C#, MS SQL,mySQL, Asp.net,Search-Engine-Optimization

Phân Đoạn Bảng Theo Chiều Dọc

tcdichvunhadat@gmail.com — Mon, 07 Mar 2011 04:49:00 +1400

Khi làm việc với một bảng rộng gồm rất nhiều cột, trong đó chỉ có một số cột được truy cập thường xuyên, bạn có thể tăng hiệu năng cho câu truy vấn trên các cột này bằng cách tách chúng ra một bảng riêng. Khi đó thay vì có một bảng rộng như ban đầu thì nay bạn có hai bảng: một bảng gồm nhóm các cột được dùng thường xuyên, và một bảng gồm các cột còn lại. Cả hai bảng đều chứa cột khóa chính để giữ liên hệ với nhau. Lúc này quan hệ giữa hai bảng là quan hệ 1-1. Trong trường hợp cần thiết, bảng ban đầu có thể được tách làm nhiều hơn hai bảng. Kỹ thuật này gọi là phân đoạn bảng theo chiều dọc (vertical partitioning). Nói nôm na là bổ dọc bảng thành nhiều mảnh.

Trong công việc tôi rất hay gặp những bảng có số lượng cột khá lớn. Ví dụ trong một dự án tôi tham gia gần đây có một bảng chứa 320 cột. Nhưng sau khi khảo sát thì phát hiện ra có khoảng 30 cột là được truy cập thường xuyên hơn hẳn các cột còn lại. Chúng tôi đã dùng kỹ thuật phân đoạn trên: chia thành 2 bảng, một bảng chứa 30 cột được dùng thường xuyên cộng với cột ID, bảng kia cũng chứa cột ID và các cột còn lại. Kết quả là hiệu năng tăng lên đáng kể: từ lúc rất hay bị lỗi time-out do thủ tục chạy quá lâu (35-40s), đến nay đã hoàn toàn không bị nữa kể cả khi server đang chịu tải nặng, với thời gian thực hiện thủ tục trung bình vào khoảng 10-12s.

Vậy lý do nào dẫn đến cải thiện về hiệu năng? Điều này liên quan đến cách tổ chức dữ liệu của bảng bên trong SQL Server. SQL Server chia mỗi bảng thành các trang (page) có kích thước đều nhau 8KB. Các bản ghi được lưu nối tiếp nhau vào từng trang, đến khi đầy trang thì lưu tiếp sang trang mới. Tùy theo kích thước của bản ghi (bằng kích thước của các cột cộng lại) mà có bao nhiêu bản ghi được xếp vừa vào một trang. Nếu kích thước nhỏ sẽ có nhiều bản ghi được chứa trong một trang, ngược lại nếu kích thước lớn thì mỗi trang sẽ chứa được ít bản ghi. Thậm chí nếu kích thước này vượt quá 8KB thì vài trang mới chứa hết một bản ghi (SQL Server 2000 không cho phép điều này nên kích thước bản ghi tối đa được phép tạo trong SQL Server 2000 chỉ là 8KB).

Trang là đơn vị dữ liệu nhỏ nhất mà hệ thống đọc từ ổ cứng. Kể cả khi chỉ cần truy xuất một bản ghi thì SQL Server cũng tìm đến vả load cả trang chứa nó vào bộ nhớ. Do đó với bảng hẹp thì cùng một thao tác đọc trang sẽ tải được nhiều bản ghi vào bộ nhớ hơn so với bảng rộng. Hay nói cách khác, để đọc cùng một số lượng bản ghi như nhau thì bảng hẹp cần đọc ít trang hơn bảng rộng. Vì thế truy vấn trên bảng hẹp luôn luôn nhanh hơn truy vấn trên bảng rộng.

Trong ví dụ sau, tôi có bảng BangBeo (bảng béo) gồm ba trường ID int, txt1 char(10), txt2 char(8000). Nay tôi tách bảng BangBeo thành hai bảng:
· BangGay (bảng gầy) gồm ID và txt1
· BangBeoPhu (bảng béo phụ) gồm ID và txt2

Tôi vẫn giữ lại bảng BangBeo ban đầu để so sánh

CREATE TABLE BangBeo(ID INT, txt1 CHAR(10), txt2 CHAR(8000) )
CREATE TABLE BangGay(ID INT, txt1 CHAR(10) )
CREATE TABLE BangBeoPhu(ID INT, txt2 CHAR(8000) )
GO
DECLARE @i INT
SET @i=1
WHILE @i&lt;=100
BEGIN
INSERT BangBeo (ID, txt1, txt2)
SELECT @i, REPLICATE('a',10), REPLICATE('a',8000)
 
INSERT BangGay (ID, txt1)
SELECT @i, REPLICATE('a',10)
 
INSERT BangBeoPhu (ID, txt2)
SELECT @i, REPLICATE('a',8000)
SET @i=@i+1
END
GO
--ghi dữ liệu ra đĩa và xóa cache
CHECKPOINT
 
-- hiện thống kê về vào ra đĩa
SET STATISTICS IO ON
 
-- xóa cache để đảm bảo công bằng khi so sánh
DBCC DROPCLEANBUFFERS 
 
SELECT ID, txt1
FROM BangBeo
 
-- xóa lại cache
DBCC DROPCLEANBUFFERS
 
SELECT ID, txt1
FROM BangGay

Mặc dù hai câu lệnh trả về cùng một kết quả, nhưng phương án thực thi cho thấy câu lệnh trên bảng gầy chỉ chiếm một phần nhỏ chi phí so với câu lệnh trên bảng béo:

Trong ví dụ trên, bảng béo có kích thước bản ghi xấp xỉ 8KB, do đó mỗi trang chứa được một bản ghi, tổng cộng bảng với 100 bản ghi sẽ chiếm 100 trang. Còn bảng gầy có kích thước vẻn vẹn 14 byte (INT 4 byte và CHAR 10 byte) – chính xác ra thì còn thêm một số byte header. Vì thế toàn bộ bảng với 100 bản ghi chiếm chưa hết một trang. Như vậy mặc dù trả về cùng kết quả nhưng câu truy vấn trên bảng béo cần đọc tới 100 trang, còn câu lệnh trên bảng gầy chỉ cần đọc có 1 trang. Kết quả thống kê I/O cũng cho thấy điều này (chú ý các con số tô đậm):

Bảng béo:

(100 row(s) affected)
Table ‘BangBeo’. Scan count 1, logical reads 100, physical reads 10, read-ahead reads 100

Bảng gầy:

(100 row(s) affected)
Table ‘BangGay’. Scan count 1, logical reads 1, physical reads 1, read-ahead reads 0

Một vài lưu ý

Kỹ thuật phân đoạn bảng theo chiều dọc như trình bày ở trên không được hỗ trợ bởi Microsoft, theo nghĩa nó không trong suốt đối với bên ngoài và các bảng được phân đoạn trở thành các bảng biệt lập (không giống với phân đoạn theo chiều ngang khi bảng vẫn hiện ra là một bảng duy nhất). Việc tách thành các bảng riêng như trên không nằm ngoài mục đích nâng cao hiệu năng cho câu truy vấn trên một số cột nhất định. Vì thế nó chỉ có ý nghĩa khi bạn xác định được một tập các cột được truy vấn thường xuyên hơn các cột còn lại. Bạn cũng không phải có bảng rộng tới 300 cột mới cần đến phân đoạn. Kể cả với bảng hẹp hơn nhưng số cột được truy vấn nhiều lần chỉ là một phần nhỏ trong tổng số tất cả các cột, bạn sẽ thấy lợi ích của việc phân đoạn.

Kỹ thuật phân đoạn này cũng kéo theo một vài rắc rối khi viết code:

Đối với lệnh SELECT, bạn phải nhớ các cột nào nằm ở bảng nào để viết câu lệnh cho đúng, vì các cột giờ không nằm chung trong một bảng nữa. Bạn có thể tạo một view gom cả hai bảng và truy vấn qua view này, nhưng như thế sẽ làm mất đi tác dụng về hiệu năng, vì khi JOIN thì cả hai bảng sẽ luôn được truy xuất và số trang cần đọc không giảm đi tí nào. Khi có thay đổi về thiết kế, chẳng hạn cần di chuyển cột từ bảng này sang bảng kia, bạn phải quay lại sửa lại câu lệnh cũ.

Đối với các lệnh DELETE/INSERT/UPDATE, bạn luôn nhớ cần thực hiện trên cả hai bảng. Bạn có thể thực hiện câu lệnh qua view, và ở bên dưới view tạo một trigger loại INSTEAD OF trong đó thực hiện thao tác trên cả hai bảng

nguồn sqlviet

ASP.NET - Password Strength Indicator using jQuery and XML

tcdichvunhadat@gmail.com — Thu, 10 Feb 2011 05:24:00 +1400

Last week, I had the opportunity to help implement and integrate a strong password policy to the legacy web application developed using ASP technology. The solution I proposed was to use jQuery to display the password strength meter to help users create strong password. Then one of my colleagues had asked "Do we have to modify the client-side script, code behind and password policy page if the client decided to alter the password policy?" The answer is "no", thanks to jQuery, the client-side script and code behind can share the same XML file. The password policy information is stored to an XML file and the client-side script and code behind are using the information in the XML file to perform the password strength validation. I found several fine jQuery plug-in to display the user's password strength but I prefer to have something somewhat similar to the ASP.NET AJAX PasswordStrength control. After spending some time doing research, I am able to find all the necessary resources and assemble the jQuery plug-in to achieve the goal. Listed below are the features of the plug-in and I have put together a demo, everyone are welcome to download it. 1. Display password strength indicator in text and progress bar meter. 2. The password policy, bar color and width are stored in the XML file and consume by the client-side and server side 3. Use XSLT to transform the password policy XML file into HTML. Figure 1 Figure 2

Shown below is the content of the sample application. If you want to test the Classic ASP code, deploy the application to your IIS Web Server. The local ASP.NET Development Web Server does not support Classic ASP. Figure 3 · Default.aspx – sample code in ASP.NET c# with MasterPage · Default.aspx2 – sample code in ASP.NET c# without MasterPage · Password_strength_Indicator.asp – sample code in Classic ASP · jQuery_Password_Strength_Indicator.htm – sample code in HTML · PasswordPolicy.xml – contains password policy information · Password.xslt – to transform PasswordPoclicy.xml file into HTML format · jQuery.password-strength.js –this is the plug-in I have created · Download latest jQuery library from here
The Password Strength Indicator Plugin
In this section, I'll touch base briefly with the contents in the jQuery.password-strength.js file. The code is very straight forward and comments are included. There is a jQuery AJAX request to read the XML file and populate the local variables based on the data in the XML file. If you are unsure of the relative URL, I would recommend using absolute URL to your XML file. The getStrengthInfo() function contains the logic to check the password strength and return appropriate message based on user input. The password strength meter bar and text position are relative to the Textbox position. Shown below is the code in the jQuery.password-strength.js file. Listing 1 (function($) { var password_Strength = new function() { //return count that match the regular expression this.countRegExp = function(passwordVal, regx) { var match = passwordVal.match(regx); return match ? match.length : 0; } this.getStrengthInfo = function(passwordVal) { var len = passwordVal.length; var pStrength = 0; //password strength var msg = "", inValidChars = ""; //message //get special characters from xml file var allowableSpecilaChars = new RegExp("[" + password_settings.specialChars + "]", "g") var nums = this.countRegExp(passwordVal, /\d/g), //numbers lowers = this.countRegExp(passwordVal, /[a-z]/g), uppers = this.countRegExp(passwordVal, /[A-Z]/g), //upper case specials = this.countRegExp(passwordVal, allowableSpecilaChars), //special characters spaces = this.countRegExp(passwordVal, /\s/g); //check for invalid characters inValidChars = passwordVal.replace(/[a-z]/gi, "") + inValidChars.replace(/\d/g, ""); inValidChars = inValidChars.replace(/\d/g, ""); inValidChars = inValidChars.replace(allowableSpecilaChars, ""); //check space if (spaces > 0) { return "No spaces!"; } //invalid characters if (inValidChars !== '') { return "Invalid character: " + inValidChars; } //max length if (len > password_settings.maxLength) { return "Password too long!"; } //GET NUMBER OF CHARACTERS left if ((specials + uppers + nums + lowers) < password_settings.minLength) { msg += password_settings.minLength - (specials + uppers + nums + lowers) + " more characters, "; } //at the "at least" at the front if (specials == 0 \|\| uppers == 0 \|\| nums == 0 \|\| lowers == 0) { msg += "At least "; } //GET NUMBERS if (nums >= password_settings.numberLength) { nums = password_settings.numberLength; } else { msg += (password_settings.numberLength - nums) + " more numbers, "; } //special characters if (specials >= password_settings.specialLength) { specials = password_settings.specialLength } else { msg += (password_settings.specialLength - specials) + " more symbol, "; } //upper case letter if (uppers >= password_settings.upperLength) { uppers = password_settings.upperLength } else { msg += (password_settings.upperLength - uppers) + " Upper case characters, "; } //strength for length if ((len - (uppers + specials + nums)) >= (password_settings.minLength - password_settings.numberLength - password_settings.specialLength - password_settings.upperLength)) { pStrength += (password_settings.minLength - password_settings.numberLength - password_settings.specialLength - password_settings.upperLength); } else { pStrength += (len - (uppers + specials + nums)); } //password strength pStrength += uppers + specials + nums; //detect missing lower case character if (lowers === 0) { if (pStrength > 1) { pStrength -= 1; //Reduce 1 } msg += "1 lower case character, "; } //strong password if (pStrength == password_settings.minLength && lowers > 0) { msg = "Strong password!"; } return msg + ';' + pStrength; } } //default setting var password_settings = { minLength: 12, maxLength: 25, specialLength: 1, upperLength: 1, numberLength: 1, barWidth: 200, barColor: 'Red', specialChars: '!@#$', //allowable special characters metRequirement: false, useMultipleColors: 0 }; //password strength plugin $.fn.password_strength = function(options) { //check if password met requirement this.metReq = function() { return password_settings.metRequirement; } //read password setting from xml file $.ajax({ type: "GET", url: "PasswordPolicy.xml", //use absolute link if possible dataType: "xml", success: function(xml) { $(xml).find('Password').each(function() { var _minLength = $(this).find('minLength').text(), _maxLength = $(this).find('maxLength').text(), _numsLength = $(this).find('numsLength').text(), _upperLength = $(this).find('upperLength').text(), _specialLength = $(this).find('specialLength').text(), _barWidth = $(this).find('barWidth').text(), _barColor = $(this).find('barColor').text(), _specialChars = $(this).find('specialChars').text(), _useMultipleColors = $(this).find('useMultipleColors').text(); //set variables password_settings.minLength = parseInt(_minLength); password_settings.maxLength = parseInt(_maxLength); password_settings.specialLength = parseInt(_specialLength); password_settings.upperLength = parseInt(_upperLength); password_settings.numberLength = parseInt(_numsLength); password_settings.barWidth = parseInt(_barWidth); password_settings.barColor = _barColor; password_settings.specialChars = _specialChars; password_settings.useMultipleColors = _useMultipleColors; }); } }); return this.each(function() { //bar position var barLeftPos = $("[id$='" + this.id + "']").position().left + $("[id$='" + this.id + "']").width(); var barTopPos = $("[id$='" + this.id + "']").position().top + $("[id$='" + this.id + "']").height(); //password indicator text container var container = $('<span></span>') .css({ position: 'absolute', top: barTopPos - 6, left: barLeftPos + 15, 'font-size': '75%', display: 'inline-block', width: password_settings.barWidth + 40 }); //add the container next to textbox $(this).after(container); //bar border and indicator div var passIndi = $('<div id="PasswordStrengthBorder"></div> <div id="PasswordStrengthBar" class="BarIndicator"></div>') .css({ position: 'absolute', display: 'none' }) .eq(0).css({ height: 3, top: barTopPos - 16, left: barLeftPos + 15, 'border-style': 'solid', 'border-width': 1, padding: 2 }).end() .eq(1).css({ height: 5, top: barTopPos - 14, left: barLeftPos + 17 }).end() //set max length of textbox //$("[id$='" + this.id + "']").attr('maxLength', password_settings.maxLength); //add the boder and div container.before(passIndi); $(this).keyup(function() { var passwordVal = $(this).val(); //get textbox value //set met requirement to false password_settings.metRequirement = false; if (passwordVal.length > 0) { var msgNstrength = password_Strength.getStrengthInfo(passwordVal); var msgNstrength_array = msgNstrength.split(";"), strengthPercent = 0, barWidth = password_settings.barWidth, backColor = password_settings.barColor; //calculate the bar indicator length if (msgNstrength_array.length > 1) { strengthPercent = (msgNstrength_array[1] / password_settings.minLength) * barWidth; } $("[id$='PasswordStrengthBorder']") .css({ display: 'inline', width: barWidth }); //use multiple colors if (password_settings.useMultipleColors === "1") { //first 33% is red if (parseInt(strengthPercent) >= 0 && parseInt(strengthPercent) <= (barWidth * .33)) { backColor = "red"; } //33% to 66% is blue else if (parseInt(strengthPercent) >= (barWidth * .33) && parseInt(strengthPercent) <= (barWidth * .67)) { backColor = "blue"; } else { backColor = password_settings.barColor; } } $("[id$='PasswordStrengthBar']").css({ display: 'inline', width: strengthPercent, 'background-color': backColor }); //remove last "," character if (msgNstrength_array[0].lastIndexOf(",") !== -1) { container.text(msgNstrength_array[0].substring(0, msgNstrength_array[0].length - 2)); } else { container.text(msgNstrength_array[0]); } if (strengthPercent == barWidth) { password_settings.metRequirement = true; } } else { container.text(''); $("[id$='PasswordStrengthBorder']").css("display", "none"); //hide $("[id$='PasswordStrengthBar']").css("display", "none"); //hide } }); }); }; })(jQuery);
Using the Code
Include a Textbox control, jQuery library and the plug-in into the web page. Change the txtPassword id to your desire id. Use this line of code "var myPlugin = $("[id$='txtPassword']").password_strength();" to call the plug-in. To check if the password met the password policy, call the metReq() function with this line of code " myPlugin.metReq()". Please refer to Listing 1 for full details. The jQuery $("[id$='txtPassword']") selector will work with ASP.NET server control, so don't bother using my 'txtPassword.ClientID'. The bar color, width and password policy information can be modify through the XML file. Listing 2 <div style="height:400px"> <br /> <asp:label runat="server" id="lblPassword" AssociatedControlId="txtPassword">Enter Password:</asp:label> <asp:TextBox ID="txtPassword" runat="server"></asp:TextBox> <br /> <a id="passwordPolicy" href="#">Password policy</a> <br /><br /> <asp:Button ID="btnSubmit" runat="server" Text="Submit" /> <br /><br /> <asp:Label ID="ResultLabel" runat="server" Text=""></asp:Label> </div> <script src="Script/jquery-1.4.4.min.js" type="text/javascript"></script> <script src="Script/jquery.password-strength.js" type="text/javascript"></script> <script type="text/javascript"> $(document).ready(function() { var myPlugin = $("[id$='txtPassword']").password_strength(); $("[id$='btnSubmit']").click(function() { return myPlugin.metReq(); //return true or false }); $("[id$='passwordPolicy']").click(function(event) { var width = 350, height = 300, left = (screen.width / 2) - (width / 2), top = (screen.height / 2) - (height / 2); window.open("PasswordPolicy.xml", 'Password_poplicy', 'width=' + width + ',height=' + height + ',left=' + left + ',top=' + top); event.preventDefault(); return false; }); }); </script> We can use the XLST to display the contents of the PasswordPolicy.xml or write code to extract its contents. I preferred to use XLST to avoid writing additional code. Displayed below is the password policy page. If you want to learn more on how to displaying XML with XSLT click on here. Figure 4
Code Behind or Server-Side Code
The regular expression that we are using is listed in listing 3. The numbers are adjustable and come from the XML file. Listing 3 (?=^.{12,25}$)(?=(?:.?\d){2})(?=.[a-z])(?=(?:.?[A- Z]){2})(?=(?:.?[!@#$%()_+^&}{:;?.]){2})(?!.\s)[0-9a-zA-Z!@#$%()_+^&]$ Shown in listing 4 is the code to generate regular expression dynamically. So, tomorrow if your client told you to increase the required digit in the password policy, you don't have to search or create a new regular expression. All you have to do is change the setting in the PasswordPolicy.xml file. You can verify the regular expression here. Listing 4 void btnSubmit_Click(object sender, EventArgs e) { PasswordSetting passwordSetting = Helper.GetPasswordSetting(); StringBuilder sbPasswordRegx = new StringBuilder(string.Empty); //min and max sbPasswordRegx.Append(@"(?=^.{" + passwordSetting.MinLength + "," + passwordSetting.MaxLength + "}$)"); //numbers length sbPasswordRegx.Append(@"(?=(?:.?\d){" + passwordSetting.NumsLength + "})"); //a-z characters sbPasswordRegx.Append(@"(?=.[a-z])"); //A-Z length sbPasswordRegx.Append(@"(?=(?:.?[A-Z]){" + passwordSetting.UpperLength + "})"); //special characters length sbPasswordRegx.Append(@"(?=(?:.?[" + passwordSetting.SpecialChars + "]){" + passwordSetting.SpecialLength + "})"); //(?!.\s) - no spaces //[0-9a-zA-Z!@#$%()_+^&] -- valid characters sbPasswordRegx.Append(@"(?!.\s)[0-9a-zA-Z" + passwordSetting.SpecialChars + "]$"); if (Regex.IsMatch(txtPassword.Text, sbPasswordRegx.ToString())) { ResultLabel.Text = "Password confront password policy!"; } else { ResultLabel.Text = "Password does not confront password policy!"; } }
Display Different Colors in the Progress Bar
I have received several suggestions from the reader to have different colors in the progress bar meter. I tried to implement this with the least possible change to the existing code. The current implementation does not have a complex algorithm to assign different weights to the characters. Here's how I implemented it, please refer to listing 5 for full details. 1. The colors is based on the password length 2. If the password length between 0 and 33 percent, display red color 3. If the password length between 33 and 67 percent, display blue color 4. If above 67 percent, display the color specified in the PasswordPolicy.xml file I also added useMultipleColors attribute to the PasswordPolixy.xml to give users the option to enable or disable the multiple colors. Listing 5 //use multiple colors if (password_settings.useMultipleColors === "1") { //first 33% is red if (parseInt(strengthPercent) >= 0 && parseInt(strengthPercent) <= (barWidth * .33)) { backColor = "red"; } //33% to 66% is blue else if (parseInt(strengthPercent) >= (barWidth * .33) && parseInt(strengthPercent) <= (barWidth * .67)) { backColor = "blue"; } else { backColor = password_settings.barColor; } }

