Tip of the Day

Tip of the Day #17: Duplicate input fields

Colin Angus Mackay — Sat, 06 Feb 2010 22:01:38 GMT

Don’t allow duplicate input fields into your form.

The other day I was trying to debug a bug in an application that I maintain. The code created a set of pagination buttons at the top of the page with previous and next buttons. At some point a request had come in that the buttons needed to be replicated at the bottom of the page. Since the HTML was being built up in a string and dumped in a literal control in the first place the developer that was tasked with making the change just dumped the string into two literal controls, the original at the top of the page, and the new one at the bottom of the page. The previous and next buttons use hidden input field to tell the application which actual page number the buttons correspond to. And these were now duplicated and as a result the previous and next buttons ceased to work.

Here is an example of something similar:

<input id="first-hidden-field" value="123" type="hidden" name="some-name" />
<input id="submit-button" value="Submit" type="submit" />
<input id="second-hidden-field" value="456" type="hidden" name="some-name" />

When the form fields are returned to the application and the field “some-name” is queried the result back is a combination of the two fields with the duplicate name. In this case:

string someName = Request.Form["some-name"];

will result in the value of “123,456” being stored in the string. Basically, it is the comma separated form of all the input fields with the given name.

Tip of the Day #16: NaN (Not a Number)

Colin Angus Mackay — Sat, 12 Sep 2009 12:21:15 GMT

The Issue

If you want to detect if a double (System.Double) or float (System.Single) is “not a number” or NaN you cannot use something like this:

if (myDouble == double.NaN) { /* do something */ }

It will always be false.

Sounds crazy? Try this:

double myDouble = double.NaN;
Console.WriteLine("myDouble == double.NaN : {0}", myDouble == double.NaN);

The result is:

myDouble == double.NaN : False

You can see that myDouble was explicitly set the value of double.NaN, yet in the next line it is returning false.

The Solution

If you want to test for a floating point value being Not a Number you to use IsNan() which is a static method on System.Double and System.Single. Here is the first example re-written to use the static method. It will now work correctly:

if (double.IsNan(myDouble) { /* do something */ }

If we re-write our other example:

double myDouble = double.NaN;
Console.WriteLine("double.IsNaN(myDouble) : {0}", double.IsNaN(myDouble));

We get the expected result too:

double.IsNaN(myDouble) : True

The Reason

According to Wikipedia: In computing, NaN, which stands for Not a Number, is a value or symbol that is usually produced as the result of an operation on invalid input operands, especially in floating-point calculations. For example, most floating-point units are unable to explicitly calculate the square root of negative numbers, and will instead indicate that the operation was invalid and return a NaN result. NaNs may also be used to represent missing values in computations.

It goes on to say: A NaN does not compare equal to any floating-point number or NaN, even if the latter has an identical representation. One can therefore test whether a variable has a NaN value by comparing it to itself, thus if x = x gives false then x is a NaN code.

This is why (double.NaN == double.NaN) always results in false. And it is also how the .NET framework detects the NaN value in the IsNan() method.

public static bool IsNaN(double d) 
{ 
    return (d != d); 
}

Technorati Tags: NaN,Not a Number,C#,.NET,floating point numbers,float,double,System.Single,System.Double

Tip of the Day #15: Loop Performance

Colin Angus Mackay — Mon, 07 Sep 2009 07:55:56 GMT

When you look at the code it will probably seem somewhat obvious, but it is interesting how the same thought process isn’t necessarily there when actually developing the code, especially when under the pressure of a looming deadline.

Take for example this snippet of code (from a fictitious hotel management system) that may have been run by a receptionist to print out the check in forms that customers of the hotel will fill in on their arrival.

List bookings = GetTodaysBookings();

foreach (Booking booking in bookings)
{
    PrintService service = GetLocalPrintService();
    service.PrintCheckInForm(booking);
}

The method GetLocalPrintService() could be doing a multitude of things. It may simply be creating a new instance of the PrintService object, or it could be resolving a number of dependencies in order to set itself up to communicate with the local printer. But what ever it is doing, we don’t actually need a new instance of the service on each loop. The code will work just as well if we have just one instance that is re-used on each iteration of the loop.

That being the case, the creation of the PrintService can be moved outside the loop so it is created only once, thus removing unnecessary work from the loop. The new code then looks like this:

List bookings = GetTodaysBookings();
PrintService service = GetLocalPrintService();

foreach (Booking booking in bookings)
{
    service.PrintCheckInForm(booking);
}

As I said at the top, this is obvious. Isn't it?

Tip of the Day #14: A Step to PCI Compliance

Colin Angus Mackay — Sun, 06 Sep 2009 11:00:51 GMT

If you have a public facing website that accepts credit card payments from customers they you’ll be looking to become PCI compliant. This means you need to improve the security of your website to prevent attack and to prevent data being intercepted by third parties.

SSL 2.0 is now seen as weak and insecure, yet IIS will by default accept connections from older browsers that want to use this. It can be turned off, but it isn’t obvious how to do that. Here’s how to turn off SSL 2.0 on IIS or Microsoft Support has a reference on How to disable PCT 1.0, SSL 2.0, SSL 3.0 or TLS 1.0 in IIS (Internet Information Services).

While many PCI auditing companies will tell you if you are using SSL 2.0 or any other weak techniques, the quick test to ensure the server is not serving pages using SSL 2.0 is to change the Advanced Options in Internet Explorer to only support SSL 2.0.

After that I went to a secure page in the site and got the following error message:

Internet Explorer cannot display the webpage

Most likely causes:

You are not connected to the Internet.

The website is encountering problems.

There might be a typing error in the address.

What you can try:

Diagnose Connection Problems

More information

This problem can be caused by a variety of issues, including:

Internet connectivity has been lost.

The website is temporarily unavailable.

The Domain Name Server (DNS) is not reachable.

The Domain Name Server (DNS) does not have a listing for the website's domain.

If this is an HTTPS (secure) address, click Tools, click Internet Options, click Advanced, and check to be sure the SSL and TLS protocols are enabled under the security section.

For offline users

You can still view subscribed feeds and some recently viewed webpages.
To view subscribed feeds

Click the Favorites Center button , click Feeds, and then click the feed you want to view.

To view recently visited webpages (might not work on all pages)

Click Tools , and then click Work Offline.

Click the Favorites Center button , click History, and then click the page you want to view.

To ensure the site was working normally, I reset the settings to allow only support SSL 3.0 and TLS 1.0 and tried again.

This time I got the page I was expecting.

Note: You cannot use FireFox to perform this quick test as it does not support SSL 2.0.

Tip of the day #13 (String Equality)

Colin Angus Mackay — Sun, 12 Jul 2009 11:19:05 GMT

When comparing two strings in a case insensitive manner, use:

myFirstString.Equals(mySecondString, StringComparison.InvariantCultureIgnoreCase)

or, if cultural rules are to be ignored completely* then use:

myFirstString.Equals(mySecondString, StringComparison.OrdinalIgnoreCase)

over:

myFirstString.ToLower() == mySecondString.ToLower()

* The invariant culture is actually a non-region specific English language culture. The ordinal comparison is faster than any culture specific comparison as it uses a much simpler comparison algorithm.

Tip of the Day #11 (iMicros)

Colin Angus Mackay — