See Sharp With ASP.Net

Top Ten Errors Java Programmers Make

2011-04-03T03:54:00.002+06:00

I found a wonderful article while I was tracing an error in my code. Here is the article Top Ten Errors Java Programmers Make. Can you believe, I did the number one error among the listed top ten errors!!! :(

According to the author, Below are the top ten mistakes that java programmer do while they do coding. So look at them and stop doing the same error again and again :)

10. Accessing non-static member variables from static methods (such as main)
9. Mistyping the name of a method when overriding
8. Comparison assignment ( = rather than == )
7. Comparing two objects ( == instead of .equals)
6. Confusion over passing by value, and passing by reference
5. Writing blank exception handlers
4. Forgetting that Java is zero-indexed
3. Preventing concurrent access to shared variables by threads
2. Capitalization errors
1. Null pointers!

For details, please visit the original article.

Happy programming!

Unable to evaluate expression because the code is optimized or a native frame is on top of the call stack

2011-03-04T03:30:00.003+06:00

Suddenly I am getting the error "Unable to evaluate expression because the code is optimized or a native frame is on top of the call stack" from my asp.net application. After spending sometimes online, I found the following cause and solution for the error. Hope the solution might help you, if you are facing the same problem.

Error: Unable to evaluate expression because the code is optimized or a native frame is on top of the call stack

Cause: If you use either Response.Redirect or Server.Transfer method, you may face this problem. I was calling Response.Redirect method inside the Try...Catch block. This happens because both methods call Response.End internally.

Solution: Pass "false" to endResponse parameter of Response.Redirect method

Response.Redirect ("xyz.aspx", false);

Thats it. Simple.

Happy programming!

Celebrate the Release of Windows 7 at IDB Auditorium, Dhaka

2009-10-27T09:23:00.003+07:00

Celebrate the release of Windows 7 in the biggest launch party ever!

Who can come: Anyone who uses a computer @ home/work.

Entry Fee: ~~50 BDT per person~~
Updated- No entry fee needed (Seats Limited).

Date: Saturday, November 7, 2009

Time: 10:30am - 1:00pm

Location:

IDB Auditorium, IDB Bhaban
E/8-A Rokeya Sarani, Sher-E-Bangla Nagar
Dhaka, Bangladesh

To register visit: http://bd.merawindows.com

Windows 7 community members will be able to install evaluation copy of Windows 7 on the event. Guest are encouraged to come with their laptop.

Proposed Agenda:

Introduction to Windows 7 (Presentation)
Demonstrate Live Windows 7 (Live Demo)
Introduction to IE 8 (Presentation and Live)
Demonstrate Windows Live (Presentation)
Windows 7 installation on interested audience's laptop
Small Quiz and distribute small gifts to the participants/winners

Note: Seats are limited so register and confirm your participation. Do hurry!

Hope everybody will enjoy the party.

I am going to Mars!!! Do you want to go?

2009-10-25T13:25:00.004+07:00

Ha Ha Ha. This is very interesting. I am going to mars!!! Oops... Not me but my name. LOL. I have found in Nasa's website that they are asking name from people and the name will be included with others on a microchip on the Mars Science Laboratory rover heading to Mars in 2011! I’ve entered my information at Nasa's website and received a certificate of participation which you are seeing in the picture here. It can be viewable from their website here too. So I am going... Oops my name is going at least :). Do you want to go with me? then register your name in their website.

Hope we will enjoy the journey :D

Why microsoft sharepoint is so popular and is going to be more popular in future?

2009-06-11T17:53:00.001+06:00

Recently I have started working on sharepoint server 2007. There are many reasons to love this application. I wanted to share some of our findings regarding sharepoint. Hope it will help you to take the right decision.

Top Ten Reasons Behind the Popularity of Sharepoint

There are many reasons behind the popularity of Microsoft sharepoint server. All the details can be found in sharepoint official site . Also I have found some important discussion here too. However, according to my point of view, following are main 10 reasons behind the popularity of sharepoint server:

1. Very easy to use as collaboration platform as it needs browser to access the server
2. Instantly create sites from predefined template
3. Share documents and tracking them with role based security
4. Use as a easy project management tool( manage lists, todo, share files, etc)
5. Plug and play webparts
6. Integrate with microsoft most popular product microsoft office
7. Work from internet as well as intranet
8. Integrated task calendar with microsoft outlook. so accessible from outlook directly
9. Connect developer, manager and client in one platform
10. Document versioning and sharepoint designer support to open and edit sharepoint site

isn't it enough to be popular sharepoint :)