Understanding Code Access Security in .NET

tcdichvunhadat@gmail.com — Sat, 29 Jan 2011 06:17:00 +1400

In Microsoft .NET you have two types of security, Code Access Security and Role Based Security. In this article we will explore what the latter implies, how it can be used, etc. So, what is Code Access Security then? Code Access Security (CAS) is a security feature of .NET that enables the code that is to be executed to be properly verified and different levels of trust granted accordingly. It actually provides the flexibility to define what the code could perform and what not to perform. This article discusses CAS, the functions and benefits of CAS, permissions and permission sets.
What is Code Access Security?
Code Access Security (CAS) is a feature in .NET which imposes security on the code under execution based on that has created it, from where was it downloaded or copied and what are the evidences of the code. Evidences tell where the code is supposed to execute. So based on the evidence, permissions are set and these permissions are managed by policies. There are other definitions of CAS too. According to the MSDN, "Code access security allows code to be trusted to varying degrees depending on where the code originates and on other aspects of the code's identity. Code access security also enforces the varying levels of trust on code, which minimizes the amount of code that must be fully trusted in order to run. Using code access security can reduce the likelihood that your code can be misused by malicious or error-filled code. It can reduce your liability because you can specify the set of operations your code should be allowed to perform as well as the operations your code should never be allowed to perform. Code access security can also help minimize the damage that can result from security vulnerabilities in your code." According to Wikipedia, "Code Access Security (CAS), in the Microsoft .NET Framework, is Microsoft's solution to prevent untrusted code from performing privileged actions. When the CLR loads an assembly it will obtain evidence for the assembly and use this to identify the code group that the assembly belongs to. A code group contains a permission set (one or more permissions). Code that performs a privileged action will perform a code access demand which will cause the CLR to walk up the call stack and examine the permission set granted to the assembly of each method in the call stack. The code groups and permission sets are determined by the administrator of the machine who defines the security policy."
Benefits
The benefits of CAS are many. Here is a list of the major benefits of CAS. · It defines a set of permissions that would specify how the system resources should be accessed by verifying the demanded permissions with the one that is granted. · Permission sets defined are configured into code groups, through which an administrator can configure the security policy. · Provides a control over the resource acquisition by the code by strictly adhering to the permission sets configured. · Provides the code to demand if its callers have required permissions.
How does it work?
The security system which is built into the CLR defines a permission set which could apply to a particular resource. To access a resource, the code needs to undergo authentication and authorization process. This is done by traversing through the code and tracking the identity beneath which is usually termed as stack walk. In managed code, any permission demanded is verified by the CLR security manager. The CLR security manager walks through the call stack by mapping the permissions demanded and the permissions granted. A SecurityException is thrown if the permission demanded is not found in the call stack. So the actual permissions are checked depending on the evidences. So evidences provide information on where the code was actually executed. Below is the diagram (figure taken from MSDN Article) which depicts the mechanism based on which the identity is traced across all the referenced assemblies by performing a call stack. Figure 1 (Adapted from an article at MSDN)
What are Policies and Policy Levels?
Policies represent the user role which could be categorized as: Application Domain Policy, User Policy, Machine Policy and Enterprise Policy. The purpose of each is defined below. Enterprise Policy – This policy is specified by the enterprise administrator. This would target to all managed code in an enterprise. Machine Policy - This policy is specified by the enterprise administrator. This would target to all managed code in the local computer. User Policy - This policy is specified by the enterprise administrator or the user of the machine. This would target to all managed code associated with the current user. Application Domain Policy - The policy is specified by the enterprise administrator. This would target all managed code in an application. A policy is a configuration file which holds details on what the assembly is permitted to do depending upon the evidence collected. A common overlap of permission sets between various policies is termed as an Intersection. These policies are defined in a hierarchical structure and before applying permission all of the policies in the hierarchic should accept it.
What is a Code Group?
Policies are configured based on a hierarchy of code groups. Code groups are structured at every policy level. So if the evidence gathered matches with the membership of a code group within a policy level, the associated set of permissions is granted to the assembly. The MSDN defines the code; groups are defined as follows: "A code group is a logical grouping of code that has a specified condition for membership. Any code that meets the membership condition is included in the group. Code groups have associated permission sets that are evaluated during a policy grant."
Permission
Permission defines the ability of an operation to have access on particular resources. They impose specific levels of authorization to a protected resource. The runtime security system defines permissions like File IO, Printing, Socket Access, Event Log, Web Access, User Interface and so forth. What are Permission Sets? Permission set is a collection of permissions which are used to modify the security policy for code groups. The CLR provides the following built-in permission sets. Nothing Implies that the code cannot be executed. Execution Implies that code does not have permission to access protected resources, but can execute. Internet Implies that code downloaded from a location and has limited permissions. LocalIntranet Implies that the code holds permissions defined in the default enterprise policy. Everything Implies that the code has all permissions except to skip verification. FullTrust Code has full access to all system resources.
Using Code Access Security in .NET
In this section we will explore how we can use CAS from our applications programmatically. Here is a sample code. Listing 1 private void btnConnectDB_Click(object sender, EventArgs e) { DataSet dsContact = new DataSet(); SqlConnection dbConnection = new SqlConnection( "Server=.;Database=Adventureworks;Trusted_Connection=true"); SqlCommand dbCommand = new SqlCommand("SELECT * FROM Person.Contact", dbConnection); dbConnection.Open(); SqlDataAdapter dataAdapter = new SqlDataAdapter(dbCommand); dataAdapter.Fill(dsContact); dbConnection.Close(); MessageBox.Show(String.Format("{0} Rows fetched from the database.", dsContact.Tables[0].Rows.Count)); } private void btnReadFile_Click(object sender, EventArgs e) { StreamReader sr = File.OpenText(@"D:\Sample.txt"); string content = sr.ReadToEnd(); MessageBox.Show(content); sr.Close(); } private void btnWriteFile_Click(object sender, EventArgs e) { StreamWriter sw = new StreamWriter(@"D:\Sample.txt"); sw.WriteLine("Hello World!"); sw.Close(); } Refer to the code snippet given above. What we are trying to do is an attempt to connect to the database in the click event of the button btnConnectDB, and then we are trying to read and write in the subsequent buttons. Now you need to compile this project with a strong name and then configure the security permissions using the .NET Configuration Tool. In the section that follows we will explore how we can use the .NET Configuration Tool to configure security permissions.
Using the Microsoft .NET Framework 2.0 Configuration Tool
Go to Visual Studio command prompt and type mscorcfg.msc <Enter>. Refer to the screen shot below. Figure 2 When you click on the option "Microsoft .NET Framework 2.0Configuration," you should see the following dialog. Figure 3 Right click on the Permission Sets and select New. Figure 4 Now, enter a name for the permission set and click next. Figure 5 From the available permissions shown in the screen shot above, select one or more permissions and set the required attributes. In our case we will choose SQLClient, File IO, User Interface and Security. Refer to the screen shots below. Figure 6 Figure 7 Figure 8 Figure 9 Observe that we have set permissions for all the selected permissions. Now, click on finish. You should be able to see the following screen. Figure 10 Next, go to the code groups, right click on All_Code and select New. Figure 11 Specify a new to the new code group as shown below. Figure 12 Select the option "Strong Name" as the condition type. Remember that at this stage you should be ready to create a strong key and compiling your project with this key. Once that is done, click the Import button to import the assembly. You will notice that the public key is copied into the box. Refer to the screen shot given below. Figure 13 Then you need to select a permission set from the lost of the permission sets. We shall select the one we had created earlier. Here is the screen shot that illustrates the same. Figure 14 Once that is done, you need to select the first check box in the membership group. This is because permissions will be a union for more than one set of policies. By checking the first check box, we are saying to use only the permissions that we specified. Figure 15 Now, when you try to execute your project, you will see the following exception. This exception is thrown because you do not have permission to access the SqlClient assemblies. Here is the screen shot that illustrates this. Figure 16 Note that we have set the read permissions to the Sample.txt file, but not the write permissions to it. When you click on the next screen, here is the output that you will see. Figure 17 Reckoning of Permissions We have discussed the policy levels and code groups. But, how would the run time calculate the permissions when the code belongs to multiple policies or code groups in the same policy? The run time does it in the following manner. · Initially, the entire All_Code group and all its child code groups are checked for any matching permissions. As said, permissions are identified by evidences. · Then a union of permissions is performed for those identified in various groups. The above procedure is repeated for each policy level and the outcome of permissions at each level are then intersected. Requesting for Permissions You might have encountered a time when you wished to check the permissions for an assembly before actually performing any operations. For instance, you might have a small windows application that reads configuration data from the UI and creates an XML file to store that information. But at the time of saving, the assembly might have not gotten any permission on the C:, and a security exception was thrown. To handle this, CAS provides three approaches which can be applied at the assembly level using declarative syntax. · RequestMinimum · RequestOptional · RequestRefuse RequestMinimum defines the permissions the code requires to execute. For example, the code below makes an attempt to write into a file. If the code does not have any permissions for writing then the assembly will not be loaded. Listing 2 using System.IO; using System.Security; using System.Windows.Forms; using System.Security.Permissions; // This is a declarative security call at assembly level. [FileIOPermissionAttribute(SecurityAction.RequestRefuse, "C:")] namespace DemoApp { public class MyClass { //TODO:.... } } RequestOptional defines permissions that the code can use, but is not necessarily required to execute. In this case the assembly is loaded, but if the required permissions are not set then a security exception is thrown by the run time. RequestRefuse defines a set of permissions that you might never want to grant to the code even though the security policy allows the permissions. Suppose that you need to ensure that you want to read the files and not even accidentally write into those files, then you could use the following. Listing 3 [assembly:FileIOPermission(SecurityAction.RequestRefuse, Write="C:")]
Imperative versus Declarative Security
The code security can be implemented by either using the Declarative Security or the Imperative Security. Let us now understand how these two differ. Declarative Security This is accomplished by placing security attributes at the assembly level, class level or member level. The attribute indicates the request type, overrides and demands. Each permission object has a state data, and this needs to be initialized to use that permission. Also, each permission has an attribute to which the type of security action, which is an enumeration called SecurityAction, is passed to the attribute. In the example below, all the members of the class are restricted accessing the "Program Files" folder. Listing 4 [FileIOPermissionAttribute(SecurityAction.RequestRefuse, "C:\Program Files")] public class RestrictPF { public RestrictPF() { //security call protects the constructor. } public void SomeMethod() { //security call also protects this method. } } If you want to restrict the permission on the assembly level, you can use the following. Listing 5 [assembly: FileIOPermissionAttribute(SecurityAction.RequestRefuse, "C:\Program Files")] If you want to restrict any registry access from the assembly level, you can use the following. Listing 6 [assembly: RegistryPermissionAttribute(SecurityAction.RequestRefuse, Unrestricted = true)] So even though the code runs in an environment that allows access to the registry or perform FileIO operations, the assembly will not be granted any kind of permissions. Imperative Security This kind of security could be used to perform demands and overrides. This helps in situations where you want to check the permissions at runtime. However, this kind of security cannot be used to perform requests. In imperative syntax, a new instance of the security permission object needs to be created before calling. Also, you need to initialize the permission set to invoke a security object. A permission set consists of a group of permissions; initializing a permission group provides a means to perform assert calls on multiple permissions in one method. For this purpose you could use the NamedPermissionSet and PermissionSet classes for grouping of permissions. You can then call the required method to invoke the appropriate security call. Listing 7 public class RestrictPF { public RestrictPF(){} public void SomeMethod() { //Here the FileIOPermissionAttribute is demanded using the imperative syntax. //Method is protected by security call. FileIOPermissionAttribute flsIOPerm = new FileIOPermissionAttribute(); flsIOPerm.Demand(); } public void SomeOtherMethod() { //Method not protected by security call. } }

