Innovative Perspective

Moving to WordPress!

2009-04-09T00:05:00.009+02:00

This was really a hard decision to take but I have decided to transfer my blog to WordPress: http://innovativeperspective.wordpress.com. All the posts has been imported there, there is nothing missing!

Actually, I didn't expect how fascinating is WordPress as a blogging experience. It gives you more features and tracking statistics. More extensible, more handy and easy to customize. WordPress is more than a blogging system. It gives you Wiki features like adding pages, creating custom friendly links, custom gadgets and more.

This blog - http://mnour.blogspot.com - will be still there, there is no intention to close it. However, it's not expected to publish new posts here in the future.

Please stay tuned and update your feed reader to link to the new blog:
http://feeds2.feedburner.com/innovativeperspective.com

Disaster Recovery - If you fail to plan, plan to fail

2009-04-08T12:21:00.003+02:00

The CuttingEdge Club will organize a two hours session about "Disaster Recovery". The session will be in Wednesday 8th April, 2009 - 5:30 PM, ITWorx - Free Zone. The speaker is Nahla Osman, Quality Team Leader, ITWorx.

CuttingEdgeClub is an ITWorx technical seminar club for technology enthusiasts. Its mission is to provide an easy gateway to pertinent and updated technology information for a growing audience in a simple, pragmatic and accessible way.

Resolution: The Underlying Connection Was Closed

2009-03-28T00:17:00.006+02:00

You usually got this exception when trying to use System.Net.HttpWebRequest class in .NET 1.1 for creating internal URL calls from your ASP.NET code. The exception is also reproducible when trying to invoke webservices using the proxy class.

By default, there is two concurrent connections in every ASP.NET application. As ASP.NET is a service it may require more than two concurrent connections to handle the requests. When you try to request URL from your ASP.NET code, ASP.NET may not be able to handle it. The solution is to increase the number of the concurrent connections which ASP.NET can handle. You can do so by modifying the "connectionManagement" element in the configuration file. For more information about the problem and its resolution, check this post.

yEd Graph Editor Replacement For Visio

2009-03-23T22:55:00.006+02:00

yEd by yWorks is a very nice graphical editor which can be considered a very perfect replacement for Visio. The tool is very simple and provide most of the functionalities of Microsoft Visio. It doesn't provide a very large collection of graph types like in Visio but at least it provides the most used and popular ones. You can create UML diagrams, flowcharts, block diagrams, networks and more. You can have glassy figures, rounded corners, curves, edges and shadows. Although, it's a Java tool, I didn't find it slow or heavy in loading. It's a very powerful graph editor tool and it really worth a try: Download yEd Graph Editior

MIX09 Sessions Videos

2009-03-20T15:43:00.013+02:00

MIX09 is a Web Design and Development Conference which is considered one of the most popular events for web professionals. The conference this year has already been launched in the last March 18th and will end in March 20th. To catchup with the event, you can watch the sessions through this link: MIX09 Sessions

[Update] 29th March, 2009
MIX stuff collected all their videos in one page: Click Here

[Update] 21st March, 2009
Guy Burstein collected all the sessions in his blog post and made available for download. So that you can watch MIX09 videos offline: Download MIX09 Sessions and Watch Offline

Software Security

2009-03-20T15:11:00.011+02:00

In the world of Facebook, E-Commerce and Email; modern threats have emerged exploiting application level vulnerabilities more than ever, A simple bug in a web or desktop application could lead to hundreds thousands dollars loss and sensitive information disclosure. Hence the need for security measures on the application level.

The CuttingEdge Club will organize a two hours session to discover the modern applications threats together with the mitigation techniques, discussing the different activities that should be done throughout the different phase of the software development life cycle to end with a more secure software.

The session will be in Wednesday 25th March, 2009 - 5:30 PM, ITWorx - Free Zone. The speaker is Ahmed Saafan, Information Security Engineer, Raya Security Services.

Blocking IP Addresses Using MMC

2009-03-18T16:27:00.033+02:00

I was searching for a solution to block any communication with specific IP addresses. I have come to this solution using MMC (Microsoft Management Console). The following steps will allow you to block any communication - whatever the protocol is - with specific IP addresses or subnet:

1. Open Start Manu > Run > Write "MMC". Then press Enter.
2. In the Management Console > File > Add/Remove Snap-in...
3. In the opened dialog, leave "Local Computer" as it's and click "Finish".

4. You will have a new node in the left tree called: "IP Secuirty Policies in Local Computer".
5. Right click on this node and select "Create IP Security Policy".
6. In the opened dialog, write "Block IP".
7. Click Next till the end of the wizard and then "Finish".
8. You will have an item in the left pane called: "Block IP". Right click on it and select "Properties".

9. In the opened dialog, click "Add".
10. Go through the wizard, till you reach a step called: "IP Filter List".
11. Click "Add". IP Filter Dialog will open.

12. Modify the name of your IP Filter and click "Add" to add an IP filter policy.
13. Click "Next. Leave "Source Address" as "My IP Address".
14. In the destination address, you can select "A specific IP Address". You can also filter by DNS or subnet. Enter the IP address to block. Then click Next.

15. Leave the protocol to be "Any" and click "Next".
16. Then click "Finish".
17. Apply all changes, and close all the opened windows. You may have to add "Block" action if it doesn't exist.
18. After you finish, don't forget to write click on "Block IP" policy and select "Assign".

Now try to ping the blocked IP addresses. You should get "Destination Unreachable" message.

Maintenance Plans in SQL Server

2009-03-17T13:41:00.014+02:00

Creating backups for your database is an essential task in every environment especially for critical data storage. But have you ever ask yourself how to create your backups in a periodic manner - say every week or so? If you was able to do so, how will you manage the space in your disk? Maybe you don't want to keep any backup files older than one month.

The first solution you may think about is to create a SQL script and execute it in a custom job. But wait, SQL Server can do it for you and save alot of this implementation hassle. In the SQL Server, you have the option to create "Maintenance Plan" for your database. This plan provides you with more advanced options for creating backups for the data and the transactions logs.

When you create a new plan, you will have to go through a configuration wizard. The interesting part is in the backup configurations. You can provide how often you want to backup your database (i.e every week, month or so). You also specify how long you want to keep the backup files and when to remove it (i.e You may remove any backups older than one month) so that you save your storage space. Another interesting point, you can create only one plan for more than one database. The plan can be configured also to create a separate backup folder for each database.

The maintenance plan is a periodic task which needs a running job. This is why it requires a running SQL Server Agent in your database server.

Stories From A Gaming Startup

2009-03-09T14:13:00.009+02:00

CuttingEdgeClub organize a seminar in ITWorx to elaborate a story about how gaming startup can emerge. The seminar is scheduled to be on Wednesday, 11th March, 2009 at 5:30 PM in ITWorx - Free Zone. The session will be provided by Mostafa Ashour - Managing Partner, Khayal Interactive Entertainment.

Resident Evil

2009-03-08T18:03:00.020+02:00

Do you know about the time-bomb viruses? Those ones which start execution in a certain time frame. Today, I have a similar behavior but this time not a virus. It's an evil code.

We have an application on the production environment which has been created seven years ago. The project seems to be working properly for a long time with no massive problems. However, an exception suddenly encountered when any user try to edit some data items.

Microsoft VBScript runtime error '800a0006'
Overflow: 'CInt'
/newsline/newsline/dbshell.asp, line 641

The project was implemented in classic ASP and VB script. If you had the opportunity to work with this crappy-style languages, you can imagine how debugging in this kind of code is missy. So I had no way except to analyze the exception getting the most out of it.

If you notice, it's an overflow exception. This means that CInt has got some large integer number to convert and failed to. After googling, I have found that there is a maximum limit for this method input and it's 32768. From a second look in the exception, you can see that it happens in a file called: "dbshell.asp". This leads to conclude that the number this method is trying to convert is retrieved from the database.

This was actually a good guessing. In the production environment and after seven years, some data table in the database reached to have more than 33974 records. The method couldn't convert any sequence ID for any items with ID larger than 32768. The issue couldn't be captured in the quality test as this low level test case couldn't be considered or even thought to be problematic.

The developer who wrote this code from seven years ago didn't imagine that some day the number of the records will reach this limit. The exception was resident to blow up after these long period. These lead us to an old lesson. At the time of building your application, you don't think that your application will last for long. You need to consider which data you think will go large and which is not. Hence you follow the appropriate guidance in the implementation.

Code Camp '09

2009-02-07T16:07:00.011+02:00

dotNetWork will organize a day called: "Code Camp '09". The day will allow the development professional to introduce several technologies and new Microsoft products. dotNetWork is promising that the day would be one of the biggest events they have ever organized before.

Code Camp '09 is a two day event. It will be held on: Thursday, February 19 and Friday, February 20, 2009. To have more information about the event and the agenda, please visit the event website: Code Camp '09

.network.org user group is a group of youth who share the same passion for the development on .Net platform in Egypt. The group started in the last December 2007 with several technical events during the last year. For more information about the group, visit their website here.

ASP.NET MVC Routing Using XML Custom Configuration Settings

2008-11-23T00:42:00.030+02:00

In ASP.NET MVC application, you need to add some routing code in the Application_Start of the Global.asax file to define your routing criteria. These lines of code take a shape of configuration settings for the MVC application and I was thinking if we can transfer these configurations line of codes to be XML settings in the web.config file. My target is to make the routing configuration in the web.config file as following:

As you can see, the later configurations define the Ignore and Routing lists of the MVC application. In the "Ignore" list, you define the URL criteria to be ignored by the MVC routing. In the "Map" list, you specify a list of the routes including the route name, controller and action. You can also define any optional parameter mappings for your actions.

To do that, I have to create a custom configuration section: MvcRouteConfigurationSectin. The section has a IgnoreCollection - inherited from ConfigurationElementCollection class - of IgnoreItem and another RoutingCollection of RouteItem.

The solution will also add an extension method for RouteCollection object so that you will be able to map the configuration section in the web.config directly to your RouteTable.

To use the project, you just need to include the MvcXmlRouting.dll in your MVC web project. Then you add the following line inside the configSection Tag in web.config:

You then define the ignore and the routing configurations for your web application as defined earlier in the web.config. Finally, you will need to edit the RegisterRoutes method in the Global.asax file to add a couple of lines as following:

Now all your routing configuration will go to the web.config file. No need to edit the Global file anymore. However, changing the routes in the web.config still need to reset your IIS as the routing is registered in Application_Start.

Download: Binary | Source Code

The project is implemented using ASP.NET MVC Beta 1 and Visual Studio 2008. It's not guaranteed that this project or the related assemblies will properly work in earlier or newer version of ASP.NET MVC Framework.

DZone - Vote Up!

Ping Back Links:
- http://blog.51mvc.com/view/20

Hewitt Middle East Best Employer Study

2008-11-13T14:18:00.014+02:00

In the last December 2007, this blog hosted a quick survey to measure the different aspects of the software employers inside Egypt. I am glad to announce that there is another independent initiative showing up these days. Hewitt - a provider of HR outsourcing and consulting services - launches the Best Employers in Middle East 2009 study. The study aims to honor the leading organizations of Middle East as outstanding places to work. Hewitt conducts its Best Employer research in a number of markets, including Eastern Europe, Canada, Latin America and Asia. This survey is designed to be the largest employee research project ever undertaken in Middle East. Hewitt invites all the employers in the Middle East to participate in this survey. The survey will show how effective is your organization and wither it provides a workplace that engages the intellectual and emotional commitment of your employees or not. The study will provide a level of confidentiality so that the names of all participating organizations will be strictly confidential at all points of time. The exception will be those organizations that will be honored as a Hewitt Best Employer in Middle East.

On Finding the Arabic Needle in the e-Haystack

2008-11-12T19:41:00.029+02:00

Lack of information is an issue, but lack of ability to reach the information is a much more serious issue. With internet getting appended everyday with million of new information pages, search engines become unconsciously mandatory to use.

CuttingEdgeClub organize a seminar in ITWorx to elaborate how search engines operates and to highlight the status of the rapidly growing Arabic-Web in particular.

The seminar is scheduled to be on Wednesday, 19th November, 2008 at 5:30 PM in ITWorx - Free Zone. The session will be provided by Hany Abdelkawi - Project Manager, Link Development.

CuttingEdgeClub is an ITWorx Club aims to share information about the latest technologies among the IT community by organizing technical sessions and seminars in a regular base.

.NETWork.org 9th Gathering - Coming Out This November

2008-11-08T23:21:00.030+02:00

.NETWork.org announced the next 9th Gathering to be held in 29th November. The event will be in CIC - Canadian International College and four speakers from ITWorx and Raya Software will be giving the sessions. Here is the list of the topics and speakers:

BizTalk - SharePoint Integration. Hossam El-Deen M. Barakat Senior Software Developer \| Raya Software	Information Architecture Mostafa Mourad Team Leader \| ITWorx
IIS 7 Hossam Kamel Senior Software Engineer \| ITWorx	Applying Domain Driven Design on ASP.NET MVC Mohammed Meligy Senior Software Developer \| Raya Software

.network.org user group is a group of youth who share the same passion for the development on .Net platform in Egypt. The group started in the last December 2007 with a total of eight technical events during the last 10 months. For more information about the group, visit their website here.

