It became clear that something had to be done and that we couldn’t wait for the W3C to come up with a new standard and browser vendors to incorporate them.

There were two things I wanted to enrich the CSS language with:

To make it work, I created an HttpHandler for ASP.NET that is able to parse these two new features and apply them to the stylesheet. It does not interfere with any CSS standards because everything is handled by the server.

Here is an example of a .css file that uses these new capabilities.

define BACKCOLOR = #00FFFF;
define FORECOLOR = pink;
define TOTALWIDTH = 550;
define RIGHTWIDTH = browser == "IE" & version >= 6 ? "150px" : "170px";
define LEFTWIDTH = TOTALWIDTH / 2 + "px";
body{
     background-color: BACKCOLOR;
      color: FORECOLOR;
      width: TOTALWIDTHpx;
}
#RightColumn{
      width: RIGHTWIDTH;
}
#LeftColumn{
      width: LEFTWIDTH;
}

This will then be outputted as this standard compliant stylesheet:

body{
      background-color: #00FFFF;
      color: pink;
      width: 550;
}
#RightColumn{
      width: 150px;
}
#LeftColumn{
      width: 275px;
}

All the lines beginning with “define” will be treated as a variable declaration, parsed and then deleted from the parsed stylesheet. Notice the two variable names “browser” and “version”. Those two variables are built in properties that return the browser name and major version number respectively.

The scripting syntax is 100% C# because it is compiled by the CodeDom into C# code in-memory. No new syntax of any kind is invented. The reason to use C# and not VB.NET is that developers or designers writing stylesheets probably also know JavaScript which also uses the C style syntax like C#. So, if you are comfortable writing JavaScript, it should be no problem to add scripting to the new CSS variables.

Remember, like JavaScript, these features are case-sensitive. However, that is not why the variable names are upper cased, I just thought it makes sense to let them stick out from the rest of the styles.

Implementation

There are two versions of the HttpHandler – one to use if you can control the IIS and one if you can’t.

If you are able to let the IIS send .css files to the ASP.NET engine you should download the CssHandler.cs file below and add it to the App_Code folder and then add the following to the web.config:

<httpHandlers>
  <add type="CssHandler" verb="*" path="*.css" />
</httpHandlers>

If you can’t access the IIS, you need to download the CssHandler.ashx below and then call that file while passing the .css file as a query string in the URL like this:

<link rel="stylesheet" type="text/css" href="csshandler.ashx?path=style.css" />

Total feature list

This is the total feature list of the handler:

• Add variables to CSS (feature)
• Use scripting capabilities (feature)
• Server and client side caching (performance)
• Cache dependant of the source .css file (performance)
• Whitespace and comment removal (performance)
• Works only on .css files (security)
• Blocks the System namespace (security)

Word of caution

Because the scripting language is pure C#, it also means that you have to take injection attacks into account. I’ve already made sure that any scripting using anything in the System namespace will be rejected. That means that you can’t use any System.File.IO commands or anything else that has the word “System.” in it. That eliminate probably 99% of the obvious attack surface, but it is not totally secure.

Download

CssHandler (.cs – for IIS access).zip (1,96 KB)

CssHandler (.ashx – for non IIS access).zip (1,91 KB)

Comments

Tag:

Add to Del.icio.us | Digg | Yahoo! My Web | Furl

Bookmark WebProNews:

Mads Kristensen currently works as a Senior Developer at Traceworks located
in Copenhagen, Denmark. Mads graduated from Copenhagen Technical Academy with a multimedia degree in
2003, but has been a professional developer since 2000. His main focus is on ASP.NET but is responsible for Winforms, Windows- and
web services in his daily work as well. A true .NET developer with great passion for the simple solution.

