service; false, otherwise. It does not ensure that the CFC receives or processes the message.

· Run your CFML application.

New flavor to execute query from coldfusion cfscript.

noreply@blogger.com (Kalyan Dhar) — Fri, 29 Jun 2012 13:53:00 -0400

As you know that coldfusion added java coding style in cfscript tag.

Here one example of executing query from coldfusion cfscript tag.

Retrieve resultset with multiple id's

function getResultSetByIDs(string dsn, required numeric userIDs) {

// Setup a variable for the Query Result

var qResult = '';

// Setup the Query variable

var q= new query();

// Add Parameter

q.addParam(name="ID", value=arguments.userIDs, cfsqltype="CF_SQL_INTEGER" list="true");

// Create the SQL String

var sqlString="

SELECT *

FROM USERS

WHERE

USERID IN (:ID)

q.setdatasource(arguments.pDsn);

q.setsql(sqlString);

qResult=q.execute().getresult();

return qResult;

}

Now Facebook session can be shared with our ColdFusion Applications

noreply@blogger.com (Kalyan Dhar) — Mon, 25 Jun 2012 10:36:00 -0400

Yesterday I was trying to build one application which can share session with FaceBook. That means if I logged in FaceBook Then I don’t need to login in my application.
I know Facebook Platform is a set of APIs. SO i try to digg into FB and after a bit of research I find out it’s possible and ‘Benoit Hediard’ already build it in ColdFusion. That’s great !!!! .
SDK URL http://facebooksdk.riaforge.org/
To use facebook session in our application we need to create one APP id/Key in Facebook Development
https://developers.facebook.com/
By which we can also track how many users logged in
From where logged in.
What they are doing in our site.
…..
…..
…
and Many more.
I like it very much.

ColdFusion Closures By Zeus

noreply@blogger.com (Kalyan Dhar) — Tue, 8 May 2012 10:33:00 -0400

ColdFusion 10 introduced a new feature called ‘ColdFusion Closures’.
A closure is an inner function. The inner function can access the variables in the outer function. You can access the inner function by accessing the outer function. See the example below.
function helloTranslator(String helloWord)
{
return function(String name) {
return “#helloWord#, #name#”;
};
}
helloInEnglish=helloTranslator(“Hello”);
helloInFrench=helloTranslator(“Bonjour”);
writeoutput(helloInEnglish (“Arindam”));
//closure is formed.
//Prints Hello, Arindam.
writeoutput(“<br>”);
writeoutput(helloInFrench(“Arindam”));
//Prints Bonjour, Arindam.
In the above example, the outer function returns a closure.
Using the helloInEnglish variable, the outer function is accessed. It sets the helloWord argument.
Using this function pointer, the closure is called. For example, helloInEnglish (“Arindam “).
Observe that even after the execution of outer function, the closure can access the variable sets by the outer function.
In this case, using closure, two new functions are created. One adds Hello to the name. And the second one adds Bonjour to the name.
helloInEnglish and helloInFrench are closures. Though they have the same function body they store different environments.
The inner function is available for execution after the outer function is returned.
A closure is formed when the inner function is available for execution. As seen in the example, even after the outer function is returned, the inner function can access the variables in the outer function.
Closure retains the reference to the environment at the time it is created. For example, the value of a local variable in the outer function. It makes closure an easy to use and handy feature.
Source: help.adobe.com/en_US/ColdFusion/10.0/Developing/index.html
Article written : Arindam Roy

Send Email with SSIS/DATABASE from gmail account

noreply@blogger.com (Kalyan Dhar) — Wed, 4 Apr 2012 11:01:00 -0400

You had noticed That the Send Email task from the SSIS package does not have the option of indicating a user name and password, it will only authenticate using Windows Authentication.

This SSIS email task does not support Gmail SMTP server. Even it does not support any smtp server with username and password.
Here is one SSIS Script executor package example to send email from gmail account. This is a Substitute of SSIS email Send task.
Steps To Send Email with gmail.

Step1: Create Global variables for SMTP server Configurations.

Step2: Drag and Drop Script Task

Step3: Add variables in ReadOnlyVariables

Step4: Click Edit to Write Script and Select Script Language “Microsoft Visual C# 2008”
So this will be our solution developing our own Send Email Function with option for User Credentials.
Now let’s start.

Step5: Write C# script to send email

Here the script to write:

using System;
using System.Data;
using Microsoft.SqlServer.Dts.Runtime;
using System.Windows.Forms;
using System.Text.RegularExpressions;
using System.Net.Mail;

namespace ST_f36d382ef89848a894adeac409e3a7f6.csproj
{
[System.AddIn.AddIn("ScriptMain", Version = "1.0", Publisher = "", Description = "")]
public partial class ScriptMain : Microsoft.SqlServer.Dts.Tasks.ScriptTask.VSTARTScriptObjectModelBase
{

#region VSTA generated code
enum ScriptResults
{
Success = Microsoft.SqlServer.Dts.Runtime.DTSExecResult.Success,
Failure = Microsoft.SqlServer.Dts.Runtime.DTSExecResult.Failure
};
#endregion

public void Main()
{
string sSubject = “[Kalyan]:SSIS Test Mail From Gmail”;
string sBody = “Test Message Sent Through SSIS”;
int iPriority = 2;

if (SendMail(sSubject, sBody, iPriority))
{
Dts.TaskResult = (int)ScriptResults.Success;
}
else
{
//Fails the Task
Dts.TaskResult = (int)ScriptResults.Failure;
}
}

public bool SendMail(string sSubject, string sMessage, int iPriority)
{
try
{
string sEmailServer = Dts.Variables["sEmailServer"].Value.ToString();
string sEmailPort = Dts.Variables["sEmailPort"].Value.ToString();
string sEmailUser = Dts.Variables["sEmailUser"].Value.ToString();
string sEmailPassword = Dts.Variables["sEmailPassword"].Value.ToString();
string sEmailSendTo = Dts.Variables["sEmailSendTo"].Value.ToString();
string sEmailSendCC = Dts.Variables["sEmailSendCC"].Value.ToString();
string sEmailSendFrom = Dts.Variables["sEmailSendFrom"].Value.ToString();
string sEmailSendFromName = Dts.Variables["sEmailSendFromName"].Value.ToString();

SmtpClient smtpClient = new SmtpClient();
MailMessage message = new MailMessage();

MailAddress fromAddress = new MailAddress(sEmailSendFrom, sEmailSendFromName);

//You can have multiple emails separated by ;
string[] sEmailTo = Regex.Split(sEmailSendTo, “;”);
string[] sEmailCC = Regex.Split(sEmailSendCC, “;”);
int sEmailServerSMTP = int.Parse(sEmailPort);

smtpClient.Host = sEmailServer;
smtpClient.Port = sEmailServerSMTP;
smtpClient.EnableSsl = true;

System.Net.NetworkCredential myCredentials =
new System.Net.NetworkCredential(sEmailUser, sEmailPassword);
smtpClient.Credentials = myCredentials;

message.From = fromAddress;

if (sEmailTo != null)
{
for (int i = 0; i < sEmailTo.Length; ++i)
{
if (sEmailTo[i] != null && sEmailTo[i] != “”)
{
message.To.Add(sEmailTo[i]);
}
}
}

if (sEmailCC != null)
{
for (int i = 0; i < sEmailCC.Length; ++i)
{
if (sEmailCC[i] != null && sEmailCC[i] != “”)
{
message.To.Add(sEmailCC[i]);
}
}
}

switch (iPriority)
{
case 1:
message.Priority = MailPriority.High;
break;
case 3:
message.Priority = MailPriority.Low;
break;
default:
message.Priority = MailPriority.Normal;
break;
}

message.Subject = sSubject;
message.IsBodyHtml = true;
message.Body = sMessage;

smtpClient.Send(message);
return true;
}
catch (Exception ex)
{
return false;
}
}
}
}

Keeping a session alive on ColdFusion using Jquery

noreply@blogger.com (Kalyan Dhar) — Tue, 6 Mar 2012 10:31:00 -0500

Here is a simple solution to keep a session open on forms where users may need an extended period of time for data entry. You can include this code on any page where you need the session extended. You can remove the javascript include if JQuery is included on all of your pages already.
<!— Include this file on any page where users may take a long time filling in text and you want to keep the session open —>
<cfparam name=”variables.refreshrate” default=”60000″>
<cfoutput>
<script type=”text/javascript” src=”/js/jquery-1.3.2.min.js”></script>
<script language=”JavaScript” type=”text/javascript”>
$(document).ready(function(){
setTimeout(“callserver()”,#variables.refreshrate#);
});
function callserver()
{
var remoteURL = ‘/emptypage.cfm’;
$.get(remoteURL, function(data){
setTimeout(“callserver()”,#variables.refreshrate#);
});
}
</script>
</cfoutput>
In the above code the function callserver will get invoked 60 seconds after the data entry page is loaded. The callserver function will keep refreshing the data entry screen at an interval of 60 seconds with all the data that user have entered till the user submits the form.

Determine default and max session/Application timeouts for current ColdFusion server

noreply@blogger.com (Kalyan Dhar) — Wed, 22 Feb 2012 10:53:00 -0500

ColdFusion provides Admin API to work with admin settings. For example setClientStorage, Cookie Management, Datasource Management etc. In one of my old post, I already provide an example how to add/update/delete a DSN from a code base.This API is mainly used to install/Build an application in one request.
In today’s post we determine how to get session and application scope values.
Usage Scenario: For example we have 3 applications in one ColdFusion server and we set different session timeout values for each application. Now if a developer wants to get sessionTimeOut and MaxSessionTimeOut values of each application.
<cftry>
<cfset adminAPI = createObject(“component”, “CFIDE.adminapi.administrator”)>
<cfset adminAPI.login(“password1$”)><!– Add password of CFadmin —>
<cfset runtimeENV = createObject(“component”, “CFIDE.adminapi.runtime”)>
<cfset sessionDefaultTimeout = runtimeENV.getScopeProperty(“sessionScopeTimeout”)>
<cfset sessionMaxTimeout = runtimeENV.getScopeProperty(“sessionScopeMaxTimeout”)>
<cfset ApplicationMaxTimeout = runtimeENV.getScopeProperty(“ApplicationscopeTimeout”)>
<cfoutput>
Default timeout session: #sessionDefaultTimeout# <br>Max value is #sessionMaxTimeout#.
<br>ApplicationMaxTimeout #ApplicationMaxTimeout#
</cfoutput>
<cfcatch>
<cfdump var=”#cfcatch#”/>
</cfcatch>
</cftry>
Note: This adminAPI will fall in CF8 if application name have space in Application.cfm/Application.cfc

Top 10 Key Information Technology Trends For 2012

noreply@blogger.com (Kalyan Dhar) — Tue, 10 Jan 2012 10:52:00 -0500

Src:- http://www.techpark.net/2011/10/31/top-10-key-information-technology-trends-for-2012/
At the Gartner Symposium IT/Expo, David Cappuccio, managing vice president and chief of research for the Infrastructure teams with Gartner, said the Top 10 Trends show how IT is changing in that many of them in the past been outside the traditional purview of IT, but they will all affect how IT does its job in the future.
The Top 10 Trends and their impact, briefly include:
1 The evolution of virtualization: Cappuccio says virtualization will ultimately drive more companies to treat IT like a business. The danger during the next few years will be in following a specific vendor’s vision, though it is unlikely that any one vendor’s vision will prevail. Users should have their own visions of architecture control, and build toward it with a constantly updated strategic plan.
2 Big data, patterns and analytics: Unstructured data will grow some 80% over the course of the next five years, creating a huge IT challenge. Technologies such as in-line deduplication, automated tiering of data to get the most efficient usage patterns per kilowatt, and flash or solid-state drives for higher-end performance optimization, will increase in importance over the next few years, Cappuccio said. Analytics and other systems to monitor for recurring data patterns that could develop into money making applications will also be important.
3. Energy efficiency and monitoring: The power issue has moved up the food corporate food chain, Cappuccio said. Nascent tools are beginning to roll out that can use analytic tools to watch power usage on a variety of levels. With the increased attention given to power consumption, it has become apparent that many systems are highly underutilized. At low utilization levels, they use a high percentage of their total energy draw. An average x86 server that is turned on, but idle, will draw upward of 65% of its nameplate wattage, for example. IT organizations need a clear inventory of what compute resources are doing and what workloads there is the potential for significant waste of energy.
4. Context aware apps: The big question here how to do something smart to take advantage of smartphones. Gartner has in the past said context-based computing will go beyond the business intelligence applications and truly make a unified communications environment possible by bringing together data culled from social networks and mobile-devices.
5. Staff retention and retraining: Here the idea is developing a plan to get people excited about their jobs enough to stay. And we’ll need is as starting in 2011 an average of 10,000 baby boomers will be eligible to retire every day for the next 19 years, Cappuccio said. Loyalty to one company is not a quality found in new workers.
6. Social networks: Affordable and accessible technology has let individuals and communities come together in a new way – with a collective voice – to make statements about our organizations, the products/services we deliver and how we deliver them, Cappuccio said. The collective is made up of individuals, groups, communities, mobs, markets and firms that shape the direction of society and business. The collective is not new, but technology has made it more powerful -and enabled change to happen more rapidly Cappuccio said. The collective is just beginning to have an impact on business operations and strategies but most organizations do not have a plan for enabling or embracing it. Ignoring social networking is not an option, Cappuccio said.
7. Consumerization: The key trend here is the fact that new application types will be developed to address mobile users but they won’t be desktop replacement applications. Still, a secure, well-defined strategy needs to be put into place to take advantage of this development, Cappuccio said.
8. Compute per square foot: Virtualization is one of the most critical components being used to increase densities and vertically scale data centers. If used wisely, average server performance can move from today’s paltry 7% to 12% average to 40% to 50%, yielding huge benefits in floor space and energy savings. Two issues that need to be considered going forward are the number of cores per server – four- and eight-core systems are becoming common, and 16 cores will be common within two years - and overall data center energy trends. IT will also have to address things like performance/licensing, Cappuccio said
9. Cloud computing: While cost is a potential benefit for small companies, the biggest benefits of cloud computing are built-in elasticity and scalability. As certain IT functions industrialize and become less customized, such as email, there are more possibilities for larger organizations to benefit from cloud computing, according to Cappuccio.
10. Fabrics: Gartner defines this infrastructure convergence as: The vertical integration of server, storage, and network systems and components with element-level management software that lays the foundation to optimize shared data center resources efficiently and dynamically. Systems put forth so far by Cisco and HP will unify network control but are not there yet.

Executing Code When ColdFusion Server Starts

noreply@blogger.com (Kalyan Dhar) — Mon, 2 Jan 2012 10:32:00 -0500

ColdFusion 9 introduced the onServerStart method into application framework in a new ColdFusion component, Server.cfc.
Having code run each time the server starts can be used for a variety of reasons but should be reserved for application independent tasks such as server wide logging.
ColdFusion 9 introduced the onServerStart method that, if implemented will run each time the server starts. The method is the only method in the new ColdFusion component Server.cfc. Unless an alternate location is specified in the ColdFusion administrator the ColdFusion server will look for Server.cfc in the webroot.
The following code will run when the server starts up and set a server wide variable that holds the data and time the server started.

<cfcomponent>

<cffunction name=”onServerStart”>

<cfset Server.StartUpDateTime = Now() />

</cffunction>

</cfcomponent>

With the addition of the onServerStart method applications can now handle server wide setup easily and efficiently.
Source: cookbooks.adobe.com

ADOBE CREATIVE CLOUD

noreply@blogger.com (Kalyan Dhar) — Fri, 18 Nov 2011 10:49:00 -0500

The biggest announcement to come out of the annual Adobe MAX Conference last month was the unveiling of the Adobe Creative Cloud.
It is basically a membership-based program formed of three pillars: Creative Services, Creative Community, and Creative Applications.
The first is Creative Services, which are hosted services that you can use in your production work, in the delivery of your content.
This includes a font service like Typekit, which Adobe recently acquired, which enables the use and delivery of a broad foundry of cloud fonts across all of your work.
A second area is Digital Publishing, which enables publishing rich media to tablets via the cloud.
And the third category is Business Catalyst, which supports designing and operating websites for small businesses, with pre-built services for things like handling e-commerce, doing customer relationship management, and integrating with social networks.
The second pillar is Creative Community, which is for all creatives around the world and enables to connect more easily with other creatives – it’s a place to share, to communicate, and to inspire each other with your work and really collaborate as you’re working.
And lastly the third pillar is Creative Applications – and these are enabling you to create not only on personal computers, but also wherever you are with mobile devices, all connected through the Creative Cloud. This includes a whole new collection of Adobe touch apps to run on tablets and other mobile devices, including Proto, Kuler, Debut, Collage, Carousel, Ideas, and Photoshop Touch.
In addition, membership also includes access to all Adobe creative desktop products you know and love, including Photoshop, Illustrator, and Dreamweaver and Premiere and InDesign, Lightroom, more. You can download and install any of these applications you choose as part of your membership, and these are all connected to Creative Cloud via desktop sync. They also interact with the touch apps, and you can move files between desktop and touch as you’re working.
Source: http://prodesigntools.com/what-is-the-adobe-creative-cloud.html

DDoS attacks in payment gateways

noreply@blogger.com (Kalyan Dhar) — Thu, 23 Jun 2011 14:43:00 -0400

A denial-of-service attack (DoS attack) or distributed denial-of-service attack (DDoS attack) is an attempt to make a computer resource unavailable to its intended users. Although the means to carry out, motives for, and targets of a DoS attack may vary, it generally consists of the concerted efforts of person or persons to prevent an Internet site or service from functioning efficiently or at all, temporarily or indefinitely. Perpetrators of DoS attacks typically target sites or services hosted on high-profile web servers such as banks, credit card payment gateways, and even root name servers. The term is generally used with regards to computer networks, but is not limited to this field; for example, it is also used in reference to CPU resource management.One common method of attack involves saturating the target machine with external communications requests, such that it cannot respond to legitimate traffic, or responds so slowly as to be rendered effectively unavailable. In general terms, DoS attacks are implemented by either forcing the targeted computer(s) to reset, or consuming its resources so that it can no longer provide its intended service or obstructing the communication media between the intended users and the victim so that they can no longer communicate adequately.

The United States Computer Emergency Readiness Team (US-CERT) defines symptoms of denial-of-service

· Unusually slow network performance (opening files or accessing web sites)

· Unavailability of a particular web site

· Inability to access any web site

· Dramatic increase in the number of spam emails received-(this type of DoS attack is considered an e-mail bomb)

Denial-of-service attacks can also lead to problems in the network ‘branches’ around the actual computer being attacked. For example, the bandwidth of a router between the Internet and a LAN may be consumed by an attack, compromising not only the intended computer, but also the entire network.

If the attack is conducted on a sufficiently large scale, entire geographical regions of Internet connectivity can be compromised without the attacker’s knowledge or intent by incorrectly configured or flimsy network infrastructure equipment.

Methods of attack

· Consumption of computational resources, such as bandwidth, disk space, or processor time.

· Disruption of configuration information, such as routing information.

· Disruption of state information, such as unsolicited resetting of TCP sessions.

· Disruption of physical network components.

· Obstructing the communication media between the intended users and the victim so that they can no longer communicate adequately.

Hack Websites by Ddos Attack

A DoS attack is a denial of service through continued illegitimate requests for information from a site. In a DDoS attack, the hacker’s computer sends a message to all the enslaved computers to send a spoofed request to the broadcast address of the victim’s computer (x.x.x.255 if it is subnetted) with the spoofed source address (x.x.x.123 being the target IP).This is Step 1 in Figure 1.6. The router then sends the spoofed message to all computers on the subnet (in many cases, these are the victim’s own computers) that are listening (around 250 maximum), asking for a response to the ICMP packet (Step 2).Those computers each respond to the victim’s source address x.x.x.123 through the router (Step 3). In the case of DDoS, there are many computers that have been commandeered that are sending many requests to the router, making the router do many times the work, and using the broadcast address to make other computers behind the router work against the victim computer (Step 4).This then overloads the victim in question and will eventually cause it to crash, or more likely the router will no longer reliably be able to send and receive packets, so sessions will be unstable or impossible to establish, thus denying service.

An example of a DoS/DDoS attack occurred in February of 2001, when Microsoft was brought to its knees. Many industry experts believe that the attack was timed to coincide with Microsoft’s launch of a $200 million ad campaign. Ironically, the ad campaign was focused on what Microsoft refers to as “Software for the agile business.”The attack by hackers was just one more sign to the Internet industry that hackers are very much able to control sites when they feel they have a point to prove

How to protect yourself

· The application should connect to the database using as low privilege user as is possible.

· The application should connect to the database with different credentials for every trust distinction (e.g., user, read-only user, guest, administrators) and permissions applied to those tables and databases to prevent unauthorized access and modification.

· The application should prefer safer constructs, such as stored procedures which do not require direct table access. Once all access is through stored procedures, access to the tables should be revoked.

· Highly protected applications:

The database should be on another host, which should be locked down with all current patches deployed and latest database software in use.
The application should connect to the database using an encrypted link. If not, the application server and database server must reside in a restricted network with minimal other hosts.
Do not deploy the database server in the main office network.

Protect yourself by ColdFusion

Role-based security is implemented by the roles attribute of the tag. The attribute contains a comma-delimited list of security roles that can call this method.

Access control is implemented by the access attribute of the tag. The possible values of the attribute in order of most restricted behavior are: private (strongest), package, public (default), and remote (weakest).
Private: The method is accessible only to methods within the same component. This is similar to the Object Oriented Programming (OOP) private identifier.

Package: The method is accessible only to other methods within the same package. This is similar to the OOP protected static identifier.

Public: The method is accessible to any CFC or CFM on the same server. This is similar to the OOP public static identifier.

Remote: Allows all the privileges of public, in addition to accepting remote requests from HTML forms, Flash, or a web services. This option is required, to publish the function as a web service.

Best Practices

· Do not use THIS scope inside a component to expose properties. Use a getter or setter function instead. For example, instead of using THIS.myVar create a public function that sets the variable (i.e. setMyVar(value)).

· Do not omit the role attribute as ColdFusion will not restrict user access to the function.

· Avoid using Access=”Remote” if you do not intend to call the component directly from a URL.

Configuration

The following section describes some of the server-wide security-related options available to a ColdFusion administrator via the ColdFusion MX 7 Administrator console web application (http://servername:port/CFIDE/administrator/index.cfm). If the console application is unavailable, you can modify these options by editing the XML files in the cf_root/lib/ (Server configuration) or cf_web_root/WEB-INF/cfusion/lib (J2EE configuration) directory; however, editing these files directly is not recommended.

Best Practice

· CF Admin Password screen

· Enable a strong Administrator password

The ColdFusion Administrator is the default interface for configuring the ColdFusion application server. It is secured by a single password. Ensure that the Administrator security is enabled and the password is strong and stored in a secure place.
Ensure the checkbox is filled
Enter and confirm a strong password string of 8 characters or more
Click Submit Changes

Sandbox Security screen

Enable Sandbox Security
The ColdFusion Sandbox allows you to place access security restrictions on files, directories, methods, and data sources. Sandboxes make the most sense for a hosting provider or corporate intranet where multiple applications share the same server. Enable this option.

Next, a sandbox needs to be configured, because if not all code in all directories will execute without restriction. Code in a directory and its subdirectories inherits the access controls defined for the sandbox. For example, if ABC Company creates multiple applications within their directory all applications will have the same permissions as the parent. A sandbox applied to ABC-apps will apply to app1 and app2. A sample directory structure is shown below:
D:\inetpub\wwwroot\ABC-apps\app1

D:\inetpub\wwwroot\ABC-apps\app2
Note: if a new sandbox is created for app2 then it will not inherit settings from ABC-apps.
Sandbox security configurations are application specific; however, there are general guidelines that should be followed:
Create a default restricted sandbox and copy setting to each subsequent sandbox removing restrictions as needed by the application. Except in the case of files/directories where access is granted rather than restricted.

Restrict access to data sources that should not be accessed by the sandboxed application.

Restrict access to powerful tags, for example CFREGISTRY and CFEXECUTE.

Restrict file and directory access to limit the ability of tags and functions to perform actions to specified paths.

Every application should have a sandbox.

In multi-homed environments disable Java Server Pages (JSP) as ColdFusion is unable to restrict the functionality of the underlying Java server.
RDS Password screen

Enable a strong RDS password
Developers can access ColdFusion resources (files and data sources) over HTTP from Macromedia Dreamweaver MX and HomeSite+ through ColdFusion’s Remote Development Services (RDS). This feature is password protected should only be enabled in secure development environments.
Ensure the checkbox is filled

Enter and confirm a strong password string of 8 characters or more

Click Submit Changes

Use RDS over SSL - During development, you should use SSL v3 to encrypt all RDS communications between Dreamweaver MX and the ColdFusion server. This includes remote access to server data sources and drives, provided that both are accessed through RDS.

Disable RDS in Production

In production environments, you should not use RDS. In earlier versions of ColdFusion, RDS ran as a separate service or process and could be disabled by disabling the service. In ColdFusion MX, RDS is integrated into the main service. To disable it, you must disable the RDSServlet mapping in the web.xml file. The following procedure assumes that ColdFusion is installed in the default location.

1. Back up the C:\CFusionMX7\wwwroot\WEB-INF\web.xml file.

2. Open the web.xml file for editing.

3. Comment out the RDSServlet mapping, as follows:

RDSServlet

/CFIDE/main/ide.cfm

–>

4. Save the file.

5. Restart ColdFusion.

Settings Screen

Enable a Request Timeout

ColdFusion processes requests simultaneously and queues all requests above the configured maximum number of simultaneous requests. If requests run abnormally long, this can tie up server resources and lead to DoS attacks. This setting will terminate requests when the configured timeout is reached.

Fill the checkbox next to “Timeout Request after (seconds)”

Enter the number of seconds for ColdFusion to allow threads to run

To allow a valid template request to run beyond the configured timeout, place a atop the base ColdFusion template and configure the RequestTimeout attribute for the necessary amount of time (in seconds).

Use UUID for cftoken

Best practice calls for J2EE session management. In the event that only ColdFusion session management is available, strong security identifiers must be used. Enable this setting to change the default 8-character CFToken security token string to a UUID.

Enable Global Script Protection - This is a new security feature in ColdFusion MX 7 that isn’t available in other web application platforms. It helps protect Form, URL, CGI, and Cookie scope variables from cross-site scripting attacks.

Specify a Site-wide Error Handler

Prevent information leaks through verbose error messages. Specifying a site-wide error handler covers you when cftry/cfcatch are not used. This page should be a generic error message that you return to the user. Also, if the error handler displays user-input, it should be reviewed for potential cross-site scripting issues.

Specify a Missing Template Handler

Provide a custom message page for HTTP 404 errors when the server cannot find the requested ColdFusion template.

Configure a memory throttling

To prevent file upload DoS attacks, Macromedia added new configuration settings to ColdFusion MX 7.0.1 that allow administrators to restrict the total upload size of HTTP POST operations. Configure these settings accordingly.

maximum size for post data

This is the total size that ColdFusion will accept for any single HTTP POST request (including file uploads). ColdFusion will reject any request whose Content-size header exceeds this setting.

Request Throttle Threshold

HTTP POST requests larger than this setting (default is 4MB) are included in the total concurrent request memory size and get queued if they exceed the Request Throttle Memory setting.

Request Throttle Memory

This sets the total amount of memory (MB) ColdFusion reserves for concurrent HTTP POST requests. Any requests exceeding this limit are queued until enough memory is available.

Memory Variables screen

Enable J2EE Session Management and Use J2EE session variables.

Best practice requires J2EE sessions because they are more secure than regular ColdFusion sessions. (See Session Management section)

Select checkbox next to “Enable Session Variables”

Select checkbox next to “Enable J2EE session variables”

Set the maximum session timeout to 20 minutes to limit the window of opportunity for session hijacking.

Set the default session timeout to 20 minutes to limit the window of opportunity for session hijacking. (The default value is 20 minutes.)

The session-timeout parameter in the cf_root/WEB-INF/web.xml file establishes the maximum J2EE session timeout. This setting should always be greater-than or equal-to ColdFusion’s Maximum Session Timeout value.

Set the maximum application timeout to 24 hours.

Set the default application timeout to 8 hours.

Data Sources screen

Do not use an administrative account to connect ColdFusion to a data source. For example, do not use SA account to connect to a MS SQL Server. The account accessing the database should be granted specific privileges to the objects it needs to access. In addition, the account created to connect the database should be an OS-based, not a SQL account. Operating system accounts have many more auditing, password, and other security controls associated with them. For example, account lockouts and password complexity requirements are built into the Windows operating system; however, a database would need custom code to handle these security-related tasks.

Disable the following Allowed SQL options for all data sources:

Create Drop Grant Revoke Alter

As an administrator, you do not have control over what a developer sends to the database; however, there should be no circumstance where the previous commands need to be sent to a database from a web application.

Debugging Settings screen

Disable Robust Exception for production servers. (Default)

Disable Debugging for production servers. (Default)

Debugging IP Addresses

Ensure only the addresses of trusted clients are in the IP list.

Only allow the localhost IP (127.0.0.1) in the list on production machines

Mail screen

Require a user name and password to authenticate to your mail server.

Set the connection timeout to 60 seconds (The default value is 60 seconds.)

Ref: WIKIPEDIA, SYNGRESS, OWASP

SQL Tips: Faster technique to get 1st and last day of the month

noreply@blogger.com (Kalyan Dhar) — Sun, 29 May 2011 13:52:00 -0400

Normally we put together the year, month and 1 as the day separating them with slashes (/) in the date format (e.g “YYYY/MM/DD” ).
Like following code:-
CREATE FUNCTION [dbo].[GetFirstDayOfMonth] ( @pInputDate DATETIME )
RETURNS DATETIME
BEGIN
RETURN CAST(CAST(YEAR(@pInputDate) AS VARCHAR(4)) + ‘/’ + CAST(MONTH(@pInputDate) AS VARCHAR(2)) + ‘/01′ AS DATETIME)
END
GO
In this function we need to separate month year from InputDate and then convert them into string.
This string conversion operation is time taking and consume good amount of memory as well.
I came up with a solution that easily return 1^stdate of current moth.
This technique doesn’t need the conversion to string and back it to date therefore somewhat faster than normal technique:
SELECT DATEADD(month, DATEDIFF(month, ‘20010101′, getdate()), ‘20010101′) as firstDate(where ‘20010101′ is a randomly chosen date - most any date will work).For instance, to get the last day of the month we need to change only the second occurrence:
SELECT DATEADD( month, DATEDIFF(month, ‘20010101′, getdate()), ‘20010131′ ) as lastDate.

Creation of Singleton Object with Coldfusion

noreply@blogger.com (Kalyan Dhar) — Wed, 4 Aug 2010 12:11:00 -0400

Note: Coldfusion in and out tag is replaced because of blogging problem)

Singletons are perhaps one of the most simple Design Patterns. For those who don’t know sigletons are a class that can only have one instance. They can be thought of as a glorified global variable - but are a lot more useful.Most ColdFusion classes, or rather instances of CF components, can be turned in a singleton by placing the following code in your Application.cfm:

cfif not structkeyexists(application,instance name)
cfset application.instance name = createobject(”component”,path to component)
/cfifor OnApplicationStart method of your Application.cfc: cfset application.instance name = createobject(”component”,path to component)

The above code places an instance of the component in the application scope and you can then access the properties and methods of the component via the application variable.Singletons can also be placed in other ColdFusion scopes such as the server or session scopes or even the request scope. Which scope you choose depends on what your code does.Another way to create a singleton is to add an getInstance method to your component and use that to return the instance.Like so:

cffunction name=”getInstance” access=”public” output=”false”

cfif not isdefined(”application.instance name”)
cfset application.[instance name] = this
/cfif

cfreturn application.[instance name]
/cffunctionRather than hard coding the instance name we can base it on the displayname of the component.cffunction name=”getInstance” access=”public” output=”false”
cfset var displayname = getMetaData(this).displayname

cfif not isdefined(”application.#displayname#”)
cfset application.[displayname] = this
/cfif

cfreturn application.[displayname]
/cffunction

While this is an improvement on the original code this method would need to be added to all components you wanted to turn into a singleton. A better solution is to create a singleton component and in a component you need to turn into a singleton extend from the singleton component.The singleton component (singleton.cfc):

cfcomponent displayname=”singleton”

cffunction name=”getInstance” access=”public” output=”false”
cfset var displayname = getMetaData(this).displayname

cfif not isdefined(”application.#displayname#”)
cfset application[displayname] = this
/cfif

cfreturn application[displayname]
/cffunction

/cfcomponentThe component we want to use as a singleton (dsn.cfc): cfcomponent displayname=”DSN” extends=”singleton”
cfset variables.DNS = “”

cffunction name=”getDSN” access=”public” returntype=”string” output=”false”
cfreturn variables.DSN
/cffunction

cffunction name=”setDSN” access=”public” output=”false”
cfargument name=”DSN” type=”string” required=”yes”
cfset variables.DSN = arguments.DSN
/cffunction

