.NET articles

Updating Your Web.Config From Each Build with CruiseControl

Sameer Alibhai — Tue, 17 Jun 2008 23:10:32 GMT

Let's say you have CruiseControl.NET all set up nice and hunky dory. Now you love the fact that it labels your each build, and you want to somehow show that from your project. Here is how you can get your CruiseControl.NET project build number into your Web.Config. This concept can be applied to update any file.

It’s super easy. You will need to add an exec block to your ccnet.config

<exec>

<executable>E:\Userdata\CruiseControl\Tools\MergeWebConfigValues.exe (my custom tool)</executable>

<buildArgs>"E:\Program Files (x86)\CruiseControl.NET\server\Main.state" e:\userdata\cruisecontrol\Dev_Main\Web.config</buildArgs>

<baseDirectory>e:\userdata\cruisecontrol\Dev_Main</baseDirectory>

</exec>

Now all you need to do is write the MergeWebConfigValues.exe

What does it do?
1. It reads the CCNET state file (provided by argument 1) and grabs the last label from there. (The state file is an XML file)
2. It then goes and writes to your Web.Config and updates the build number in there. (or writes to any specified file you like)

Lastly, update your code to read this value by adding some version or about page to read your Web.Config

You now instantly know what version your code is.

Unit Testing on Your Database

Sameer Alibhai — Thu, 22 May 2008 22:09:58 GMT

When unit testing on your database, you will run into a common problem.

Rolling back.

So you want to do some unit tests, and then you want to reset your database back to the nice squeaky clean version that doesn't have half failed unit tests.

So how can you do this?

There are many ways to achieve this.

The best way I found (requires Win XP SP2 or Windows Server 2003) is to use Roy's Unit Testing Rollback Attribute. Simply inherit his class, add a "DataRollback" attribute, and you are good to go. Using some complicated Interception logic and Enterprise Services (COM+) it rolls back all the database work that was done. It's super easy to implement. Here is some sample code that shows you just how easy it is. You just have to download XtUnit (an extension to NUnit) to do this. (Full source code available)

using System;

using System.Data;

using System.Collections.Generic;

using System.Text;

using TeamAgile.ApplicationBlocks.Interception.UnitTestExtensions;

using NUnit.Framework;

using System.Data.SqlClient;

using Microsoft.ApplicationBlocks.Data;

namespace DBTest

{

///<summary>

/// Test roll back functionality.

///</summary>

[TestFixture]

public class RollbackTest : ExtensibleFixture

{

[Test, DataRollBack]

[Category("Database")]

public void TestInsert()

{

//this method will be performed inside a COM+ transaction

//this requires windows XP SP2 or better

//Windows Server 2003 works as well.

string strCnn = "your_conn_string";

Guid random = Guid.NewGuid();

string sqlI = string.Format(@"insert into log4net (message,date,thread,level,logger) values ('{0}',getdate(),'{1}','Debug','Test')", random.ToString(), System.Threading.Thread.CurrentThread.GetHashCode());

SqlHelper.ExecuteNonQuery(strCnn, CommandType.Text, sqlI);

string sqlS = string.Format(@"select count(*) from log4net where message='{0}'", random.ToString());

int rowcount = (int)SqlHelper.ExecuteScalar(strCnn, CommandType.Text, sqlS);

Assert.That(rowcount > 0, "Cannot find {0}", random.ToString());

}

This test passes successfully. What does that mean? The insert and select worked perfectly fine. After that, I did a query and found the database to be clean. So the rollback worked too.

There are also other ways to skin this cat (i.e. to achieve this goal). One is to use Spring Framework and extend their Unit Testing class (AbstractTransactionalSpringContextTests), and they will handle rolling back everything. Here is an article on this topic, but unfortunately I was not able to make it work for me due to some odd reason. Here's hoping you have better luck. If you don't have any transactions, and your code is wired to use Spring, it's still also very easy, you just need to call TransactionManager.Rollback.

You can also try to achieve this using Nested Transactions if you have existing transactions implemented via Spring. But then you have to set up checkpoints and stuff like that.

I have some other ideas on how to achieve this that I will post later, God willing.

PHP VS. ASP.NET

Sameer Alibhai — Thu, 08 May 2008 21:42:05 GMT

This is a very shallow comparison of my experiences with PHP and ASP.NET

Don’t take this as a religious war or something, the idea is just some basic comparison.

