News, Tutorials and Codesnippets about C#, ASP.NET- Silverlight

Last week I read a great post on Mad’s Blog about Re-Enable Request Validation in ASP.NET. He built a javascript function which automatically HTMLEncodes the Text on Clientside when the User hits Submit by using Tagmapping and automatically HTMLDecodes it on server-side.

By using his technique you can still benefit of the ValidateRequest Security while allowing HTML in your forms.

Now to the Follow Up: If you use ASP:Panels on your webform and you hide specific Panels which do include Textboxes to show them just on specific events you run into a Javascript Error saying tb is null. That’s because the HTML Output which is dynamically created doesn’t contain the textbox when the Panel is hidden, although ASP.NET is executing the JS Statement for those hidden textboxes anyway and that’s when the Error pops up. You can fix that pretty easy by checking if tb is null, here’s Mad’s Code containing that little fix:

public class SafeTextBox : System.Web.UI.WebControls.TextBox
{
protected override void OnLoad(System.EventArgs e)
{
base.OnLoad(e);
if (!Page.ClientScript.IsClientScriptBlockRegistered(Page.GetType(), "TextBoxEncode"))
{
System.Text.StringBuilder sb = new System.Text.StringBuilder();
sb.Append("function TextBoxEncode(id)");
sb.Append("{");
sb.Append("var tb = document.getElementById(id);");
sb.Append(”if (tb != null){”); //fix
sb.Append(”tb.value = tb.value.replace(new RegExp(’<’, ‘g’), ‘<’);”);
sb.Append(”tb.value = tb.value.replace(new RegExp(’>’, ‘g’), ‘>’);”);
sb.Append(”}”);
sb.Append(”}”);
Page.ClientScript.RegisterClientScriptBlock(Page.GetType(), “TextBoxEncode”, sb.ToString(), true);
}

// Adds the function call after the form validation is called.
if (!Page.IsPostBack)
Page.Form.Attributes["onsubmit"] += “TextBoxEncode(’” + ClientID + “‘);”;
}

public override string Text
{
get { return base.Text; }
set
{
if (!string.IsNullOrEmpty(value))
base.Text = value.Replace(”<”, “<”).Replace(”>”, “>”);
else
base.Text = value;
}
}
}

Read Mad’s full article on how to implent this technique and be sure to turn ValidateRequest back on!

I usually keep an eye on what my web applications are doing every now and then. Recently I noticed some really strange redirects being fired from one of my older projects. Like redirects to specific IP adresses or curious subdomains, rather traditional addresses for e.g. phishing attacks.

After checking my redirect logic the problem was immediately clear, I didn’t validate my redirects in any way, lazy me. The following code is offers actually a great way for people to use your brand/domain for redirects to spam sites or even phishing sites:

string RedirctURL = Request.QueryString["r"].ToString();
Response.Redirect(RedirectURL);

Now someone could easily drop his URL into the QueryString: http://www.yourdomain.com/somesite.aspx?r=http://www.the-injected-url.com. So what you should do is, check if the input really belongs to your site or is something you really want to redirect to.

If you only redirect to internal sites you can just check the string for a double slash “//”, if it occurs, deny the redirect. If you also redirect to external sites you have to use a database and save all permitted redirect URLs in there.

Also, don’t be tricked by using System.URI.AbsolutePath, because Firefox and IE will transform an invalid URL to a valid URL:

// Returns "//www.url-to-injected-site.com/badstuff.aspx" which will work in FireFox and IE!
Uri link1 = new Uri("http://www.url-to-injected-site.com//www.url-to-injected-site.com/badstuff.aspx");

As you probably know you should always validate external inputs, don’t be lazy or you will be sorry later..

I recently noticed that automatic mails sent by one of my online shops were flagged as spam when using GMX, GMail or generally mail services which are using SpamAssassin to filter out spam.

Sending out plain text-mails is old and rusty, if you want to deliver pretty mails to your customers you have to use HTML, unfortunately there is no way around it, but how to make sure that those pretty HTML mails actually reach the customer? Spam filters like SpamAssassin treat HTML Mails as potentially dangerous, so you have to use HTML very carefully.

If you do use HTML Mails you have to create two kinds of Bodys, one HTML Mail Body and one PlainText Mail Body. I show you how to do this in C# / ASP.NET 2.0 by using the built-in System.Net.Mail Class after some general advices.