http://www.madskristensen.dk/

Hit counters aren’t the only programs that count hits. In fact, many programs will record those file access requests, and perhaps the most popular ones are the web servers, themselves. Since it’s the job of the web server to serve up those files, it only makes sense that web servers like Apache and Microsoft’s Internet Information Services (IIS) would keep track of that activity. These logs routinely include details of browser visits, an example of which is reproduced below, with identifying information altered to protect the source:

pool-71-0-107-3.locfl.dsl-w.isp.net - - [01/Sep/2006:07:17:15 -0400] "GET /cgi-bin/page.cgi?g=New%2F;d=1 HTTP/1.1" 200 7409 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8.0.6) Gecko/20060728 Firefox/1.5.0.6"

pool-71-0-107-3.locfl.dsl-w.isp.net - - [01/Sep/2006:07:17:23 -0400] "POST /cgi-bin/user.cgi HTTP/1.1" 200 7091 "http://www.sample.com/cgi-bin/user.cgi?d=1" "Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8.0.6) Gecko/20060728 Firefox/1.5.0.6"

These three lines were taken from the logs of an Apache server in Combined Log Format (CLF), recorded on September 1, 2006, at 7:17 AM EDT. They show the hostname or IP address of the connecting party, the date and time, the HTTP instruction processed (GET or POST ), the results of the instruction (server response code 200 means the server found no errors in the request), the amount of data passed as a result, the referrer URL (where the request came from), the kind of browser making the request, and the PC environment running the browser.

Reading the log entries would give you a good idea of the kind of activity your site receives. The entries would easily let you learn how many visits your site has had, and you can see which pages are the most popular. By making note of the connecting host and the timestamp, you could follow a visitor through your site, and see what interests him or her. All it takes is a bit of digging through the logs. Most people, however, would probably find it time consuming and dull.

Sure beats log reading

It is this awkward presentation that led developers to produce web analytics software in the first place. Log-based web analytics software imports or reads the web server log file and produces a series of graphs and tables. These user-friendlier graphs and tables take much of the drudgery out of “counting hits.” Popular examples of log-based web analytics programs include Webalizer and AWStats, best known because they are free products often used by web hosts as a benefit for clients.

It might be fair to classify Webalizer and AWStats as log readers, rather than analytics programs. Making web server logs readable is what they specialize in, after all. Webalizer starts with bar graphs permitting a comparison of site visits over the past year, along with a chart offering a summary of the major statistics over that same period. Clicking on a month gives you details on that month’s visits, all collected from the server’s logs. When you have nothing else, it’s handy, which is why (along with the price) so many web hosts provide it as a free benefit of hosting with them.

But there is more to analytics than simply restating the logs in a friendly manner. We’ll look at what the commercial log-based web analytics programs can do in a future blog.

Tag:

Add to Del.icio.us | Digg | Yahoo! My Web | Furl

Bookmark WebProNews:

Michael Pedone is the President / CEO of eTrafficJams.com, a search engine optimization and website marketing company <http://www.etrafficjams.com> located in Clearwater, Florida that specializes in getting targeted, eager-to-buy traffic to your site. You can catch him blogging at: <http://www.etrafficjams.com/blog/>.

When you run a file-system web site, it runs under the ASP.NET Development Server by default. Because this server has limitations, however, you’ll want to be sure to test a file-system web site under IIS as well as under the development server. Figure 4-6 describes how you do that.

To start, you need to create a virtual directory for the web site as described in figure 4-1. Then, if you open the web site from this virtual directory, it will automatically run under IIS. Alternatively, you can open the file-system web site directly and change its start options so the URL you specify is used to start the application. In this figure, for example, you can see that the Use Custom Server option has been selected and the URL for the web site’s virtual directory has been entered in the Base URL text box.

This figure also lists the limitations of the ASP.NET Development Server. The most significant of these limitations is that it always runs under the current user’s security context, but your own user account probably has stronger security privileges than the account IIS runs ASP.NET applications under. As a result, when you move the application to a production web server, you may have to contend with security issues that weren’t apparent when you tested with the development server, especially if you access files or databases located in folders outside of the application’s folder structure.

The dialog box for specifying a web server

How to test a file-system web site with IIS

Create a virtual directory for the web site as described in figure 4-1.

Open the web site from its virtual directory, or open the file-system web site and then use the Property Pages dialog box shown above to specify the URL for the virtual directory.

Run the application using one of the techniques in figure 4-4.

Limitations of the ASP.NET Development Server

Can serve pages only to the local computer.

Runs in current user’s security context, so it doesn’t accurately test security issues.

Does not include an SMTP server, so it can’t be used to test email applications.