Here is a summary: If you are choosing which technology to use to build an application, use .NET. You will get more bang for the buck. With the same effort you will be able to build a much more rich user interface.

My Disclaimer: Keep in mind there are a lot of great libraries and tools for PHP which I never got to use, I just had a simple PSPad text editor and my handy PHP web site. I really wanted some “Intellisense” style code completion but I could not get it to work with PHP since I couldn’t find a decent IDE (i.e. editor)

However, it all depends on your requirements. For example, if you are selling something that most of your customers will be on a shared linux hosting environment, then why would you use .NET ? A good example is the software Clipshare, which is a clone of Youtube. The sites purchasing this product are mainly shared hosting customers who have PHP but not .NET. And Mono (.NET port on Linux) is not yet stable or popular enough to use.

I did some PHP programming before I started doing .NET fulltime. Before then I couldn’t say much about it, but after working with .NET for a few years now, I have much to say.

.NET does a very good job in handling the whole life cycle. With PHP you have to do it manually. For example, there is no such concept of “Postback” with PHP. This is such a basic thing that you can easily check with .NET to see if the page has been submitted and what button was pressed. For example if your “btnSubmit” was pressed, it will call btnSubmit_Click. With PHP, you have to do this manually. Not to mention how mish mashed your PHP page can be in terms of mixed code and style/HTML elements.

How about caching? I wanted to implement caching with PHP and I had a fun time, I had to check if the cached output file existed, and then if so, then check how old it is, and so on... Yeah okay again maybe there are some nice components already done for this, but I didn’t have to look very hard to do it with .NET, I simply added a CacheDependency on an XML file (or whatever the case was), and BOOM! It regenerated the file whenever necessary.

How about reusable components? With .NET you can create ASCX (Custom Controls) that you can place within a page that expose certain properties and the control itself maintains its state, can have buttons, etc, etc.

How about master pages (i.e. templates) in .NET? Again, super cool reusability! You can create pages with repeatable parts, with headers, footers, all sorts of fun stuff.

I can go on and on... but in general, the more I use .NET, the more impressed I am with it. However, what makes it not-so-practical is how expensive Windows Server hosting is. In summary .NET kicks butt!

Manage your transaction chaos with Spring Framework

Sameer Alibhai — Wed, 30 Apr 2008 22:51:24 GMT

Spring is a popular framework available in Java. It has also been published in .NET and is called Spring.NET

This framework is huge, but what I wanted to focus on is the section that deals with transaction management.

If you have ever worked with Transactions, (say SQLTransactions), you would realize how messy it can be when you have to keep your connection open and pass around a transaction to many different functions that are making updates or queries, and then you might make a small little change and find out you forgot to use the transaction object and you caused a deadlock!

How can you fix this? By having a generic transaction/connection object? Well, that's one way.. but how about using the Spring.NET framework to deal with the transactions?

Spring.NET allows you to specify when you need a transaction, and you would begin and end the transaction. However, when you do the actual database calls, you would not pass any connection string, it would automatically use the transaction in process if there is one, or if not needed then it would use a regular connection and disconnect after the query is complete.

Here is a code snippet to demonstrate programmative transaction management, taken from the Spring.NET source code (yeah its open source!)

[Test]
        public void ExecuteTransactionManager()
        {
            DefaultTransactionDefinition def = new DefaultTransactionDefinition();
            def.PropagationBehavior = TransactionPropagation.Required;

            //TODO change to property of name TransactionStatus...
            ITransactionStatus status = transactionManager.GetTransaction(def);
            
            int iCount = 0;
            try
            {
                iCount = (int)adoOperations.ExecuteScalar(CommandType.Text, "SELECT COUNT(*) FROM TestObjects");
                /*
                IAdoCommand cmd = new AdoCommand(dbProvider, CommandType.Text);
                cmd.CommandText = "SELECT COUNT(*) FROM TestObjects";
                iCount = (int)cmd.ExecuteScalar();
                */

                //other AdoCommands can be executed within same tx.
            } catch (Exception e)
            {
                transactionManager.Rollback(status);
                throw e;
            }
            transactionManager.Commit(status);
            Assert.AreEqual(2, iCount);

        }

As you can see from this code, the adoOperations.ExecuteScalar does not have any connection string passed to it. Same thing with ExecuteDataSet, and so on.