Here are some recommendations for a automatic HTML mails which are being sent out a hundred times per day:

• Don’t forget to add <html><body>Your HTML Text/Code</body></html> to your HTML-Text-String
• Try to stick with 1-3 Images in total. For example your Logo, a header background and a photo of the particular product.
• Use HTML Tags with care. Set a good looking font like Arial, create listings, link tags, bold and italic texts and restrict yourself to create a well formed/layouted text, which is most important. Don’t even think about implenting an embed or object tag for including flash videos or anything like that.

SpamAssassin checks a lot of factors and is using a point-system for filtering out spam, here is a little snippet:

1.723 MSGID_FROM_MTA_ID
0.001 HTML_MESSAGE
5.000 BAYES_99
0.177 MIME_HTML_ONLY
1.047 HTML_IMAGE_ONLY_16
0.629 FORGED_OUTLOOK_HTML

The heaviest impact is BAYES_99, if your text sounds spammy, you are spam flagged. If you e.g. sell Viagra you shouldn’t list the product name in your confirmation mail ;-). Another example is MIME_HTML_ONLY, this hits your mail if you only supply HTML Text, without a seperated PlainText. I won’t explain every function in detail here, if you follow this HowTo you likely won’t run into any problems.

Let’s have a look on how to properly send a HTML Mail with the System.Net.Mail Class, in this case it is sending the Mail via Google Apps / GMail:

What’s important here: Setting the correct Encoding, in my case utf-8. Create a plainView and htmlView of the mail message. For the plainView I used a simple Regex statement for stripping out the HTML Tags. Add the plainView and htmlView to the AlternateViews Class of the Mail Message and finally send the mail, in my case via SSL, if you don’t know whether you have an Mailserver with SSL capabilities just ask your provider.

Using this construct you send out your HTML Mails as HTML Mail and Plaintext Mail and SpamAssassin is going to like you for that.

I use gmx.net for testing my mails as they are using a pretty well configured SpamAssassin and you can easily see the spam-flags by checking out the Header of the mail (also possible with GMail and hopefully every other mail application out there). An example of this:

X-GMX-Antispam: 5 (HTML_IMAGE_ONLY_12,HTML_MESSAGE,HTML_MIME_NO_HTML_TAG,MIME_HTML_ONLY)
X-GMX-UID: UNbaLmk4ZDI4zQ9QSmY2gY1xemhmY8Gs

A Spam-Score of 5 (=treated as Spam) and it’s telling me that I didn’t supply a PlainText Version of the Mail, after including that one all errors were gone.

Hope this saves some headaches

ScottGu just announced the Silverlight 1.0 Release on his blog for Windows and MAC. Silverlight 1.0 is focused on enabling rich media scenarios in a browser. Head over to this blog for more info on this and to see some deployed Silverlight 1.0 examples.

I already jumped on the Silverlight 1.1 train as it features full .NET Language support. The good news are that the MS Silverlight team can completly focus themselves on the v1.1 Release now.

I’m building a pretty big ASP.NET Application at the moment for the gaming sector which needs to have a forum for discussions about site related stuff, games and all kind of topics.

I would really like to use an ASP.NET Forum, but after one week of crawling through every available ASP.NET Forum out there I came to the conclusion that vBulletin (PHP) still offers the best features you need for a successful community in that kind of genre.

Yet Another Forum
Version: 1.9.0
Date: Tuesday, October 10, 2006

Last update in the year 2006, I won’t need to comment this any further. Honorable try to build a free .NET Forum but unfortunately it seems like people are not motivated to continue it anymore.

CommunityServer 2007

Actually the best currently available forum, although it’s a complete Community with Blogs, Gallery and Downloads. I prefered the splitted versions some years ago, now it’s one big package. What I miss here is: Support. The public forums are missing essential support by experienced CommunityServer Users and Developers. Another point is the missing SEO capabilities. Since CS 2.1 and CS 2007 they became much better regarding SearchEngineFriendly URLs but there are still big drawbacks. The Forum doesn’t feature the words of the title in the URL and duplicate content is being generated due to multiple URLs pointing to the same page - an example would be the profile link:

When viewing a forum the Link to the Profile looks like that:
http://communityserver.org/user/Profile.aspx?UserID=XXX

Inside a thread it looks like that:
http://communityserver.org/members/UserName.aspx

I’m running the Trial Edition of CommunityServer at the moment and was almost ready to buy the full version, but after starting more than 3 threads in their forum which all ended up with no reply I changed my mind. Maybe you got more luck if you buy Gold Support, but for me the first impression matters. If I post a question over at the vBulletin Forums I usually got an answer in less than 1 hour without any kind of Gold Support. And instead of about 2000$ for CommunityServer I just paid around 140$ for a vBulletin licence. CommunityServer is rich on features but vBulletin has such a big modding Community and therefore ends up with even more features. For SEO vBSEO is all you ever need.