Sharepoint Installation

Sharepoint installation is very easy and straight forward. If anybody is interested then can follow the procedure below:

1. First of all download the WSS 3.0 from the following location- its good for beginner or you can buy MOOS2007(Microsoft Office Sharepoint Server 2007)

http://www.microsoft.com/downloads/details.aspx?FamilyId=D51730B5-48FC-4CA2-B454-8DC2CAF93951&displaylang=en

Maintain the following sequence in a windows 2003 server. If you don't have windows server 2003, you can try with virtual pc or vmware what I am doing now

2. Install IIS

3. Install .net framework 2.0/+

4. Configure server

5. Install WSS

At the final step of installation you will get the link of the server to access. Wish you will enjoy your time with sharepoint.

Happy programming!

Make Understand IE6 About 'position:fixed'

2009-01-22T13:54:00.001+06:00

Many times we need to use fixed position along with relative, static and absolute position in style sheet, specially in AJAX progress bar. Now question is what it does actually? To show the longer content of a web page, browser use scroll bar which can make your progress message out of the sight. Specially, while we update at the bottom of the ajax update panel, user might not notify about the waiting message or update message. We can easily fix the problem by using 'position: fixed' in CSS. But problem is IE6 or older version of IE, don't understand this. To make it understand on this particular style, we need to write a little javascript code in the CSS. Let see that simple code below:

.updateProgress

     {

       background-color:#CF4342;

       color:White;

       position: absolute; 

       top: expression(0+((e=document.documentElement.scrollTop)?e:document.body.scrollTop)+'px'); 

       right: expression(0+((e=document.documentElement.scrollLeft)?e:document.body.scrollLeft)+'px');}

     }

Now for cross browser support let see the full code below:

<style type="text/css"> 

        .updateProgress 

        { 

            background-color: #CF4342; 

            color: White; 

            top: 0px; 

            right: 0px; 

            position: fixed; 

        } 

        .updateProgress img 

        { 

            vertical-align: middle; 

            margin: 2px; 

        } 

    </style> 

    <!--[if gte IE 5.5]> 

    <![if lt IE 7]> 

    <style type="text/css"> 

    .updateProgress 

     { 

       background-color:#CF4342; 

       color:White; 

       position: absolute; 

       top: expression(0+((e=document.documentElement.scrollTop)?e:document.body.scrollTop)+'px'); 

       right: expression(0+((e=document.documentElement.scrollLeft)?e:document.body.scrollLeft)+'px');} 

     } 

    .updateProgress img { 

       vertical-align:middle; 

       margin:2px; 

     } 

    </style> 

    <![endif]> 

<![endif]-->

That’s all. Enjoy Programming!

Document Security Over IIS Using Form Authentication

2008-09-15T01:51:00.001+06:00

We all rely on asp.net authorization technique to protect our forms from anonymous access. But what about documents like pdf, images or other type of documents? By default, if anybody type the direct URL of a document in the browser’s address bar then IIS6 permit them to see the physical document without checking the authentication permission. Its a big threat for secured web-site. To solve the issue, we have to configure IIS such a way so that aspnet_isapi.dll take the control to show the document while request will come. Here is what it can be done:

1. Right click on the virtual directory which need to be secured and select property. From the opened dialogue box select Virtual Directory tab and click on configuration button. Now add a new configuration with the following settings

Executable: aspnet_isapi.dll location

Extension: document extension (like .pdf)

Verbs: GET

2. Add Location path to web.config file

<system.web>

</authorization>

</system.web>

</location>

That’s it. You are done. Now if you want that the document will be handle by custom code for extra security then you can add a entry in the http handler in the following way:

1. Add a entry to httphandlers section to handle the file type for extra security in web.config file

</httpHandlers>

2. And create a custom class to App_Code following way:

Public Class PdfHandler

Implements IHttpHandler

Public Sub New()

End Sub

Public Sub ProcessRequest(ByVal context As HttpContext) Implements IHttpHandler.ProcessRequest

Dim path As String = context.Request.PhysicalPath

Dim name As String = path.Split("\"c)(path.Split("\"c).Length - 1)

If Not String.IsNullOrEmpty(path) AndAlso path.ToLower().EndsWith(".pdf") Then

context.Response.ClearHeaders()

context.Response.ClearContent()

context.Response.Clear()

context.Response.Charset = Nothing

context.Response.ContentType = "application/pdf"

context.Response.AddHeader("Content-Type", "application/pdf")

context.Response.AppendHeader("Content-Disposition", String.Format("inline;filename={0}", name))

context.Response.WriteFile(path)

Else

Throw New FileNotFoundException("The page requested is invalid", path)

End If

End Sub

Public ReadOnly Property IsReusable() As Boolean Implements IHttpHandler.IsReusable

Get

Return False

End Get

End Property

End Class

Note: You can replace the above code with your custom requirements.