Uses a randomly chosen port rather than the standard HTTP port 80.

Description

By default, a file-system web site is run using the ASP.NET Development Server. To run a file-system web site using IIS, you can use one of the techniques above.

To open the Property Pages dialog box, right-click the project in the Solution Explorer and select Property Pages from the shortcut menu. Then, to change the server that’s used to run the web site, click the Start Options node, select the Use Custom Server option, and enter the URL of the virtual directory for the web site.

Add to Del.icio.us | Digg | Yahoo! My Web | Furl

Bookmark WebProNews:

Joel Murach has been writing and editing for more than 10 years. During that time, he sharpened his programming skills as a contract programmer in San Francisco and his instructional skills as a trainer for HarperCollins Publishing. He always brings a vision to his projects that leads to improved effectiveness for his readers.

A remote web site is similar to a local web site except that a remote web site resides on a computer that you have access to over a LAN.

To create this type of web site, FrontPage Server Extensions must be installed on the remote computer. Then, you can just select the HTTP location option and enter the location of the web site as shown in figure 4-2. Here, a web site named Ch03Cart is being created in a directory named ASPNET2005 on a server named mma1.

Although you use the same techniques to work with a remote web site as you use to work with a local web site, you should realize that the permissions for a remote web site may not be set the way you want. For example, suppose you create a web site that writes to a text file that’s stored in the App_Data folder of the site. To do that, the web site must have write permissions on that folder. By default, though, a remote web site is given only read permissions. Because of that, you’ll need to have the system administrator assign the appropriate permissions to the web site.

The dialog box for creating a remote IIS web site

Description

To create a remote web site, select HTTP from the Location drop-down list. Then, enter the URL of the web site you want to create.

You can also create a remote web site by clicking the Browse button and then using the Choose Location dialog box that’s displayed for a remote site. However, this dialog box doesn’t provide any additional options.

By default, a web application that you create on a remote server doesn’t have the permissions needed to change files in the web site at runtime. If an application needs to change a file, then, you’ll need to contact the system administrator about giving it the appropriate permissions.

Visual Studio communicates with a web site on a remote server using HTTP and FrontPage Server Extensions. Because of that, FPSE must be installed on the remote server. For information on how to install FPSE, see appendix A.

Add to Del.icio.us | Digg | Yahoo! My Web | Furl

Joel Murach has been writing and editing for more than 10 years. During that time, he sharpened his programming skills as a contract programmer in San Francisco and his instructional skills as a trainer for HarperCollins Publishing. He always brings a vision to his projects that leads to improved effectiveness for his readers.

A local IIS web site is a web site that resides on your local computer. To create a local IIS web site, then, you must have IIS installed on your computer.

Figure 4-1 illustrates how you create a local IIS web site. To start, you select HTTP for the location option in the New Web Site dialog box (see the next figure). Then, you typically click the Browse button to display the Choose Location dialog box shown in this figure.

In the Choose Location dialog box, you can click the Local IIS button at the left side of the dialog box to display the IIS web server. Then, you can select the directory where you want to create your web site. In this case, I selected the ASPNET2005 directory. Then, I clicked the Create New Web Application button to create a new web site named Ch03Cart in that directory.

When you use this technique, the files for the web site are stored within the directory you create. If that’s not what you want, you can create a virtual directory that points to the directory where the files for the web site will be stored. To do that, just click the Create New Virtual Directory button in the Choose Location dialog box. Then, a dialog box is displayed that lets you enter a name for the virtual directory and the path where the files for the web site should be stored. In the dialog box shown in this figure, for example, the virtual directory will be named Ch03Cart, and the files will be stored in a directory with the same name within the ASP.NET 2.0 Web Sites directory on the C drive.

In addition to using the New Virtual Directory dialog box to create a virtual directory for a new web site, you can also use it to create a virtual directory for a file-system web site you’ve already created. To do that, just enter the path for the existing web site in this dialog box. Then, when you click the OK button in the New Web Site dialog box, Visual Studio will warn you that there is already a web site at the location you specified. To create a virtual directory that points to the existing web site, select the Open the Existing Web Site option.

Before I go on, you should realize that you can also create a virtual directory for a file-system web site using the IIS Management Console. If you’re interested, you can learn how to do that in appendix A. Unless you need to change the default permissions for a virtual directory, though, I recommend that you create the virtual directory from within Visual Studio.

The dialog box for selecting a local IIS web site

The dialog box for creating a virtual directory

Description

To create a web site that will run under IIS on your local computer, select HTTP for the location option in the New Web Site dialog box. Then, enter the path of the IIS directory where you want to create the web site, or click the Browse button to display the Choose Location dialog box.

From the Choose Location dialog box, click the Local IIS button and expand the Default Web Site node. Then, select the directory where you want to create the web site from the default web site and click the Open button, or create a new directory or virtual directory.

To create a new IIS directory for a web site, click the Create New Web Application button and then enter the name of the directory. The files for the web site will be stored in this directory.

To create a virtual directory for the web site, click the Create New Virtual Directory button to display the New Virtual Directory dialog box. Enter a name for the directory and the path where you want to store the files for the web site. If the path you specify already contains a web site, you can open that web site from the virtual directory.

Add to Del.icio.us | Digg | Yahoo! My Web | Furl

Joel Murach has been writing and editing for more than 10 years. During that time, he sharpened his programming skills as a contract programmer in San Francisco and his instructional skills as a trainer for HarperCollins Publishing. He always brings a vision to his projects that leads to improved effectiveness for his readers.

When the blogger behind the brand new EvolvedLight blog wanted to find out more information regarding an accident at Alton Towers amusement park in Staffordshire, England, the quest for information led to the park’s media page.

“This site is for Media use only. To gain an access password please call 01538 704015,” reads the page. Instead, the blogger turned to the ubiquitous Google to indulge in a little Google hacking.

In looking at the source code, one section revealed that whatever is entered as a password would trigger a redirect to a page named {password}.html. The right password would reveal the press page.

So the blogger sent Google a simple search string: * site:http://press.altontowers.com and guess what was revealed as the third result in the SERPs?

“Welcome to the Alton Towers Press Site,” said the revealed page, called pressxpsa.html. That means the password would be pressxpsa.

And indeed it is. To call this a poorly designed page would be an insult to poorly designed pages everywhere. In the interest of helping out someone in need, here is a Microsoft link on securing ASP pages for the amusement park’s Windows Server 2003 host running IIS 6.

—
Tag:

Add to Del.icio.us | Digg | Yahoo! My Web | Furl

Bookmark WebProNews:

David Utter is a staff writer for WebProNews covering technology and business.

1. You may need to put your Windows XP Pro CD into the PC.

2. Go to Control Panel, ‘Add Remove Programs’, then ‘Add/Remove Windows Components’. In the Windows Components window, place a check mark beside ‘Internet Information Services (IIS)’, then click next, then click finish.

3. During installation, Windows creates a directory at C:\inetpub\wwwroot and places a few files there. You can view the home page of your web browser by typing ‘http://localhost’ or ‘http://COMPUTER_NAME’ (where COMPUTER_NAME is the actual name of your computer) into the address bar of any web browser. If you haven’t placed any files in C:\inetpub\wwwroot, you should see some basic IIS information in the web browser at this address.

4. Your web server is now working. The console for IIS is located in Control Panel > Administration Tools (if you use Classic View; under ‘Performance and Maintenance’ if not).

The next steps are for adding a new virtual directory.

5. To add a new virtual directory, open the IIS management console (step 4), click the plus signs on the left until you see ‘Default Web Site’, then right-click on it and select ‘New > Virtual Directory’.

6. The Virtual Directory Creation Wizard is now on the screen. Click Next on the first screen. Type an Alias for your website. This will be the name you will type after http://localhost to view your website ( example: http://localhost/ALIAS ). Click Next.

7. Now you must enter the directory path. Click ‘Browse’ and browse to the appropriate folder location for your new website’s files. This location will most likely be C:\inetpub\wwwroot\ALIAS. Click next.

8. On the last screen you will see security information. If you are not worried about implementing security, check all of the boxes. If you want to run ASP scripts, select the first two. Click next.

9. Your virtual directory is set up. You can view it by typing http://localhost/ALIAS into the web browser’s address bar.