This actually saves you a lot of headache, as you just have to make sure you use the spring DataOperations object. The easiest way to implement this on a ASP.NET site is to put these objects as a static variable and initialize them on Application_Load. Just an idea but it should work.

If you want to do more digging, Spring.NET has tons of stuff, it seems to mostly focus on Dependency Injection and loose coupling of code from objects from the data layer. I really like it and I recommend you give it a shot.

It's proven itself in Java and I think this framework is going to prove itself in .NET as well. At the very least the source code is a prime example of a clean object oriented well designed application with full unit tests and sample code, XML documentation, thorough use of interfaces and inheritance, and even ORM (object relational mapping) using NHibernate (again a popular Java framework which has come into .NET)

Update: I called this "declarative transaction management", actually its "programmative transaction management". - FIXED

Convert your site from VB.NET to C#

Sameer Alibhai — Tue, 12 Feb 2008 12:45:24 GMT

If you are tired of the headaches of using VB.NET code, and want to convert it to C#.. Here is a nice way to do it and get the comments too.

Why would you do that? Well if I have to explain to you, then you probably don't need to do it. One big reason for me is that VB.NET does not support multi line strings. You have to keep putting " & _ at the end of each line making it very difficult to go back and forth from another program with strings. You could technically create a tool to do this for you but that's so silly. Another thing is I really like using ?? operator in C#, for example txtLocation.Text = (GetLocation() ?? "").ToString() will ensure that even if SomeFunction returns null, this will always give you at least empty string.. I like to use this in cases where I am getting null and its a text box I am setting the text for.

Another reason is that VB.NET code doesn't force you to type your variables properly, so everything is an object unless you specify, or unless you put on Option Strict

One way to do it is to use Reflector + Code generation add-in, but you will lose the comments and maybe even variable names because it uses the intermediate language (IL) from the DLL to re-make the source, so it's pretty useless to do it this way if you want to keep your code in the long run.

The way I like is to use a site such as http://labs.developerfusion.co.uk/convert/vb-to-csharp.aspx

Keep in mind I know there are other tools available that you can pay for, and some that are free too, but this is a quick and easy way to do it at work without requiring any installation.

Once you perform the conversion, the code will still have some things that need to be manually converted.
One thing is this site does not compile the code, so it does not know if the VB code .Rows(5) is actually a function call called Rows with a parameter 5, or its an array index [5]. So you will need to fix these manually.

Same thing with Tables[], Session[], etc.
Sometimes with VB code you will see .Item being used when no such thing exists in C#, you just use the square brackets to get the item directly such as .Rows.Item(5) in VB.NET is equal to .Rows[5] in C#

Here is how you can search and replace these with a regular expression.

Search: \({(["|a-z|A-Z|,|0-9|\:|\.|_])+}\)

Replace: [\1]

You have to do this manually and confirm each one.. Or make it more smart by searching for keywords such as QueryString, Cookie, Value, etc.. and replace all, then do the rest manually

And again if you want to do them all at once, I wold recommend improving this search to find Rows, Tables, etc.. Also if you have declared an instance of a DataRow object or any other array type object, you will need to search for those as well.

Keep in mind its not perfect. For example I did not put any numbers in my search, so it will miss some of the results. You might need to tweak it a bit and add |0-9 to the first set of brackets which means OR 0-9

The next thing is that functions such as .InStr are not supported directly from C#, you need to call Microsoft.VisualBasic.Strings.InStr(...) The code converter will automatically do this, but you need to add using Microsoft.VisualBasic.Strings to the top of your class file.

There are a few more things I could mention, but just try it out and see how it goes.

Here is a few more things
1) "my string" & " is very long" will give an error while converting. Before you run the converter, replace these & in your VB code with + instead.
2) the functions that have handles such as lstItems_SelectedIndexChanged(...) handles lstItems.SelectedIndexChanged need to be taken care of by putting either an event in the ASPX page in the <DropDownList OnSelectedIndexChanged="lstItems_SelectedIndexChanged"

Also, they might be private, so you need to make them protected. Here's a regexp to start you off:
find: {(protected|private)} void {(lnk|lst)}
replace with: public void \2

3) Functions that have optional parameters need to be taken care of. An easy way to take care of this is to create another function that calls the second one that passes the default value with the same name. That easy!

By the way, since I am not regularly writing here, I would suggest you subscribe to my feed so you can get an update when I post a new article.

How Random is your Random??

Sameer Alibhai — Wed, 05 Dec 2007 13:52:22 GMT

How random is your random?

Computers are very deterministic. What that means is that you put something in, you get something out. In order to get computers to perform "randomness", it is very difficult.

Why is this important to understand? Because we want to write our code properly, if we depend on the random function for some security purpose, such as for generating passwords, we are actually putting security holes in our application without realizing it.

In .NET Using RNGCryptoServiceProvider would give you much better random results than just a Random.Next()

http://msdn2.microsoft.com/en-us/library/system.security.cryptography.rngcryptoserviceprovider.aspx

However, in order to truly randomize your number, you would have to do something like use data from customer mouse movements, or something wierd like that. Alternatively you can use a hardware random number generator such as the one Intel created that uses thermal noise to generate real random numbers

To realize just how complicated this really is, lets look at this quote from the Pokerstars web site on how they shuffle the cards in their software:

SHUFFLE

"Anyone who considers arithmetic methods of producing random digits is, of course, in a state of sin." - John von Neumann, 1951

We understand that a use of a fair and unpredictable shuffle algorithm is critical to our software. To ensure this and avoid major problems described in [2], we are using two independent sources of truly random data:

* user input, including summary of mouse movements and events timing, collected from client software
* true hardware random number generator developed by Intel [3], which uses thermal noise as an entropy source

Each of these sources itself generates enough entropy to ensure a fair and unpredictable shuffle.
Shuffle Highlights:

* A deck of 52 cards can be shuffled in 52! ways. 52! is about 2^225 (to be precise, 80,658,175,170,943,878,571,660,636,856,404,000,000,000,000,000 ways). We use 249 random bits from both entropy sources (user input and thermal noise) to achieve an even and unpredictable statistical distribution.
* Furthermore, we apply conservative rules to enforce the required degree of randomness; for instance, if user input does not generate required amount of entropy, we do not start the next hand until we obtain the required amount of entropy from Intel RNG.
* We use the SHA-1 cryptographic hash algorithm to mix the entropy gathered from both sources to provide an extra level of security
* We also maintain a SHA-1-based pseudo-random generator to provide even more security and protection from user data attacks
* To convert random bit stream to random numbers within a required range without bias, we use a simple and reliable algorithm. For example, if we need a random number in the range 0-25:
o we take 5 random bits and convert them to a random number 0-31
o if this number is greater than 25 we just discard all 5 bits and repeat the process
* This method is not affected by biases related to modulus operation for generation of random numbers that are not 2n, n = 1,2,..
* To perform an actual shuffle, we use another simple and reliable algorithm:
o first we draw a random card from the original deck (1 of 52) and place it in a new deck - now original deck contains 51 cards and the new deck contains 1 card
o then we draw another random card from the original deck (1 of 51) and place it on top of the new deck - now original deck contains 50 cards and the new deck contains 2 cards
o we repeat the process until all cards have moved from the original deck to the new deck
* This algorithm does not suffer from "Bad Distribution Of Shuffles" described in [2]

PokerStars shuffle verified by Cigital and BMM International

PokerStars submitted extensive information about the PokerStars random number generator (RNG) to two independent organizations. We asked these two trusted resources to perform an in-depth analysis of the randomness of the output of the RNG, and its implementation in the shuffling of the cards on PokerStars.

Both independent companies were given full access to the source code and confirmed the randomness and security of our shuffle. Visit Online Poker Random Number Generator for more details.

[2] "How We Learned to Cheat at Online Poker: A Study in Software Security" - http://itmanagement.earthweb.com/entdev/article.php/616221
[3] "The Intel Random Number Generator" - http://www.cryptography.com/resources/whitepapers/IntelRNG.pdf"

Here is an article about how to shuffle a deck of cards: http://www.codinghorror.com/blog/archives/001008.html?r=31644 and in one of the links it explains a big security hole in their random number generation and how it could have been used to leverage thousands of dollars from players.