Happy Programming!

Advantage and Disadvantage of Using XML and XSLT

2008-09-15T00:58:00.001+06:00

After getting request from few of my blog readers, I am here to describe some major advantages and disadvantages of using XML and XSLT:

Advantages:

1. XSLT applies user defined transformations to an XML document and the output can be HTML, XML, or any other structured document. So it is easy to merge XML data into presentation.

2. XPath used by XSLT to locate elements/attribute within an XML document. So it is more convenient way to traverse an XML document rather than a traditional way, by using scripting language.

3. Being template based, XSLT is more resilient to changes in documents than low level DOM and SAX.

4. By separating data (XML document) from the presentation (XSLT), it is very easy to change the output format in any time easily without touching the code-behind.

5. Using XML and XSLT, the application UI script will look clean and will be easier to maintain

6. XSLT templates are based on XPath pattern which is very powerful in terms of performance to process the XML document

7. XSLT can be used as a validation language as it uses tree-pattern-matching approach.

8. XML is platform independent.

9. XML has column flexibility, so it can be update easily rather than a traditional table-row-column approach

10. XML Supports Unicode

11. XML has self-documenting capability

Disadvantages:

1. It is difficult to implement complicate business rules in XSLT

2. Changing variable value in looping, is difficult in XSLT

3. Using XSLT have performance penalty in some cases as its engine don’t optimize code by using caching technique like traditional compiler.

4. XML encourage non-relational data structure(de-normalized)

Happy Programming!

Browser Back Button Security

2008-08-28T02:19:00.001+06:00

Sometimes, we have to work for secured project where even browser cache can be a problematic things. Normally in ASP.Net web application, every page is cached by the web browser. So, anybody can thief potential information from the web pages using back button if the user forget to close the browser after sign-out. Sometimes its create a embarrassing situation. But we can kill the cache on the spot easily by adding the following two lines in every page’s PageLoad event which will disable the browser back button functionality in ASP.Net application :

Response.Cache.SetCacheability(HttpCacheability.NoCache);
Response.Cache.SetAllowResponseInBrowserHistory(false);

The above two line is enough to say the browser not to cache the page. However, you can also add the following three line for better performance

Response.CacheControl = "NO-CACHE";
Response.AddHeader("Pragma", "no-cache");
Response.Expires = -1;

which is the equivalent of the following meta tag

<meta http-equiv="Pragma" content="no-cache">
<meta http-equiv="Expires" content="-1">
<meta http-equiv="CACHE-CONTROL" content="NO-CACHE">

Also don’t forget to set authorization in configuration file. So that application will force the user to login page:

Enjoy Programming!

Building ASP.NET Web Server Controls using XML and XSLT

2008-08-23T16:12:00.001+06:00

XML(Extensible Markup Language) and XSLT(Extensible Style-sheet Language Transformations) are very popular in terms of use in programming. XML has a vast use in web application because of column flexibility and platform independence ability. Because of column flexibility, programmers can increase or decrease a column anytime without changing much code (like different types of address such as home address, office address, etc). On the other hand, XSLT can traverse XML faster which can operate with lots of XML data quickly and can give the application a dynamic layout without touching any single line of code from the code-behind. So the combination of XML and XSLT can show its own strength and beauty which can boost up our application. Normally XSLT can produce plain XML or HTML without any hassle. But in some cases, plain XML or HTML might not work rather than we might need ASP.Net server controls since they have some valuable events (click event, data binding event, data bound event, etc) and other advanced functionality like state management, input validation, etc. If we want to create our ASP.NET server controls by using XML and XSLT then we should follow some procedures. I have described those procedures with example in my article which has been published in www.aspalliance.com

Enjoy Programming!!!