/cfcomponentUsing the component (in Applicaton.cfm): cfscript
if (not structkeyexists(application,’dsn’)) {
application.dsn = createobject(’component;,’dsn’).getInstance();
application.dsn.setDSN(’mydsn’);
}
/cfscriptor OnApplicationStart method of Application.cfc: cfscript
application.dsn = createobject(’component’,'dsn’).getInstance();
application.dsn.setDSN(’mydsn’);
/cfscriptIn the page: cfquery name=”myquery” datasource=”#applicaton.dsn.getDSN()#”
…
/cfquery Here the example code : singleton.cfc cfcomponent displayname=”singleton”

cffunction name=”init” access=”public” output=”false”
cfset var displayname = getMetaData(this).displayname

cfif not isdefined(”application._singletons”)
cfset application._singletons = structnew()
/cfif
cfif not isdefined(”application._singletons.#displayname#”)
cfset application._singletons[displayname] = this
/cfif

cfreturn application._singletons[displayname]
/cffunction

cffunction name=”remove” access=”public” output=”false”
cfset var displayname = getMetaData(this).displayname

cfif isdefined(”application._singletons.#displayname#”)
cfset structdelete(application._singletons, displayname)
/cfif
/cffunction

/cfcomponentAnd here hows it’s setup in Application.cfm (or .cfc): cfscript
// function to get an instance of a singleton
function getInstance(name) {
if (not isdefined(”application._singletons.#name#”)) {
instance = createobject(”component”,”com.classsoftware.utils.#name#”).init();
}

return application._singletons[name];
}

// function to remove a singleton
function removeInstance(name) {
if (isdefined(”application._singletons.#name#”)) {
application._singletons[name].remove();
}
}

// remove instance if asked
if (isdefined(”url.init”)) {
removeInstance(’dsn’);
}
/cfscriptAnd how it’s used on the page: cfset dsn = getInstance(”dsn”)

cfquery name=”myquery1″ datasource=”#dsn.getDSN()#”
select ….
/cfquery

cfquery name=”myquery2″ datasource=”#dsn.getDSN()#”
select ….
/cfquery

So you can create a component that has a method that throws an exception (via cfabort) and then have all methods of that component call that method. You can create an instance of the component but if you call any methods you will get an error.Applying this to our singleton component we get:

cfcomponent displayname=”singleton”
cffunction name=”init” access=”public” output=”false”
cfscript
var displayname = getMetaData(this).displayname;

this.invalid();

if (not isdefined(”application._singletons”)) {
application._singletons = structnew();
}
if (not isdefined(”application._singletons.#displayname#”)) {
application._singletons[displayname] = this;
}

return application._singletons[displayname];
/cfscript
/cffunction

cffunction name=”remove” access=”public” output=”false”
cfscript
var displayname = getMetaData(this).displayname;

this.invalid();

if (isdefined(”application._singletons.#displayname#”)) {
structdelete(application._singletons, displayname);
}
/cfscript
/cffunction

cffunction name=”invalid” access=”public” output=”false”
cfabort showerror=”Singletons must be created via helper functions not via create object!”
/cffunction

/cfcomponentThe this.invalid();

would also needed to be added to all methods of classes than extend singleton.cfc. eg dsn.cfc in the last article.If you then remove the method that generates the error (via structdelete) before any methods are called then the methods of the instance can be called.Applying this to our getInstance function we get: // function to get an instance of a singleton
function getInstance(name) {
if (not isdefined(”application._singletons.#name#”)) {
instance = createobject(”component”,”path..#name#”);
structdelete(instance,”invalid”);
instance.init();
}

return application._singletons[name];
}

That way only instances returned from our getInstance function can be used and any other instances created via created object (or other way) will throw an error when a method of that instance is called.

cffunction name=”getInstance” access=”public” output=”false”

cfcomponent displayname=”singleton”

cffunction name=”init” access=”public” output=”false”
cfset var displayname = getMetaData(this).displayname

cfif not isdefined(”application._singletons”)
cfset application._singletons = structnew()
/cfif
cfif not isdefined(”application._singletons.#displayname#”)
cfset application._singletons[displayname] = this
/cfif

cfreturn application._singletons[displayname]
/cffunction

cffunction name=”remove” access=”public” output=”false”
cfset var displayname = getMetaData(this).displayname

cfif isdefined(”application._singletons.#displayname#”)
cfset structdelete(application._singletons, displayname)
/cfif
/cffunction

/cfcomponentAnd here hows it’s setup in Application.cfm (or .cfc): cfscript
// function to get an instance of a singleton
function getInstance(name) {
if (not isdefined(”application._singletons.#name#”)) {
instance = createobject(”component”,”com.classsoftware.utils.#name#”).init();
}

return application._singletons[name];
}

cfquery name=”myquery1″ datasource=”#dsn.getDSN()#”
select ….
/cfquery

cfquery name=”myquery2″ datasource=”#dsn.getDSN()#”
select ….
/cfquery

The functions getInstance and removeInstance could be placed inside a component that creates/removes singletons (a singleton factory?). However that component itself would need to be a singleton or you’d need to create it (via createobject) on every page. I’ll feel it’s best just to leave them as user defined functions for simplicity and performance sake.Anther issue that came up was that you can still use createobject (or cfinvoke) to create other instances of the component and there seems no way of stopping this.Well there’s one way I can think of but I’m not sure if I’d actually use it in a production system, but it may be of interest to someone so here’s how to do it.ColdFusion methods can be set at run time, you can add or replace methods by assigning them to new functions like so: // from this point on when method is called call newmethod instead
cfset instance.method = newmethodMethods can also be removed like so: // remove method “method” from instance
cfset structdelete(instance,”method”)So you can create a component that has a method that throws an exception (via cfabort) and then have all methods of that component call that method. You can create an instance of the component but if you call any methods you will get an error.Applying this to our singleton component we get: cfcomponent displayname=”singleton”
cffunction name=”init” access=”public” output=”false”
cfscript
var displayname = getMetaData(this).displayname;

this.invalid();

if (not isdefined(”application._singletons”)) {
application._singletons = structnew();
}
if (not isdefined(”application._singletons.#displayname#”)) {
application._singletons[displayname] = this;
}

return application._singletons[displayname];
/cfscript
/cffunction

cffunction name=”remove” access=”public” output=”false”
cfscript
var displayname = getMetaData(this).displayname;

this.invalid();

if (isdefined(”application._singletons.#displayname#”)) {
structdelete(application._singletons, displayname);
}
/cfscript
/cffunction

cffunction name=”invalid” access=”public” output=”false”
cfabort showerror=”Singletons must be created via helper functions not via create object!”
/cffunction

/cfcomponent

The this.invalid(); would also needed to be added to all methods of classes than extend singleton.cfc. eg dsn.cfc in the last article.If you then remove the method that generates the error (via structdelete) before any methods are called then the methods of the instance can be called.Applying this to our getInstance function we get:

// function to get an instance of a singleton
function getInstance(name) {
if (not isdefined(”application._singletons.#name#”)) {
instance = createobject(”component”,”path..#name#”);
structdelete(instance,”invalid”);
instance.init();
}

return application._singletons[name];
}

How Coldfusion works and it’s Key Features( Compilation and precompile )

noreply@blogger.com (Kalyan Dhar) — Wed, 4 Aug 2010 12:03:00 -0400

Where Does the Compilation Go?
CFMX compiles cfm (and cfc) templates into .class files, which are Java byte code files. The files are written to (and executed from) the cfclasses subdirectory of [cfusionmx]\wwwroot\WEB-INF\ directory where CFMX is installed. This occurs whether you are using another Web server or have located your file outside the default wwwroot location. CFMX compiles and runs the code from this cfclasses directory, regardless of the location of the source file. The file names for these class files may not be at all apparent. A CF template named Setsession.cfm might lead to a class file named cfsetsession2ecfm1011928410.class. All templates from all directories end up in this one cfclasses subdirectory. They’re not stored here in any subdirectories related to their original location. Instead, CF includes a hash of the directory name in that set of numbers after the file name. Keep that in mind when trying to associate a given class file with its original cfm template. The hashing process is a bit convoluted. Perhaps the easiest way to detect which class file goes with which source file is to simply edit the file and then execute (or precompile) it. Look in the cfclasses directory for the most recently created class file. Assuming your server is not too busy with many compilations taking place, it should be pretty easy to associate the classname with the CF source code name.

Saving Java Source Code Produced by CFMX (Earlier coldfusion Versions)
So that’s where the compiled source code goes. But what about seeing the actual uncompiled Java source code that your CF template is converted into? Normally it’s of no concern to CF developers what CFMX is doing under the covers in converting our CFML to Java. For the ardently curious among you, did you know that you can ask CFMX to save the Java code it creates, in source form? You can. It’s an undocumented feature, and while I’ve had no trouble doing it. The setting can only be enabled by someone with administrative control of the server, and the setting is also server-wide. It will add a slight additional time to the compile process, so it’s not something you’d want to turn on in production. It probably ought not be left on in development either. You need to edit the file web.xml in the [cfusionmx]\wwwroot\WEB-INF directory. There, if you’re familiar with XML files, you’ll find a parameter called “coldfusion.compiler.saveJava”. Change its value from false to true. Save the file. Restart the server. Now, whenever a new or recently edited file is compiled (whether automatically by CFMX or by our precompile.bat file), CFMX will also create a “.java” file along with the “.class” file. This “.java” file will be found in that same [cfusionmx]\wwwroot\WEB-INF\cfclasses\ directory as the “.class” files (and will be subject to that same issue of the curious file naming mentioned above).

The Idea of Deleting the Generated Class Files
Some have proposed that instead of precompiling their code they’d just as soon delete the underlying Java class file that was created when it was last compiled. That may seem like overkill, but there are times when it might be worth trying. Just note that, as the previous sections discussed, finding the class file that’s associated with a given source template can be challenging. While some may simply delete all the class files, that’s certainly overkill. There is a -f directive you can pass to the compile process (by modifying the precompile.bat file now cfcompile.bat). That will force a recompile of a file even if CF doesn’t think it’s necessary. Sometimes that solves the same problem that deleting the class file would solve.

Precompiling ColdFusion pages

You can use the cfcompile utility to precompile ColdFusion pages (CFM, CFC, and CFR files). This can enhance initial page loading time at runtime.

Use the following command to compile ColdFusion pages into Java classes:

cfcompile webroot [directory-to-compile]

Sourceless distribution
You can use the cfcompile utility with the -deploy option to create ColdFusion pages (CFM, CFC, and CFR files) that contain Java bytecode. You can then deploy the bytecode versions of the ColdFusion pages instead of the original CFML source code.