Even worse is that there are almost no converters available for CommunityServer, if you’d like to switch FROM vBulletin to CommunityServer start looking for a CommunityServer AND vBulletin specialist.

All other ASP.NET Forums besides CommunityServer and YAF are not even worth mentioning. I would recommend CS 2007 as decent Blogging Solution, but once again you can just buy the whole package here which leads to an overpriced WebBlog-System if you ask me.

I (have to) stick with vBulletin

It’s sad, but true. I keep on building all kind of bridges between my ASP.NET Application and the PHP vBulletin and I eventually dig into the vBulletin MySQL database directly.

Check the comments on this post for more info on this.

PS: Of course vBulletin is not an ASP.NET Forum as written in the title, but I still use it as Forum for all my ASP.NET Applications and that’s why I’ve chosen such an evil title.

Dan Wahlin found out why the Firefox is responding so slow when it tries to connect to the localhost which for example is being used by the Visual Studio 2005 and Visual Studio 2008 integrated webserver. He writes:

It turns out that the slowness is caused by an IPv6 issue with DNS and can easily be resolved by turning IPv6 support off in Firefox while doing localhost testing. To make the change, type about:config in the address bar, locate the network.dns.disableIPv6 setting and double-click on it to set it to true. This does the trick for the Firefox localhost issue on Vista and everything is running fast again.

Good job, thanks Dan!
Source: Fixing Firefox Slowness with localhost on Vista.

A quick example on how to use the new GroupTemplate which is being featured by the new ListView Control of the .NET Framework v3.5.

The ListView templates follow a strong hierarchy:

LayoutTemplate [root item, container for ListView rendering]

• GroupTemplate [Optional, required for tiled layout]
• >> ItemTemplate
• >> AlternatingItemTemplate
• >> EditItemTemplate
• >> InsertItemTemplate
• >> ItemSeparatorTemplate
• >> EmptyItemTemplate
• >> SelectedItemTemplate
• GroupSeparatorTemplate

and finally the EmptyDataTemplate (optional), which is only being displayed when there are no results for the DataSource. To be able to use the GroupTemplate you have to set a groupContainer and put the layoutTemplate inside the GroupTemplate Tag.

By using the GroupTemplate you can produce tiled layouts which are e.g. needed for Image Galleries. However, as stated earlier you can only set a GroupItemCount at the moment, it would be great if we could get more options here for the final Release.

Side note:
The GroupSeparatorTemplate is displayed at the end of each GroupTemplate except the last one. The ItemSeparatorTemplate is displayed at the end of each ItemTemplate except the last one. The EmptyItemTemplate is displayed for filling up dummy columns when e.g. building a xhtml layout.

I just finished my first fully driven LINQ ASP.NET Page in one of my Projects by using the LINQDataSource and ListView. Let’s have a quick look at the Code.

The LINQDataSource:

<asp:LinqDataSource ID="LinqDataSource1" runat="server"
ContextTypeName="sqlGFDataContext" EnableDelete="True" EnableInsert="True"
EnableUpdate="True" OrderBy="commentID desc" TableName="gf_game_comments" OnDeleted="lvComments_OnDeleted">
</asp:LinqDataSource>

The ListView Control:

<asp:ListView ID="lvComments" runat="server"
DataSourceID="LinqDataSource1"
ItemContainerID="layoutTemplate"
DataKeyNames="commentID"
InsertItemPosition="None">

<Layouttemplate>
<div id="layoutTemplate" runat="server" />
</Layouttemplate>

<ItemTemplate>
Zu <%# Eval("gf_game.URL") %>"><%# Eval("gf_game.Title") %> von <%# Eval("aspnet_User.UserName") %> am <%# Eval("commentDate") %><br />
<%# Eval("Comment") %>
<asp:Button ID="Button1" runat="server" CommandName="Edit" Text="Edit" />
<asp:Button ID="Button2" runat="server" CommandName="Delete" Text="Delete" />
</ItemTemplate>
<AlternatingItemTemplate >
<%# Eval("UserID") %>
<%# Eval("Comment")%>
<asp:Button ID="Button1" runat="server" CommandName="Edit" Text="Edit" />
<asp:Button ID="Button2" runat="server" CommandName="Delete" Text="Delete" />
</AlternatingItemTemplate>
<EditItemTemplate>
Comment: <asp:TextBox  runat="server" id="txtComment" Text='<%# Bind("Comment") %>'></asp:TextBox>
<br />
<asp:Button ID="Button3" runat="server" CommandName="Update" Text="Update" />
<asp:Button ID="Button4" runat="server" CommandName="Cancel" Text="Cancel" /><br />
</EditItemTemplate>
<InsertItemTemplate>
<asp:TextBox runat="server" ID="txtUserID" Text='<%# Bind("GameID") %>'></asp:TextBox>
<asp:TextBox  runat="server" id="txtAbstract" Text='<%# Bind("Comment") %>'></asp:TextBox>
<asp:Button ID="Button3" runat="server" CommandName="Insert" Text="Insert" />
<asp:Button ID="Button4" runat="server"
CommandName="Cancel" Text="Cancel" /><br />
</InsertItemTemplate>
</asp:ListView>

And if you need to do some custom operations while the Delete Event is fireing you can hook it up really easy:

protected void lvComments_OnDeleted(Object sender, LinqDataSourceStatusEventArgs e)
{
var gc = (gf_game_comment)e.Result;
csFN.ReCalcUserFactor(Int32.Parse(gc.GameID.ToString()));
}

As you see you got access to the complete table object with all its data inside, it’s really comfortable.

All this stuff is almost working out of the box if you use the new LinqDataSource Control and enable support for Inserting, Updating and Deleting Data while binding the DataSource. It’s really amazing how easy this stuff got, you don’t even have to care about JOINS, LINQ is doing everything for you.

If you check the code on my ListView again you notice this Eval Code - Eval(”aspnet_User.UserName”) - I got access to this tablefield without writing any SQL Join. LINQ automatically checks the relations between your tables and sorts out the specific data. This could be another great step in productivity as you don’t have to take care of huge SQL Querystrings anymore.

More on this topic:
Scott Gu for setting up the ContextType (required for the LINQ DataSource): Binding UI using a LINQ DataSource
Rick Strahl for a quick Overview on the new Controls by using a SQLDataSource: ListView and DataPager in ASP.NET 3.5.

Watch out if you use Gridviews which display links or specific HTML in some columns. Since I upgraded to the .NET Framework 3.5 on my servers my Gridviews had HTMLEncoding turned on by default.

So you have to turn it off now manually via HtmlEncodeFormatString=”False”. I didn’t notice that at first but a customer quickly reported the missing links in the Gridview - the columns displayed plain HTML Text instead of a link.

Just fyi..

Now I’m really missing my CopyToHTML Plugin back from Visual Studio 2005 :o. Here is a little example on how to use the new ListView Control and DataPager of the .NET Framework 3.5:

That’s it, here is how it looks:

However, there is one big downside of the DataPager: If you build a Website which needs to score in SEO matters you wouldn’t want to use the DataPager. As of now the links to the pages look like that:

javascript:__doPostBack(’ctl00$ContentPlaceHolder1$DataPager1$ctl01$ctl02′,”)

A SearchEngine won’t be able to follow this link, which means you eventually run into problems if you want to get a heavy paged site indexed in a SearchEngine by using the DataPager Module in that kind of way.

Here’s how it would need to look like for e.g. page 2:

yoururl.com/pagedsite.aspx?p=2 or even better: yoururl.com/pagedsite.aspx/2/

The PagerData Control is really amazing but if it’s missing the SEO aspect I can’t use it for my public SEO oriented sites..

UPDATE: Here you can find a querystring based DataPager built by Polita Huff: click. Great!

Be careful when you open an ASP.NET AJAX Project in Visual Studio 2008 Beta 2! VS2008 thinks it’s a .NET Framework 3.5 Project at first and you will run into problems when you try to use the new controls as the web.config settings are still pointed to the 2.0 Settings. I tried to modify the System.Web.Extensions entries in the web.config manually but forunately there’s a much easier way:

How to fix this: Go to the project properties and convert it back to a .NET 2.0 project. Hit OK and go to the project properties once again. Now choose .NET 3.5 project and it will correctly modify the web.config so you will be able to use the 3.5 tools.