SQL Injection and XSS in Classic ASP

2008-08-23T15:19:00.002+06:00

SQL Injection and XSS(cross site scripting) is a big threat for classic asp sites in present days. Before coming ASP.Net in the market, ASP was the very popular scripting language. As a result, there are a good number of e-commerce and enterprise level project already exist using classic asp in the market. According to various source, from the very Beginning of this year, all the asp sites is the main target for SQL Injection and XSS by hackers. Since ASP.net have some built-in mechanism to sanitize input like “ValidateRequest”,”EnableEventValidation”, etc so this is quite safe position regarding XSS. Let me explain very quickly about XSS and SQL Injection:

SQL Injection is a technique by which hackers can execute dangerous SQL commands by taking advantage of un-sanitized input opportunities in web application.
Cross-Site Scripting(XSS) attacks exploit vulnerabilities in Web page validation by injecting client-side script code. The script code embeds itself in response data, which is sent back to an unsuspecting user. The user's browser then runs the script code. The browser has no way of recognizing that the code is not legitimate, and Microsoft Internet Explorer security zones provide no defense. Cross-site scripting attacks also work over HTTP and HTTPS (SSL) connections.

Several communities have already started a few workarounds on these issues. HP Web Security Research Group published a tool named HP Scrawlr, to find out SQL Injection vulnerabilities in web-sites. Also, Microsoft recently released source code analyzer for SQL Injection. Let me show that how we can protect our valuable site from this threat:

1. A very fast and easy way is to make a central validation system which is very similar approach of ASP.net built-in system. It will inspect all the input variables(form variable, query-string variable, cookie variable,etc) for the vulnerabilities automatically. It will protect the web site not only from SQL injection but also from XSS. Here is one of my research work, how to make such a system. In a really quick description, it will cover the following areas:

Sanitize all the input fields
How to make exception list to give the user flexibility
Default error page forwarding, if any problem found in input fields
Implement a automated reporting system while problem found with details information of inputs,IP,referrer page,etc
Implement a custom error page

2. Avoid disclosing database error information by using try…catch and custom error page.

3. Use escape character routines to handle special characters. For example replace the single quote(‘) by the following way:

Replace(Request.Form("txtUsername"), "'", "''")

so that any SQL injection code will be treat like a normal string and will be protect to execute.

4. Use Html encode and decode techniques to show html data. This technique will protect the site from XSS specially.

5. Use stored procedures rather than dynamic query where possible and parameterize query incase of dynamic query

6. Use a least privileged database account- only stored procedure will have the permission for update/insert and script will have only read permission

If all the above rules maintain in a site then no worry about SQL injection and XSS. But sometimes it is really very tough; like to convert all the inline query to stored procedure. In that case, we have to implement as much as possible. The first technique will ensure that site secured from the threat and make a primary security layer. the second technique will make the site more stronger and make second security layer then the third and so on.

Reference:

http://aspalliance.com/1703_SQL_Injection_in_Classic_ASP_and_Possible_Solutions

http://en.wikipedia.org/wiki/Cross-site_scripting

http://en.wikipedia.org/wiki/Sql_injection

Enjoy Programming!

Add, Update, Delete Key Value in Web Configuration File from Code Behind

2008-06-13T15:11:00.000+06:00

Add Key:

Configuration objConfig = WebConfigurationManager.OpenWebConfiguration("~");
AppSettingsSection objAppsettings
=(AppSettingsSection)objConfig.GetSection("appSettings");
objAppsettings.Settings.Add("apiusername", "ehsan4u");
objAppsettings.Settings.Add("apipassword", "ehsan4u");
objConfig.Save();

Note: It is not recommended as any change in the web.config file will restart the Web server and refresh the cache entries.

Read Key Value:

Specific Key Value:

ConfigurationSettings.AppSettings["apiusername"]

All key Value:

Configuration objConfig = WebConfigurationManager.OpenWebConfiguration("~");
AppSettingsSection objAppsettings =
(AppSettingsSection)objConfig.GetSection("appSettings");

if (objAppsettings != null) {

foreach (string key in appSettings.Settings.AllKeys) {

  string value = appSettings.Settings[key].Value;

   Response.Write(string.Format("Key: {0} Value: {1}", key, value));
 }
}

Update a Value:

Configuration objConfig = WebConfigurationManager.OpenWebConfiguration("~");
AppSettingsSection objAppsettings =

(AppSettingsSection)objConfig.GetSection("appSettings");

if (objAppsettings != null){

objAppsettings.Settings[strKey].Value = strValue;
objConfig.Save();
}

Remove

Configuration objConfig = WebConfigurationManager.OpenWebConfiguration("~");

AppSettingsSection objAppsettings =

(AppSettingsSection)objConfig.GetSection("appSettings");

if (objAppsettings != null){

objAppsettings.Settings.Remove(key);

objConfig.Save();

}

Reference:

http://msdn.microsoft.com/en-us/library/system.configuration.appsettingssection.aspx

Server Application Unavailable

2008-02-26T17:42:00.003+06:00

Server Application Unavailable

The web application you are attempting to access on this web server is currently unavailable. Please hit the "Refresh" button in your web browser to retry your request.

Administrator Note: An error message detailing the cause of this specific request failure can be found in the application event log of the web server. Please review this log entry to discover what caused this error to occur.

Today morning, I got the same error in my ASP.Net application as above. I am not getting this error for first time. But the interesting thing is, I solved the error in different way before. I think this problem can be occurs for many reasons. Since I face the problem and spent time to solve this issue, I think it is better to share ideas with others. It may be helpful for those who will get this error in future.

According to http://support.microsoft.com/kb/315158 the problem occurs because of Aspnet_wp.exe fails to start. By default, ASP.NET runs its worker process (Aspnet_wp.exe) with a weak account (the local machine account, which is named ASPNET) to provide a more secure environment. On a domain controller or on a backup domain controller, all user accounts are domain accounts and are not local machine accounts. Therefore, Aspnet_wp.exe fails to start because it cannot find a local account named "localmachinename\ASPNET". To provide a valid user account on the domain controller, you must specify an explicit account in the section of the Machine.config file, or you must use the SYSTEM account.

Solution 1:

1. Check that ‘IUSR_machine’ and ‘IWAM_machine’

Solution 2:

1. Stops the IIS and the ASP.NET state services.

2. Deletes and then re-creates the ASPNET account by using a known temporary password.

3. Reregisters ASP.NET. This step creates a new random password for the account and applies default ASP.NET access control settings for the account.

4. Restarts the Microsoft Internet Information Services (IIS) service.

Alter Database Authorization in SqlServer 2005

2007-12-29T10:59:00.000+06:00

"Database diagram support object can not be installed because this database does not have a valid owner. To continue, first use the files page of the Database properties dialog box or the ALTER AUTHORIZATION statement to set the database owner to a valid login, then add the database diagram support object "

I have resolved the above issue few days ago by alter database authorization. According to MSDN the Alter Authorization syntaxt is

ALTER AUTHORIZATION
  ON [  :: ] entity_name
  TO { SCHEMA OWNER | principal_name }

 ::=
   {
       Object | Type | XML Schema Collection | Fulltext Catalog | Schema
   | Assembly | Role | Message Type | Contract | Service
   | Remote Service Binding | Route | Symmetric Key | Endpoint
   | Certificate | Database
   }

my SQL statement was

ALTER AUTHORIZATION ON Database::databasename TO username;

Hope it will help you. Enjoy!

Read Resource Value Programmatically By C#

2007-12-28T09:36:00.000+06:00

There are two types of resource file in .net framework 2.0. They are

1. Global Resource File and
2. Local Resource File

Global resource file can be read by GetGlobalResourceObject method. This method takes two parameter: resource class and the resource key. The class name associates with the .resx file name that contains global resources. Suppose we want the value of "LoginText" from global resource file, named Resource.resx, then our statement will be like below

GetGlobalResourceObject("Resource", "LoginText");

Local resource file which normally stored in App_LocalResources folder, can be read by GetLocalResourceObject method. GetLocalResourceObject takes a resource name as parameter. so we can get a local resource value by the following way

lblMessage.Text = GetLocalResourceObject("msgInvalidLink").ToString();

Enjoy!

Abnormally LDF File Grow Problem in SQL Server 2005

2007-12-13T13:58:00.000+06:00

Recently I had faced a peculiar problem with my database LDF file. My total database MDF file size was 12 MB but the LDF file size was unexpectedly 21 GB!!! As a result I couldn't take the backup of the LDF file to our web server since our web server had only 1 GB free space. I have solved the problem by the following SQL command

BACKUP LOG databaseName WITH TRUNCATE_ONLY
GO
DBCC SHRINKFILE (N'database_log' , 2)

Note: If you get "file in use" error message from the above command, try changing the permission to single user mode.

The above command shrink my database log file to 2 MB. Its awesome and solve my problem within few seconds. Hope it will help. :)

Happy Programming!!!