Developing Custom Controls - Part 1

tcdichvunhadat@gmail.com — Sat, 29 Jan 2011 06:14:00 +1400

Server controls are meant for eliminating redundant code and boosting productivity. They make development tasks easier by hiding their internal details and providing ready to use packaged functionality. There are many controls shipped with ASP.NET that shorten development effort, but there are always opportunities for us to build our own controls to reduce even more development effort. Many times business scenarios create the need of custom controls to simplify development solutions. If you want some reusable functionality in a single application or for few developers and it can be achieved from combining existing web controls then user controls can be a good choice. But when you want to make a piece of functionality reusable and redistributable then custom controls will be the best solution. You can extend some control or make one from scratch or combine multiple ones as per your need. This activity will let you get into the things and will add confidence for bringing novelty and uniqueness into your projects. Most importantly, you will become adept at intrinsic details of the architecture of the dozens of standard controls shipped with ASP.NET. The purpose of these controls is to achieve a different functionality (from the existing server control), a totally new functionality, or a combined functionality of several other existing or new server controls.
Need of a Custom Control
In this article we will examine the need, types and the architecture of custom controls. First of al, you must be aware of your requirement whether or not it really requires a custom control irrespective of the fact you will be able to develop it or not. It might be that the case that can be best handled with user controls. To analyze the need of a custom control you must know what it lacks, if there is some similar control already in the standards controls toolkit. Sometimes you may decide to go for an entirely new control if none of the controls have any functionality that you could inherit. The need of custom controls can be better understood if we learn a little about their types.
Types of Custom Controls
Literally speaking, "a control is custom for user if it fulfills a requirement that can’t be satiated by any standard control." The term custom control becomes vague sometime for the user when there is a parallel term of user controls which are also custom controls in nature, but are created differently. I would like to put light on this ambiguity and will try to resolve it. Yet before this, it is more important to know the types of custom controls and their place in the hierarchy of controls. It is important to know that all controls are server controls i.e. they run at server and are rendered into the appropriate HTML controls at the client's browser. We can make two major level categories of server controls. · Just In Time (JIT) Compiled · Pre Compiled JIT compiled controls are those controls that are embeddable in the source of aspx page and are compiled as per demand i.e. just in time. These controls, directly or indirectly, are inherited from System.Web.UI.WebControls.WebControl or System.Web.UI.Control which let them expose properties and provide events. They are compiled when the page gets compiled by the Framework. The following are the main types of JIT compiled controls. · HTML server controls · Web server controls · Validation controls · User controls Let us take a look on these controls one by one. HTML Server Controls HTML controls support an additional property of “runat.” If this set is to “server,” it runs at server and is accessible in the code behind. Therefore, it is said to be an HTML Server control. Since these controls require less UI support, they are inherited from System.Web.UI.Control. Web Server Controls Web server controls are all standard server side controls that are shipped with ASP.NET. They include simple controls such as Panel and as rich as GridView. The basic purpose of these controls is to minimize the effort required for designing pages or building tools/controls that automatically generate user interface. These controls hide details of their internal working and make the task easier and less erroneous for developers. It is important to know that these controls inherit one of these two classes. System.Web.UI.Control It defines the properties, methods, and events that are common to all web server controls, for example methods and events needed handle the execution lifecycle. This does not support any UI specific feature. The controls that require no UI support inherit this class, such as ASP.NET controls including Literal, Repeater, PlaceHolder and XML. or System.Web.UI.WebControls.WebControl The WebControl class inherits Control class and exposes additional properties and provides methods for UI support. A control that renders some UI should be inherited from WebControl. It is the class which provides UI-related properties such as BackColor, ForeColor, Font, Height, Width, etc. All ASP.NET controls except aforementioned controls inherit this class. Validation Controls These controls are used for validation of the input of other controls of a page/user control. These controls can perform client side, server side or both types of validation. Validation controls inherits the BaseValidator class that implements IValidator interface and inherits Label class, thus they inherit System.Web.UI.WebControls.WebControl indirectly. User Controls Lastly let us have a look at user controls and know how they are different from custom controls. User controls are custom in nature by purpose not by architecture. Development and design-wise they have nothing common with custom controls. They are closer to an aspx page than a custom control. This may be a bit misleading yet we have to take them entirely separate. Their architecture and way of working is entirely different the only thing that is common is they both can fulfill custom needs of a user. The following are the important differences between a user control and a custom control from all aspects.
User Control vs. Custom Control
· A user control inherits System.Web.UI.UserControl class with class hierarchy (bottom up) MyUserControlà UserControlà TemplateControlà Controlà Object. Whereas a custom controls inherits System.Web.UI.Control or System.Web.UI.WebControls.WebControl class with class hierarchy (bottom up) either MyCustomControlà Controlà Object OR MyCustomControlà WebControlà Controlà Object. · A user control has extension .ascx and is JIT compiled, while a custom control is in the form of dynamic linked library (.ddl), thus pre-compiled. · A user control must encapsulate functionality of other web server control(s) through dragging and dropping in design mode. A custom control does not have any design editor. It may or may not inherit functionality of other standard control(s). It can be an entirely new one. · A user control is easy to create because it can be designed like a page is designed i.e. they have design editor and code behind simultaneously while a custom control does not have design editor so is harder to create. · A user control requires registration and instantiation per page and resides on a page as an object and is compiled along with the page. It is not in pre-compiled form whereas a custom control (newly created or extended) is a separate and pre-compiled component. · A user control cannot be registered with Global Assembly Cache (GAC) while a custom control can be registered with GAC, thus giving an advantage of being a framework wide component. A custom control is more reusable because you do not need a separate copy of it for each application; it can automatically be loaded be from the GAC. · A user control is compiled as a part of the same page class while a custom control is compiled as a separate, distinct class. Moreover, any client side logic (html, JavaScript, DOM etc.) is also written programmatically in case of Custom controls. · A user control cannot provide the level of richness that a custom control can provide. It is because custom control’s class is not bound with any design. Here you can take the leverage of the flexibility and richness of .NET programming model; you can expose properties, override functions of the base class and also register complex client side logic in the class. · A user control may fulfill your need if you are working on a single web application while a custom control is the best choice especially when you want to make your controls redistributable, more reusable and make it a Visual Studio IDE aware component. · A user control can use a custom control, but vice versa is not possible.
Custom Server Controls
Now getting specific to custom controls they are Pre Compiled in nature. As mentioned earlier, there three types of custom control with respect of their requirement and way of developing them. Types of custom controls are Extended, Composite and Fully Custom. It is important to note that these categories are not hard and fast. There can be a control that can fall into all three categories simultaneously. It can be a totally new, composite and may have its constituent controls extended, composite or new ones. We will explore them separately. Let us take a look on each of these types with respect to their requirement and development method. Extended If there is a standard web server control that meets most of our requirements and you want it to do few more tasks, then you will go for extended custom control. You will add a few more properties to achieve the desired tasks. For this purpose you extend the existing web server control, letting the new one inherit the full functionality set and behavior of the existing control and adding the required ones. Composite You build a new control combining functionality of two or more existing controls. Suppose you want to build a control named PrimeTester; you would be required to include three standard web server controls to make it accomplished. It will combine functionality of a Textbox, Button and Label. A TextBox for input, a Button to test if it is prime and a Label to show the test result. Many standard web server controls shipped with ASP.NET are of composite nature. A simpler example is ASP.NET CheckBox control. Its gets rendered into two html controls. Say there is the following ASP.NET Checkbox control on the page. Listing 1 <asp:CheckBox id=”checkbox1” runat=”server” Text=”This is simple composite control” … /> If you see the source of the page in the browser, you will notice that it has been rendered into these controls. Listing 2 <input type=”checkbox” id=checkbox1…/> and <Label for=” checkbox1”> This is simple composite control </Label > Since the html control “input” of type checkbox cannot support storing and displaying the contents of Text property of the ASP.NET Checkbox control, the html Label control has been added to keep record of the text of the Checkbox. The “for” property of the html label control keeps the ID of the associated Checkbox. We will see composite custom controls in detail with a working example of a new composite control in Part II of the article. Fully Custom When none of the standard web server controls fulfills your requirements, what you want is entirely different from the functionality of any existing server control. You need to go for an entirely new one that neither extends any of the standard web server controls nor combines functionality of an exiting control. Based on the functionality of a fully custom control, it might have to implement one or more of the interfaces System.Web.UI.INamingContainer, System.Web.UI.IPostBackDataHandler or System.Web.UI.IPostBackEventHandler. We will look on fully custom controls in detail with a working example of a new fully custom control in Part II of the article.
Building an Extended Custom Control
Extending an existing server control is an interesting and a simple job most of the time. I have chosen TextBox control for this purpose. Let us first analyze our need of building an extended TextBox control as we do not want to extend it just for the sake of an example! This analysis can be divided into two parts finding deficiencies to make up and suggesting enhancements that are useful. I emphasize on the analysis so that we can extend it meaningfully and purposefully making it a really useful member of our control tool kit. With inclusion of these properties in our control you will also be able to learn how a custom control can emit HTML and JavaScript as per required. There is a deficiency that really becomes problematic for developers; when the TextMode of the TextBox is set to Multiline, the MaxLength property stops working. We will discuss why it cannot support this. While focusing on enhancements there are several which can be very useful, for example providing a support for entering cased input uppercase or lowercase, numeric, and alphanumeric. A textbox can also be self validating, these enhancements can add a good worth to it. So after a little analysis, we are able to figure out what we want to overcome and what we want to add in our new control. Our new Textbox, ExtendedTextBox, will have the following features. 1. It supports a cased input by providing TextCaseMode property. 2. It supports an input mode for numeric and alphanumeric input by providing InputMode property. 3. It supports MaxLength property when TextMode is set to MultiLine also. 4. It provides built in required field validation by providing IsRequired property. Now getting specific to the implementation, the following are the steps to accomplish all this. 5. First, create a new project of Web Control Library. Please note that VB and Visual C# in Standard Edition do not support the Web Control Library template. It is only available in the professional edition. 6. Give the class some suitable name, in our case ExtendedTextBox, and extend it from its base i.e. TextBox as shown below. Listing 3 [Description("Extended TextBox v1.0 (Developed by Mahr G. Mohyuddin)")] [DefaultProperty("Text")] [ToolboxData("<{0}:ExtendedTextBox runat=server></{0}:ExtendedTextBox1>")] public class ExtendedTextBox : System.Web.UI.WebControls.TextBox { ... You can see the class has been adorned with some attributes, Description, DefaultProperty and ToolboxData. Description attribute keeps the description of the control that is displayed on bringing the ouse over it in the tool box. DefaultProperty is used to bring the given property to focus when the property window of a control is displayed. ToolBoxData is a mandatory attribute that is used to define the look of control declaration in aspx markup when it is dropped on the page. It ensures that the control is given the class name; otherwise it will flag an error. You can also add more attributes like DefaultEvent, which add declaration of the specified event in the code behind when a control is double clicked. ToolBoxItem specifies whether the control should be visible or not; when it is set to True the control is visible and vice versa. ToolBoxBiitmap sepecifies the bitmap image that should be used as the icon for the control and finally ToolBoxItemFilter attribute specifies the filter Visual Studio 2005 uses to determine whether the control should be enabled or disabled for a specific designer. Now, add properties that we need to expose to let the world use features we are going to provide. This includes TextCaseMode, InputMode, IsRequired, and ErrorMessage. Definition of all properties is similar. For instance, TextCaseMode sets the case of the text to be entered. It can be Uppercase, Lowercase or NotSet. We will need an enumeration for this purpose. The following code snippet shows the definition of TextCaseMode property. Listing 4 [Description("Sets the case of the text entered")][Category("Behavior") ][DefaultValue(TextCaseMode.NotSet)] public TextCaseMode TextCaseMode { get { object o = ViewState["TextCaseMode"]; return (o != null ? (TextCaseMode)o: TextCaseMode.NotSet); } set { ViewState["TextCaseMode"] = value; } } The property has been adorned with three attributes: Description, Category and DefaultValue. Use of Description is quite evident. Category attribute takes the name of the category in the property pane of the control in Visual Studio IDE. All properties of a control are organized in Accessibly, Appearance, Behavior, Data, Layout and Misc categories. We want the new property TextCaseMode to be displayed in Behavior category. Another important attribute is DefaultValue which sets a default value,; the specified one, is shown when the no value is set by user. In our case we want the text case mode not to be set by default. Therefore, NotSet has been provided as the default value. This property is of type TextCaseMode enum that has been defined. A property that is of type enum is shown in the form of Dropdownlist in the control property pane. Figure 1 The new properties added to the control have been encircled. You can see that the name with description (provided in Description attribute) of the selected property appears on the bottom of the pane. A value of property is set and retrieved in/from ViewState having name of property of the property as key, since ASP.NET controls save their state through ViewState. Similarly, a custom control should also save its state. In other words, the value of properties exposed by a custom control should be retained on postbacks. It can be possible only if we set the value of a property in ViewState and get from it as shown above. The following code snippet shows the definition of TextCaseMode and InputMode enums. Listing 5 public enum TextCaseMode { UpperCase, LowerCase, NotSet } public enum InputMode { Alphanumeric, Numeric, NotSet } Similarly, define other properties InputMode, IsRequired and ErrorMessage. In short, InputMode property is used to set the mode the text being entered that can either be Numeric, Alphanumeric or NotSet. The enum used has been defined in Listing 3. IsRequired property when set to true makes input in the textbox mandatory and stops all postback until some value is entered. It shows the error, in tooltip, given in ErrorMessage property when the mouse comes over it. The following code snippet shows the definition of the rest of properties. Listing 6 [Description("Sets input mode")][Category("Behavior")][DefaultValue (InputMode.NotSet)] public InputMode InputMode { get { object o = ViewState["InputMode"]; return o != null ? (InputMode)o: InputMode.NotSet; } set { ViewState["InputMode"] = value; } } [Description("Mandates if the text is required")][Category("Behavior") ][DefaultValue(false)] public bool IsRequired { get { object o = ViewState["IsRequired"]; return o == null ? false : true; } set { ViewState["IsRequired"] = value; } } [Description("Displays messages if textbox input is required")][Category( "Behavior")][DefaultValue("")] public string ErrorMessage { get { object o = ViewState["ErrorMessage"]; return o != null ? (string)o: ""; } set { ViewState["ErrorMessage"] = value; } } Since all the features of the control should work on client side we have client side script events to handle this. We have to write JavaScript code that will be emitted by the control as per demanded by the user who specify them through properties. For this purpose we have to override PreRender event of the control so that our new control will be able to add the JavaScript logic before completing the rendering of the control. We will add this code in the overridden PreRender event of the control as the following exhibit shows. Listing 7 protected override void OnPreRender(EventArgs e) { base.OnPreRender(e); string alphaNumeric = "function alphaNumeric(textBox){ " + "if(/[^0-9A-Za-z]/.test(textBox.value)){ " + "textBox.value=textBox.value.replace(/([^0-9A-Za-z])/g,''); " + "textBox.title = ''; " + "} " + " }"; string numeric = "function numeric (textBox){ " + "if(/[^0-9a-z]/.test(textBox.value)){ " + "textBox.value= textBox.value.replace(/([^0-9])/g,''); " + "textBox.title = ''; " + "} " + " }"; ... The code snippet shows that we have called PreRender event of the base class i.e. TextBox and then declared and initialized two string members alphaNumeric and numeric that define javascript methods for respective functionality. I will explain one of them as an example and all upcoming JavasSript code will be quite similar. Please note that we have not registered them yet, that will be done later. We have defined alphaNumeric method that takes the textbox object as parameter and tests it on a regular expression (regExp) object by calling test method. If it is true then call the replace method on the result, that replaces any undesired input char with empty string; it uses again the same regExp object with a global search qualifier g to search the input. You may have noticed that before closing the body of the methods, we have cleared the title property of the textbox which shows an error message as the tooltip when IsRequired is set to True. So on any input we should clear the tooltip. Likewise, define other javascript methods for UppCase,LoweCase, MaxLength and IsRequired features and set the respective string variables so that later could be registered on demand. Listing 8 … string upperCase = "function upperCase(textBox){ " + "if(/[^0-9A-Z]/.test(textBox.value)){ "+ "textBox.value=textBox.value.toUpperCase().replace(/([^0-9A-Z])/g,''); "+ "textBox.title = ''; "+ "} " + "}"; string lowerCase = "function lowerCase(textBox){ " + "if(/[^0-9A-Z]/.test(textBox.value)){ "+ "textBox.value=textBox.value.toLowerCase().replace(/([^0-9A-Z])/g,''); "+ "textBox.title = ''; "+ "} "+ "}"; … UpperCase and lowerCase methods have similar logic, the only change is the input is upper/lower cased by calling string class’s method toUpperCase() and toLowerCase(). Now it is time to register them on the basis of the property set by the user. The user may form any combination of the properties TextCaseMode (UpperCase,Lowercase,NotSet), InputMode (Numeic,AlphaNUmeric,NotSet). For this purpose we have to define another method which will call these methods depending upon the properties’ values. The following code snippet shows this. Listing 9 … string cleintScript = "function extendedTextBox_PropertyChange(xTextBox){"; // method body starts if (this.InputMode == InputMode.Numeric) { Page.ClientScript.RegisterClientScriptBlock(this.GetType(), "numeric", numeric, true); cleintScript += "numeric(xTextBox); "; } if (this.InputMode == InputMode.Alphanumeric) { Page.ClientScript.RegisterClientScriptBlock(this.GetType(), "alphaNumeric", alphaNumeric, true); cleintScript += "alphaNumeric(xTextBox); "; } if (this.TextCaseMode == TextCaseMode.UpperCase) { Page.ClientScript.RegisterClientScriptBlock(this.GetType(), "upperCase", upperCase, true); cleintScript += "upperCase(xTextBox); "; } if (this.TextCaseMode == TextCaseMode.LowerCase) { Page.ClientScript.RegisterClientScriptBlock(this.GetType(), "lowerCase", lowerCase, true); cleintScript += "lowerCase(xTextBox); "; } cleintScript += " }"; // end of method body … We have defined a string variable “clientScript” initialized with the method name; the forthcoming code registers script for a particular method and appends its script, i.e being added in the body of the main work horse method extendedTextBox_PropertyChange. At the end, append the string that closes the body of the method. Now we have to register extendedTextBox_PropertyChange method. The following code snippet not only registers it, but also adds it in the attributes collection of the control for onpropertychange event. We can also use onkeypress event, but using this will notice little elapse in uppercasing and lowercasing the input character. Listing 10 … Page.ClientScript.RegisterClientScriptBlock( this.GetType(), "cleintScript", cleintScript, true); this.Attributes.Add("onpropertychange", "extendedTextBox_ PropertyChange (this);"); … Next, we have defined checkMaxLength method that makes MaxLength property of the textbox working when its TextMode is set to MultiLine. In TextBox control this problem arises when TextBox is MultiLine because in this case it is rendered into “TextArea” html control (<textarea id="ExtendedTextBox1" />) instead of “input control with type text” (<input name="ExtendedTextBox1" type="text" id="ExtendedTextBox1). It is important to know that TextArea control does not support MaxLengh property. Therefore, when we set TextMode property to MultiLine, the MaxLength property stops working. To resolve this problem we have to write some client side logic and make part of the control as shown in the following listing. Listing 11 … string checkMaxLength = "function checkMaxLength(textBox) {" + " if(textBox) { " + " return ( textBox.value.length <" + this.MaxLength + "); " + " } " + "} "; if (this.TextMode == TextBoxMode.MultiLine) { Page.ClientScript.RegisterClientScriptBlock( this.GetType(), "checkLength", checkMaxLength, true); this.Attributes.Add("onkeypress", "return checkMaxLength(this);"); } It checks and returns true if the length of input is less than or equal to the value of MaxLength property and false if vice versa. Then we have to register it as usual and add in the attributes collection of the control for onkeypress event. Now, there is another very important feature added in the new textbox control. It mandates the input if specified using the IsRequired property. The implementation of this is simple, we have to handle form’s client side onSubmit event as shown in following code. Listing 12 … if (this.IsRequired == true) { this.Page.Form.Attributes.Add("onSubmit", "if(" + this.ClientID + ".value==''){"+ this.ClientID + ".title = '" + this.ErrorMessage + "';"+ "return false;} "+ "else{ " + this.ClientID + ".title = ''; "+ " return true;}"); } } // end of PreRender Instead of making a separate method, the handler for onSubmit has been added directly in the attributes collection of the control. It checks if IsRequired property is set to True then sets the title property (used for tooltip) of control with the error message given by the user in ErrorMessage property and return false, otherwise clears the title property and return true i.e. allows postbacks. When IsRequired property is set to True, it performs the required field validation, stops all postabacks and shows the error message in tooltip when the mouse is brought over the control. The Following figure shows this.

Role Based Forms Authentication in ASP.NET 2.0

tcdichvunhadat@gmail.com — Sat, 29 Jan 2011 06:11:00 +1400

Using Role based forms authentication, we can restrict users of the site to accessing certain resource if they are not part of a particular role. In this article, Satheesh demonstrates how to build sites with this type of authentication. He provides a short overview of various Login Controls and Providers and then discusses a scenario with detailed explanation of various aspects of the sample application with screenshots and source code.

Any ASP.NET site we develop will always have an authentication module unless and until there is nothing private on the site or something we explicitly know as being unnecessary. For instance, a simple public content site will not require an authentication module. Depending on the nature of the application we can decide on the type of authentication we are going to provide for our site. Meaning, if it is going to be an intranet web application, we can very well utilize the windows authentication by making use of the availability of user information in the AD, thus preventing a separate user information storage private to our application. Still, role mapping to the users has to be stored privately for the application. If our application is an internet application then the best choice is to use Forms Authentication. This article will explore the implementation forms authentication with roles in ASP.NET 2.0. From 1.x days, the implementation of forms authentication in ASP.NET is not that complicated. But the actual drawbacks are in those days ASP.NET itself does not have that many controls that aid in implementing forms authentication easily. Also, if we have role based forms authentication then we should go for our custom code for validating a resource access. With the introduction of 2.0 we have a handful of controls that help in implementing role based forms authentication very easily with the primary support of Providers in ASP.NET 2.0.
Who Process the FormsAuthentication?
Forms authentication is processed by a HTTP module called FormsAuthenticationModule which takes part in regular ASP.NET page processing.
Login Controls and Providers
As I said earlier, ASP.NET 2.0 is packed with set of new controls called Login controls through which we can implement forms authentication with less effort. This section will take us through how best to use these Login controls in our projects. By default, Login controls will use the default membership provider and role provider which will have their own database schema. So, it is not advisable to use this controls as it is because enterprise applications itself will have its own database schema and architecture. The solution for this problem is to develop our own custom provider or our own custom code that solves our application specific requirements. However, we can still use some of the login controls, like LoginView, LoginName and LoginStatus, in our applications. In this article I will explain our subject matter with a custom implemented login form without using any login control on it. Also, we will have a look on how to use some of the login controls effectively with role based forms authentication. Moving forward, I will explain a sample scenario where we can use role based forms authentication and will use the same scenario throughout this article for easy understanding.
Scenario
Consider we are creating a content management system where users can login and post their contents. The posted contents will be moderated by the administrator of the site. Meaning, Administrator can either approve or reject the content posted by the user. The posted content can be viewed by anyone once it is approved by the admin. In this scenario we can have 2 roles defined, namely Admin and Publishers. The sample application attached with this article uses the same scenario explained in this article.
Application Structure
Our application will have two folders called Admin and Publisher as shown in the figure below (Figure 1 – Sample Application Solution). Admin folder will have all the ASPX pages that are put together to form the Admin module while the Publisher folder will have all the ASPX pages for Publisher module. Figure 1 – Sample Application Solution
Configuring Forms Authentication
As we all know, this is done in Web.config by changing the value of <authentication> tag. Listing 1 <authentication mode="Forms"> <forms loginUrl="Login.aspx" name=".ASPXAUTH" protection="All"> </forms> </authentication> The default timeout for forms authentication is 30 minutes. It indicates that 30 minutes of inactivity on the application will cause timeout expiration and the user will be prompted to the login page. Any hit to the site after login will reset this clock to 30 minutes again starting from that time. If we want to override this setting then we can include this in the above <forms> tag. See MSDN for a full list of attributes that can be specified in this tag. After configuring forms authentication we need to configure the authorization part of the Web.Config. Listing 2 <authorization> <allow users="*"/> </authorization> The above setting says it will allow all the users because the posted content should be viewed by anyone as I said in the Scenario section. The next section will explain the configuration settings to restrict users accessing the pages in Admin and Publisher folders.
Controlling Access to Roles
This is done by <Location> tag in Web.Config file. Listing 3 <location path="ADMIN"> <system.web> <authorization> <allow roles="ADMIN"/> <deny users=""/> </authorization> </system.web> </location> <location path="Publishers"> <system.web> <authorization> <allow roles="PUBLISHER,ADMIN"/> <deny users=""/> </authorization> </system.web> </location> The above setting will restrict users trying to access the Admin section and Publisher section until they are part of that role and allow users who are already part of the roles.
Constructing Login Form
Construct a login form that has a textbox for entering user ID and password, and a button for login with an optional Remember me checkbox. On Login button click do the following steps. 1. Create Forms Authentication ticket. Listing 4 – FormsAuthentication ticket syntax FormsAuthenticationTicket ticket = new FormsAuthenticationTicket( int version, string userName, DateTime CreationTime, DateTime Expiration, bool IsPersistent, string UserData, string CookiePath); 2. User’s role information can be specified in UserData in the above argument list. 3. Encrypt the above created ticket through following method in FormsAuthentication class. Listing 5 - Encrypt Ticket string Encrypt(FormsAuthenticationTicket ticket); 4. It returns a string containing an encrypted forms-authentication ticket suitable for use in an HTTP cookie. 5. Create the cookie with the encrypted. 6. Add the created cookie to the response object. 7. The below code Listing 6 shows the implementation of the above steps. Listing 6 - Login Event protected void btnLogin_Click(object sender, EventArgs e) { User _user = new User(); DBOperations dbo = new DBOperations(); _user = dbo.CheckUser(txtUserid.Text); if (_user != null) { if (_user.Password == txtPassword.Text) { FormsAuthenticationTicket Authticket = new FormsAuthenticationTicket(1, txtUserid.Text, DateTime.Now, DateTime.Now.AddMinutes(30), chkRememberMe.Checked, _user.Role, FormsAuthentication.FormsCookiePath); string hash = FormsAuthentication. Encrypt(Authticket); HttpCookie Authcookie = new HttpCookie (FormsAuthentication.FormsCookieName, hash); if (Authticket.IsPersistent) Authcookie.Expires = Authticket.Expiration; Response.Cookies.Add(Authcookie); string returnUrl = Request.QueryString["ReturnUrl"]; if (returnUrl == null) returnUrl = "/"; Response.Redirect(returnUrl); } else { lblMessage.Text = "Password does'nt match."; } } else { lblMessage.Text = "User not exists."; } } Since the user information is stored as encrypted value in the cookie we need to construct the decrypted version of our credentials for every request and assign it to the Context object. This is done to make the user information available on the pages. The FormsAuthentication module will decrypt the forms authentication ticket in the cookie and make it available through the property HttpContext.Current.User.Identity. A new GenericPrincipal object should be constructed and assigned to the User property of Context object. This has to be done in Application_AuthenticateRequest event in Global.asax file. By default, there will be no Global.asax file added to our solution if you use visual studio 2005 so we need to add it explicitly through "Add new Item." Listing 7 - Application Authenticate Event protected void Application_AuthenticateRequest(Object sender, EventArgs e) { if (HttpContext.Current.User != null) { if (HttpContext.Current.User.Identity.IsAuthenticated) { if (HttpContext.Current.User.Identity is FormsIdentity) { FormsIdentity id = (FormsIdentity)HttpContext.Current.User.Identity; FormsAuthenticationTicket ticket = id.Ticket; string userInfo = ticket.UserData; string[]roles = userInfo.Split(','); HttpContext.Current.User = new GenericPrincipal(id, roles); } } } } We need to import System.Security.Principal namespace to the Global.asax file for the above code to work. Listing 8 - Import Namespace <%@ Import Namespace="System.Security.Principal" %>