Here is a snippet of how to get Cryographically safe random numbers:

This will fill in the 8 bytes with a crytographically strong sequence of random values.

byte[] salt = new byte[8];
RNGCryptoServiceProvider rng = new RNGCryptoServiceProvider();
rng.GetBytes(salt);

How To Debug Inside The Code Of Your 3rd Party Libraries

Sameer Alibhai — Tue, 06 Nov 2007 13:08:55 GMT

Let's say you are using a 3rd Party Library like ELMAH in your web site project to handle unhandled exceptions and it's throwing an exception and you don't know why. Since the code is open source, you would LOVE to see what line its crashing on and then submit your changes to the project so that others can benefit from the fix you made. It gives you that good feeling, right?

Well, unfortunately, you put the compiled DLL in the bin folder and when it crashes, it just crashes and burns.

How can you see the source code? Simple! Compile the source code on your machine, and copy the PDB ("Debugging Database") file to your bin folder along with the DLL, and then your web site crashes while in debug mode, it will go to the exact folder on your file system where the DLL was compiled from and show you the exact line of the error.

This was my recent experience with Elmah that it was crashing due to the fact that XMLWriter was misbehaving and throwing an exception when it was supposed to actually replace invalid entities in the XML automatically (at least, according to the MSDN documentation).

Take a look at Issue 43 on Elmah Site for more details.

Are You a Sharp Developer?? (Part 2)

Sameer Alibhai — Mon, 13 Aug 2007 01:18:17 GMT

This is the second post in the series "What Makes a Sharp Developer"
The next article in this series will discuss keeping up with the bleeding edge - Visual Studio 2008 (Orcas), Silverlight, .NET 3.5, LINQ, .. and more

This post will focus on: balanced lifestyle, staying away from drugs, and keeping a healthy balance between learning and working. Overall this article discusses how you can become a more valuable resource to your team and to your employers.

Lead a Balanced Lifestyle

Many of us in the development or business field unfortunately tend to overwork ourselves. We work late nights at the office surviving on Java alone (caffeine, that is, not Sun Microsystems Java^R). We take our work home in the evenings, or we might be doing stuff on the weekend that is work related so that we have a head start during the week. I feel this tendency to overwork ourselves is part of our human nature. We have to protect ourselves against this and yearn to keep a balance. Although there is some overlap, I like to divide my time into three categories - Work time, Time for God, and Time for my family (don't forget Time for Myself). The difficult part is keeping the three in balance and perspective.

If we start doing fifty or sixty hour weeks consistently, our quality of work will definitely go down. It is unfortunate that some companies do not understand this, and push their developers to work longer and harder despite the fact that inevitably their performance will suffer. As well if your family life suffers, that will not be good for you at work. Your wife (or husband) might end up putting extra hot sauce in your sandwich because you didn't spend time with her for the last six weeks and your stomach isn't going to like that.

Stay away from the drugs

One of the keys to success is to stay away from drugs. That includes alcohol, nicotine, and.... that includes caffeine, man (Bummer!). Actually caffeine is one of my favourite drugs :(. But keep it in moderation. If you overdo it, or if you become dependent on caffeine to survive, you are going to be at a weakness to those who can survive without their daily injection. Also it hides your tiredness, especially if you start to use it regularly even when you aren't working, you might not realize just how tired you are. If you notice you are coming home with bad headaches, or are feeling dizzy or other strange things are happening, THOSE ARE NOT A GOOD SIGNS.

A balance between working and learning

This one is a tricky one. It depends a lot on your work environment and how tight your deadlines are. I am suggesting that you make sure that no matter what, each day you learn something new. Do not spend so much time on your task so that you are completing it as fast as possible without taking the time to investigate or find better solutions. Don't assume that just because you did this four times before, that the fifth time you should do the same thing. It could be possible that you did it a silly way four times and you are just going to make it the fifth now! There have been so many cases where I have been repeating my same noobness (i.e. lack of expertise) by declaring my SQL parameters as an ArrayList for example, whereas I could do it without the additional memory overhead and then conversion into an array by declaring my SQLParameters directly into an array with the exact size I need! Sometimes employees think that they are not doing their company a favour if they "waste" time reading stuff like this.