For more tutorials visit http://www.StudioThreeHundred.com

Add to Del.icio.us | DiggThis | Yahoo! My Web | Furl

Chris Alexander is an IT Professional for a large corporation as well as a freelance web designer. Read more about him at http://www.studiothreehundred.com

Prerequisite: IIS (web server) installed. Click here for tutorial.

The first step is to extract all of the files from the downloaded zip file into C:\PHP (create the folder if it doesn’t already exist). You may choose a different location, although it is not recommended. The path must NOT have spaces, for example, you cannot use C:\Program Files\PHP. Some web servers may not be able to handle the path name and will fault.

PHP 5 includes a CGI executable, a CLI executable as well as the server modules. The DLLs needed for these executables can be found in the root of the PHP folder (C:\PHP). php5ts.dll needs to be available to the web server. To do this, you have 3 options:

1. Copy php5ts.dll to the web server’s directory (C:\inetpub\wwwroot). 2. Copy php5ts.dll to the Windows system directory (C:\windows\system32). 3. Add the PHP directory path to the environment variables PATH.

We will go with option 3, because we would like to keep all of our PHP install files in the same location, for easier cleanup later, if needed. Let’s proceed…

Instructions on how to put C:\php in env variables PATH.

First we want to open System Properties. There are two ways to get to System Properties. Either way will work.

1. Right-Click on My computer and choose “properties”.

2. Go to Control Panel, and select “System”.

Once here, we want to select the Advanced tab. In the Advanced tab, click the “Environment Variables” button. There are two sections in the Environment Variables window, User Variable and System Variables. We will be using System Variables. Scroll down in System Variables until you find the variable PATH. Highlight that line and the select Edit below the System Variables window. We will only be adding to the Variable Value. BE CAREFUL HERE. You do not want to delete anything on this line. Simply find the end of the line and add a semi-colon ( ; ) if there is not one already. After the semi-colon, type: C:\PHP and then hit OK. Now click OK on the Environment Variables window.

Finally click OK on the System Properties window and we are done with this part.

Now we must restart the computer to make the Environment Variables changes come into play. We cannot simply log off and log on, you must restart.

The next step is to set up a config file for PHP, php.ini. In C:\PHP you will find two files named php.ini-dist and php.ini-recommended. We will use php.ini-recommended for this install, and all you need to do is rename it from php.ini-recommended to php.ini.

1. doc_root = C:\inetpub\wwwroot

2. cgi.force_redirect = 0

Now PHP is installed, lets move on to preparing our IIS to use PHP.

Configure IIS to use PHP.

1. Open IIS

2. Under Home Directory: Set “Execute Permissions” to “Scripts Only”

3. Click on configuration..

a. Click Add

b. Set “executable” to C:\PHP\php5isapi.dll

c. Set “extension” to .php (don’t forget to include the . )

d. Click OK

e. Click Apply, then OK. Under ISAPI Filters

a. Click “Add”

b. Set Filter Name to PHP

c. Set Executable to C:\PHP\php5isapi.dll

d. Click OK.

e. Click Apply, then OK. Restart the Web Server

Now we want to test PHP on our system. To do this, we will create a file called phpinfo.php and it will be used to display all of the PHP info from our system in our web browser.

1. Open Notepad and type: <?php echo phpinfo(); ?>

2. Save the file as phpinfo.php and select the file type ‘All Files’ (Important: do not save the file as .txt, as it will not work).

3. Move the file into C:\inetpub\wwwroot

4. Open your web browser and type: http://localhost/phpnfo.php

5. Your browser should display a lot of PHP information.

Congratulations! PHP is now installed and configured on your machine. You can now start building dynamic web pages. For more tutorials visit http://www.StudioThreeHundred.com

Chris Alexander is an IT Professional for a large corporation as well as a freelance web designer. Read more about him at http://www.studiothreehundred.com

“MaximumASP is a natural choice to debut IIS 7.0 in a hosted environment. Throughout the evaluation and testing process, MaximumASP demonstrated excellent flexibility and technical skill, and has developed a strong relationship with the developer product groups at Microsoft,” said Bill Staples, the product unit manager of IIS 7.0.