Adding Remember Me Option
In the above code the line that creates FormsAuthentication ticket has an argument for specifying cookie as a persistent or non persistent cookie. This attribute is the one that is used for "Remember Me" option in Login pages. Include a Checkbox beneath the password textbox in the login page and assign the Checked property of the checkbox as the value for the above said argument. We have completed creating a simple site with role based forms authentication. Now when we run our application, users with admin role can access the resources in admin section publisher section. A user with a publisher role cannot access admin resources while he can access the Publisher section. In the next section we will see how to use the LoginView control to show and hide a group of controls on a page.
Using LoginView Control with Roles
[ Back To Top ] It can be used to show or hide a group of control or content based on the user login status. Below is the syntax of using it. Listing 9 - LoginView Control <asp:LoginView ID="LoginView1" runat="server"> <LoggedInTemplate> </LoggedInTemplate> <AnonymousTemplate> </AnonymousTemplate> </asp:LoginView> Things inside <LoggedInTemplate> will be exposed only if the user is already logged in where the things in <AnonymousTemplate> will be visible even if the user is not logged in. For example, if we want to display or hide controls based on the user's role then this control is a champion of doing it with very little effort. Consider we have an error page that reports the error to the users. If we want to hide the technical error message to all the users and show the technical error message only for the users with ADMIN role then we can use LoginView control to achieve this requirement. Refer to the below code for the implementation. Listing 10 - LoginView Control With Roles <asp:LoginView ID="loginview" runat="server"> <RoleGroups> <asp:RoleGroup Roles="ADMIN"> <ContentTemplate> <b>Technical Information:</b><%= TechnicalErrorMsg %> </ContentTemplate> </asp:RoleGroup> </RoleGroups> </asp:LoginView> The above code will display the technical error messages only to the users with ADMIN Role. We can also achieve the above with the following code. Listing 11 - Role Chech In Code if (User.IsInRole("ADMIN")) lblMessage.Text = TechnicalErrorMsg; The next sections will describe some of the common problems that we will come across when we use FormsAuthentication and the workarounds to those problems.
Redirecting user to NotAuthorized page
When a user who does not belong to admin role is already logged in and has tried accessing the admin section, unfortunately he will be again forwarded to the Login page. Refer to Figure 2. Figure 2 – NotAuthorized Problem Instead, if a "Not authorized" page is displayed, it will be more appropriate for this scenario. We can achieve this by redirecting the user to NotAuthorized page by including the below code in Page_Load event of Login page. Listing 12 - Not Authorized Page Redirection if (User.Identity.IsAuthenticated && Request.QueryString["ReturnUrl"] != null) { Response.Redirect("NotAuthorized.aspx"); } The above code checks whether the user is authenticated and ReturnUrl is not null through which we can confirm that the user is trying to access a resource which he does not have access after authenticating.
FormsAuthentication.SignOut() doesnot reflect in LoginStatus and LoginName
Suppose, if we have a password reset feature in our ASP.NET site then the user should be forced to logged out once he chooses the new password, and clicked save. He should be asked to login again and verify the new password. When a user is already logged in, he can reach the form PasswordReset.aspx and he can choose the new password. When the user types in the new password and clicks save, the user is logged off by calling SignOut() method of FormsAuthentication object. Refer to the code below. Listing 13 - FormsAuthentication Signout Problem int res = userDAO.ResetPassword(User.Identity.Name, txtOldPassword.Text, txtConfirmPassword.Text); lblMessage.Text = SUCCESSMSG; FormsAuthentication.SignOut(); The actual problem is here. After the password reset is successful the above code will log out the user as planned. But the LoginStatus and LoginName controls on the page will still show the status of the user as logged in as seen in Figure 3. Figure 3 – Signout Problem When the form is refreshed or for the subsequent server trip the status of the user that is displayed on the form will be successfully changed to logged out. The cause for this problem is even after the FormsAuthentication.SignOut(); line execution the context information of the current request will still hold the logged in user information. On executing the line Context.User.Identity.Name, the signout code will still give the logged in user information and thus LoginStatus control will not reflect the logout change. From the next request Context.User.Identity.Name will have no value in it which will make the login control to behave correctly. The work around for the above problem will be making the User attribute of Context object to null. The final code is: Listing 14 - FormsAuthentication Signout Problem Resolution int res = userDAO.ResetPassword(User.Identity.Name, txtOldPassword.Text, txtConfirmPassword.Text); lblMessage.Text = SUCCESSMSG; FormsAuthentication.SignOut(); Context.User = null; The other way of solving this problem is by redirecting the user to the login page after changing the password. But you need to have some logic to notify the user that the password is successfully changed.

How to add and remove cookie with JQuery

tcdichvunhadat@gmail.com — Wed, 05 Jan 2011 20:08:00 +1400

// Get the cookie:

$.cookie('myCookie');

// Set or update the cookie:

$.cookie('myCookie', 'myCookieValue');

// Delete a cookie:

$.cookie('sampleCookie', null);

Active Directory - check if a user exists - C#.

tcdichvunhadat@gmail.com — Wed, 05 Jan 2011 20:03:00 +1400

This code snippet, shows how to query active directory and search if a specific username exists.

DirectoryEntry directoryEntry = new DirectoryEntry();
directoryEntry.Path = "LDAP://OU=Domain,DC=DomainToSearch,DC=com";
DirectorySearcher directoryEntrySearch = new DirectorySearcher();

directoryEntrySearch.SearchRoot = directoryEntry;
directoryEntrySearch.Filter = "(&(objectClass=user) (cn=" + username + "))";

SearchResultCollection results = directoryEntrySearch.FindAll();

(results.Count > 0) ? Console.WriteLine("Found") : Console.WriteLine("Not Found");

ASP.NET MVC - writing HTML Helper for creating image link html tag in C#.

tcdichvunhadat@gmail.com — Wed, 05 Jan 2011 20:02:00 +1400

It is very common when you need to use HTML helper in ASP.NET MVC framework to create an image link.
The default set of HTML helpers do not include such HtmlHelper.
This code shows how to write HTML Helper for linking image or just the image tag.

public static string ImageLink(this HtmlHelper htmlHelper, string imgSrc, string alt, string actionName, string controllerName, object routeValues, object htmlAttributes, object imgHtmlAttributes) { UrlHelper urlHelper = ((Controller)htmlHelper.ViewContext.Controller).Url; string imgtag = htmlHelper.Image(imgSrc, alt, imgHtmlAttributes); string url = urlHelper.Action(actionName, controllerName, routeValues); TagBuilder imglink = new TagBuilder("a"); imglink.MergeAttribute("href", url); imglink.InnerHtml = imgtag; imglink.MergeAttributes(new RouteValueDictionary(htmlAttributes), true); return imglink.ToString(); }

and the image tag:

public static string Image(this HtmlHelper htmlHelper, string imgSrc, string alt, object imgHtmlAttributes) { TagBuilder imgTag = new TagBuilder("img"); imgTag.MergeAttribute("src", imgSrc); imgTag.MergeAttribute("alt", alt); imgTag.MergeAttributes(new RouteValueDictionary(imgHtmlAttributes), true); return imgTag.ToString(); }

C# Split String Examples

tcdichvunhadat@gmail.com — Wed, 22 Dec 2010 05:47:00 +1400

You want to split strings on different characters with single character or string delimiters. For example, split a string that contains "\r\n" sequences, which are Windows newlines. Through these examples, we learn ways to use the Split method on the string type in the C# programming language.