PRG Pattern - You're Already Doing it

2008-11-08T21:50:00.012+02:00

Have you ever had this message dialog asking about resubmiting the data when you try to refresh a web page? This actually happen after submitting a form or enter your login information.

One of the good practices when developing web application is to redirect the user after a successful posting request. This practice is refereed as PRG pattern (Post/Redirect/Get). The target is to avoid duplicate post requests from the client and providing a smooth navigation through the web application.

What actually happen in PRG is that the browser try to send an HTTP 303 redirect request along with HTTP "Location" header. It's nice to know that something you're used to make as a default practice is actually a pattern. The following is a sample code in ASP.NET MVC illustrating the usage of the pattern:

[Authorize]
[AcceptVerbs(HttpVerbs.Post)]
public ActionResult ChangePassword(string currentPassword, string newPassword, string confirmPassword)
{
    if (ModelState.IsValid)
    {
        MembershipUser currentUser = Provider.GetUser(User.Identity.Name, true /* userIsOnline */);

        // Attempt to change password
        bool changeSuccessful = currentUser.ChangePassword(currentPassword, newPassword);

        if (changeSuccessful)
           return RedirectToAction("ChangePasswordSuccess"); //PRG Pattern recommendation
    }

    return View();
}

NeatUpload - File Upload Open Source Library

2008-10-01T20:51:00.005+02:00

NeatUpload is a very nice open source ASP.NET component which allow you to make file uploads to file system or database storage with customized AJAX-like progress bar indicators. The library is made in .NET and it works under Mono's XSP/mod_mono or Microsoft's ASP.NET implementation. You can easily download the source code and even modify it to match the required behavior of your project.

The library features 2 custom web controls: InputFile allows the user to select a file to upload, and ProgressBar displays the upload progress either inline or in a popup. ProgressBar uses AJAX-style refreshless updates on modern browsers when JavaScript is available, but also allows users without JavaScript to see upload progress. HttpModule is included as well to get the upload progress and handle the upload context states.

You can download and give it a try from this link: Brettle Development NeatUpload

Microsoft and jQuery Engagement

2008-10-01T20:26:00.019+02:00

It seems that Microsoft is going to include jQuery by default in the new releases of Visual Studio and ASP.NET MVC in the near future. jQeury is a very nice and handy Javascript library which has an increasing acceptance recently in the web development community. Here is a part of the John Resig post in jQuery Blog about this news:

Microsoft is looking to make jQuery part of their official development platform. Their JavaScript offering today includes the ASP.NET Ajax Framework and they’re looking to expand it with the use of jQuery. This means that jQuery will be distributed with Visual Studio (which will include jQuery intellisense, snippets, examples, and documentation).

Additionally Microsoft will be developing additional controls, or widgets, to run on top of jQuery that will be easily deployable within your .NET applications. jQuery helpers will also be included in the server-side portion of .NET development (in addition to the existing helpers) providing complementary functions to existing ASP.NET AJAX capabilities.

Javascript - Access Denied When Calling Window Opener

2008-10-01T19:34:00.012+02:00

We usually use the "open" method in the window object to open a new window in Javascript. However, sometimes you need to change some values in the parent window depending on the changes of the new window elements values or you may need to call a method in the parent window from the child one. To do so, you can use the "opener" property in the window object to access the parent page elements. The following Javascript statement access an input element in the parent window with "txtEmail" ID and update its value:

window.opener.document.getElementById("txtEmail").value = "mohammedn@mailhost.com";

You can even call a method direct in the parent window from the new opened one:

window.opener.SomeMethodInTheParentWindow();

However, you may get "Access Denied" or "Permission Denied" message when trying to access the "opener" property in the popup window. This usually because you call the window.open with the full path of the pop window:

window.open('http://www.domain.com/accounts/register_popup.aspx');

To resolve this issue, use the relative path of the popup page instead of the full path when opening it and you will be able to safely access the opener property of the window.

window.open('accounts/register_popup.aspx');

TeamCity - Continuous Integration Server and Build Management Tool

2008-09-05T22:46:00.045+02:00

TeamCity is a continuous integration & build management solution for both .NET and Java development. TeamCity is developed by JetBrains - the producer of the famous Resharper - and shipped in two editions: Professional Edition and Enterprise Edition. The Professional Edition of the team city is free and you can use it without a need for any kind of licenses. This edition is more than enough for small and medium size company or teams.

Build Servers are very useful tool in any development environment where you need to track the build state of your team code. It make sure that all the committed code is not in a breaking state. The integration with the build servers and the continuous integration tools like SVN and sourcesafe help you to assign the responsibilities of the breaking code to specific developer to fix.

TeamCity is a a very powerful build server which has many features to facilitate your project building process. You can download the last version of TeamCity from here. I have downloaded the last version and played a little bit with it and it seems very interesting tool. When you run it for the first time, you will be asked to make a new account. Then you will have to create a new project by entering the main project information. Afterwords, you will be asked to enter the general settings of the project. Then, you will have to enter a new build configuration. You can have more than one build configuration in the same project allowing a kind of switching for the build needs and requirements for your project.

In "Build Configuration" step, you need to define the build numbers format. You can have your own format for the builds numbers like "CG-01" or "MX-01" or whatever suitable format. You can define the criteria of the build failing. For example, you can define the failing criteria if the building execution itself failed, the project test failed, error reported by the build runner and/or the build take more than a specified number of minutes (timeout).

Also in this page there is a nice feature called "Status Widget". This means you can include the status of your build in any external web page or whatever external tracking site you may use internally. When you enable it, you will have to copy and paste small HTML and CSS tags inside this external page to show your build status.

Then you will be asked to enter the build runner information in "Build Runner" step. In this step, you need to define the platform you will use to build the project. Team City provide several build runners for .NET and Java projects as well. I am working with .NET so I choose MSBuild as a build runner. Then I specified the build file virtual path which is the solution file of my project (ex. teamcitytest.sln). When you select MS Build, you define the suitable .NET Framework version for the build. You also define more command line parameters for MSBuild.exe if required.

Then, you will enter the version control settings like the checkout path if it's different than the default directory of the agent. You can also make automatic labeling if the build succeeded.

There is another nice setting in TeamCity which allow you to run the build periodically. You set it by clicking "Edit Configuration Settings" in the top panel of the build progress screen. Then in the left tabs, choose "Build Triggering". Select "Other Triggering". Check "Automatically start a new build when the previous build failed." and specify the time intervals between the builds.

This was a very quick walkthrough for TeamCity. I really like it and recommend it for your development team as a very efficient and customizable build server.

Google Code Jam 08 - Registeration Started

2008-06-20T02:13:00.005+03:00

Google Code Jam is a coding competition in which professional and student programmers are asked to solve complex algorithmic challenges in a limited amount of time. The contest is all-inclusive: Google Code Jam lets you program in the coding language and development environment of your choice.

Google Code Jam begins in July and continues in August, when you will compete in online rounds against contestants from around the world. The Top 500 participants will advance to onsite competitions at a local Google office to compete against those in their region (Asia Pacific; Europe, Middle East and Africa; and the Americas). The Top 100 will participate in the final round at the Google Headquarters in Mountain View, California on Friday, November 14.

Google offers more than $80,000 in cash prizes for the winners. Don't be left out! Make sure to register between June 17 and July 17, and show your coding creativity in Google Code Jam.

Code Style Review Using Microsoft Source Analysis

2008-06-13T22:02:00.024+03:00

Today, I gave a try for Microsoft Source Analysis aka StyleCop. The tool was internally used inside Microsoft and it's now publicly released. It nicely integrates with Microsoft Visual Studio with the ability to attach the analysis process with the project build - See this post. The tool scan all your C# code and gives you hints for better coding style according to the best practices followed in writing C# code. It gives for example notes regarding the missing comments, formating, missing or extra spaces, extra blank lines and unnecessary brackets.

Here are some sample error messages resulted after running the Source Analysis on one of my projects

- The class must have a documentation header.
- The property must not be placed on a single line. The opening and closing curly brackets must each be placed on their own line.
- Property names begin with an upper-case letter: projectspath.
- All using directives must be placed inside of the namespace.
- The body of the if statement must be wrapped in opening and closing curly brackets.
- Statements or elements wrapped in curly brackets must be followed by a blank line.
- The code must not contain multiple blank lines in a row.
- All properties must be placed after all constructors.

However, there is some drawbacks regarding the tool like it targets only C# developers. More so it can't recognize the spelling mistakes in the code and comments which is one of the most common issues. Another point is that the tool is not flexible regarding its guidelines rules. It doesn't give you the option to exclude a rule in the next time of the analysis scan. For example, it consider putting a preceding underscore in the class private members as a breaking style. However, it is common for most of the C# developers. I think there is already a debate about the best style guidelines for C# coding to follow. The issue even seems to have some historical sides..

I really recommend this tool if you want your team to follow the basics of the C# coding guidelines without caring much about going in details while reviewing their code. It just help you, so that you ignore all the small crappy notes giving all your attention to the real massive mistakes in the coding logic and modules interactions.

You can find more about the tool releases and the future expectations in the Source Analysis blog.

MbUnit 2.4 - Avoiding Crappy Data Resulted From The Test

2008-06-12T22:35:00.050+03:00

One of the nice features in MBUnit 2.4, is the ability to rollback the crappy data in the database resulted from running subsequent test methods. This is really interesting because this crappy data can become a nightmare during the application development or even after the deployment. You will spend pretty much time exploring your data to filter the dirty ones which can lead sometimes to some mistakes.

MbUnit give you the ability to rollback any changes made in the database during the test. Using MbUnit 2.4, this can be done by referring MBUnit.Framework.2.0 in the project references and using RollBack2 attribute for each test method.

[Test]
[RollBack2]
public void InsertNewProductTest()
{
      Product product = Product.CreateNew('Nokia 800', 2300, true);

      Assert.AreEqual('Nokia 800', product.Name);
      Assert.AreEqual(2300, product.Price);
      Assert.AreEqual(true, product.InStock)

      ProductRepository.Persist(product);
}

In the later example, any changes made in the database by persisting the Product object will be rolled back after the test execution. This will keep your tables clean containing only your application live data.

MBUnit uses TransactionScope in System.Transactions to provide the rollback functionality. However, you will need to set some security configurations for the DTC settings in order to make the TransactionScope properly work. To set these settings, open the Component Services in the Administrative tools. Then, show the properties of your computer and select MSDTC tab. Open the Security configurations and setup the needed settings for the remote and local authorization of the transactions on your machine.

As a side note, you are able to track the operating transactions by putting some break points inside your test method. Then, in the Component Services under the Transaction list you will find your active transactions listed there. More so you can check the Transaction Statistics to track the committed and aborted transactions of your test operations.

Thinking In REST

2008-04-18T11:09:00.057+02:00

REST or WS-*? The debate which will never end. While REST is taking the lead gradually, the community see many drawbacks in using the traditional WS-*. The complexity and overhead in using WS-*, REST simplicity and how they fit the web architecture are always the main points of the argument. REST is simple, that is it. It has nothing to deal with except three things: Resources, Verbs and URIs. The idea of making use of the HTTP standards to accomplish all the needed CRUD operations on the resources is really interesting from the service development perspective.

It was clear from the beginning of the WS-* evolution that WS-* violates and ignores the architecture of the Web. It replaces the concept that the Web is identified by URIs to the concept that the services is identified by WS addresses. However, in the RESTful architecture, all the addressing is through URIs. This creates a homogeneous architecture comparing to how the web is actually constructed. Even dealing with URIs as your default addressing help in promoting your service in the search engines results and making it more reachable by your consumers.

WSDL doesn't give you much information about the semantic and logical interactions between the services methods. It just provide a listing for the service methods names, parameters and data types. You can't know for example what shall you need to call first to accomplish a specific task or what this service is actually doing. This is not the case in the RESTful services where you can build you own service documentation. You provide a custom HTTP GET request returning an HTML response with the allowed operations for this specific URI along with any custom documentation you may need to attach. However, you still able to describe your services using the WADL Language - the WSDL equivalent - in case you still need to use a descriptive language for your RESTful services.

Another point to mention is about how REST can make use of the HTTP protocol standards. Suppose you want to make a request to some WS-* service and get the response in several formats. You will need to pass the required response type to the service method or even make a separate method for each type! Neither of the two solutions is convenient. In REST, you can make a solid use of the standard HTTP header. You simply modify the "Accept" field in the HTTP request header with the required content-type of the response. In the server side, you will receive the required content-type in the request header so that you will be able to respond with the corresponding format. This way you save the confusion of your service consumers and make uses of the HTTP header to provide some kind of a separation between the needed request parameters and the other non-related ones.

Another point is about error handling. In REST, you are able to make use of the standard HTTP status codes in a very elegant way. You may respond with standard error 505 for example if the requested resource is not found or with error 401 if you're not authorized to access the resource. So you have a rich standard protocol to build your own services on.

