6293_FM.fm Page i Tuesday, November 15, 2005 7:29 PM Pro ASP.NET 2.0 Website Programming ■ ■ ■ Damon Armstrong 6293_FM.fm Page ii Tuesday, November 15, 2005 7:29 PM Pro ASP.NET 2.0 Website Programming Copyright © 2005 by Damon Armstrong All rights reserved. No part of this work may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying, recording, or by any information storage or retrieval system, without the prior written permission of the copyright owner and the publisher. ISBN (pbk): 1-59059-546-7 Printed and bound in the United States of America 9 8 7 6 5 4 3 2 1 Trademarked names may appear in this book. Rather than use a trademark symbol with every occurrence of a trademarked name, we use the names only in an editorial fashion and to the benefit of the trademark owner, with no intention of infringement of the trademark. Lead Editor: Tony Davis Technical Reviewer: Damien Foggon Editorial Board: Steve Anglin, Dan Appleman, Ewan Buckingham, Gary Cornell, Tony Davis, Jason Gilmore, Jonathan Hassell, Chris Mills, Dominic Shakeshaft, Jim Sumser Project Manager: Denise Santoro Lincoln Copy Edit Manager: Nicole LeClerc Copy Editor: Julie McNamee Assistant Production Director: Kari Brooks-Copony Production Editor: Kelly Winquist Composition, proofreading, and indexing: Argosy Publishing Artist: Kinetic Publishing Services, LLC Cover Designer: Kurt Krames Manufacturing Director: Tom Debolski Distributed to the book trade worldwide by Springer-Verlag New York, Inc., 233 Spring Street, 6th Floor, New York, NY 10013. Phone 1-800-SPRINGER, fax 201-348-4505, e-mail [email protected], or visit http://www.springeronline.com. For information on translations, please contact Apress directly at 2560 Ninth Street, Suite 219, Berkeley, CA 94710. Phone 510-549-5930, fax 510-549-5939, e-mail [email protected], or visit http://www.apress.com. The information in this book is distributed on an “as is” basis, without warranty. Although every precaution has been taken in the preparation of this work, neither the author(s) nor Apress shall have any liability to any person or entity with respect to any loss or damage caused or alleged to be caused directly or indirectly by the information contained in this work. The source code for this book is available to readers at http://www.apress.com in the Source Code section. You will need to answer questions pertaining to this book to successfully download the code. 6293_FM.fm Page iii Tuesday, November 15, 2005 7:29 PM for Teresa 6293_FM.fm Page iv Tuesday, November 15, 2005 7:29 PM 6293_FM.fm Page v Wednesday, November 16, 2005 10:12 AM Contents at a Glance Foreword. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .xv About the Author . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .xvii About the Technical Reviewer. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xix Acknowledgments. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxi Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxiii ■ CHAPTER 1 Configuration Strategy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 ■ CHAPTER 2 Exception Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45 ■ CHAPTER 3 Master Pages, Themes, and Control Skins . . . . . . . . . . . . . . . . . . . . 93 ■ CHAPTER 4 Developing Reusable Components: The Skinned Page-Message Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111 ■ CHAPTER 5 User Management Tools and Login Controls for Forms Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 151 ■ CHAPTER 6 Managing Profiles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 211 ■ CHAPTER 7 Building Portals Using the Web Parts Framework . . . . . . . . . . . . . 249 ■ CHAPTER 8 Effective Search Tools and Techniques for Your Business Applications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 327 ■ CHAPTER 9 Building a Reusable Reporting Framework . . . . . . . . . . . . . . . . . . . 391 ■ CHAPTER 10 Web-Based Wizards: Avoiding Duplicate Data Entry . . . . . . . . . . 437 ■ CHAPTER 11 Uploading Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 473 ■ CHAPTER 12 Security and Encryption. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 495 ■ CHAPTER 13 Using HTTP Handlers: Request Processing, Image Generation, and Content Management . . . . . . . . . . . . . . . . . 557 ■ INDEX. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 613 v 6293_FM.fm Page vi Tuesday, November 15, 2005 7:29 PM Contents Foreword. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .xv About the Author . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .xvii About the Technical Reviewer. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xix Acknowledgments. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxi Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxiii ■ CHAPTER 1 Configuration Strategy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 New Configuration Tools in ASP.NET 2.0 . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 Web Site Administration Tool . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 ASP.NET Property Page in IIS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Configuration Basics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 Application Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 Connection Strings. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 Configuration Guidelines . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 Strongly Typed Configuration Classes. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 The Strongly Typed Configuration Sample Application . . . . . . . . . . 13 Adding the Web.config File . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 The Config Class. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 Using the Config Class in Your Code . . . . . . . . . . . . . . . . . . . . . . . . . 16 Error Handling in the Config Class . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 Caching Application Settings and Connection Strings . . . . . . . . . . . 18 Custom Configuration Sections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 Configuration Section Architecture. . . . . . . . . . . . . . . . . . . . . . . . . . . 19 Storing Configuration Settings in a Database. . . . . . . . . . . . . . . . . . . . . . . 33 When to Avoid the Web.config File. . . . . . . . . . . . . . . . . . . . . . . . . . . 33 Creating a Database Table to Store Configuration Settings. . . . . . . 34 Avoiding SQL Injection Attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 Creating the DataConfig Class . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 Reading Configuration Values from the Database . . . . . . . . . . . . . . 37 Writing Configuration Values to the Database. . . . . . . . . . . . . . . . . . 38 Properties of the DataConfig Class. . . . . . . . . . . . . . . . . . . . . . . . . . . 39 Serializing and Deserializing Objects in the Database. . . . . . . . . . . 41 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 vi 6293_FM.fm Page vii Wednesday, November 16, 2005 10:14 AM ■ CONTENTS vii ■ CHAPTER 2 Exception Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45 Exception Management Basics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 What Are Exceptions? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 Handling Exceptions with the Try Catch Statement . . . . . . . . . . . . . 46 Using Multiple Catch Statements . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 Catching Specific Errors Using the When Clause . . . . . . . . . . . . . . . 51 Using the Finally Keyword. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52 Throwing Exceptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 Creating Custom Exception Classes. . . . . . . . . . . . . . . . . . . . . . . . . . 54 Inner Exceptions and Exception Wrapping. . . . . . . . . . . . . . . . . . . . . 57 Error Propagation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59 Global Error Handling. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62 IIS versus ASP.NET Errors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62 Defining a Default Error Page for ASP.NET . . . . . . . . . . . . . . . . . . . . 62 Using an ASPX Page as the Default Error Page. . . . . . . . . . . . . . . . . 63 Defining Custom Error Pages in ASP.NET . . . . . . . . . . . . . . . . . . . . . 64 Defining Custom Error Pages in IIS. . . . . . . . . . . . . . . . . . . . . . . . . . . 64 Using the Application Error Event. . . . . . . . . . . . . . . . . . . . . . . . . . . . 66 Logging Exceptions for Analysis. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67 Choosing an Exception Logging Tool . . . . . . . . . . . . . . . . . . . . . . . . . 67 Architecture Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68 Creating the ExceptionLog Table to Store Data. . . . . . . . . . . . . . . . . 69 ExceptionLog Class. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70 ExceptionLogCollection Class . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77 ExceptionLogger Class. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80 Using the ExceptionLogger Class in Your Code. . . . . . . . . . . . . . . . . 84 Reviewing Exceptions Online . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91 ■ CHAPTER 3 Master Pages, Themes, and Control Skins . . . . . . . . . . . . . . . 93 Master Pages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94 Creating a Master Page . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95 Creating Content Pages. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98 Accessing Master Pages from Content Pages. . . . . . . . . . . . . . . . . 101 Defining a Default Master Page for Your Application . . . . . . . . . . . 102 Changing Master Pages in Code. . . . . . . . . . . . . . . . . . . . . . . . . . . . 103 Nested Master Pages. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103 Themes and Control Skins . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105 Creating a Theme. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105 6293_FM.fm Page viii Tuesday, November 15, 2005 7:29 PM viii ■ CONTENTS Adding a Cascading Style Sheet to Your Theme. . . . . . . . . . . . . . . 105 Creating Control Skins for Your Theme . . . . . . . . . . . . . . . . . . . . . . 106 Disabling Control Skins . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107 Creating Named Control Skins for Your Theme. . . . . . . . . . . . . . . . 107 Applying Themes to Specific Pages or the Entire Application. . . . 108 Programming with Themes. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109 ■ CHAPTER 4 Developing Reusable Components: The Skinned Page-Message Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111 New Control Features in ASP.NET 2.0. . . . . . . . . . . . . . . . . . . . . . . . . . . . 112 Design-Time Rendering of User Controls. . . . . . . . . . . . . . . . . . . . . 113 Global Tag Registration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113 Developing Server Controls with the ControlState. . . . . . . . . . . . . . . . . . 115 Building the ControlState Example Control . . . . . . . . . . . . . . . . . . . 115 Creating the ControlState Demo Page . . . . . . . . . . . . . . . . . . . . . . . 119 Viewing the ControlState Behavior in the Demo Page . . . . . . . . . . 120 Building a Skinned Page-Message Control. . . . . . . . . . . . . . . . . . . . . . . . 121 What Is a Skinned Control?. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122 How Does the Server Control Manipulate the UserControl? . . . . . 122 How Are Skinned Controls Implemented?. . . . . . . . . . . . . . . . . . . . 123 Architecture of the Skinned Page-Message Server Control. . . . . . 125 Storage Locations for UserControl Skins. . . . . . . . . . . . . . . . . . . . . 127 Setting Up the Messaging Web Control Project. . . . . . . . . . . . . . . . 128 The Skinned Web Control Class . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128 The MessageDataCollection Class . . . . . . . . . . . . . . . . . . . . . . . . . . 132 Defining a Standard Tag Prefix for Your Control Library . . . . . . . . 140 Design Time Rendering . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 140 Referencing the PageMessageControl in Your Web Project . . . . . 141 Creating the PageMessageControl’s Skin Files. . . . . . . . . . . . . . . . 142 Using the PageMessageControl . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149 ■ CHAPTER 5 User Management Tools and Login Controls for Forms Authentication. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 151 Forms Authentication in ASP.NET . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152 Authentication Modes. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 153 Configuring an Authentication Mode for Your Application. . . . . . . 155 Authentication Tickets in Concept . . . . . . . . . . . . . . . . . . . . . . . . . . 155 6293_FM.fm Page ix Tuesday, November 15, 2005 7:29 PM ■ CONTENTS ix Authentication Cookies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 155 Specifying a Default Login Page and Login Redirection URL. . . . . 156 Other Forms Authentication Configuration Options . . . . . . . . . . . . 156 Manually Implementing Forms Authentication . . . . . . . . . . . . . . . . 159 Working with the Membership and Roles Objects. . . . . . . . . . . . . . . . . . 167 The Membership Object. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 167 The Roles Object. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 171 Programming with the Membership and Role Objects. . . . . . . . . . 173 Configuring the Membership and Role Providers . . . . . . . . . . . . . . 173 Managing Users and Security with the Web Site Administration Tool. . 178 Opening the Web Site Administration Tool . . . . . . . . . . . . . . . . . . . 178 Home Tab . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 178 The Provider Tab. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 178 The Security Tab. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 181 Adding, Editing, and Deleting Users. . . . . . . . . . . . . . . . . . . . . . . . . 189 ASP.NET 2.0 Login Controls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 192 Templated Controls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 193 Creating Templates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 194 The Login Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 196 The LoginView Control. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 199 The Password Recovery Control. . . . . . . . . . . . . . . . . . . . . . . . . . . . 202 The LoginStatus Control. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 205 The LoginName Control. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 205 The CreateUserWizard Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 206 The ChangePassword Control. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 208 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 210 ■ CHAPTER 6 Managing Profiles. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 211 Profile Basics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 212 The Profile Object. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 212 Enabling and Disabling Profiles. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 213 Defining Profile Properties in Web.config . . . . . . . . . . . . . . . . . . . . 213 Creating Profile Property Groups. . . . . . . . . . . . . . . . . . . . . . . . . . . . 214 Implementing a Profile Property Class. . . . . . . . . . . . . . . . . . . . . . . 215 Strongly Typed Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 218 ProfileManager Class. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 219 Working with Anonymous Profiles. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 221 Enabling Anonymous Profile Identification. . . . . . . . . . . . . . . . . . . . 222 When to Use Anonymous Identification . . . . . . . . . . . . . . . . . . . . . . 225 Drawbacks of Anonymous Identification . . . . . . . . . . . . . . . . . . . . . 226