“The IIS product is at the center of Microsoft’s Web platform strategy,” Staples continued. “IIS serves as the underlying hosting and management infrastructure for all of Microsoft’s Web platform technologies including ASP.NET and Windows Communication Foundation. Microsoft is excited to work with MaximumASP as an early adopter of IIS 7.0 and believes its commitment to quality hosting and excellent customer service will result in a fantastic opportunity for customers to evaluate IIS 7.0.”

At the other end of the deal, Chris Page, CTIO of MaximumASP, seemed equally enthusiastic. “We are very excited about the IIS 7.0 architecture and anxious to give users a sneak preview of how it will change management of hosted sites and Web applications,” he said. “MaximumASP continues to lead the hosting industry by giving our customers a competitive edge and enabling them to be first-to-market with new solutions.”

Users all over the world will be able to try out the new technology, which will be available in a hosted environment, for free. It’s likely that many people will take advantage of the opportunity to test-drive the long-anticipated “Longhorn.”

Add to | DiggThis | Yahoo! My Web

Technorati:

Doug is a staff writer for WebProNews. Visit WebProNews for the latest eBusiness news.

However, 20% of millions of servers is still a pretty substantial number of servers, and so IIS (Internet Information Server) can’t be written off that quickly.

IIS and Security

Among technical people, though, IIS is mainly known for its terrible security record, most famously when a security hole allowed the Code Red worm (a kind of virus) to spread between IIS servers back in 2001 . Microsoft was forced to issue press releases asking people to secure their servers, which meant that millions of webmasters had to go to Microsoft’s website and download a patch to fix the problem. This prompted many people to go and download Apache instead, so the same thing wouldn’t happen again. Most of IIS’ security holes were caused by services that most people don’t use, simply because they were left on by default. Once an attacker was in, the damage they could do was greatly increased by the fact that IIS ran with all the security privileges available on the system – essentially, once someone got past IIS’ lacking security, they could do anything to the system.

For the latest version, Microsoft finally turned off unnecessary services and made the server run with fewer privileges, creating a much more secure web server. However, most of the IIS servers on the Internet today are not running the latest version, as the only way to get it is to upgrade to the Windows Server 2003 operating system – there are plenty of people still running IIS 5 on Windows 2000.

IIS and Stability
Another prominent criticism of IIS is that it has a tendency to fail under heavy loads, as it can’t handle very many connections at once. If you’ve ever seen an error that says something like ‘Website Too Busy’, the chances are that IIS was responsible for it.

So Why Would Anyone Use IIS?

The primary reason anyone uses IIS is that they created their website using Microsoft’s software. This usually means that their database is Microsoft SQL, and their pages are written using ASP (Active Server Pages), the latest version being ASP.Net. ASP is easy to use, as most scripts are written in a Visual Basic-like language named VBScript, and comes with a slick environment that makes it easy to rapidly develop dynamic websites.

In the latest .Net version, servers can actually run whole programs using the Visual Basic .Net and C# programming languages. This is a powerful feature, allowing full-fledged programming languages to be used to generate HTML pages, and Microsoft counts on it to differentiate ASP from other solutions.

As recently as 2001, ASP was the leading solution for dynamic web pages (it was beaten by PHP the next year), and it still ha a lot of momentum. Open source languages can seem unreliable to managers, and they were often unwilling to make the change from technology that had the backing of a big company like Microsoft. Companies are now starting to make the change, although quite a few are c to Java instead of PHP.

IIS Alternatives

Since so many people want to switch away from IIS, a market has opened up in helping them to do so while letting them keep their ASP code – after all, it wouldn’t be any good if they had to start over in PHP, would it? The best solution is made by Sun, and you can see it at www.sun.com/software/chilisoft. Unfortunately, that software costs $500, so it’s only really worth it if you have a lot of code tied up in an ASP language.

Really, the best thing to do is to stay away from IIS to begin with – yes, it’s easy to write web pages in VBScript, and, yes, IIS does come for free with Windows, but in the long run it really isn’t worth the hassle.

Information supplied and written by Lee Asher of Eclipse Domain Services

Domain Names, Hosting, Traffic and Email Solutions.