RESTful architecture starts to get more and more acceptance in the web development community. Microsoft provide RESTful capabilites in its WCF Web Programming Model. Google, Yahoo, Amazon and all the big entities are now digging in the RESTful Services. There is something there you should start to care about.

Seekda - Seeking Services On The Web

2008-04-11T21:54:00.008+02:00

SOA is now one of the most valuable options in building integrable and loosely-coupled applications. As much as the number of the web-services increases on the web, indexing the services to be reachable by the seekers became a vital need. seekda! - by Semantic Technology Institute (STI) - is one of the nice efforts to index the business services around the Web. The project is based on the results of another research project funded by the European Union called DIP - which started on 1st January 2004 and came to an end officially on 31 Dec 2006 with total funding of €16.3 M. The project acts like a link between the services providers and service consumers aiming to increase the transparency of the services market across the web.

Open XML Appears to Win ISO Approval

2008-04-05T01:29:00.009+02:00

After more than 14 months of intensive review, a Joint Technical Committee of the International Standardization Organization (ISO) and the International Electrotechnical Commission (IEC) has concluded its formal process to evaluate Ecma International’s submission of the Draft International Standard (DIS) 29500: Office Open XML (Open XML). While the final vote has not yet been announced formally, publicly available information appears to indicate the proposed Open XML standard received extremely broad support. Open XML now joins HTML, PDF and ODF as ISO- and IEC-recognized open document format standards. Read the full story here.

jQuery Validation Plugin

2008-03-24T00:21:00.092+02:00

We start to see several plugins in the web based on the jQuery library. I have the chance today to work a bit with a plugin called: jQuery Validation Plugin by Jörn Zaefferer - which enable you to apply client validation to your web forms using jQuery.

To get started, you have to download the plugin files from this link. And sure the jQuery library as well: jQuery 1.2.2. Then, you should have: jquery.validate.js and jquery.js files reside on your project somewhere and linked in your markup.

IMPORTANT NOTE: I had a problem when using jquery.validate with the new vesrions - higher than 1.2.2 - of jQuery library. jquery.validate uses functions in jQuery library which no longer exist.

The following sample is the simplest one. You use the selector to get the form element. Then, you call the validate function.

<script language="text/javascript">
    $(document).ready( function() {
         $("#simpleSignUp").validate();
    }
</script>

In this case, you will have to set some predefined metadata in the class attribute of the elements telling the library the required rules to apply for the form inputs.

<form id="simpleSignUpForm" action="" method="get">
        <input type="text" id="firstname" class="required" minlength="2"/>
        <input type="text" id="lastname" class="required" minlength="2"/>
        <input type="text" id="username" class="required" minlength="2"/>
        <input type="text" id="email" class="required email" minlength="2"/>
        <input type="text" id="password" class="required" minlength="8" />
        <input type="text" id="website" class="url" />
        <input type="submit" value="Submit" />
</form>

In this case, the plugin will use some defaults error messages for validating the inputs. However, you can have more controls on the errors and rules. The following sample show in details how you can validate a full sign up form elements by specifying the rules with the associated error messages. In this sample, you won't have to apply any CSS styles as you already defines explicitly your rules.

<script type="text/javascript">
        $(document).ready( function() {
               $("#signupForm").validate({
                           rules:{
                                           username:{
                                                               required:true,
                                                               minlength:2
                                           },
                                           password:{
                                                               required:true,
                                                               minLength:5
                                           },
                                           confirm_password:{
                                                               required:true,
                                                               minlength:5,
                                                               equalTo:"#password"
                                           },
                                           email:{
                                                               required:true,
                                                               email:true
                                           },
                                           topic:{
                                                               required:"#newsletter:checked",
                                                               minLength:2
                                           },
                                           agree:"required"
                            },
                            messages:{
                                           username:{
                                                               required:"Please enter a username",
                                                               minLength:"Your username must consist of at least 2 characters"
                                           },
                                           password:{
                                                               required:"Please provide a password"                                                                minLength:"Your password must be at least 5 characters long"
                                           },
                                           confirm_password:{
                                                               required:"Please provide a password",
                                                               minLength:"Your password must be at least 5 characters long",
                                                               equalTo: "Please enter the same password as above"
                                           },
                                           email: "Please enter a valid email address",
                                           agree: "Please accept our policy"
                            }
               });
        }
</script>

For more information about the methods you can use for the validation, check it here.

The way you define your rules and messages are unified and configurable. You define a message per rule which is extremely a need in any web project. It's common to have several validation rules with different error messages in the same web form. When I see this style, I just remember the Design by Contract style in which your requirements (contract) are easily mapped to rules (benefits and obligations). It's similar as you put all your quality matrix in one place. Besides, it's easy to modify as like as you set some configurations to your web form!

Another point to mention is the different scenarios you can have and how this library fit it. In the last sample, you can see how you check for password confirmation, input formats (emails, URLs ... etc.) and user selections.

You can modify the CSS style of your validation errors - i.e how the input controls will look like in case of a validation error occurred. You simply modify the following snippet to have different look for the validated inputs.

div.error { display: none; }
input { border: 1px solid black; }
input:focus { border: 1px dotted black; }
input.error { border: 1px dotted red; }

This plugin is perfect for ASP.NET MVC. Actually, there is already some tries like Validator Toolkit for ASP.NET MVC which enable client and server side validation for MVC. It uses jQuery as well for the client validation. I don't think jQuery Validation is easy to be used in ASP.NET web forms as the page structure actually differs. However, we may find some other versions suitable for ASP.NET Web Forms in the future.

Unlike the ASP.NET validation controls which you need to inject inside your markup, jQuery Validation Plugin puts all the validation rules in one place. I think this really a benefit. In fact, this is one of the benefits of using jQuery itself - thanks for the nice selectors. This style definitely enhance your code readability by separating the validation stuff away from the markup giving the designers - and even the devs - more clean markup to work in.

Get the Last Run Query in SQL Server 2005

2008-03-01T14:40:00.008+02:00

Have you ever run an update or delete query by mistake and you need to roll back or at least want to know the last run query to fix the problem? The following SQL statement can help in that.

SELECT deqs.last_execution_time AS [Time], dest.text AS [Query]
FROM sys.dm_exec_query_stats AS deqs
CROSS APPLY sys.dm_exec_sql_text(deqs.sql_handle) AS dest
ORDER BY deqs.last_execution_time DESC

This will retrieve the last run queries with its execution time.

Inversion of Control & Dependency Injection

2008-03-01T12:58:00.008+02:00

In the last Thursday, 28th Feb. 2008, we had our internal demoday in SK. The day was really informative. We had many interesting topics in different fields. My topic was an introduction about the inversion of control and the dependency injection. You can download it from here:

Download: Internal_Demoday_28_2_08_IoC_DI.pptx

N.B: Most of the examples in the presentation use Sprint.NET as a DI framework.

If you want to go deeper in the topic, I recommend the following article: Inversion of Control Containers and the Dependency Injection pattern. The author is Martin Fowler - Chief Scientist, ThoughtWorks - and the article is considered to be the ideal reference for the topic.

The Root and Top-Level Nameservers

2008-02-23T23:17:00.011+02:00

I was reading: Web Security, Privacy & Commerce by Simson Garfinkel and it was interesting to know that there are only 13 DNS root servers on the internet that are responsible for resolving the IP addresses to the top level domains (e.g: .com, .org, .net). For example, when you write unesco.org on the address bar of your browser, the address will be resolved from right to left. The client computer will ask one of these 13 root servers to resolve the address of .org server which accordingly will be responsible to fetch the address of the unesco.org. The address formats of the root servers is: X.ROOT-SERVERS.NET where X ranges from A to M.

You may have an initial guess that most of these servers exist in the United States. But actually this not correct. Most of the physical root-servers are outside the United States and distributed in multiple locations in different continents. Check the full list here: root-servers.org

The root-servers are completely transparent to the internet users. It's the hidden side of the internet. They are definitely critical zones in the network. This is why they are carefully watched and monitored. As the whole traffic depends on these 13 servers, any crash or unexpected behavior happened in these servers, the internet users will have to memorize the IP addresses to be able to navigate on the internet. Needless to mention that any referral, ads or even bookmarks will be unreachable without the existence of these 13 servers.

Securing Configurations

2008-02-16T13:19:00.052+02:00

Have you ever wanted to provide a level of protection to your values in the configuration files? aspnet_regiis will help you in encrypting the configuration section(s) in your config files. The executable resides in: "<windows_root>\Microsoft.NET\Framework\<framework_version>" and it was common to be used in installing ASP.NET on IIS. However, you can use it as well in encrypting/decrypting the configuration files.

Here is the command line used for encrypting a section in the web.config of SecureWebProj application:

aspnet_regiis.exe -pe connectionStrings -app /SecureWebProj

-pe attribute is used to tell the executable to encrypt the specified section. You can also use -pd attribute instead of -pe if you want to restore or decrypt the section to its original values. -app attribute is for specifying the application virtual path.

After encrypting the connectionStrings section, the web.config will look like that:

<connectionStrings configProtectionProvider="RsaProtectedConfigurationProvider">
    <EncryptedData Type="http://www.w3.org/2001/04/xmlenc#Element" xmlns="http://www.w3.org/2001/04/xmlenc#">
       <EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#tripledes-cbc" />
       <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
          <EncryptedKey xmlns="http://www.w3.org/2001/04/xmlenc#">
              <EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-1_5" />
              <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
                  <KeyName>Rsa Key</KeyName>
              </KeyInfo>
              <CipherData>
                  <CipherValue>j2E3lO/bMp8ljiDFKhRJu33zVD0mrXD7k5WV4nQ5uNJEav7cKcjhtO1ztCfxJw7ZE5uNdj+THVwJroZBoPEhtPAISPH75Zq
                       5C1G+5WOLcBwBBzbcp7C6i6U7+/IWmThTNFRAEdQp/lHryDkapep4MNUCGNZlcVLlmX0n/bqZEoE=</CipherValue>
              </CipherData>
          </EncryptedKey>
       </KeyInfo>
       <CipherData>
           <CipherValue>D/Z9ZyH7P+9e3kDi5gLevpdqbjwia0uQ/cOB0gHVXc8=</CipherValue>
       </CipherData>
    </EncryptedData>
  </connectionStrings>

Sometimes you just need to map the operation direct to the application physical path. This would be useful if you are using ASP.NET Development Server instead of IIS.

aspnet_regiis.exe -pef connectionStrings E:\Projects\SecureWebProj

Encrypting the configuration sections won't prevent you to access the configuration values from your code. If you have already completed the project and you need to encrypt some sections inside the configuration files, you don't have to modify your application code anymore. The code will still run properly and won't be affected by the encryption changes.

The nice part is that you can encrypt the web.config sections even within your code. The following sample encrypts the connectionStrings section in the web.config of SecureWebProj:

Configuration cfg = WebConfigurationManager.OpenWebConfiguration("/SecureWebProj");
ConnectionStringsSection section = (ConnectionStringsSection)(cfg.GetSection("connectionStrings"));
section.SectionInformation.ProtectSection("RsaProtectedConfigurationProvider");
cfg.Save();

You may ask: This is an encryption operation, so where the encryption keys? Actually, each .NET installation will create by default a new key container in your machine formally called: NetFrameworkConfiguarationKey. This will contains the needed keys for the providers to work. However, you can create a new key container using aspnet_regiis as well.

aspnet_regiis.exe -pc SecureKeyContainerName -exp

You may find more about securing your key containers in this MSDN entry: Securing ASP.NET Configuration. In the later command line, -exp attribute means that the key container is exportable. You can export this container to XML file and use it in any other machine. This would be useful if your application is running in a web farm and you want to share the encrypted configurations across the farm machines.

DZone

Mohammed Hossam @ Microsoft

2008-02-14T12:36:00.006+02:00

Great news! My dear friend, Mohammed Hossam, will join Microsoft Live Team in the next May. Mohammed is one of the best techinical professionals I have ever met. You can find that from his blog posts, sessions, initiatives and technical side talks. Mohammed is so effective in his work and his knowledge is always spread among the team. You can feel his innovation, spirit and knowledge when you work with him. He is one of the few guys who is always up-to-date with the new technologies and not always that he tries to use it in real projects if it really fit the needs.

We will miss you Mohammed. We wish you all the best of luck in Microsoft. Keep in touch!

Survey Results

2008-02-03T12:10:00.003+02:00

In December 29th, a survey were published for public to answer - for more details check this post. Here is the results of the survey:

Download the Survey Results: 2008_Survey_Results.zip

[Update] The attempt should be considered as a start to confirm the benefits of these kind of surveys. The results may appear to have some illogical information. Unfortunately, we have only 150 participants. Needless to say that the more you get participations, the more you get accurate results. But still I promised to publish the results even with this small number of participation. I hope to find more similar and effective attempts in the future from authorized and independent organizations in Egypt.

Survey - The Software Industry Inside Egypt

2007-12-29T20:20:00.001+02:00

This survey is one of the first initiatives aims to formulate accurate indicators about the software development industry inside Egypt. The survey will give important information about the current professional level of the software companies. It will try to measure different aspects in the industry like the companies technical level, management, process, salaries and the work environments. The target is to give informative details for the IT stuff to get a clear and transparent information regarding their career.

Please be accurate in your answers as much as you can. Your answer is definitely affect the overall results and the others attitude. The final results will be published here in this blog.

* We don't collect any identity information in this survey.

ANSWER THE SURVEY NOW!

[Update]

[03/2/2008] The survey results have been published. Click here
[31/1/2008] The survey results will be published on Sunday, 3rd February, 2008
[12/1/2008] The survey participation period is extended to 19th Jaunary, 2007

Vote Results: Do you apply design patterns in your software projects?

2007-12-27T16:05:00.001+02:00

This is the result of a vote I made later: Do you apply design patterns in your software projects? The question is to illustrate if the developers really care about learning solutions for already predefined problems. Do you really care about using the best solution to solve a problem?

37 people contributed in the vote. The following is a chart representing people votes.

Design Patterns are a collection of patterns documenting successful solutions for specific problems. The term introduced from a long time. Most of the developers uses the patterns in there daily work, but don't really know that it's a predefined design pattern until they read about it. For more information about the topic, I highly recommend this book: "Design Patterns - Elements of Reusable Object-Oriented Software" by "Erich Gamma, Richard Helm, Ralph Johnson, John Vlissides". For a brief summary about the book, check the Wikipedia Version

Image Resizing

2007-12-22T21:03:00.002+02:00

Sometimes you need to process the users' uploaded images in your web application so that it doesn't take too much space. This can be done either by resizing the uploaded image, saving it in a specific format or may be both.

The following is a code snippet for resizing images and saving it in *.jpeg format. The method take the image file to be resized as a stream, the destination path, the file name to save the image as and the maximum side size of the image (i.e the output image should fit a square of this maximum side size).

public static void ResizeImage(Stream originalImageStream, string destinationFilePath,
                               string destinationFileName, ImageEncoding saveEncoding, int maxSideSize)
{
    int intNewWidth;
    int intNewHeight;

    Bitmap original = new Bitmap(originalImageStream); // your original image

    //Set the image format
    ImageFormat fmtImageFormat = original.RawFormat;

    //Get the image original width and height
    int intOldWidth = original.Width;
    int intOldHeight = original.Height;

    //Determine if Landscape or Portrait
    int intMaxSide;

    if (intOldWidth >= intOldHeight)
    {
        intMaxSide = intOldWidth;
    }
    else
    {
        intMaxSide = intOldHeight;
    }


    if (intMaxSide > maxSideSize)
    {
        //set new width and height
        double dblCoef = maxSideSize / (double)intMaxSide;

        intNewWidth = Convert.ToInt32(dblCoef * intOldWidth);
        intNewHeight = Convert.ToInt32(dblCoef * intOldHeight);
    }
    else
    {
        intNewWidth = intOldWidth;
        intNewHeight = intOldHeight;
    }


    Size resolution = new Size(intNewWidth, intNewHeight); // size of your thumbnail

    Image thumbnail = new Bitmap(original, resolution);

    Graphics g = Graphics.FromImage(thumbnail);

    // The InterpolationMode was the catalyst to eliminate pixelation.
    g.InterpolationMode = InterpolationMode.HighQualityBicubic;
    g.CompositingQuality = CompositingQuality.HighQuality;
    g.SmoothingMode = SmoothingMode.HighQuality;

    g.DrawImage(original, new Rectangle(0, 0, thumbnail.Size.Width, thumbnail.Size.Height));


    // Prepare for a controlled-quality JPEG export
    ImageCodecInfo jpegCodec = GetEncoderInfo("image/jpeg");
    Encoder jpegEncoder = Encoder.Quality;
    EncoderParameters jpegEncoderParameters = new EncoderParameters(1);
    EncoderParameter jpegEncoderQuality = new EncoderParameter(jpegEncoder, 100L /*jpegQuality*/);

    jpegEncoderParameters.Param[0] = jpegEncoderQuality;

    thumbnail.Save(destinationFilePath + destinationFileName + ".jpg", jpegCodec, jpegEncoderParameters);
}

You will have to get the appropriate codec information to save the image.

	ImageCodecInfo jpegCodec = GetEncoderInfo("image/jpeg");
1

The following is the implementation of GetEncoderInfo.

private static ImageCodecInfo GetEncoderInfo(string encoderString)
{
    foreach (ImageCodecInfo info in ImageCodecInfo.GetImageEncoders())
    {
        if (info.MimeType == encoderString)
            return info;
    }

    return null;
}

Simply you loop through all the encoders in ImageCodecInfo to find JPEG codec info. Other codecs info can also be retrieved for other image types like PNG, JIF and BMP.

The interesting point is in specifying the quality of your output image so that you avoid the pixelation problem and make your output image looks smooth. You declare a new Encoder Parameter with the required quality of your output image. Then you pass the encoding parameters when saving the final resized image.

// Prepare for a controlled-quality JPEG export
ImageCodecInfo jpegCodec = GetEncoderInfo("image/jpeg");
Encoder jpegEncoder = Encoder.Quality;
EncoderParameters jpegEncoderParameters = new EncoderParameters(1);
EncoderParameter jpegEncoderQuality = new EncoderParameter(jpegEncoder, 100L /*jpegQuality*/);

jpegEncoderParameters.Param[0] = jpegEncoderQuality;

The quality encoder parameter may have varying values (i.e. 25L, 50L, 75L and 100L). You will have to tune it to balance the quality with the output image size.

Another point to mention that there are many other interesting encoders you can make use of like Encoder.Transformation - which allowing you to rotate or swap your images. You can find more information here.

Language-specific Code Compilation in App_Code

2007-12-20T23:32:00.000+02:00

App_Code folder is the default location to add your code files for your ASP.NET project. You may have the situation when you want to add mixed code files written in different languages i.e C# or VB.Net and you need to include these mixed files in the project compilation. The question: Can I have mixed files some written in C# and others in VB.NET in the App_Code folder? Yes, you can but in limitation. First, you will have to add different folders for each language-specific code. Then, in web.config add an entry for each folder inside CodeSubDirectories tag.

<?xml version="1.0"?>
<configuration>
   <system.web>
         <compilation debug="true">
                <codeSubDirectories>
                        <add directoryName="CSharpFolder"/>  
                        <add directoryName="VBFolder"/>  
                </codeSubDirectories>
         </compilation>
   </system.web>
</configuration>

If the folder you added to codeSubDirectories tag doesn't physically exist, you will have a compilation error.

The code subdirectory '/MyProject/App_Code/CSharpFolder/' does not exist. E:\Projects\MyProject\web.config

ASP.NET MVC Framework CTP is Finally Released.

2007-12-10T13:56:00.001+02:00

ASP.NET MVC CTP is finally released. The framework is released as a part of new ASP.NET 3.5 Extensions package. The extensions includes some new stuff beside the MVC framewok like: The Entity Framework, new additions for ASP.NET AJAX and others.

Download ASP.NET 3.5 Extensions

Scott Guthrie published a series of articles about MVC. Here is the full list:

ASP.NET MVC Framework: Introduction
ASP.NET MVC Framework (Part2): URL Routing
ASP.NET MVC Framework (Part3): Passing ViewData From Controllers to Views
ASP.NET MVC Framework (Part4): Handling Form Edit and Post Scenarios

Scrum in Action

2007-10-20T16:58:00.002+02:00

We are now working in a project which have taken more than 6+ months and still in progress. 159078+ lines of code, 80+ page, 120+ user controls, 100+ tables and counting. In projects with such scale, you need to manage and control your development life cycle. You want to decrease all risks and possibilities of failure. Working with Scrum methodology helps a lot in making developers time management more efficient.

I'll try to state some points which helps us during the development of the project. My recommendation points maybe a part of the scrum definition and maybe not. But sometimes practice is more trivial than science. The following are the concluded results.

Design meetings: In each project you have to design. But as a fact, the design will change. So all what you need is to put the outlines. You don't have to state all the details. Try to make the design meetings for things which is really need a heavy mind storming and architecture. This includes frameworks, libraries and infrastructures. Discussing the design of each part in the project is a time consuming and won't help you that much.

Time Estimation: When estimating the time of the tasks, it should be in the presence of your team members as it's a part of the sprint planning. The sprint planning is usually a long boring meeting. For each task, each member will make an estimate. Then the average will be the final estimate of the task. If some member give an estimation which isn't reasonable or far away of the others estimations average, you start to ask him why? He may know something in the task which is mysterious, may take more time or may need more resources. Depending on all these discussions you will get a better estimation and better time management.

Another point, if a task will take more than 2 days, you should start to think about dividing it. Most of the uncompleted and bottlenecks in the projects are the long estimated tasks. The estimation of the long tasks are usually not accurate. Even the scrum master won't be able to know your progress each day if you just telling him "I am still working on it". Try to divide your task to smaller parts so that you can give it a better estimation.

Daily meetings: The essence of the scrum is the daily scrum meetings. If you didn't do it daily you will lose process monitoring. The team activity will be degraded. You won't be able to finish the work on the estimated time. Try to keep on this 15 min. meeting every day. Try to keep these meetings physical as much as you can. I mean here to avoid instant messaging meetings or such stuff. Instant messaging meetings takes much time than the physical ones. People don't take care about the time while messaging and the scrum master won't be able to control it. Try to determine a fixed time for the meeting each day - ideally - 15-30 min. maximum - and make sure it doesn't exceed the time limit.

Code Review: Usually you will need to refactor some parts of your code with your teammates. Code Review Meeting is your way to do that. Problems exists when you try to make "code reviews" as a rule in each sprint. It doesn't work like that. From my experience don't do any code review if you don't have a predefined list of your targets and you really have a problem you want to solve. If you have nothing to review in these meetings, then it will be a hassle and it will be something other than a technical meeting! It will be time consuming and the meeting will end up with nothing. Specify the targets of the meeting before scheduling it. Team members may inform the scrum master if they think there is a part in their code should be refactored in attendance of the other team members.

Design Changes Reporting: Keep all design documents on your source control or repository folder. Make sure that any updates on the designs, flow, sequence diagrams or even requirements modifications are accessible for all the team members. Problems occurred if one of the team members changes something in the design or the flow and didn't inform the others about it. The best practice is to update your documents with any modifications and commit it in your repository. Not only that but you should inform the others about your modifications and the member you think his work will be affected with your changes.

Bug Fixing: During the sprint, testers may start to test your work of the previous ones. Bugs will be accumulated and it's not considered as a part of the sprint estimation. You have 2 choices, either allocate a member in your team to fix all these stuff or assign the bugs to their owners. The later option - if not well controlled - will contradict with the scrum rules. The developers will have an increasing bug list and will feel that they don't make any progress. The solution is to postpone any generated bugs through the sprint to the next one. Testing the work during the development is really a mess . Testers may report some bugs which are features to be implemented on the sprint. Still the bugs should be reported but not assigned to the developers during the sprint. It should be postponed. In the next sprint meeting it will be considered in the developers estimation.

Injecting Members to the Team: You have time constraints and you want your developers to take care of the new features. But in the same time, you have a list of bugs to be fixed. Don't inject external developers to fix these bugs. Especially if they don't have enough idea about the project and the requirements. You will end up with a longer bug list!

This is my review about the best practice which makes the scrum process more efficient. Still it's not that perfect on all the time. Try to modify the process to fit your needs. Although learning and reading is so important to improve your process, but still nothing better than practice.

Dzone - Vote for for this article!
Stumbleupon - Add Your Review

Finally MVC Model For ASP.NET

2007-10-09T23:42:00.001+02:00

Finally we will have MVC model for ASP.NET. This was announced on Alt.Net Conference last day. In my opinion, this will be one of the most interesting feature added to ASP.NET. MVC is one of the old design patterns which introduced in many object-oriented languages. In MVC pattern, controllers just handle application flow, models represent the data, and the view is just concerned about presentation logic. The model was first introduced in SmallTalk. It is widely used on many other web frameworks like Zend Framework for PHP and MoneRail.

I was reading about Zend Framework from a while and I liked the way which they separate their pages and controllers classes. The model itself has a great trust from many web developers especially when building large scale projects where updatability is a critical issue.

Using MVC model, you will be able to define you application URLs like:
http://domain_name/Controller/Action/Parameter1/Parameter2/...

Where you map a URL to a certain Controller and action.

Read more about this topic here.
For more about MVC Model, check out this post

SKDD2 - Windows Workflow Foundation Session

2007-08-12T15:47:00.000+03:00

This is one of the sessions held on SilverKey DemoDay 2 - Cairo Conference Center. The session was an introduction to Windows Workflow Foundation and how it can help you in automating you business process in an entire organization. The session was in Arabic language. If you're interested, you can download the session materials to try out the demos and check out the slides. I will try to keep track of all other videos of SKDD 2 and link it on this post as soon as being available. So, keep watching!

Updates:
SOA via WCF Part 1 and Part 2 - By Mohammed Hossam

Why Employees Leave Organization?

2007-08-10T20:11:00.001+03:00

This is an article of Azim Premji - Chairman & CEO of Wipro - explains why employees leave their organizations - even it seems that their choice in the begining was right. The conclusion that if you start losing talented people in your organization, you should start looking to their immediate managers. As a fact, People leaves Managers not Companies. Humiliation, Stress, being too controlled are all reasons making employees leave. Check out more about the reasons here:

Why Employees Leave Organizations?

SubSonic - Free DAL Generator

2007-08-05T17:24:00.000+03:00

Data Access layer generation is one of the exhausting tasks in building any multi-tier software projects. SubSonic is one of the free .NET Data Layer Generators which can help to make your life easier. The generator is really simple to use and efficient. You can do almost all the needed SQL operations using simple method calling. Moreover it's an Open source and the source is available on CodePlex.

Learn More About SubSonic
HOW-TO Video

Information Source: Mohammed Tayseer

New ASP.Net PageFlow Framework available for Download

2007-07-24T02:05:00.000+03:00

New UI Workflow Framework was recently available for download. The framework brings Workflow and UI applications together - This includes ASP.NET applications as well. The source code of the framework and some sample applications built on top of it - is included. The design document describing the entire architecture of the framework is also included.

To learn more about PageFlow Framework, check this post:
More About PageFlow Framework

To download the framework:
Download Pageflow Framework

Touring the Windows Workflow Foundation Team Offices

2007-07-22T16:27:00.000+03:00

This is very nice tour video in Windows Workflow Foundation Team Offices. You will meet those WF guys - the creators of this technology. The video is out there for a while and I just found it while navigating on channel 9. But really very interesting one.

WWF - Windows Workflow Foundation - is a solution provided by Microsoft as a core component on .NET Framework 3.0 for business process automation.

Introducing Windows Workflow Foundation

2007-07-21T19:23:00.002+03:00

This is a brief post introducing Windows Workflow Foundation - We will try to introduce basic concepts and definitions. We will know also why Workflow Foundation can be useful for building large scale projects.

Workflow - Concept & Definition

First let's start by defining Workflow as a word - according to wikipedia definition: "A workflow is a reliably repeatable pattern of activity enabled by a systematic organization of resources, defined roles and mass, energy and information flows, into a work process that can be documented and learned". In workflow-based projects you have a certain flow defines a specific organization or business process. Through this flow, you can't do a certain step in this business flow without making sure that one or more pre-request steps are completed.

If you think a little about this model, you will find most of the applications you develop daily can fit in this definition. You have a certain logic and business rules you want to automate. Ideal Examples will include: Document Management Applications, Insurance/Financial Applications, Governmental Projects and Customer-Relationship Management Applications.

This type of applications have some specific characteristics. These applications has high rate/cost of change over time. Your client may come after a while saying that the flow of the application is to be modified. He needs to add another step inside the current flow which is not currently exist. He wants to remove a flow path. He wants to manage more information on his business flow.

This also make us think about the usability. You're not using the flow one time. Suppose you build an automation software for a Hospital and you still get many deals for the same industry. In most of the cases, the features will be common for the same projects in the same industry field. You may need a way to build a flow once and use it as more as you need for any kind of projects serving the Medical industry for instance. It's all about productivity. Building once and use whenever you need.

Windows Workflow Foundation

WWF - Windows Workflow Foundation - is a solution provided in .NET 3.0 to solve most of these problems. You're able to define your organization flow in a graphical way using Workflow Designer Component which can be hosted - not only on Visual Studio - but on any other hosting applications you may develop. This gives you some kind of extensibility of building your own flow and enables business administrators or manager to change the business flow even on-the-fly.

Another side of extensibility that you can build your own libraries for domain specific activities. This help in increasing your development usability and so the productivity.

The extensibility is not limited for this point. The Workflow runtime is the engine which handle the creation of the Workflow Instances. Extensibility applies here as well. You may extend the behavior of the runtime itself. You may change the default way of persistence. You may want to change the persistence so that you don't save the state of the workflow on the database and decide to persist it on another media like XML or whatever.

Windows Workflow Process Types

Let's talk about the workflow types provided by WF. WF provides two types of workflow. The first one is called Sequential Workflow. This one will be your choice when you know exactly the predefined path your application should follow. This type is most like a flowchart. You have conditions, loops and rules stuff which control the desired flow of your workflow.

The second type is called: State-Machine Workflow. Here you have a collections of states and you define the flow so that state-A will go to state-B - if and only if - a certain event or trigger is raised. This kind of flow helps when you don't have a predefined flow and states may go to many other states in non-ordered way.

What the best model of building workflow-based applications? The best model for this kind of projects is MVC model - Model View Controller. The model here is mapped to the "Workflow" engine, the View is your UI and the Controller is controlling the flow between the Model and View. So that, the UI (View) don't know that it's controlled by the Workflow engine and vise versa - the Workflow doesn't know that it controls the UI.

Starting Up

You will need - .NET Framework 3.0 or higher - installed on your machine and - Workflow extension - for Visual Studio 2005. The last one will include the Workflow Designer for Visual Studio 2005 - this is not compatible with Visual Studio Express Edition - and project templates for building workflow projects. You start building your flow using the Workflow Designer. Your flow can be represented on either XML or Code. For XML, you will have an XML representation of your workflow in an *.xoml file. This is best solutions if you may change this XML later or even auto generate it with any other tools. The other representation is representing the Workflow as Code. Your workflow will be represented as a class which you can use when instantiating workflow instances using Workflow Runtime.

SKDD II - Another Success

2007-07-08T02:38:00.000+03:00

Today, we had our SKDD 2 event on Cairo Conference Center. The day was really amazing. We discussed many topics and technologies. My session was about "Business Automation Using WF". We discussed how Windows Workflow Foundation can help you in automating your business process in an efficient and transparent way. For interested people, the materials, videos and demos will be available on demoday.us soon. Feel free to add your comments and feedback about the day and the sessions. Thanks for all people who attended this day and thanks for all SK stuff who made this day that great.

Update: Download Demoday Materials

Microsoft Releases First Public Longhorn Beta

2007-04-28T13:10:00.000+03:00

Microsoft has moved forward on the server side of the OS equation. The company just released the first public beta of Windows Server, aka Longhorn. It's widely available for download by just about anyone who wants it. And finally, the OS is feature complete.

Download Windows Server - Code Name Longhorn - Beta 3

Copied - eWeek.com

New Way in Searching

2007-04-12T11:45:00.000+02:00

We usually get the new searching inventions from Google. This time we have a new search way introduced by alltheweb. It depends on something like AJAX style searching or auto-complete search. While typing, you get some suggested keywords which help you get results faster.

AllTheWeb Live Search

Propagation of Trust & Distrust

2007-03-30T15:24:00.000+02:00

Yesterday, I presented my session in SilverKey Internal Demo Day. The topic title was: "Propagation of Trust And Distrust". There is currently a great interest in maintaining and building trusting networks between the communities members so that you allow users to get the "high" quality of information before acting on it.

Many variants of algorithms and techniques introduced. The techniques of trusting propagation are applied in many well known websites such as Epinion and eBay. In my session, I presented a mathematical approach which introduced by IBM researchers and applied in a wide range of data in Epinion

Open XML and Java

2007-03-21T11:58:00.000+02:00

As you know Open XML doesn't target only Microsoft products. That is - we find currently many ambitious projects to enhance other programming languages and frameworks to make use of Open XML capabilities. Java is one of the main targets here. This is a meeting with Julien Chable who worked in an open-source API project to provide the functionality of System.IO.Packaging - which used in .NET Framework 3.0 - to the Java developers.

IP-To-Country Mapping

2007-03-19T13:22:00.000+02:00

I have just found this interesting IP-To-Country mapping database which enables you to map a certain IP Number to Country. The problem is that this database is not alwayes up-to-date. So, you may take care of this point when you using it. Also, you should check the copyrights section if you want to use it in a commercial applications. The database uses IP Number ranges for identifying the addressed country.

Virtual Earth 3D Control

2007-03-12T19:34:00.000+02:00

The Virtual Earth 3D control is a new tool released by Microsoft for visualizing the entire world in three dimensions. Rather than a standalone application, Virtual Earth™ 3D is implemented as a managed control, which allows seamless integration with Web sites or standalone applications. The Microsoft^® .NET Framework security model gives users the capability of dynamically loading plug-ins to supply data, but restricting them to execution in a partial-trust environment.

Get More Details

Customer-Developer Relationship

2007-03-12T12:55:00.000+02:00

I was reading on "Agile Software Development Ecosystems"- Chapter 5: Delivering Something Useful. The chapter was talking about the customer-developer relationship and the best methodolgoies which should be followed.

One of the points I liked in this chapter which was talking about demand-driven methodology when you're dealing with your customer. That is you should try to avoid forcasting as much as you can and wait for the customer to demand this feature. This will avoid any missunderstanding and minimize the effort of doing the task and changing it afterwards.

Another nice point, when the author was talking about the developers of customer-domain knowledge. Actually, this skill is rarely to find in most of the developers. Customer-domain aware developers - who have the ability to know the terminology used by the customers, recommend features based on their knowledge, and even use their own experience to fill in details-level requirements gaps. In my point of view, this is a kind of "Good" forecasting which is based on knowledge as developer of this kind know by experience what the customer will demand and what can be done to make the customer life easier. This customer-domain awareness save a lot of time which might be consumed in fixing and modifying the features after customer reviewing.

Also, the chapter was talking about the Proxy Users - the ones we called: "System Analysts". The chapter discussed how Proxy Users are important in the customer-developer relationship. The point which take my interest was that Proxy users sometimes fall in a problem when they begin to believe that they actually are the customers! and start to block the direct contact between the developers and real customers. This will increase the probability of failure to deliver the project as expected by the customer and will increase the number of iterations needed to resolve the requirement.

Digg This Post!

My Post on OpenXMLDeveloper.org

2007-03-08T23:57:00.000+02:00

My post about Generating Dynamic OpenXML Docx Files is now on OpenXMLDeveloper.org - The Official Microsoft site for OpenXML. Check the post on OpenXMLDeveloper.org

Visual Studio Code Name "Orcas" March CTP Available Now!

2007-03-01T20:21:00.000+02:00

Get an early look at Visual Studio codename "Orcas". Orcas CTP is now available. The next version of Visual Studio, Visual Studio code name “Orcas”, will provide an industry-leading developer experience for Windows Vista, the 2007 Microsoft Office system, and the Web. In addition, it will continue in the Microsoft tradition of development language innovation.

100 Best Employers

2007-03-01T13:58:00.000+02:00

Maybe you see it before, here is the 100 Best Employers according to Fortune Magazine survey.

Digg it!

Generating Dynamic OpenXML Docx Files

2007-02-27T21:42:00.000+02:00

Recently, I needed to integrate one of my applications to MS Office Word 2007 by generating dynamic *.docx reports. Actually, I didn't want to just find the steps to do it. I wanted to make a reusable library so that, I can use it independently in any project in the future.

Introducing Docx File Format

In Office 2007, new file formats are introduced such as docx (for MS Word) and xlsx for (MS Excel). These extensions are based on an ECMA OpenXML standard which enables you to define your data and styles based an XML format specifications (such as wordprocessorML for word and spreadsheetML for excel). So, in the end, it's just an XML and you easily control the style, data and configuration of your office documents by modifying some XML documents.

Here, I will focus on the new MS Word file format - docx. The format is actually a zip achieve file which means you can open it using any zip extractors. The *.docx file itself is called Package. When you unzip the content of *.docx file, you will have a collection of folders and XML files. Each file is called part. These parts contains all the needed styles, layout, fonts and configurations of your word document. And the relations between these parts or files are also defined in XML. This is an important point here as XML-like files enable the developers to change the file style or even the entire data using any programming language. It's not about Microsoft technologies. OpenXML is now an ECMA standard and the format now is accessible to any programming language.

The XML part of interest in docx files is "document.xml". This part contains all the data written in the word document. To see its formate, try to make a word document, write any text inside it, unzip, open document.xml which exists in "word" folder and see how your word document is expressed as XML file.

GenericWordDocument Class

In this section, I will explain my library design which I made to generate my dynamic documents. I created a class called GenericWordDocument. This is the main class in my library. Beside this class, I created a base class called TemplateFile. This class represents the docx template file which my document will inherits its styles, fonts and main characteristics. This help me so that I can make all the static visualization by hand (just by opening Office 2007, set the colors, document header, footers and all lovely static staff) and then use these visualization in my generated document by taking a copy of this template and modify it dynamically within my program.

I have also some additional classes for generating dynamic data. The first one is Iterator Class and the other one called TemplateRepeatedItem which is inherited from TemplateItem. So that you can have a repeated data to be generate in the word document. Simply you set the XML style of the iterator, when a new Item created in the Iterator it will inherit the style and reformulate itself with the manipulated data.

So, suppose I want to generate a simple word report for some products in my store. I will make a docx template file, add some keywords inside it such as: "#STORE_NAME#", "#COMPANY_NAME#" and so on. This keyword will be replaced with my data within my program. The following snippet show how I will use GenericWordDocument in this simple case:

Suppose, I want to generate iterated rows for some products in my company store. I write down something like that:

Also, you can make nested iterations as each iterator aggregate another iterator inside it. So, you can generate Product list and for each product you can, for example, list its accessories.

Reading/Editing XML Parts

.NET Framework 3.0 gives you the ability to read *.docx files and its XML parts using WindowsBase assembly. You just add a reference for WindowsBase assembly to your project and you can access the inner hierarchy and parts of docx format without extracting it.

The following is a method which read document.xml part from the docx file:

And the following snippet is the part which generate the word document and write the modified XML to document.xml

More about OpenXML?

I recommend these links for learning more about Office OpenXML - OOML and the new MS Office 2007 file formats:

Conclusion

In this post, I tried to make use of OpenXML format of the docx file to create dynamic word documents. I think the new OpenXML formats of Office 2007 is a worthy addition to the Microsoft products interoperability which will increase the developers ability to create more usable and productive projects.

Digg it
Vote For it

Average .NET Developers Salaries

2007-02-24T03:07:00.000+02:00

Are .Net developers really paid higher salaries than the traditional development languages? I have just found this survey about the average salaries for developers in UK. The survey covers several development languages like C++, JAVA, .NET and Delphi. It was made in August-October 2006. You may check it here:

Average Salaries Survey

Filtering Procedures.. Do you make it right?

2007-02-23T20:36:00.000+02:00

All of us do filtering in their project. It's one of the most repeated functionalities. But do we make it well? How do you make your filtering procedures? Ok.. Have a look on the following one:

CREATE PROCEDURE std_GetFiles
@fileCategory varchar(50),
@tag varchar(50)
AS
declare @SQL as nvarchar(200)

SET @sql = 'SELECT * FROM tscoFileIndex WHERE '

if @fileCategory <> null
set @sql = @sql + ' FileCategory = ' + @fileCategory + ' and '

if @tag <> null
set @sql = @sql + ' tag = ' + @tag + ' and '

SET @SQL= LEFT(@SQL, LEN(@SQL) -4)

GO

This is the first way come to your mind when you trying to do filtering. But take care. Actually, all the string concatenation in this procedure make your data under threaten. As this allow procedure users to inject sql statements inside your concatenated query by passing unexpected paramaters through "fileName" and "tag" inputs. Also the many if conditions here affects your procedure performance.

The alternative, which is better than this, would be something like that:

CREATE PROCEDURE std_GetFiles
@fileCategory varchar(50),
@tag varchar(50)
AS

SELECT *
FROM tscoFileIndex
WHERE (@fileCategory is null OR FileCategory = @fileCategory ) AND (@tag is null OR tag = @tag)

GO

So, you match all rows if the parameter is null, and use the
condition when the parameter is not null.

MDC07 Review

2007-02-11T11:42:00.000+02:00

As you know, MDC07 started in last 4th Feb. and remains for 4 days. The conference in general was very good, however some faults and management drawbacks affected its ultimate success.

Actually, I didn't attend Day 0, which has some problem in registration process (depending on attendees comments in this day). So, I will start talking about Day 1. In this day, The Keynote was so bad for a big conference like MDC. They have interviewed some young children who have basic programming skills, introducing windows vista and office features, interviewing with some business guys from ITWorx and Investment Ministry. The keynote wasn't informative at all as most of the attendees are developers and they are not interested in such stuff.

Afterwards, I attend "Patrick Hynds" session. The session was talking about some tips for ASP.NET. Although, Patrick is one of the most popular speakers, in this MDC, he wasn't that good in choosing his session subjects. I felt that he didn't have anything new to talk about.

I attend also "Agile Methodology" session, one of the most exciting and informative sessions in this MDC. The speakers was two members in "Microsoft patterns & practices" in Microsoft HQ. The session was discussing the Agile Methodologies, XP Methods and Pair Programming.

Then, attending Delving into VSTS for Software Testers. It was nice to see the Microsoft investment in Testing Module in VSTS. Not only API testing, but also some interesting testing techniques for the load and performance of your applications.

In Day 2, some sessions were cancelled or removed, which was so confusing! I attended a session about VSTS tools for System Architects. The speaker was Microsoft guy called "Abhishek Mathur". So interested session. Afterwards, attended another session about ASP.NET AJAX-Style Server Controls for "Patrik Hynds". It was interested to know how to build your own ajax-style server controls if the current one doesn't fit your requirements. Then, I attended a session about Workflow Foundation. It wasn't so informative. Only some introduction. We expected more than that.

The conference as overall was above average, not so perfect. However, the organization was better than the last years. The place - Cairo conference center - is better and perfect for this large event. Very nice ideas introduced in this conference such as encouraging students to join ImagineCup competition and supporting the online Egyptian communities. I think the sessions needs to target more the developers needs, removing all the propaganda stuff. We hope for better organization in the next years.

AutoCompleteExtender Problem

2007-01-24T14:59:00.002+02:00

IMPORTANT NOTE: This problem was found when I was working with AJAX RC1.

Recently, I tried to add an AutoCompleteExtender for each item in a repeater (which itself is inside an UpdatePanel). In each item, I added also Edit/Update links, textbox and AutoCompleteExtender. Here is the HTML view

However, it seems that TargetControlID property is not affected when the autocomplete set inside the repeater/updatepanel (Actually, don't know which one is the reason). But what I did is to set the TaregtControlID property of the extender in runtime, when the user trying to edit a certain item.

That is all!

AJAX Version 1.0 Available Now!

2007-01-24T13:45:00.000+02:00

AJAX Version 1.0 is now released for market and available to download.

To download the full version, visit: ASP.NET Offical Site

ASP.NET AJAX is a free framework for quickly creating a new generation of more efficient, more interactive and highly-personalized Web experiences that work across all the most popular browsers.

With ASP.NET AJAX, you can:

Create next-generation interfaces with reusable AJAX components.
Enhance existing Web pages using powerful AJAX controls with support for all modern browsers.

Continue using Visual Studio 2005 to take your ASP.NET 2.0 sites to the next level.
Access remote services and data directly from the browser without writing a ton of complicated script.

Enjoy the benefits of a free framework with 24x7 technical support provided by Microsoft.

Paging Implementation With SQL

2007-01-24T12:26:00.000+02:00

When you see how the paging is a piece-of-cake now in .NET server controls (like GridView), you should imagine how much amount of work is needed to do paging in early days. On of the suggestions was to fetch all the data block and store them on a session variable or any such temporary allocation and just do your paging in you business layer! Ok..I hear someone say what a silly solution! That is true. This is really a mess when you working on huge data blocks. So, the best way is to do you paging in your data layer.

You may ask? why I should consider paging while I have ready-to-use paging server controls? .. Well, Although, .NET provide ready-to-use controls with paging feature (like GridView), you still need to implement paging inline for other controls such as Repeaters and Datalists.

Recently, I was searching for doing paging using a single SQL statement. Unfortunatily, solutions differ from DBMS to another. For example, in MySQL, you can make the paging using a SQL statement like that:

SELECT fields FROM table LIMIT $offset,$pgsize

In the other side, SQL Server doesn't have such keywords for paging. But still there is a solution. You can go around and use "TOP" keyword to do the paging using SQL. For example, if your page size is PAGESIZE, you can divide you data to several pages as following:

SELECT TOP PAGESIZE * FROM EMP WHERE ID NOT IN (SELECT TOP OFFSET ID FROM EMP)

PAGSIZE is constant,and you just change the OFFSET. For example, if your PAGESIZE is 20, then your offset should be: 0, 20, 40 and so on. I think this SQL statement is a piece of art! I really like it!

MDC2007 Registeration Starting Up

2007-01-13T18:19:00.000+02:00

MDC2007 started up its registeration process for attending the event. MDC 2007 is the biggest Developers' Conference of the year in the Middle East, and is a critical event for any developer who wants to see the newest as well as the next-generation technology. MDC07 is full of sessions and activities that help you learn the current and future of the Microsoft platform and get to know people who are as passionate about software as you are.

MDC2007 will be held in Cairo International Conference Center, between February 4-7. The registeration fees is 100 Egyptian Bound, which you will have to pay in the first of February, 2007 in Cairo International Center.

For Registeration, Visit MDC2007 Official Site

iPhone - New Apple Device

2007-01-13T01:16:00.000+02:00

iPhone combines three products — a revolutionary mobile phone, a widescreen iPod with touch controls, and a breakthrough Internet communications device with desktop-class email, web browsing, maps, and searching — into one small and lightweight handheld device. iPhone also introduces an entirely new user interface based on a large multi-touch display and pioneering new software, letting you control everything with just your fingers. So it ushers in an era of software power and sophistication never before seen in a mobile device, completely redefining what you can do on a mobile phone.

The phone will be available in two models, 4GB and 8GB priced at $499 and $599 respectively, and will ship to the US in June of this year. Europe will get the phone in the fourth quarter, while Asia will wait till 2008.

It's nice to mention that Microsoft has recently released Zune. In my opinion, iPhone has crashed any expectations and provide ultimate features which can't be compared with Zune such as internet access and mobile phone cababilities.

On the other hand, Cisco sues Apple over use of iPhone trademark. Cisco said in the complaint that Apple had attempted to get rights to the iPhone name several times, but after Cisco refused, the company created a front company to try to acquire the rights another way, according to the lawsuit. For more about this issue, click here.

Finally, it's the industry challenge and days will be tell us who wins.

Zune: The Microsoft iPod

2007-01-01T23:11:00.000+02:00

It seems that Microsoft want to straggle in all the fields even in the Media and Music World. Now, we have a new competitor for iPod - The Apple Product - which is introduced as Zune. Zune is a new handled device for music and media gives you almost the same features of iPod and maybe better. Explore more about it here: Zune - Official Site

Depending on this post, Zune has some key features which may lead to a great success over iPod. For example, Zune gives you the WiFi conectivity feature which is an attractive way in sharing songs and videos. However, you can't connect to the internet through it (see this). Also, the wide screen is something attractive for Zune fans.

The challenge which Zune may face is in the Zune battery life which may not be able to last for a long time with the Wi-Fi connectivity and the device large screen. It's nice to mention here that, iPod battery can currently last for approximatly 12-hours.

Microsoft War

2006-12-31T15:18:00.000+02:00

Check out the strategy of Microsoft in building its industry Empire! The image illustrate cleary the way Microsoft challenges with its market competitors. This is a fact we can't ignore and is clearly obvious. Microsoft wants to challenge in every sector in the industry which is not reasonable.

Click on the image for a large view.

PHP Popularity .. Why?

2006-12-30T18:49:00.000+02:00

No one can deny that PHP is one of the most popular and spreading web language nowadays. What I want to discuss here is why PHP is a strong competitor in the web world?

Simply, open any freelance website and you will get this fact: PHP fans are usually small business owners who needs to complete their project quickly with minimum cost. So, they need the easy way. They need ready made components. They need to find cost-effective programmers easily when a bug or error raised. This is what PHP giving them.

You can find many open source PHP projects available on the net such as vBulletin, oscommerce, x-cart, pMachine, ez-Publish, gallery, phpBB and php-nuke, plus other hosting control panel favorites. Open source solutions for forums, images-organizer, CMS (Content Management Systems) and even e-commerce. Just some configurations and you have a ready working project in just a moment. This aspect can't be seen widely in .NET or J2EE for example.

Another point here is the hosting. If we compare between the number of PHP hosting servers and Java for example. PHP is the winner in this comparison.

Although the simplicity of the PHP, it's still has a drawback in the style of the code. Actually, PHP is going in the way of creating its rich libraries and assemblies. However, You still develop a PHP application in a missy old fashion way - a combination of HTML and the PHP script. Still no separation between the code and the design which considered unprofessional way in development. You still have problems here related to scalability and updatability.

In my point of view, choosing PHP for projects is still related to the economical aspects not technical ones. Small customers still needs minimum development cost, and PHP is the ultimate choice if this is the only considered side here.

My Freelancing Experience in RentACoder

2006-12-17T15:17:00.003+02:00

RentACoder is one of the most popular sites on the net for freelancing seekers. Actually, I started working in RAC - AKA: RentACoder - since May, 2006. Till now, I completed nearly 12 projects with different scales. However, I see many Egyptian coders are facing problem specially in the starting phase. Some related to strategy in getting a new bid and some is not related to the Coders skills itself, it's related to their way in getting a deal.

In your starting phase, always remember that you haven't anything to encourage buyers to choose you for their projects. You haven't created any projects neither been rated yet. So, my advise is to apply in many projects with a relative low cost. Don't think when you apply to a project that you will get it. It's not always guaranteed. In my starting phase in RAC, I applied for nearly 24 projects and finally get only one! The buyer needs a coder who can trust to complete the work. His trust comes - in most of the cases - from the coders rate and previous projects. But actually you haven't got that yet.

In choosing your project, try to read carefully the requirements and any attached documents with the bid request. This will help you to identify if you can do the job or not. Don't bid for thing you can't do. Bid only for projects you think you can do or even you will be able to do.

Another point here, make your bids reasonable. Fixing bugs, for example, is not like building enterprise project. Consider your bids well and put in your mind that many buyers considers many other things other than the financial cost. Buyers not always choose the lower bid!

After you finished your first project, put in your consideration the next cost of your project. For example, if your first project was $100 cost, your next one shouldn't be less than that. Try to invest your experience.

During the development, try always to know your buyer characteristics. Some buyers need daily reports about your work, other not. Formulate your behavior depending on the buyers characteristics. This sure will affect your rating and your client satisfaction.

Try to gain the buyer loyalty. Buyers tends to use coders who gives them the best service. Try to build a good relationships with your buyers. This sometimes needs you to be more flexible in your dealing.

Now you have collected a reasonable amount of money, and you need to get the cash. RentACoder gives you 3 choices for the payment. Two of them are suitable for Egyptian coders. The first one (the cheapest) is receiving a check by mail with the specified money. The problem here is that the check is issued from "Bank of America", which has no branches here in Egypt. You will have to go to your international bank to transfer the fund to your bank account. This will take nearly 30 days.

The other choice (the expensive one) is to get the money through Western Union. This is a money transfer company which have many branches in the world and in Egypt as well. RentACoder will send you the money to Western Union, and you get paid from any Western Union branch here in Egypt. Western Union takes a percentage from the money transferred. But the good news here is that you got the money (in dollars) within the same day (or next day maximum) of sending.

I like this Article! - Digg it

CMMI Certified Software Companies in Egypt

2006-12-15T20:02:00.018+02:00

IMPORTANT NOTE: These statistics is based on the Software Engineering Institute (SEI) results. These results were published on this blog in December 2006.

15 Egyptian software companies have already achieved SW-CMM/CMMI ( Software - Capability Maturity Model / Capability Maturity Model Integrated ).

No.	Company	CMM/CMMI	Date Achieved	Company website
1	EDS-Egypt	CMMI-Level 3	26 August, 2004	http://www.eds.com/
1	EDS-Egypt	CMM-Level 2	February, 2003	http://www.eds.com/
2	ITSoft	CMMI-Level 5	21 September, 2006	http://www.itsoft.com.eg/
		CMMI-Level 4	25 August, 2005
		CMM-Level 3	24 June, 2004
		CMM-Level 2	6 May, 2004
3	IBM-Egypt	CMMI-Level 5	5 October, 2005	http://www.ibm.com/
3	IBM-Egypt	CMM-Level 3	16 August, 2004	http://www.ibm.com/
4	Raya Software	CMMI-Level 3	3 September, 2004	http://www.rayasoftware.com/
5	ITWorx	CMMI-Level 3	9 December, 2005	http://www.itworx.com/
5	ITWorx	CMMI-Level 2	23 December, 2004	http://www.itworx.com/
6	DMS	CMMI-Level 4	18 August,2005	http://www.dmsegypt.com/
6	DMS	CMM-Level 3	11 August, 2004	http://www.dmsegypt.com/
7	Digital Vision	CMMI-Level 2	22 June, 2006	http://www.digitalvisionco.com/
8	LINKdotNET	CMMI-Level 3	29 June, 2006	http://www.link.net/english/default
9	Egypt Network	CMMI-Level 2	29 June, 2006	http://www.egyptnetwork.com/
10	Delta Software	CMMI-Level 2	10 July, 2006	http://www.delta-sw.com/
11	Harf Information Technology	CMMI-Level 3	16 July, 2006	http://www.harf.com/
12	Microtech	CMMI-Level 3	21 July, 2006	http://www.microtech-eg.com/
13	Horizons Software	CMMI-Level 3	26 July, 2006	http://www.horizonssoftware.com/
14	Fujitsu Egypt	CMMI-Level 2	26 July, 2006	http://www.fujitsu.com.eg/
15	VIAS EGYPT	CMMI-Level 3	21 September, 2006	http://www.valeo.com/

Can You Hear Me Now?

2006-12-08T22:55:00.000+02:00

Cell phone users, beware. The FBI can listen to everything you say, even when the cell phone is turned off.

A recent court ruling in a case against the Genovese crime family revealed that the FBI has the ability from a remote location to activate a cell phone and turn its microphone into a listening device that transmits to an FBI listening post, a method known as a "roving bug." Experts say the only way to defeat it is to remove the cell phone battery.

"The FBI can access cell phones and modify them remotely without ever having to physically handle them," James Atkinson, a counterintelligence security consultant, told ABC News. "Any recently manufactured cell phone has a built-in tracking device, which can allow eavesdroppers to pinpoint someone's location to within just a few feet," he added.

References: ABC News

Declared Accessibility Keywords .NET

2006-12-03T20:59:00.000+02:00

Declared accessibility keywords definition are mostly the same for all the programming lanugage. In the next lines, I will state the basic definition of each acessibility keyword for .NET languages

Class Accessibility:

A class or struct can be declared as internal or public

internal:
access limited to the current assembly only.

public:
class marked as public can be accessed from outside the assembly.

By default, classes are declared as internal, unless you didn't add the public kewyrod in the class declaration.

Class Members Accessibility

protected:
Access limited to the types derived from the containing class.

private:
only class contains this member can access this member.

internal protected:
access limited to the current assembly OR access limited to the types derived from the containing class.

Google Opening Middle East Office in Egypt

2006-11-03T00:13:00.000+02:00

Google will be basing their Middle East marketing & sales operations in Cairo, although they already have a Research and Development Lab based in Israel. On Angelo's blog he states that the Arab world had expected Google to open their regional office in the elegant area of Dubai (UAE), but Google has decided on Egypt.

Angelo writes on Stravinsky's Sizzlin' Shack (warning, two or more pop-up windows served):

According to some sources, a few months ago, Google Egypt hired a Country Manager (Sherif Iskander — mentioned here) who also serves as a regional manager and is now looking around for suitable candidates to fill the posts of Associate Product Marketing Manager and Product Marketing Manager. An unofficial Google page at Wikia.com details why Google should choose Egypt as their Middle Eastern base for regional operations and at the Wiki's talk page, someone also notes the hiring of the regional manager for the Middle East and points to the vaccant positions.

It seems that although the official Google jobs site lists the vacancy for a product marketing manager for their office in Egypt, the listing fails to mention that posting may require travel between London and Cairo, the same job posted on monster.com states that the job is located in London although it is for Google Egypt. I'm guessing here, but I think that Google is planning on pushing Arabized/localized versions of their enterprise solutions like the OneBox & Google Earth. One of the reasons as to why Google might have chosen Egypt for their Middle Eastern regional office over Dubai, is since Yahoo already has a footing in terms of advertising sales & marketing operations for the region over at Dubai's Internet City.

For more..

http://www.searchenginejournal.com/?p=3567

http://www.dailystaregypt.com/article.aspx?ArticleID=1896

COPIED!.

Optimization Or Compatability ... Hard Choice!

2006-09-29T18:49:00.000+02:00

I was reading an interview held with Shannon Hickey, the technical lead for the Swing toolkit team at Sun Microsystems. He was asked about his dream project which he would like to make one day. The answer was so impressive:

" ... As an engineer, I'd love to be able to clean up old and unused parts of the Swing toolkit and the Java programming language without having to worry about backward compatibility. It's just a dream though, because compatibility is very important to our customers and is something we take seriously. For instance, every time I fix a bug, even if I'm correcting completely wrong behavior, I must be careful not to break something for someone who is relying on that wrong behavior.

For example, I modified JTable a while back to ensure that the focused row was set to the first row whenever the table gained its first data and was then set back to -1 when the table became empty. The goal was to ensure that tables showed focus whenever possible but to correctly use -1 if they are empty. This solved numerous open bugs.

Unfortunately, within a couple of weeks, two bugs were filed against my change. It turned out that modifying the focused row fired events, and some existing client code wasn't prepared to deal with these events. Although I strongly want code to "do the right thing," I understood that we must try not to break existing code. Unfortunately, I had to pull this perfectly good code in favor of something less optimal. Now, the focused row always stays at -1, until either the developer or the user changes the selection. The funny thing is, I've seen bugs filed on this behavior since ..."

You see. It is really hard to take care of all this issues when you developing technologies others will widely use.

I like this Article - Digg it

RSS Feed Available Now!

2006-09-29T14:41:00.000+02:00

You can keep uptodate with any post sent on this blog through the blog RSS feed. This is an XML-based file that you can use to display the blog posts in any RSS feed enabled softwares. Simply you add the blog RSS Feed to your software feeds and any new post will be displayed there.

For example, if you use Gmail, you will find a "Web Clip" bar in the top of your mail client, showing your favorites feeds. You can add all favorite feeds from different URLs and all will be dispayed in this web clip.

My Weblog RSS Feed is: http://mnour.blogspot.com/rss.xml

Microsoft Visual Studio 2005 SP1 Showing Up

2006-09-29T13:45:00.000+02:00

Microsoft has released the Visual Studio 2005 Service Pack 1 (SP1) Beta. Visual Studio 2005 shipped in November of 2005 and this Service Pack incorporates fixes that Microsoft have addressed since that release. You can test this beta and inform Microsoft about any bugs you may find. The beta program will run until October 30th.

The fixes were mostly related to some reliability and security issues found in the last release of Visual Studio.

You can participate in the beta program by visiting: Click Here

For more information, visit: Microsoft Site

Google Code Jam 2006

2006-09-12T22:39:00.000+03:00

Google Code Jam 2006 Qualification Round was started in the last 5th, September. This competition is supported by google and aims to create an international competition in programming and problem solving. Depending on the round, you got a set of problems and you will have to solve it in a certain time.

The qualification round consists of 2 problems - 250 point and 750 point problems - and you will have to solve these problems in 60 minutes. CodeJam gives you a great option to choose your favorite programming language to program with (Java, C#, VB.NET, C++ and Paython), which supports the idea of not giving much importance to the programming langauge and free the minds to solve the problem itself.

Qualification round will filter the participants to 1000 coders who will be qualified to continue to Round 1. The 1000 coders then will be filtered to be 100 who will get the prices and go to New York, USA to challenge again.

Egypt existance in Google Code Jam this year was not enough. I am sure we have so many skills out there who need to be encouraged to participate and challenge.

Changing Web References in VS.NET 2005

2006-07-27T22:27:00.000+03:00

.NET gives you the ability to call webservices methods within a web or desktop applications. The problem you may face is that the webservice URL can be changed and so your application may not be able to call the webservice correctly.

Each .NET project calls webservices methods will have a folder called "webreferences" which contains three files:

ServiceName.wsdl
ServiceName.disco
ServiceName.discomap

You will have to open these files with any editor, and update the URLs of the webservices with new URL or IP address.

Also, if your .NET project is web project, then you will need also to update the webservices URL in the web.config file.

Port Forwarding

2006-07-27T22:25:00.000+03:00

If you have a server inside your LAN and you hope to access this server from WAN (ex: internet), unfortunatlly, you will not be able to access this server with out making some changes to your router configurations. So that, any requests comes from port 80 will be forwarded to the server LAN IP address.

For example, suppose you server local IP address is 198.65.1.144, and WAN address: 81.44.1.70. In your router configuration, forward any request comes on port 80 to 198.65.1.144. In this way, you will be able to access the server from the internet by addressing: http://81.44.1.70

Of course this not just for port 80, for example, you server may receives the HTTP requests on another port, say 8080. So, you do the previous steps as it is but with this port number. And you will be able to connect to server from the internet by addressing: http://81.44.1.70:8080

ASP Problem in IIS6 and Windows Server 2003

2006-07-27T22:18:00.000+03:00

You may encounter a problem in running classic ASP in IIS6/Windows Server 2003. So you may try to test an ASP page on IIS6 and you get "Page Not Found" error. This is beacuase IIS6 by default doesn't enable any Scripting language. HTML is the only script enabled by default

To enable ASP Scripting, just open your IIS6 and on the left tree view. Click on "Web Service Extensions". The exiting extensions on the server will be listed. Click on “Active Server Pages” extension and enable it by clicking on “Allow” button. Then make a test ASP page and make sure that ASP scripting is working well.

Webservice Authentication

2006-07-21T16:23:00.000+03:00

Suppose you have a collection of webservices resides in some server. You would like not to give a public access to these webservices. What shall you do?

Actually, you need some how an authentication mechanism to compromise the accessablity. One soultion would be to make an authentication webservice. Any client wants to access your webservices, should call it first. This webserice simply will take 2 parameters: username and password. The return value would be a hashcode.

This hash code could be used afterward in accessing any other webservice. The interfaces for example for your webservices could be something like that:

[C#]

string wsAuthenticate(string username, string password)
string wsAnyOtherWebservice(string accessCode, ... )

As you see, the returned hash code (access code) form wsAuthenticate will be used in accessing the other webservices and the client will not be able to get the service unless he have an account in your system.

Using SOAP Tool Kit 3.0 with VB Programs

2006-07-21T15:40:00.000+03:00

Connecting to a webservice from a .NET desktop application is a piece of cake. But what about connecting to a webservice within unmanaged code - VB6/C++ programs? Actually SAOP Tool kit is the soultion. It is a Microsoft Tool used for calling webservices from unmanaged code.
You can download the kit from the Microsoft Official website:

http://www.microsoft.com/downloads/details.aspx?familyid=c943c0dd-ceec-4088-9753-86f052ec8450&displaylang=en

Here is a code snippt to call a webservice form inside VB6 program:

Dim soap As New SoapClient30
Dim serverURL as String
Dim hashCode as string

On Error GoTo ConnectionError

Public Sub WebServiceConnect

'Set Server URL
serverURL = "http://localhost/MyServiceName/Service.asmx?wsdl"

'Client is initialized
soap.MSSoapInit serverURL

'Calling the webservice
hashCode = soap.wsAuthenticate(txtUsername.Text, txtPassword.Text)

Exit Sub

ConnectionError:

MsgBox "Connection Error Encountered"

Exit Sub

The tool now is in its third version. Micorsoft declared that the SOAP tool kit 3.0 will not be supported after 31st March, 2008 because of the next generation of the Microsoft softwares will be .NET based. There will be no need to use SAOP tool kit as VS.NET gives already the ability to connect easily to webservices from the .NET desktop programs.

Spiders & Google Sitemaps

2006-05-03T17:53:00.000+03:00

Internet Searching became one of the most popular services provided on the internet. Google, Yahoo, Altavista and AllTheWeb are all examples of search engines. Although, the simplicity of the searching, the inner technique used in searching is not easy as we think. Searh engines have to update their index regularlly and infiniatly.

Such engines use a special kind of softwares called “Spiders” or “Robots”. These softwares try to scan the whole internet to update their index with the new – or modified – locations, urls and contents. Depending on whatever algorithm or technqiue, “Spiders” will try extracts the keywords of the webpages content and restore the results on huge databases.

To comprehense its service, Google had provide an effective service for webmasters so that they can increase the traffic of their website. The idea is that each website will have an XML file called “sitemap.xml”, this file should be uploaded in the highest root of the FTP space of the web application. This file will include the informaton about the site pages and how they frequently changed. Here is a sample file for a small website:

<?xml version="1.0" encoding="UTF-8"?>

<urlset xmlns="http://www.google.com/schemas/sitemap/0.84">

<url>
<loc>http://mnour.blogspot.com</loc>
<lastmod>2006-05-01</lastmod>
<changefreq>daily</changefreq>
<priority>1.0</priority>
</url>

<url>
<loc>http://mnour.blogspot.com/2006/04/sql-injection-part-1.html</loc>
<lastmod>2006-05-01</lastmod>
<changefreq>weekly</changefreq>
<priority>1.0</priority>
</url>

<url>
<loc>http://mnour.blogspot.com/2006/04/sql-injection-part-2.html</loc>
<lastmod>2006-05-01</lastmod>
<changefreq>weekly</changefreq>
<priority>1.0</priority>
</url>

<url>
<loc>http://mnour.blogspot.com/2006/04/ajax-new-giant.html</loc>
<lastmod>2006-05-01</lastmod>
<changefreq>weekly</changefreq>
<priority>1.0</priority>
</url>

</urlset>

While Google spiders scans the network, they will try to read this file – “sitemap.xml” – from a scanned domain. Then, it will check if any pages were modified after last time scanning this domain.

As you can notice, each “url” tag in the file contains how frequently the content of this URL will be updated. Actually, all of the webmasters will make there pages as updated hourly! thinking that this will increase there chances for being in the first results of Google. Actually, Google declared that this parameter is not taken as it’s. Maybe a URL declared as updated Montly, be indexed by Google Spiders more than another one declared as updated hourly!

This technqiue gives the benefits for the both sides: Webmasters and Google. Webmasters will be able to add their site to the serach results of most popular search engine on the net. On the other side, the technique will decrease the time needed for Google spiders to update their index.
The main drawback for this technique is for webmasters. They will have to update this file frequently after each update of their site content.

Creating Word Reports Dynamically

2006-04-19T23:59:00.000+02:00

From a while, I faced a problem in creating MS Word reports in web-based applications. Actually, I have an intranet application and I want to give the system user the ability to generate dynamic reports and view it in Microsoft Word.

After searching, I found that it's just a matter of changing the content type of the HTTP response. For example, if you are using ASP, then all what you will do is to make your report as a normal ASP page, but you will changing the content type of the response object to "application/msword". You can use any HTML tags as you need in side the report. But try to keep away from using images in your generated report as you may deal with URLs - and this depend on the connectivity state of the user.

Here is a sample code writen in ASP:

'-------------------------------------------------

'Creating MS Word Document Dynamically

'-------------------------------------------------

<%

Response.ContentType = "application/msword"

%>
<html>
<body>
<table>
<tr>
<%

' Your
Dynamic Content Here

%>
</tr>
</table>
</body>
</html>

That is all!. It's so simple which is not expected! Actually, you can use this method in generating Excel documents as well.

For more details about creating dynamic MS Word documents, read the following article:
http://www.infinetsoftware.com/content/officedocuments.asp

Also, for .NET guys, here is an article about generating MS Word reports in ASP.NET:
http://aspalliance.com/794

You may find some problems in displaying the report on the browser. For example, when you trying to call the URL of the code that generates the report, you may find a pop-up message asking if you want to save or open the document. To disable this dialoge from appearing, open the "Folder Opions" of your IE, then "File Types", find the "DOC" format, then click on "Advanced" Button. Then uncheck the "Confirm Open After Download". This will open the report directly after calling its scripting page. That is all!

New Service In Alex. Bibliotheque Museum

2006-04-16T22:00:00.000+02:00

The Museum of the Alexandria bibliotheque has created a new service for its visitors allowing them to explore the museum pieces-of-art using a handled PC.

The visitor simply enters the piece ID, and all the related information is viewed on his handled. After the visitor finishes his tour, he can send all the information - he got in his tour - to his email address.

AJAX - The New Giant

2006-04-13T19:03:00.000+02:00

AJAX – Asynchronuos Javascript And XML – is a new technique introduced recently to give more richness to web applications. AJAX is totally executed on the client machine. We can consider AJAX as a Java Applet – The Sun technology – in the main idea.

Web applications in general can be formalized as a “Request” and a corresponding “Response”. In other word, any web application is synchronous – a request and an acknowledge (response). This criteria makes web applications some how not rich in developing. Many functionalities done in desktop applications is not easy to be performed in web development.

For example, suppose you want to make a small dictionary that accept a word in English and return the equivalent in Arabic. If your decision is to make this application as web-based application, then you will have a web form which accept your word, after submition, your browser will perform a request. In meanwhile, the whole page will be refreshed to give you finally the equivalent word in Arabic!

As you see, for this simple proces, there is no need to refresh the whole page just to get the translation of one english word. Offcourse, you hope that your user can enter his english word and after submission, the results is shown in the same page without refreshing. The process simplicity, make this experience. This is what your user expect from the application.

In desktop application, a process like that is so easy. However, in web application, this is some how so hard to be done.

AJAX comes to solve such kind of problems in web development. AJAX act like a background component which can make small requests and get the response without the need to refresh the webpage. The same way the desktop applications act.

Actually, we can’t define AJAX as a new technology. AJAX is a group of technologies, grouped to solve a certain problem faced by web developers. AJAX uses XHTML (Extended Hyperlink Text Markup Language), CSS (Cascaded Style Sheets), DOM, ActiveX, XML and offcourse Javascript.

AJAX is supported now with many browsers such as Internet Explorer 5 or later, Netscape, Mozilla, Firefox and Opera. The technique also can be seen in many online applications like Gmail and GoogleMaps.

AJAX now can be used in .NET applications using ATLAS component – a release of AJAX for .NET technology.

AJAX is spreading now. And we have now a new effecive tool in building rich web applications. However, we need to change the way we think about the web.

SQL Injection - Part 2

2006-04-10T22:16:00.000+02:00

In part 1, we discussed a simple methodology in using SQL injection to break a security point in web applications. Actually, this was the simplest way. As you know more about the generated errors of the different database engines, you will do better with SQL injection.

Some methods of SQL injection, depends on how you can inject some SQL statement in the page parameters, to gain usefull errors! .. So funny, aha! Actually, these errors gives you some usefull information about the inner structure of the victim database. This will help in making greater destruction!

One of the SQL injection methods is to concatenating "Having" statement in your query string. As we know, "Having" is used alwayes with "Group by" statement to inforce some condition on the grouping SQL statement. But if the "Having" is inserted in a sql statement without "Group By" we get a horrible error!

Suppose we have web page which displays products for a certain category. For example, our page url is something like that:

http://online-store.com/products.aspx?catID=1

The previous url will get all the products of the category that have ID = 1. Now, lets playing with this url and make the following trick:

http://online-store.com/products.aspx?catID=1 having 1=1 --

When submitting the previous url, the resulting page will display an error like that:

Microsoft OLE DB Provider for SQL Server (0x80040E14)

Column
'products.ID' is invalid in the select list because it is not contained in an
aggregate function and there is no GROUP BY clause.

/products.aspx, line 24

SQL Server tried to execute the following SQL statement after injecting our "Having":

select * from products where catID=1 having 1=1 --

As you see, we have "Having" without "Group By". And in a SQL statement with "Group By" and "Having", all the columns after "SELECT" should be in the "Group By" clause. So, the db engine didn't find the first column which is "products.ID" in the "Group By" clause and throw this error.

Actually, we got two usefull infomration from this later error. The table name - "Products" and a column on it - "ID" column.

Now, Try to add the "ID" column after a "Group By" clause in the url:

http://online-store.com/products.aspx?catID=1 Group By ID having 1=1 --

You get the following error:

Microsoft OLE DB Provider for SQL Server (0x80040E14)

Column
'products.Name' is invalid in the select list because it is not contained in an
aggregate function and there is no GROUP BY clause.

/products.asp, line 24

You got the idea, aha! .. You have now another column name in the table. You just go on with this trick until you got all the table columns!

Suppose, now you discovered that the "Products" table contains only 3 columns "ID", "Name", and "Description". And on a way or another you got that the site users are stored in a table called "users". Well, try to make the following trick. Inject a UNION statement in your url so that, you view products data followed by users data. Cool, isn't it?!

http://online-store.com/products.aspx?catID=1 UNION SELECT 1, username, password FROM users --

Now, you got a list of the products, followed by all the site users with their passwords!

Actually, you can be more destructive by executing some harming SQL statements. For example, you can make something like that:

http://online-store.com/products.aspx?catID=1; drop table users;

Some database engines like SQL Server support such kind of SQL queries. You execute two or more queries in one time. Now, your victim loses his users table!

Also, you may execute some built-in stored procedures which exists in SQL server:

http://online-store.com/products.aspx?catID=1; exec master..xp_cmdshell
'iisreset'; --

This was a short tour in exploring SQL injection.

References

SQL Injection Attacks - Are You Safe? By Mitchell Harper

SQL Injection - Part 1

2006-04-10T18:39:00.000+02:00

Security .. This word repeated regularly when taking about critical applications. Actually, security is one of the most important aspects in developing applications, especially, web applications. Why? Because, web applications has a very unique property .. "It's a public application!". This means many people have access to your application, many people has access to your services. And as long as the accessibility increase, threatens also increase.

SQL Injections is one of the simplest and popular attacks on the net. However, it needs somehow experienced attackers in SQL and database engines.

Dynamic web forms usually receive parameters and according to these parameters the web-form rearrange its behavior and layout. Parameters are sent to the web-forms through HTTP using one of the two methods: GET or POST - Actually explaining these methods is out of our scope here.

For example, using GET method, we can send parameters to the web form like:

mydomain.com/Login.asp?username=nour&password=mypass

As shown, the "Login" page receives two parameters: username and pass. In your login page, you may check the credentials of the user using a SQL statement like that:

sql = "SELECT username, password FROM users WHERE username=" & username
& " AND password=" & password

Suppose that our lovely attacker now try to play with this login page. He will simply pass the parameters to this web-form as following:

mydomain.com/Login.asp?username=nour&password=mypass or 1=1

Actually, if this login page is for an administration page, for example, then you're in a critical situation! Why? .. The "password" parameter is now "mypass or 1=1". And after concatenated with the SQL statement in our page, the SQL statement will be like that:

SELECT username, password FROM users WHERE username=nour AND password = mypass or 1=1

As you can see, the WHERE condition will not return only one record. Actually, it will return all users records in your system. A great disaster! . So, if your authentication method is built on this query, it will return always results and any user can access it regardless of the given password! Actually, this is a simple demonstration of what can be done with SQL injection.

Wait for more in Part 2...

References

SQL Injection Attacks - Are You Safe? By Mitchell Harper

BizTalk - SharePoint Integration. Hossam El-Deen M. Barakat Senior Software Developer \| Raya Software	Information Architecture Mostafa Mourad Team Leader \| ITWorx
IIS 7 Hossam Kamel Senior Software Engineer \| ITWorx	Applying Domain Driven Design on ASP.NET MVC Mohammed Meligy Senior Software Developer \| Raya Software