Use the following command to compile CFML files into bytecode format that you can deploy instead of CFML source code:

cfcompile -deploy webroot directory-to-compile output-directory

After you run the cfcompile utility, perform the following steps:

Back up your original CFML files
Copy the generated bytecode CFML files to the original directory
Deploy the application.

How to get the primary key of a record added to the table with coldfusion

noreply@blogger.com (Kalyan Dhar) — Thu, 24 Jun 2010 14:45:00 -0400

Many people use database tables with autonumber primary keys. These are columns (typically

named “id”) that the database will provide a value for by simply adding one to the last highest value.

So if the last record inserted had an ID value of 5, the next will be 6. (Note that this isn’t always true.

You can’t assume the next value will be one over the last highest value.) If you need to find out what

value was used for the primary key, ColdFusion provides a simple way to do that.

To use this feature, you first must provide the result attribute to your cfquery tag. This tells

ColdFusion to save information about the query to the variable named by the result attribute.

“foo” result=“result”>

insert into people(name,email)

values(“Paris Hilton”, “trash@celebs.com”)

After running this query a structure named result will be created. Most of the keys of this structure

are set, including the sql of the query, recordcount, and other values, however there is a special key

that will store the value of the primary key assigned to the insertion. Unfortunately, this key value

will vary depending on the database. For SQL Server, the value will be in the IDENTITYCOL key.

For Oracle, the value will be in the ROWID key. For Sybase, the value will be in the

SYB_IDENTITY key. For Informix, the value will be in the SERIAL_COL key. For MySQL, the

value will be in the GENERATED_KEY key.

Using the above query as an example and assuming MySQL, you can display the primary key value

like so:

The ID of the row I just inserted was #result.generated_key#.

Logical architecture of a Fusebox application

noreply@blogger.com (Kalyan Dhar) — Thu, 24 Jun 2010 14:41:00 -0400

Logical architecture of a Fusebox application

The logical architecture of a Fusebox app resembles a hub and spoke system, with all actions returning to the hub (the Fusebox). This sort of structure is also known as a circuit application.

Figure 1 Fusebox App Structure

A circuit application is usually a single directory of files and generally does a few related tasks such as search. The overall application is called the home application, which is made up of many circuit applications. This is where Fusebox gets its name. Just like an electrical Fusebox, it is set up as a group of circuits (”fuses”) that are ready to send the user to whichever part of the application his or her next click requires. Each of these fuses has a name, called a fuseaction. Fuseactions are used to turn on the appropriate switches to cause the required action. So the Fuseaction is the key to the application?without a fuseaction, the application will only do the default fuseaction.

INDEX.CFM and the FuseactionThe home application is ALWAYS engendered in a file called INDEX.CFM, which is placed in the root directory of your application. Every link on the website will always be to this file! When creating the user interface for the application, each URL link or form will be to INDEX.CFM and then contain the name of the fuseaction that will do the work necessary if it is activated. For a URL, the fuseaction will be contained in the query string, for instance: http://localhost/INDEX.CFM?fuseaction=search. For a form, the usual method of placing the fuseaction is to call the INDEX.CFM file in the form?s action field, but then include a hidden form field with the fuseaction:

Now, The question is for internal workings of the INDEX.CFM file. It will use CFINCLUDEs to combine files together to create a working application. But how does ColdFusion use the fuseaction to know which files to combine? This is done using CFCASE/CFSWITCH. The CFCASE/CFSWITCH tags perform a similar function to a CFIF statement with a bunch of CFELSEIFs. But, using CFSWITCH/CFCASE will run much faster than a similar series of CFIF/CFELSEIF. When there are many ELSEIF’s, the logic is exactly the same. For example, here is a logical statement using CFIF/CFELSEIF:

“Wooof” “Meeooow” “Moooooo” [[Silence]]

Using CFCASE/CFSWITCH, the same statement would be:

“Wooof” “Meeooow” “Moooooo” [[silence]]

Since CFSWITCH/CFCASE is faster, it is the method used in the Fusebox architecture. INDEX.CFM will contain CFSWITCH/CFCASE to determine what the user wants to do. Think of the INDEX.CFM as basically one big switch statement and each CFCASE contains the information on what to do for a particular fuseaction. Therefore, the EXPRESSION= parameter of the CFSWITCH will be equal to your Fuseaction variable. An example: fuseaction=search might run a search and then display the results. In this case, the opening CFSWITCH statement should assign #FUSEACTION# to be the variable to be used, as in:

This means that basically, a fuseaction is the equivalent of a single CFCASE statement in your INDEX.CFM. Have a look at this code:

Suppose a user clicks on the following link:

registration

Using the example code above, when ColdFusion executes our CFSWITCH using the “registration” fuseaction, it will first display our HTML header block, then it will include the registration form itself and then finally the HTML footer. The rest of the CFCASES will be ignored.

Article Inspired from : fusionauthority

Coldfusion and It’s Advantages

noreply@blogger.com (Kalyan Dhar) — Thu, 24 Jun 2010 14:40:00 -0400

ColdFusion is a rapid scripting environment server for creating dynamic Internet Applications. ColdFusion Markup Language (CFML) is an easy-to-learn tag-based scripting language, with connectivity to enterprise data and powerful built-in search and charting capabilities. ColdFusion enables developers to easily build and deploy dynamic websites, content publishing systems, self-service applications, commerce sites, and more.

ü Develop and manage applications quickly and easily—ColdFusion lets you condense complex and powerful business logic into fewer lines of code that can be reused, helping you to save time and reduce errors. It provides insight into applications across servers and helps you maintain a consistent configuration across clusters to more efficiently manage your environment. Using ColdFusion , you can improve application performance with more granular control over code, templates, and applications. And speed up application development with the tight integration between ColdFusion and Adobe ColdFusion Builder™ software, the new Eclipse™ based IDE.

ü Rapidly build rich interfaces for new and existing ColdFusion applications—By leveraging the unique integration between ColdFusion and the products in the Adobe Flash Platform, you can accelerate the development of RIAs and interfaces, from client to server. Built-in support for Ajax controls enables you to easily create rich interfaces using Ajax and to build more compelling and intuitive applications. New controls include mapping, multimedia player, multifile upload, accordion navigation, progress indicator, confirmations, alerts, buttons, and sliders. In addition, you can now leverage the power of ColdFusion enterprise services via AMF or SOAP without writing a single line of CFML.

ü Integrate ColdFusion applications with enterprise technologies—Using the enterprise services in ColdFusion , you can easily access data from an existing infrastructure. It’s also easy to build a hub application for enterprise personnel by including Microsoft Exchange enterprise messaging, calendaring, a contact list, and task management. You can expose data from Microsoft Office SharePoint web services to a ColdFusion application and dynamically generate office documents for reporting, decision making, and presentations. Leverage .NET objects from other applications to build a hub application for multiple enterprise resources. Also integrate with Java™ objects, IMAP, and more.

Sources: • Sun Developer Network overview of Java SE security• MSDN, “How To: Use Regular Expressions to Constrain Input in ASP.NET”• PHP.NET Manual—“Security” section• Adobe white paper—Rapid application development for J2EE using Adobe ColdFusion 8• Adobe white paper—ColdFusion 8 developer security guidelines

ColdFusion Magic:- Join between oracle and sql server Using resultset

noreply@blogger.com (Kalyan Dhar) — Thu, 24 Jun 2010 14:39:00 -0400

Yes, it is possible to JOIN result sets from different datasources

One unique use for Query of Queries is to JOIN recordsets from separate queries. By extension, this means you can JOIN recordsets from different datasources as well.

Let’s assume that my datasource for customers is an Oracle database, but the database for customer orders is SQL Server. I realize this is a bit contrived, but we all know how strange the corporate operating environment can be. Using Query of Queries, you can run a JOIN on the two recordsets.

In this example, I’m grabbing orders for a specific customer. First, we’ll look at the getCustomerOrders query, which will provide the second recordset that we’ll use in our JOIN along with the getCustomers recordset:

select
orderID,
customerID,
orderAmount
from
customerOrders

This would produce a recordset like the one shown in Figure 1.

JOIN query(Figure 1)

Now, let’s JOIN these separate result sets:

select
getCustomers.customerID,
getCustomers.customerName,
getCustomerOrders.orderID,
getCustomerOrders.orderAmount
from
getCustomers, getCustomerOrders
where
getCustomerOrders.customerID = getCustomers.customerID
AND getCustomerOrders.customerID = 91

The resulting recordset can be seen in Figure 2.

JOIN Query of Query(Figure 2)

This ability to relate records in separate queries can be a useful approach to certain programming challenges.

Vulnerability affects ColdFusion MX 7 and ColdFusion 8

noreply@blogger.com (Kalyan Dhar) — Thu, 24 Jun 2010 14:38:00 -0400

A vulnerability has been reported in Adobe ColdFusion, which potentially can be exploited by malicious people to hijack user sessions.

The vulnerability is caused due to an unspecified error when using CFID or CFTOKEN and can be exploited to e.g. hijack a user’s session on an application built using ColdFusion.

NOTE: This vulnerability does not affect customers using J2EE session management.

The vulnerability affects ColdFusion MX 7 and ColdFusion 8.

Issue

ColdFusion manages sessions by keying on cookie values for CFID and CFTOKEN, by default. It has been found that ColdFusion will accept empty string values for either or both of these variables. If an application accidentally stored empty values to CFID and CFTOKEN, all users could share the same session data.

Solution

This update will cause ColdFusion to create a new session if CFID and/or CFTOKEN values are empty strings.

ColdFusion 8

You use the ColdFusion 8 Administrator to install hot fixes. The installation process is the same for all platforms and installation choices.

Download hf800-70523.zip (6.25K) and extract the hf800-70523.jar file.
Open the ColdFusion 8 Administrator and select the System Information page.
Next to the Update File field, select the Browse Button and browse to the extracted file. Select the file and click Submit.
Restart ColdFusion.

The ColdFusion 8.0 hot fix JAR file does not need to be retained after installing it with the ColdFusion Administrator. The file has been copied into the correct location.

The ColdFusion 8.0 hot fix JAR file will appear as a new entry in the System Information list.

Hot fixes are installed in the cf_root\lib\updates directory. To uninstall a hot fix, delete the JAR file from the updates directory that are being replaced by the cumulative update, after stopping the ColdFusion 8 application server.

ColdFusion MX 7

You use the ColdFusionMX 7 Administrator to install hot fixes. The installation process is the same for all platforms and installation choices.

Download hf702-70523.zip (106K) and extract the hf702-70523.jar file.
Open the ColdFusionMX 7 Administrator and select the System Information page.
Next to the Update File field, select the Browse Button and browse to the extracted file. Select the file and click Submit.
Restart ColdFusion.

The ColdFusionMX 7.02 hot fix JAR file does not need to be retained after installing it with the ColdFusion Administrator. The file has been copied into the correct location.

The ColdFusionMX 7.02 hot fix JAR file will appear as a new entry in the System Information list.

Hot fixes are installed in the cf_root\lib\updates directory. To uninstall a hot fix, delete the JAR file from the updates directory, after stopping the ColdFusionMX 7.02 application server.

For More information use following link

http://kb2.adobe.com/cps/402/kb402805.html

Use Single Sign-On to access ColdFusion applications via SharePoint

noreply@blogger.com (Kalyan Dhar) — Thu, 24 Jun 2010 14:38:00 -0400

SharePoint custom Web Parts let you access multiple ColdFusion applications from the SharePoint server using Single Sign-On (SSO). After signing in, users can access multiple secure ColdFusion applications by accessing ColdFusion services from multiple Web Parts.

To make a ColdFusion application available from SharePoint, use the CFSharepoint SSO WebPart template. This template is a customized version of PageViewer WebPart. It enables you to pass SSO credentials to the ColdFusion application. Download this template from the Adobe website or copy it from the ColdFusion 9 DVD.

Remember these points:

Web Parts support only the native single sign-on solution; other pluggable single sign-on services are not supported.
Only single sign-on credentials are passed to the ColdFusion application. The ColdFusion application must have the necessary logic to retrieve the credentials and login to the application.

Deploy the CF9SSOWebPart.wsp Web Part for SharePoint Portal Server 2007

To configure single sign-on for SharePoint Server 2007, deploy the CF9SSOWebPart.wsp file to the SharePoint server.

Copy the CF9SSOWebPart.wsp file to the BIN folder within the Web Server extensions. It is normally located at Program Files\Common Files\Microsoft Shared\Web Server Extensions\12\BIN in the SharePoint server.
To deploy the solution to SharePoint, use the command prompt to navigate to Program Files\Common Files\Microsoft Shared\Web Server Extensions\12\BIN and enter the following commands, as required.
To delete the solution if it is already present:
```
STSADM.EXE -o deletesolution -name CF9SSOWebPart.wsp -override
```
To add the solution to SharePoint:
```
STSADM.EXE -o addsolution -f CF9SSOWebPart.wsp
```
To deploy the solution to the configured website by specifying the URL:
```
STSADM.EXE -o deploysolution -name CF9SSOWebPart.wsp  -url  -local -allowGacDeployment
```
To deploy the solution to all the configured websites:
```
STSADM.EXE -o deploysolution -name CF9SSOWebPart.wsp -local -allowGacDeployment
```

Import the CF9SSOWebPart.wsp Web Part into a Web Part Page

Navigate to the web page on the SharePoint server where you want the Web Part to be accessible.
In the Web Part page, click Site Actions > Site Settings.
In the Site Settings page, click Galleries > Web Parts.
In the Web Part gallery, click Upload in the toolbar pane.
Select the CF9SSOWebPart.wsp Web Part.
Enter the following details in the toolbar pane.
- URL of the ColdFusion application to access
- The form field name as the User ID
- The form field name as the password
- Name of the SSO application where the credentials are configured

Once the Web Part is deployed, it takes the credentials from the SharePoint Single Sign-On database (based on the application name entered in the Tools Pane). These credentials are transferred to the ColdFusion application through the URL (provided in the Tools Pane) in a FORM containing the specified form fields.

Using cfsharepoint

Sharepoint integration with ColdFusion helps you dynamically manage user lists, views, and groups; work with images and document workspaces; and use search effectively. The cfsharepoint tag lets you create new lists, retrieve list items, and update list items on the SharePoint server.

The following example shows how to create a picture library list called “getpics”.

      < action  ="create new folder" login= "#login#" name="collection1" params="#{strListName=" strparentfolder="">          myimage = filereadbinary(expandpath("Bird.jpg"));      //convert the image into byte array to pass as input for "upload" action.                baseimage = filereadbinary(expandpath("bird.jpg"));  //convert the image into byte array to pass as input for "upload" action.

To check and ensure that all the updates are made, you can retrieve the list items using code like the following:

      SUCCESS

Access ColdFusion from SharePoint using custom Web Parts

You can access ColdFusion applications from within SharePoint using custom Web Parts. You can create a custom Web Part using the Page Viewer Web Part template that is shipped, by default, with SharePoint services 2.0 and 3.0, and Microsoft Office SharePoint Portal Server 2003 or 2007.

From the SharePoint Server page, click Modify Shared Page.
Select Add Web

Ref : www.adobe.com

How can I automate cached queries to update at an exact time each day?

noreply@blogger.com (Kalyan Dhar) — Sat, 24 Apr 2010 15:00:00 -0400

While ColdFusion gives you the ability to choose how long query data is cached, and even couple of
options to clear a cached query by hand, you may still find a situation that requires more precise
control over your cached query updates.
For example, say you have a query that generates a list of the newest recipes submitted to your
recipe site. Because this query is used so often, you choose to cache it. However, you would like to
update the cached query at exactly noon each day to reflect a daily cutoff for new recipe entries.
How could you do this?
The solution lies in using the scheduling engine of your choice (ColdFusion server has one built in)
to run a ColdFusion template that will refresh your cached query.
If you were using the following cached query in your pages:

start cfquery
name="qWithinTest"
datasource="myDs"
cachedWithin="#createTimeSpan(1, 0, 0, 0)#">
select name
from recipes
end cfquery

You could create a template that flushes the query cache using the following code:

start cfquery
name="qWithinTest"
datasource="myDs"
cachedwithin="#createTimeSpan(0, 0, 0, -1)#">
select name
from recipes
End cfquery

It is then a simple matter of using your scheduling engine to run this query flush template at noon
each day.

Create 6D Array with Coldfusion 8

noreply@blogger.com (Kalyan Dhar) — Wed, 21 Apr 2010 13:21:00 -0400

Coldfusion 8 Server support 1-3 Dimentional array only.
If you want to create more that 3D Array then coldfusion server will give you error.
Then what will be the possible sollution for it or is it impossible??

What i preffer to do is in following way.

arr = arrayNew(3);
arr[1][1][1] = arrayNew(3);

Here arr is 6D array.
you can use in following way
arr[1][1][1][1][1][1].
.............................................................................................................................................
Some more interesting sollutions are comming...

Urgent openning in coldfusion in CTS(Cognizant) Kolkata

noreply@blogger.com (Kalyan Dhar) — Wed, 21 Apr 2010 13:15:00 -0400

Very urgent openning in coldfusion in cognizant(CTS) Kolkata.
Interested people can apply.
Please send me your updated resume to kalyan.cse.jis@gmail.com

An Introduction to SQL Server 2005 Integration Services

noreply@blogger.com (Kalyan Dhar) — Fri, 2 Apr 2010 02:56:00 -0400

This paper discusses the challenges that face businesses that rely on data integration technologies to provide meaningful, reliable information to maintain a competitive advantage in today’s business world. It discusses how SQL Server 2005 Integration Services (SSIS) can help Information Technology departments meet data integration requirements in their companies. Real-world scenarios are included.

Introduction

The ability to transform corporate data into meaningful and actionable information is the single most important source of competitive advantage in today’s business world. Harnessing the data explosion to better understand the past and get direction for the future has turned out to be one of the most challenging ventures for enterprise Information Technology departments in global organizations. There are three broad categories of issues associated with data integration:

Technology challenges
Organizational issues
Economic challenges

In this paper, we will explore these challenges in detail and discuss how to address them with Microsoft® SQL Server™ 2005 Integration Services (SSIS). First, let’s view them in the context of a real-world scenario.

A Real-World Scenario

A major global transportation company uses its data warehouse to both analyze the performance of its operations and to predict variances in its scheduled deliveries.

Data Sources

The major sources of data in this company include order data from its DB2-based order entry system, customer data from its SQL Server-based customer relationship management (CRM) system, and vendor data from its Oracle-based ERP system. In addition to data from these major systems, data from spreadsheets tracking “extraordinary” events, which have been entered by hand by shipping supervisors, is incorporated into the data warehouse. Currently, external data such as weather information, traffic status, and vendor details (for subcontracted deliveries) are incorporated on a delayed basis from text files from various sources.

Data Consumption

Not only are the sources for these data diverse, but the consumers are also diverse both in their requirements and their geographic locations. This diversity has led to a proliferation of local systems. One of the major efforts for the Information Technology department is to establish a “single version of the truth,” at least for its customer data.

Data Integration Requirements

In view of this diversity of data, business needs, and user requirements, the Information Technology department has specified the following set of data integration requirements:

They must provide reliable and consistent historical and current data integrated from a variety of internal and external sources.
To reduce lags in data acquisition, data from providers and vendors must be available via Web services or some other direct mechanism such as FTP.
They need to cleanse and remove duplicate data and otherwise enforce data quality.
Increasing global regulatory demands require that the company maintain clear audit trails. It is not enough to maintain reliable data; the data needs to be tracked and certified.

Challenges of Data Integration

At one level, the problem of data integration in our real-world scenario is extraordinarily simple. Get data from multiple sources, cleanse and transform the data, and load the data into appropriate data stores for analysis and reporting. Unfortunately, in a typical data warehouse or business intelligence project, enterprises spend 60–80% of the available resources in the data integration stage. Why is it so difficult?

Technology Challenges

Technology challenges start with source systems. We are moving from collecting data on transactions (where customers commit to getting, buying, or otherwise acquiring something) to collecting data on pre-transactions (where customer intentions are tracked via mechanisms such as Web clicks or RFID). Data is now not only acquired via traditional sources and formats, such as databases and text files, but is increasingly available in a variety of different formats (ranging from proprietary files to Microsoft Office documents to XML-based files) and from Internet-based sources such as Web services and RSS (Really Simple Syndication) streams. The most pertinent challenges are:

Multiple sources with different formats.
Structured, semi-structured, and unstructured data.
Data feeds from source systems arriving at different times.
Huge data volumes.

In an ideal world, even if we somehow manage to get all the data we need in one place, new challenges start to surface, including:

Data quality.
Making sense of different data formats.
Transforming the data into a format that is meaningful to business analysts.

Suppose that we can magically get all the data we need and that we can cleanse, transform, and map the data into a useful format. There is still another shift away from traditional data movement and integration. That is the shift from fixed long batch-oriented processes to fluid and shorter on-demand processes. Batch-oriented processes are usually performed during “downtimes” when users do not place heavy demands on the system. This usually is at night during a predefined batch window of 6-8 hours, when no one is supposed to be in the office. With the increasing globalization of businesses of every size and type, this is no longer true. There is very little (if any) downtime and someone is always in the office somewhere in the world. The sun really doesn’t set on the global business.

As a result we have:

Increasing pressure to load the data as quickly as possible.
The need to load multiple destinations at the same time.
Diverse destinations.

Not only do we need to do all these, but we need to do them as fast as possible. In extreme cases, such as online businesses, data needs to be integrated on a continuous basis. There are no real batch windows and latencies can not exceed minutes. In many of these scenarios, the decision making process is automated with continuously running software.

Scalability and performance become more and more important as we face business needs that can’t tolerate any downtime.

Without the right technology, systems require staging at almost every step of the warehousing and integration process. As different (especially nonstandard) data sources need to be included in the ETL (Extract, Transform, and Load) process and as more complex operations (such as data and text mining) need to be performed on the data, the need to stage the data increases. As illustrated in Figure 1, with increased staging the time taken to “close the loop,” (i.e., to analyze, and take action on new data) increases as well. These traditional ELT architectures (as opposed to value-added ETL processes that occur prior to loading) impose severe restrictions on the ability of systems to respond to emerging business needs.

Figure 1

Finally, the question of how data integration ties into the overall integration architecture of the organization is becoming more important when both the real-time transactional technology of application integration and the batch-oriented high-volume world of data integration technology are needed to solve the business problems of the enterprise.

Organizational Challenges

There are two broad issues with data integration in a large organization; these are the “power” problem, and the “comfort zone” problem.

Power Challenge: Data is power and it is usually very hard to make people think of data in terms of a real valuable shared asset of the company. For enterprise data integration to be successful, all the owners of multiple data sources have to whole-heartedly buy into the purpose and direction of the project. Lack of cooperation from the relevant parties is one the major reasons for the failure of data integration projects. Executive sponsorship, consensus building, and a strong data integration team with multiple stakeholders are a few of the critical success factors that can help resolve the issues.

Comfort Zone Challenge: Problems of data integration, when analyzed in the context of an isolated need, can be solved in multiple ways. About 60% of data integration is solved by hand-coding. The technology used to solve similar problems can range from replication, ETL, SQL, to EAI. People gravitate towards the technology they are familiar with. Although these approaches have overlapping capabilities and can perhaps do the job in isolated cases, these technologies are optimized to solve different sets of problems. When trying to solve the problem of enterprise data integration, the lack of a sound architecture with appropriate technology choices can turn out to be a recipe for failure.

Economic Challenges

The organizational and technology related issues previously outlined conspire together to make data integration the most expensive part of any data warehouse/business intelligence project. The major factors that add to the cost of data integration are:

Getting the data out in the format that is necessary for data integration ends up being a slow and torturous process fraught with organizational power games.
Cleansing the data and mapping the data from multiple sources into one coherent and meaningful format is extraordinarily difficult
More often than not, standard data integration tools don’t offer enough functionality or extensibility to satisfy the data transformation requirements for the project. This can result in the expenditure of large sums of money in consulting costs to develop special ETL code to get the job done.
Different parts of the organization focus on the data integration problem in silos.

When there is a need to put them all together, additional costs are incurred to integrate these efforts into an enterprise-wide data integration architecture.

As the data warehousing and business intelligence needs of the organization evolve, faulty data integration architecture becomes more and more difficult to maintain and the total cost of ownership skyrockets.

SQL Server 2005 Integration Services

The traditional ETL-centric data integration from standard data sources continues to be at the heart of most data warehouses. However, demands to include more diverse data sources, regulatory requirements, and global and online operations are quickly transforming the traditional requirements for data integration. In this fast growing and changing landscape, the need to extract value from data and the need to be able to rely on it is more important than ever before. Effective data integration has become the basis of effective decision making. SQL Server Integration Services provides a flexible, fast, and scalable architecture that enables effective data integration in current business environments.

In this paper we will examine how SQL Server Integration Services (SSIS) is an effective toolset for both the traditional demands of ETL operations, as well as for the evolving needs of general purpose data integration. We will also discuss how SSIS is fundamentally different from the tools and solutions provided by major ETL vendors so it is ideally suited to address the changing demands of global business from the largest enterprise to the smallest business.

SSIS Architecture

Task flow and data flow engine

SSIS consists of both an operations-oriented task-flow engine as well as a scalable and fast data-flow engine. The data flow exists in the context of an overall task flow. It is the task-flow engine that provides the runtime resource and operational support for the data-flow engine. This combination of task flow and data flow enables SSIS to be effective in traditional ETL or data warehouse (DW) scenarios as well as in many other extended scenarios such as data center operations. In this paper we will mainly focus on the data-flow related scenarios. The use of SSIS for data center oriented workflow is a separate topic by itself.

Pipeline architecture

At the core of SSIS is the data transformation pipeline. This pipeline has a buffer-oriented architecture that is extremely fast at manipulating rowsets of data once they have been loaded into memory. The approach is to perform all data transformation steps of the ETL process in a single operation without staging data, although specific transformation or operational requirements, or indeed hardware may be a hindrance. Nevertheless, for maximum performance, the architecture avoids staging. Even copying the data in memory is avoided as far as possible. This is in contrast to traditional ETL tools, which often require staging at almost every step of the warehousing and integration process. The ability to manipulate data without staging extends beyond traditional relational and flat file data and beyond traditional ETL transformation capabilities. With SSIS, all types of data (structured, unstructured, XML, etc.) are converted to a tabular (columns and rows) structure before being loaded into its buffers. Any data operation that can be applied to tabular data can be applied to the data at any step in the data-flow pipeline. This means that a single data-flow pipeline can integrate diverse sources of data and perform arbitrarily complex operations on these data without having to stage the data.

It should also be noted though, that if staging is required for business or operational reasons, SSIS has good support for these implementations as well.

This architecture allows SSIS to be used in a variety of data integration scenarios, ranging from traditional DW-oriented ETL to nontraditional information integration technologies.

Integration Scenarios

SSIS for Traditional DW Loading

At its core, SSIS is a comprehensive, fully functional ETL tool. Its functionality, scale, and performance compare very favorably with high-end competitors in the market at a fraction of their cost. The data integration pipeline architecture allows it to consume data from multiple simultaneous sources, perform multiple complex transformations, and then land the data to multiple simultaneous destinations. This architecture allows SSIS to be used not only for large datasets, but also for complex data flows. As the data flows from source(s) to destination(s), the stream of data can be split, merged, combined with other data streams, and otherwise manipulated. Figure 2 shows an example of such a flow:

Figure 2

SSIS can consume data from (and land data into) a variety of sources including OLE DB, managed (ADO.NET), ODBC, flat file, Excel, and XML using a specialized set of components called adapters. SSIS can even consume data from custom data adapters (developed in-house or by third parties). This allows the wrapping of legacy data loading logic into a data source that can be seamlessly consumed in the SSIS data flow. SSIS includes a set of powerful data transformation components that allow data manipulations that are essential for building data warehouses. These transformation components include:

Aggregate Performs multiple aggregates in a single pass.
Sort Sorts data in the flow.
Lookup Performs flexible cached lookup operations to reference datasets.
Pivot and UnPivot Two separate transformations do exactly as their names suggest.
Merge, Merge Join, and UnionAll Can perform join and union operations.
Derived Column Performs column-level manipulations such as string, numeric, date/time, etc. operations, and code page translations. This one component actually wraps what other vendors might break up into many different transformations.
Data Conversion Converts data between various types (numeric, string, etc.).
Audit Adds columns with lineage metadata and other operational audit data.

In addition to these core data warehousing transformations, SSIS includes support for advanced data warehousing needs such as Slowly Changing Dimensions (SCD). The SCD Wizard in SSIS guides users through specifying their requirements for managing slowly changing dimensions and, based upon their input, generates a complete data flow with multiple transformations to implement the slowly changing dimension load. Support for standard Type 1 and 2 SCD along with 2 new SCD types (Fixed Attributes and Inferred Members) is provided. Figure 3 shows a page from the SCD Wizard.

Figure 3

Figure 4 shows the data flow generated by this Wizard.

Figure 4

SSIS also can be used to load Analysis Services multidimensional OLAP (MOLAP) caches directly from the data-flow pipeline. This means that SSIS can not only be used to create relational data warehouses, but also to load multidimensional cubes for analytical applications.

SSIS and Data Quality

One of the key features of SSIS is its ability to not only integrate data, but also to integrate different technologies to manipulate the data. This has allowed SSIS to include cutting edge “fuzzy logic” based data cleansing components. These components were developed by the Microsoft Research labs and represent the latest research in this area. The approach taken is a domain independent one and doesn’t depend upon any specific domain data, such as address/zip reference data. This allows these transformations to be used for cleansing most types of data, not just address data.

SSIS is deeply integrated with the data mining functionality in Analysis Services. Data mining abstracts out the patterns in a dataset and encapsulates them in a mining model. This mining model amongst other things then can be used to make predictions on what data belongs to a dataset and what data may be anomalous, allowing data mining to be used as a tool for implementing data quality. Support for complex data routing in SSIS allows anomalous data to not only be identified, but also be automatically corrected and replaced with better values. This enables “closed loop” cleansing scenarios. Figure 5 shows an example of such a closed loop cleansing data flow.

Figure 5

In addition to its built-in data quality features, SSIS can be extended to work closely with third-party data-cleansing solutions.

Application of SSIS Beyond Traditional ETL

The ability of the data-flow pipeline to manipulate almost any kind of data, the deep integration with Analysis Services, the support for extending it with a large variety of data manipulation technologies, and the inclusion of a rich work-flow engine allow SSIS to be used in many scenarios that are not traditionally thought of as ETL

Service Oriented Architecture

SSIS includes support for sourcing XML data in the data-flow pipeline, including data both from files on disk as well as URLs over HTTP. XML data is “shredded” into tabular data, which then can be easily manipulated in the data flow. This support for XML can work with the support for Web services. SSIS can interact with Web services in the control flow to capture XML data.

XML can also be captured from files, from Microsoft Message Queuing (MSMQ), and over the Web via HTTP. SSIS enables the manipulation of the XML with XSLT, XPATH, diff/merge, etc. and can also stream the XML into the data flow

This support enables SSIS to participate in flexible Service Oriented Architectures (SOA).

Data and text mining

SSIS not only has deep integration with the data mining features from Analysis Services, but it also has text mining components. Text mining (also referred to as text classification) involves identifying the relationship between business categories and the text data (words and phrases). This allows the discovery of key terms in text data and based upon this to automatically identify text that is “interesting.” This in turn can drive “closed-loop” actions to achieve business goals such as increasing customer satisfaction and enhancing the quality of the products and services.

On-demand data source

One of the most unique features in SSIS is the DataReader destination, which lands data into an ADO.NET DataReader. When this component is included in a data-flow pipeline, the package containing the DataReader destination can be used as a data source, exposed as an ADO.NET DataReader itself. This allows SSIS to be used not only as a traditional ETL to load data warehouses, but also as a data source that can deliver integrated, reconciled, and cleansed data from multiple sources on-demand. For example, this might be used to allow Reporting Services to consume data from multiple diverse data sources using a SSIS package as its data source.

A possible scenario that integrates all of these, consists of identifying and delivering interesting articles from RSS feeds as part of a regular report. Figure 6 shows a SSIS package that sources data from RSS feeds over the Internet, integrates with data from a Web service, performs text mining to find interesting articles from the RSS feeds, and then lands the interesting articles into a DataReader destination to be finally consumed by a Reporting Services report.

Figure 6

Figure 7 shows the use of the SSIS package as a data source in the Report Wizard.

Figure 7

From an ETL tool perspective, this scenario is very unusual because there really isn’t any data extraction or transformation or loading.

SSIS, the Integration Platform

SSIS goes beyond being an ETL tool not only in terms of enabling nontraditional scenarios, but also in being a true platform for data integration. SSIS is part of the SQL Server Business Intelligence (BI) platform which enables the development of end-to-end BI applications.

Integrated development platform

SQL Server Integration Services, Analysis Services, and Reporting Services all use a common Visual Studio® based development environment called the SQL Server Business Intelligence (BI) Development Studio. BI Development Studio provides an integrated development environment (IDE) for BI application development. This shared infrastructure enables metadata-level integration between various development projects (integration, analysis, and reporting). An example of such shared construct is the Data Source View (DSV), which is an offline schema/view definition of data sources, and is used by all three BI project types.

This IDE provides facilities such as integration with version control software (e.g., VSS) along with support for team-based features such as “check-in/check-out” and as such it fulfills the need for an enterprise-class team-oriented development environment for business intelligence applications. Figure 8 shows a BI Development Studio solution that consists of Integration, Analysis, and Reporting projects.

Figure 8

Not only does this provide a single place to develop BI applications, but it also can be used to develop other Visual Studio projects (using Visual C#®, Visual Basic® .NET etc.) and so can provide developers with a true end-to-end development experience.

Besides an integrated BI development environment, BI Development Studio has features for true run-time debugging of SSIS packages. These include the ability to set breakpoints and support for standard development constructs such as watching variables. A truly unique feature is the Data Viewer, which provides the ability to view rows of data as they are processed in the data-flow pipeline. This visualization of data can be in the form of a regular text grid or a graphical presentation such as a scatter plot or bar graph. In fact, it is possible to have multiple connected viewers that can display the data simultaneously in multiple formats. Figure 9 shows an example of geographic data visualized using a scatter plot and a text grid.

Figure 9

Programmability

In addition to providing a professional development environment, SSIS exposes all its functionality via a set of rich APIs. These APIs are both managed (.NET Framework) and native (Win32) and allow developers to extend the functionality of SSIS by developing custom components in any language supported by the .NET Framework (such as Visual C#, Visual Basic .NET, etc.) and C++. These custom components can be work-flow tasks and data-flow transformations (including source and destination adapters). This allows legacy data and functionality to be easily included in SSIS integration processes, allowing the past investments in legacy technologies to be effectively leveraged. It also allows easy inclusion of third-party components.

Scripting

The extensibility previously mentioned is not only limited to re-usable custom components but also includes script-based extensibility. SSIS has script components both for task flow as well as for data flow. These allow users to write scripts in Visual Basic. NET to add ad hoc functionality (including data sources and destinations) and to re-use any preexisting functionality packaged as .NET Framework assemblies.

Figure 10 shows an example of a script that manipulates rows of data inside a data flow.

Figure 10

This extensibility model makes SSIS not only a data integration tool, but also an Integration Bus into which technologies like data mining, text mining, and UDM can easily be plugged in to enable complex integration scenarios involving pretty much arbitrary data manipulation and structures.

Making Data Integration Approachable

The flexible and extensible architecture of SSIS allows it to address most of the technology challenges to data integration outlined earlier in this paper. As shown in Figure 11, SSIS eliminates (or at least minimizes) unnecessary staging. Because it performs complex data manipulation in a single pipeline operation, it is now possible to react to changes and patterns in the data fairly quickly, in a time frame that is actually meaningful for closing the loop and taking action. This is in contrast to traditional architectures that rely on data staging and that become impractical for closing the loop and taking meaningful action on data.

Figure 11

The extensible nature of SSIS makes it possible for organizations to leverage their existing investments in custom code for data integration by wrapping it as re-usable extensions to SSIS and by doing so to take full advantage of features such as logging, debugging, BI integration, etc. This greatly helps to overcome some of the organizational challenges outlined earlier in this paper.

The inclusion of SSIS in the SQL Server product makes the cost acquisition extremely reasonable as compared to other high-end data integration tools. Not only is the initial cost acquisition lowered, but via tight integration with Visual Studio and the rest of SQL Server BI tools, the cost of application development and maintenance is also significantly lowered in comparison to other similar tools. The extremely reasonable total cost of ownership (TCO) of SSIS (and the rest of SQL Server) makes enterprise-class data integration approachable to all segments of the market, taking it out of the exclusive domain of the largest (and richest) companies. At the same time, the architecture of SSIS is tuned to take advantage of modern hardware and to deliver performance and scale at the highest end of customer requirements. SSIS enables rich, scalable data integration to all customers, from the highest end enterprise to the small and medium business. In conjunction with the rest of the features in SQL Server, the Microsoft customer support infrastructure (ranging from broad, long beta testing, to rich online communities to premiere support contracts) and the consistency and integration with the rest of Microsoft product offerings, SSIS is truly a unique toolset that opens up new frontiers in data integration.

Tacken from microsoft.com

Some coldfusion Interview & certifications Questions

noreply@blogger.com (Kalyan Dhar) — Fri, 2 Apr 2010 02:27:00 -0400

1. Suppose you are going to make one asynchronously communicating event gateway.

Which coldfusion attributes will you use? Please Explain? (Example will be Preferable )

2. We can build web application with only cfm files in coldfusion serer. Then Why cfc had introduced ? What is the basic need of cfc.

3. What is the difference between Web server and Application Server.

4. Can we have multiple “Application.cfm” file in an Application?

5. Suppose you don’t want to share source code what you have written but you are ready to share all the functionalities. Is there any facility which prevents viewing of source code?

6. When we will use “<cfintup type=” other than normal html “

7. How can you set the Session Management?

8. What are the different ways to access CFC?

9. What is the difference between HTMLEditFormat and HTMLCodeFormat?

10. What is CFFlush?

11. What is the difference between CFAbort and CFBreak and CFExit?

12. Versus SQL INSERT, State advantages and disadvantages.

13. How do you automate cached queries to update at an exact

time each day?

14. <cfsavecontent variable="cachedOutput">

I am going to count to 10!<p>

<cfoutput>#loopOn#<br>cfoutput>

cfloop>

cfsavecontent>

Here What will be the Output in browser?

15. <cfquery name="myQry" datasource="myDatasource" cachedwithin="#createTimeSpan(0,0,0,-1)#">

select foo

from tblfoobar

order by bar desc

cfquery>
Here What is the meening of createTimeSpan(0,0,0,-1)? Will it gives you error message?

16. What is custom Tag?

17. What is UDF and how it differ from coldfusion component?

18. How to access posted form items?

19. How many types of looping coldfusion support?

20. <cfset var testStr = “”> can we set variable like this in CFM.

21. What kind of coldfusion errors are not handled with <cftry><cfcatch> Block?

22. How can you ensure there are no leading or trailing spaces in your variable?

23. Which scope will you use to track user’s IP Address?

24. <cfset Str=”1234@3476$4hj^&(mdw”/>
<cfloop from=”1” index=”i” to=”#Len(Str)#”>
<cfset str_display = Left(Left(Right(Str,i),i),1)/><cfset i=i+1/>

<cfoutput># str_display #cfoutput>

What will be the output?

25. IF update and insert needed in one action. For this scenario how will you roll back if 2^nd one failed?

26. How can you make a form submit to itself without hardcoding the file name?

Which one is more secure? And why?
<cfquery name="QCheckUser" datasource="blahblah">

SELECT *

FROM USERS

WHERE username = '#FORM.username#'

AND password = '#FORM.password#'

cfquery>

SELECT *

FROM USERS

WHERE username = <cfqueryparam cfsqltype="cf_sql_varchar" value="#FORM.username#">

AND password = <cfqueryparam cfsqltype="cf_sql_varchar" value="#FORM.password#">

cfquery>

27. How do you add one extra column after selecting result set?

28. Is that possible to create more than three dimension array in CF?

29. How do you determine if a number is even or odd with coldfusion?

30. How do I end a session when the user closes their browser?

31. Explain the types of lock and purpose of using types.

32. How do you find a value in list,Array,struct?

33. How do you get the entire columns list from a result set?

34. How do you know when a user's session ends?

35. Is it possible to create two functions with same name under one component?

36. How do you output a query result set grouped by a specific field?How do I output a query result set grouped by a specific field?

37. How do you upload files into the server?

38. What is the difference between <cfinclude> and <cflocation>

39. Is DUMP possible under <cfscript>?

40. What is Ajax and why it is introduced?

41. What are the difference of Form post method and get method?

42. State example where you store data as session variable and as application variable.

43. How do you determine if an array position exists?

44. How do you validate date, number, email with coldfusion.

45. How do you stop users from clicking the submit button more than once with JS?

46. Is it possible to connect more than one database server at a time.

47. You have two dates/times you want to compare. How will you get max date?

48. How do you get all the struct value with using loop?

49. What is your favorite web-application language? Why? If not Coldfusion then compare both the language?

50. If you use under application.cfc . What will be "test" variable's scope?

coldfusion CMS Frameworks Flex Ajax

Asynchronous webservice response.

New flavor to execute query from coldfusion cfscript.

Now Facebook session can be shared with our ColdFusion Applications

ColdFusion Closures By Zeus

Send Email with SSIS/DATABASE from gmail account

Keeping a session alive on ColdFusion using Jquery

Determine default and max session/Application timeouts for current ColdFusion server

Top 10 Key Information Technology Trends For 2012

Executing Code When ColdFusion Server Starts

ADOBE CREATIVE CLOUD

DDoS attacks in payment gateways

SQL Tips: Faster technique to get 1st and last day of the month

Creation of Singleton Object with Coldfusion

How Coldfusion works and it’s Key Features( Compilation and precompile )

How to get the primary key of a record added to the table with coldfusion

Logical architecture of a Fusebox application

Coldfusion and It’s Advantages

ColdFusion Magic:- Join between oracle and sql server Using resultset

Vulnerability affects ColdFusion MX 7 and ColdFusion 8

Issue

Solution

ColdFusion 8

ColdFusion MX 7

Use Single Sign-On to access ColdFusion applications via SharePoint

Deploy the CF9SSOWebPart.wsp Web Part for SharePoint Portal Server 2007

Import the CF9SSOWebPart.wsp Web Part into a Web Part Page

Using cfsharepoint

Access ColdFusion from SharePoint using custom Web Parts

How can I automate cached queries to update at an exact time each day?

Create 6D Array with Coldfusion 8

Urgent openning in coldfusion in CTS(Cognizant) Kolkata

An Introduction to SQL Server 2005 Integration Services

On This Page

Introduction

A Real-World Scenario

Data Sources

Data Consumption

Data Integration Requirements

Challenges of Data Integration

Technology Challenges

Organizational Challenges

Economic Challenges

SQL Server 2005 Integration Services

SSIS Architecture

Task flow and data flow engine

Pipeline architecture

Integration Scenarios

SSIS for Traditional DW Loading

SSIS and Data Quality

Application of SSIS Beyond Traditional ETL

Service Oriented Architecture

Data and text mining

On-demand data source

SSIS, the Integration Platform

Integrated development platform

Programmability

Scripting

Making Data Integration Approachable

Some coldfusion Interview & certifications Questions