Use the Split method to separate parts from a string.
If your input string is A,B,C --
Split on the comma to get an array of:
"A" "B" "C"

Using Split

To begin, we look at the basic Split method overload. You already know the general way to do this, but it is good to see the basic syntax before we move on. This example splits on a single character.

=== Example program for splitting on spaces (C#) ===

using System;

class Program
{
    static void Main()
    {
        string s = "there is a cat";
        //
        // Split string on spaces.
        // ... This will separate all the words.
        //
        string[] words = s.Split(' ');
        foreach (string word in words)
        {
            Console.WriteLine(word);
        }
    }
}

=== Output of the program ===

there
is
a
cat

Description. The input string, which contains four words, is split on spaces and the foreach loop then displays each word. The result value from Split is a string[] array.

Multiple characters

Here we use either the Regex method or the C# new array syntax. Note that a new char array is created in the following usages. There is an overloaded method with that signature if you need StringSplitOptions, which is used to remove empty strings.

=== Program that splits on lines with Regex (C#) ===

using System;
using System.Text.RegularExpressions;

class Program
{
    static void Main()
    {
        string value = "cat\r\ndog\r\nanimal\r\nperson";
        //
        // Split the string on line breaks.
        // ... The return value from Split is a string[] array.
        //
        string[] lines = Regex.Split(value, "\r\n");

        foreach (string line in lines)
        {
            Console.WriteLine(line);
        }
    }
}

=== Output of the program ===

cat
dog
animal
person

StringSplitOptions

While the Regex type methods can be used to Split strings effectively, the string type Split method is faster in many cases. The Regex Split method is static; the string Split method is instance-based. The next example shows how you can specify an array as the first parameter to string Split.

=== Program that splits on multiple characters (C#) ===

using System;

class Program
{
    static void Main()
    {
        //
        // This string is also separated by Windows line breaks.
        //
        string value = "shirt\r\ndress\r\npants\r\njacket";

        //
        // Use a new char[] array of two characters (\r and \n) to break
        // lines from into separate strings. Use "RemoveEmptyEntries"
        // to make sure no empty strings get put in the string[] array.
        //
        char[] delimiters = new char[] { '\r', '\n' };
        string[] parts = value.Split(delimiters, StringSplitOptions.RemoveEmptyEntries);
        for (int i = 0; i < parts.Length; i++)
        {
            Console.WriteLine(parts[i]);
        }

        //
        // Same as the previous example, but uses a new string of 2 characters.
        //
        parts = value.Split(new string[] { "\r\n" }, StringSplitOptions.None);
        for (int i = 0; i < parts.Length; i++)
        {
            Console.WriteLine(parts[i]);
        }
    }
}

=== Output of the program ===
    (Repeated two times)

shirt
dress
pants
jacket

Overview. One useful overload of Split receives char[] arrays. The string Split method can receive a character array as the first parameter. Each char in the array designates a new block.

Using string arrays. Another overload of Split receives string[] arrays. This means string array can also be passed to the Split method. The new string[] array is created inline with the Split call.

Explanation of StringSplitOptions. The RemoveEmptyEntries enum is specified. When two delimiters are adjacent, we end up with an empty result. We can use this as the second parameter to avoid this. The following screenshot shows the Visual Studio debugger.

See StringSplitOptions Enumeration.

Separating words

Here we see how you can separate words with Split. Usually, the best way to separate words is to use a Regex that specifies non-word chars. This example separates words in a string based on non-word characters. It eliminates punctuation and whitespace from the return array.

=== Program that separates on non-word pattern (C#) ===

using System;
using System.Text.RegularExpressions;

class Program
{
    static void Main()
    {
        string[] w = SplitWords("That is a cute cat, man");
        foreach (string s in w)
        {
            Console.WriteLine(s);
        }
        Console.ReadLine();
    }

    /// <summary>
    /// Take all the words in the input string and separate them.
    /// </summary>
    static string[] SplitWords(string s)
    {
        //
        // Split on all non-word characters.
        // ... Returns an array of all the words.
        //
        return Regex.Split(s, @"\W+");
        // @      special verbatim string syntax
        // \W+    one or more non-word characters together
    }
}

=== Output of the program ===

That
is
a
cute
cat
man

Word splitting example. Here you can separate parts of your input string based on any character set or range with Regex. Overall, this provides more power than the string Split methods.

See Regex.Split Method Examples.

Splitting text files

Here you have a text file containing comma-delimited lines of values. This is called a CSV file, and it is easily dealt with in the C# language. We use the File.ReadAllLines method here, but you may want StreamReader instead. This code reads in both of those lines, parses them, and displays the values of each line after the line number. The final comment shows how the file was parsed into the strings.

=== Contents of input file (TextFile1.txt) ===

Dog,Cat,Mouse,Fish,Cow,Horse,Hyena
Programmer,Wizard,CEO,Rancher,Clerk,Farmer

=== Program that splits lines in file (C#) ===

using System;
using System.IO;

class Program
{
    static void Main()
    {
        int i = 0;
        foreach (string line in File.ReadAllLines("TextFile1.txt"))
        {
            string[] parts = line.Split(',');
            foreach (string part in parts)
            {
                Console.WriteLine("{0}:{1}",
                    i,
                    part);
            }
            i++; // For demo only
        }
    }
}

=== Output of the program ===

0:Dog
0:Cat
0:Mouse
0:Fish
0:Cow
0:Horse
0:Hyena
1:Programmer
1:Wizard
1:CEO
1:Rancher
1:Clerk
1:Farmer

Splitting directory paths

Here we see how you can Split the segments in a Windows local directory into separate strings. Note that directory paths are complex and this may not handle all cases correctly. It is also platform-specific, and you could use System.IO.Path. DirectorySeparatorChar for more flexibility.

See Path Examples.

=== Program that splits Windows directories (C#) ===

using System;

class Program
{
    static void Main()
    {
        // The directory from Windows
        const string dir = @"C:\Users\Sam\Documents\Perls\Main";
        // Split on directory separator
        string[] parts = dir.Split('\\');
        foreach (string part in parts)
        {
            Console.WriteLine(part);
        }
    }
}

=== Output of the program ===

C:
Users
Sam
Documents
Perls
Main

Internal logic

The logic internal to the .NET framework for Split is implemented in managed code. The methods call into the overload with three parameters. The parameters are next checked for validity. Finally, it uses unsafe code to create the separator list, and then a for loop combined with Substring to return the array.

Benchmarks

I tested a long string and a short string, having 40 and 1200 chars. String splitting speed varies on the type of strings. The length of the blocks, number of delimiters, and total size of the string factor into performance. The Regex.Split option generally performed the worst. I felt that the second or third methods would be the best, after observing performance problems with regular expressions in other situations.

=== Strings used in test (C#) ===
//
// Build long string.
//
_test = string.Empty;
for (int i = 0; i < 120; i++)
{
    _test += "01234567\r\n";
}
//
// Build short string.
//
_test = string.Empty;
for (int i = 0; i < 10; i++)
{
    _test += "ab\r\n";
}

=== Example methods tested (100000 iterations) ===

static void Test1()
{
    string[] arr = Regex.Split(_test, "\r\n", RegexOptions.Compiled);
}

static void Test2()
{
    string[] arr = _test.Split(new char[] { '\r', '\n' }, StringSplitOptions.RemoveEmptyEntries);
}

static void Test3()
{
    string[] arr = _test.Split(new string[] { "\r\n" }, StringSplitOptions.None);
}

Longer strings: 1200 chars. The benchmark for the methods on the long strings is more even. It may be that for very long strings, such as entire files, the Regex method is equivalent or even faster. For short strings, Regex is slowest, but for long strings it is very fast.

=== Benchmark of Split on long strings ===

[1] Regex.Split:    3470 ms
[2] char[] Split:   1255 ms [fastest]
[3] string[] Split: 1449 ms

=== Benchmark of Split on short strings ===

[1] Regex.Split:     434 ms
[2] char[] Split:     63 ms [fastest]
[3] string[] Split:   83 ms

Short strings: 40 chars. This shows the three methods compared to each other on short strings. Method 1 is the Regex method, and it is by far the slowest on the short strings. This may be because of the compilation time. Smaller is better. This article was last updated for .NET 3.5 SP1.

Performance recommendation. For programs that use shorter strings, the methods that split based on arrays are faster and simpler, and they will avoid Regex compilation. For somewhat longer strings or files that contain more lines, Regex is appropriate. Also, I show some Split improvements that can improve your program.

See Split String Improvement.

Escaped characters

Here we note that you can use Replace on your string input to substitute special characters in for any escaped characters. This can solve lots of problems on parsing computer-generated code or data.

See Split Method and Escape Characters.

Delimiter arrays

In this section, we focus on how you can specify delimiters to the Split method in the C# language. My further research into Split and its performance shows that it is worthwhile to declare your char[] array you are splitting on as a local instance to reduce memory pressure and improve runtime performance. There is another example of delimiter array allocation on this site.

See Split Delimiter Use.

=== Slow version, before (C#) ===

//
// Split on multiple characters using new char[] inline.
//
string t = "string to split, ok";

for (int i = 0; i < 10000000; i++)
{
    string[] s = t.Split(new char[] { ' ', ',' });
}

=== Fast version, after (C#) ===

//
// Split on multiple characters using new char[] already created.
//
string t = "string to split, ok";
char[] c = new char[]{ ' ', ',' }; // <-- Cache this

for (int i = 0; i < 10000000; i++)
{
    string[] s = t.Split(c);
}

Interpretation. We see that storing the array of delimiters separately is good. My measurements show the above code is less than 10% faster when the array is stored outside the loop.

get extension of downloaded file

tcdichvunhadat@gmail.com — Sun, 05 Dec 2010 21:30:00 +1400

class Program
{
    static void Main()
    {
        string p = @"C:\Users\Sergio\Documents\Test.txt";

        string e = Path.GetExtension(p);
        if (e == ".txt")
        {
            Console.WriteLine(e);
        }
    }
}