ORDER BY in a view or a nested select statement

I noticed one different behavior in SQL Server 2005 comparing with 2000:

If you run “select * from (select top 100 percent * from [table name] order by lastname) as temp” on SqlServer 2000 and on SqlServer 2005, you will see the difference. In 2000, the list you get is still sorted while in 2005 it's not.

The bottomline is: don’t say “order by” in a view or in a nested select statement. Putting "order by" in a view is never a good practice, in my opinion, because:
1. You have to say "top 100 percent" in order to do that
2. We should put "order by" in the most outer select so it costs minimum workload for the Sql Server (it only needs to sort the things you need at the end).

Form authentication with SSL

This is the settings we need in the Web.config:
<system.web>
<sessionState timeout="180" regenerateExpiredSessionId="false"/>
<authentication mode="Forms">
<forms name="XXX" loginUrl="login.aspx" protection="All" timeout="180" requireSSL="true"/>
</authentication>
<authorization>
<deny users="?"/>
</authorization>
<customErrors mode="RemoteOnly"/>
<compilation debug="false"></compilation>
</system.web>

DateTime ToString Formats

To format a DateTime:
string a = date.ToString("MM/dd/yyyy"); the string will look like "03/02/2008"

You can also do "MMM dd, yyyy", then you will have "Mar 02, 2008". For the entire list of format options, please see http://msdn.microsoft.com/en-us/library/8kb3ddd4.aspx.

toggleOptions

Hi guys!

Miss me? How can you miss me if I keep blogging! :P

OK so as you know I added a code library to the repo. I put all the Javascript we had already collected into it. The trouble is it's disorganized and some of it is pretty old and possible inefficient or not the best code. Therefore I hope to clean up the library to only have clean and good code :) And in an effort to do this AND organzie, from now on when I can I will add scripts into subfolders. I will label the folders by control type. Then inside the folder will be all the different scripts. So, if the JS is in a subfolder of Javascript, then it has been "quality controlled."

Please feel free to aid my efforts! Remember when you add a script to add a comment with your initials so we know who to ask if we have questions about the code!

Myself, I will try to blog whenever I add a script.

OK on to today's script. We may already have had something like this, I don't know. It was a mess in there so I didn't find it.

This function was written for those times when one of the options you pick should make all of the other options invalid. For example let's say the question is What color do you like best: red, green or none of the above? None of the above should obviously make it impossible to check red or green.

The code below is specifically for ASP:CheckBoxList, hence the part where I format the field's name as name = fieldName + "_" + i; because .NET takes the ListItem in a CheckBoxList and names it controlId_indexOfItem. If in my example the control was called cblColor then in the HTML red would have the id cblColor_0, and green would be cblColor_1 etc etc.

The parameters: optionToFocusOn is the one that triggers the function. In my example it would be cblColor_2, the none of the above. totalOptions is the total number of options, and in my example would be 3. fieldName would be the id of the control itself; in my example it would be cblColor.

//toggle options on and off - for use when one selection should disable the rest of the group
//for use with the ASP:CheckBoxList

function toggleOptions (optionToFocusOn, totalOptions, fieldName)
{
    var name = fieldName + "_" + optionToFocusOn;    
    if (document.getElementById(name).checked == true)
    {
        for (i = 0; i < totalOptions; i++)
        {
            name = fieldName + "_" + i; 
            if (i != optionToFocusOn)
            {
                document.getElementById(name).checked = false;
                document.getElementById(name).disabled = true;
            }
        }
    }
    else
    {
        for (i = 0; i < totalOptions; i++)
        {
            name = fieldName + "_" + i; 
            if (i != optionToFocusOn)
            {
                document.getElementById(name).disabled = false;
            }
        }
    }
}

document.form1 doesn't work?

In an aspx page, we use two ways to call a form from javascript:
1. document.getElementById("form1"), or
2. document.form1
and they both work.

However, the "form1" means different things in these two lines:
1. document.getElementById("form1") -- the form1 is the id of the form
2. document.form1 -- the form1 is the name of the form

When working on an aspx page, we only put id="form1" in the form tag, but when the page gets processed and sent back to the client, ASP.NET adds a bunch of stuff to the page, including name="form1" in the form tag (it puts a name in every server control in a page). So that is why document.form1 works in an aspx page without a name for the form.

If you works on an html page, you will have to put name="form1" to get the second method to work.

Form validation - part 2: the .NET validators

Since as we move forward, some of the team which does more of the front-end work, will start to delve more into contributing by doing some of the client-side validation, I thought it would be good to give an overview of the .NET validators. The first version of ASP.NET I worked with - 1.1 - had validator controls as part of the .NET framework. I bet they had them in the 1.0 version as well although I don't actually know for sure. Now the way these validators were supposed to work was like other .NET controls such as the datalist, or the repeater; you could just drag the control onto your page and hook it up. When the aspx made the round trip to the server and rendered in a browser, it would actually serve as client side validation of whatever field you hooked the validator control up to. The trouble was the 1.1 validators created javascript which only worked on IE. :P AND if javascript was disabled...no validation at all!

Furthermore, they were somewhat limited in what you could do with them. In the kind of forms we build, we frequently end up with skip patterns. "If you answered No to 12, go to 14" for example, meaning if you answered no to 12, 13 was not required; but if you answered yes to 12, then it WAS required. This was fairly simple javascript to create, but there existed no validator control that could handle it, except for the CustomValidator. And since we already had an extensive library of javascript functions covering most situations that cropped up, it was much simpler to just not use the validators and stick to the javascript.

In 2.0 however, Microsoft vastly improved the way these validator controls worked. Now they:

1. are cross browser compatible. WOW!
2. still work when javascript is disabled
3. have this neat option where you can tell them to ONLY turn on if the javascript is not enabled. COOL!

Our blog user known as tiger figured out how to work out #3 quite elegantly. Therefore #3 is the way we have been going, unless we don't have the hours to cover it. However as our code library goes, it is taking less and less time to even handle this task :)

Now I am going to show you a basic example. Let's say we have a form with one field with id 'greekGod' for "Favorite Greek god" and one field with id 'faveNumber' for "Favorite Number up to 20". Color is a textbox and Number is a dropdown starting with "Choose Number" for the zero index and going to 20.

Normally this might be your validation. Note that the following function actually calls 2 others, expecting them to return true or false individually. The following function is a handy way of checking numerous fields at once, and just returning false (in other words not letting the form submit) if ANY of them are invalid/have a problem:

function checkForm() <-- note it takes no arguments/parameters
{
 if (
  (isNotBlankAlpha(document.getElementById('greekGod'))) && 
  (isSelected(document.getElementById('faveNumber'))
  )
  {
   return true; 
  }
  
 return false; 
}

And this might be how you hook your form up to the javascript:

form onsubmit="return checkForm();"

If we were using the validator controls as well as the javascript, our javascript would be slightly altered:

function checkForm(source, clientside_arguments) <-- note it takes 2 arguments {  
 if (   
  (isNotBlankAlpha(document.getElementById('greekGod'))) && 
  (isSelected(document.getElementById('faveNumber'))   
  )   
  {    
   clientside_arguments.IsValid = true;    
  }     
 clientside_arguments.IsValid = false;  
} 

And instead of hooking the form tag to the javascript, our aspx file would include a CustomValidator that might look like this:

asp:customvalidator id="CustomValidator1" runat="server" errormessage="" clientvalidationfunction="checkForm" onservervalidate="CustomValidator1_ServerValidate" display="Dynamic" setfocusonerror="True"

Note that it is the ClientValidationFunction property of the control that you use to tie it to the javascript. Note that you don't need the parens to call it either. However, notice that the javascript function itself now has 2 arguments. These are a mandatory signature; the source argument refers to the HTML tag that represents the validator control, and the clientside_arguments parameter refers to an object with 2 properties, IsValid and Value. The Value property is the value stored in the input control to be validated. The IsValid property must be set to false or true according to the result of the validation (Programming Microsoft ASP.NET 2.0 by Dino Esposito).

Note that the Value property is not relevant to the way we are using the CustomValidator - we are not using it to validate a single control, which is what the Value would be the value of - but instead we are validating a group of inputs all at the same time. Further, note that the javascript now takes 2 arguments - and it appears that these 2 arguments are in fact passed to the client function by the server, probably passed by the CustomValidator itself. Finally, the client function (javascript function), now that it is being tied to the CustomValidator, needs to set the IsValid property of the args parameters passed into it.

I hope this overview is somewhat helpful in explaining how to tie javascript to the ASP.NET CustomValidator control. Questions, comments, corrections are all welcome.

Form Validation - on the client side (part 1)

I just thought I'd put up a little overview on form validation. First here is a list of good articles on the subject.

http://developer.apple.com/internet/webcontent/validation.html
http://www.elated.com/articles/form-validation-with-javascript/
http://www.w3schools.com/js/js_form_validation.asp


OK, so here is my summary: whenever you are working with any form that is transmitted over the internet, you want to do some kind of validation of the input before you do anything with it. The point is not just to make sure that the input is correct - like you want to make sure a zip code has only numbers and no letters in it - but because forms are a gateway for malicious attacks on a web server. Secure forms will validate on the client side, usually using Javascript, and also on the server side, in the programming language of choice - after all not every client will have Javascript enabled.

However, for this post we are focusing on client side validation - so this is the checking that should be done before the form submits to the server. So when you are a validating a form you are doing a couple things:

1. making sure required fields are answered
2. making sure input is in a correct format

1. is self explanatory to me but more on 2:


Making Sure Input Is In a Correct Format

First, keep in mind that this should be done on ALL fields - both required and optional fields. As for what this means: you want to make sure that the input adheres to what you are expecting. Keep in mind that sometimes you can help achieve this by just designing for it. For example if you are collecting a date - don't give them a text field, give them 3 drop downs. They can't type "yesterday" if you don't give them something to type into ;)

More examples:
- SSN
- email
- phone number
- zip code
- valid range (i.e. if the answer should be 100-500, or 0 to 100%)

Let's look at SSN. To validate it, you would want to make sure that there are 9 characters, all of which are numeric. If you give the user one text field to enter SSN into, then you might start by stripping the field of all non-numeric characters, including whitespace. You would then test the length of the resulting string to see that it is 9.

This is the end of part 1. In my next post, I'll talk about doing client side validation within a .NET project that is also using the built in .NET validators.

LINK TO PART TWO, CLICK ME :)