This is a little bug in Visual Studio 2008 Beta 2 which will probably be fixed in the next release.

You can get the full release here and the smaller Express Edition here.

Some of the new features:

• VS 2008 Multi-Targeting Support
• VS 2008 Web Designer and CSS Support
• ASP.NET AJAX and JavaScript Support
• Language Improvements and LINQ
• Data Access Improvements with LINQ to SQL
• Lots of other improvements

Scott Guthrie added an important note for two things you should do after VS 2008 installation:

1) You should download and run this batch file. This takes only a few seconds to run, and fixes an issue we found earlier this week with the version policy of System.Web.Extensions.dll - which is the assembly that contains ASP.NET AJAX. If you don’t run this batch file, then existing ASP.NET 2.0 projects built with ASP.NET AJAX 1.0 and VS 2005 will end up automatically picking up the new version of ASP.NET AJAX that ships in .NET 3.5 Beta2. This will work and run fine - but cause you to inadvertently introduce a .NET 3.5 dependency in the applications you build with VS 2005. Running the batch file will change the version binding policy of the new System.Web.Extensions.dll assembly and ensure that you only use the new .NET 3.5 ASP.NET AJAX version with projects that you are explicitly building for .NET 3.5.

2) If you have ever installed a previous version of “Orcas” or VS 2008 on your machine (either Beta1 or one of the CTP versions), you need to reset your VS 2008 settings after installing Beta2. If you don’t do this, you’ll have an odd set of settings configured (some windows will be in the wrong place), and you’ll potentially see some IDE performance slowness. You can reset your settings by typing “DevEnv /resetsettings” on the command-line against the VS 2008 version.

Also note that this release features a Go-Live Licence, so let’s get ready for VS 2008 deployments

Quick note: Scott Guthrie confirmed the Release of Visual Studio 2008 Beta 2 in the near future:

VS 2008 Beta2 should be available for free download in the next three weeks. It will support a go-live license.

Sounds great, I usually don’t like using Beta Software that much, especially as IDE, but for proper and comfortable WPF / Silverlight development this is a must.

With ASP.NET Ajax and ASP.NET v2.0 it is a piece of cake to create an asynchronous Webservice these days.

However, what if that needs about 45 minutes or even longer to complete? You know your users, many people will hit the button again after 10 minutes because they think it will be faster that way, or they accidently double click it. Just imagine people standing at a traffic light and hitting the “Get Green Button” like a thousand times. The result of this is an unwanted increase of the server load by starting an additional webservice process with every click.

Here is a very easy solution to pretend this, add this to the Button which fires the async webservice call, in my case Button1:

That’s it! The button will be disabled until the final PostBack is taking place. Of course your controls need to be in an UpdatePanel for this to work.

Was anyone able to get this running on Windows Vista 32Bit or Windows Vista 64Bit? The funny thing is, 32Bit throws a different Error than 64Bit.

While Vista 64Bit is complaining about some folder called DavWWWRoot, Vista 32Bit says no matter what the folder I would like to set up is invalid.

I found this fix here: Software Update for Web Folders but it didn’t help me, same error.

How did I setup the WebDAV Folder on Windows 2003 Server? Pretty straight forward in fact:

• Created a folder called WebDAV in my WWW root, in details: C:\root\domains\WebDAV
• My Website is located in C:\root\domains\WebDAV\domain.com
• I added a virtual folder to my website in IIS6, pointing to C:\root\domains\WebDAV and carrying the name WebDAV
• I disabled anonymous connections and just enabled Windows Authentication
• I made sure I got proper rights on that folder with my local Account
• I fired up “Computer” on my local PC, added a network ressource and filled in http://www.mydomain.de/WebDAV as path.
• I received an invalid folder error after typing in my credentials on Vista 32Bit, just using the domain without the WebDAV folder doesn’t help either.
• On Vista 64Bit I’m receiving another error includin something about a DavWWWRoot which is as far as I know the standard root directory for WebDAVs - I even tried calling my folder DavWWWRoot but it didn’t change anything

So I were not able to get it running on Vista x32 or x64. This seems to be a serious bug in Vista as XP seems to do just fine. I can even connect to the folder with IE7 after filling in the credentials, but no drag&drop supported anymore as you can’t open it as WebFolder in IE7.

Does anyone have a fix or workaround for that? It’s really pretty annoying, I can’t believe Vista implented a buggy WebDAV Gateway and noone cared about it after almost 6 months!