Infact, I beg to differ!! On the contrary, you will be a MUCH more valuable employee if you insist on taking the time to learn things. An employee who consistently learns is the last one to get fired, whereas the old dog who can't learn new tricks is going to be the first one to have to sleep outside (so to speak). Please, this is so important. If your boss doesn't give you time for this, either get a new job, or work late so that you can spend an hour a day on this. As well, this will give you a bit of job security incase you end up being the one who is laid off, because you have been keeping up with the improvements and constantly sharpening your skills, you will be more in touch with the technology than the ones sitting on their old skills.

As a PS, I would also recommend looking at current job postings to see what technologies are in demand, and as well try to see if you can figure out trends (i.e. which direction the market is heading and what technologies are up and coming.)

Smarter Debug Code With Conditional Compilation

Sameer Alibhai — Wed, 18 Jul 2007 22:15:30 GMT

Debug statements. We've all used debug statements at one time or another--most commonly to print out some values and see what they are. Commonly criticized (and rightly so) as a "beginners" way to debug, many developers usually advance to a proper debugger and leave behind semi-useless print statements.

But wait.

Are they useless?

The idea of print statements is to show something to the developer--print some value.

But what about more advanced debug code? Extra buttons that let you skip and automate tedious steps. Labels that show you that certain values are meeting their expectations. Forms that run in the background and churn out useful information.

"Ok, sure," you might say, "but, eh, I have to remove that for the release version."

But do you?

.NET says you don't have to.

How does it work?

.NET has something called conditional compilation--the gist of it is that, like System.Diagnostics.Assert, certain methods are only compiled into the code when you're running in debug mode. Otherwise, they're ignored, and all calls to those methods do nothing. So you can happily introduce function calls all over the place to help you test your code, without worrying about the extra overhead of it compiling into production code (not to mention having to remove it from your application).

How do you do it? Simply add the following attribute to your desired methods:

[System.Diagnostics.Conditional("DEBUG")]

And VOILA! .NET leaves the code uncompiled in Release mode, and all function calls to that method are removed.

So go, and enjoy your newfound powers! And remember--it's not about print statements. Smart debugging code can be a beneficial aid to development. It's a tool for you to use, just like any other tool. Don't misuse it.

Also see How To Debug Inside your 3rd Party Libraries

How To Use SqlParameterCache (Caching Sql Parameters)

Sameer Alibhai, Ashiq Alibhai — Sat, 30 Jun 2007 00:35:40 GMT

This article describes how to cache your SqlParameters. If you have code that is regularly executed, and that uses a stored procedure, you can benefit from this. This information, as well as how to properly use this, is very hard to find, even on Google. (Don't worry, you don't need to spend all that time looking, the information is already here for you!)

There is a function that Microsoft built that will allow you to get the parameter information from the database stored procedure, and that doesn't require you to re-build your parameter array every time. The only thing you will need to do is set the values of the parameters.

What some people don't realize, is that a similar approach can be taken with regular SQL queries that are not stored procedures!

The downside is that the first call will be slower, because it will need to cache the parameters, however, for each extra call, it will be faster because the parameters are already created.

How can you do this? You first create your parameters, and store it in the call by calling SqlParameterCache.CacheParameterSet()

Then you call SqlParameterCache.GetCachedParameterSet() to get the cached result. If the result is null, then you can store the parameters in the cache, otherwise you already have it cached!

Here is an example in VB.NET of how to use SqlParameterCache.CacheParameterSet()

Dim cachedParams as SqlParameter() = SqlHelperParameterCache.GetCachedParameterSet(Config.connstring,strSql)

if cachedParams is nothing then

Dim params as SqlParameter() = { _
    New SqlParameter("@userID", userID), _
    New SqlParameter("@timestamp", timestamp), _
    New SqlParameter("@email",email), _
    New SqlParameter("@timesLoaded",5), _
    New SqlParameter("@country",country), _
    New SqlParameter("@source",source) _
}

SqlHelperParameterCache.CacheParameterSet(Config.connstring,strSql,params)
    cachedParams = params
else
    cachedParams(0).Value = userID
    cachedParams(1).Value = timestamp
    cachedParams(2).Value = email
    cachedParams(3).Value = 5
    cachedParams(4).Value = country
    cachedParams(5).Value = source
End If

SqlHelper.ExecuteNonQuery(Config.connstring, CommandType.Text, strSql, cachedParams)

Now the down side to this, is you lose your ability to dynamically create your SQL parameters (i.e. it depends on the order of your SQL parameters).

Related articles: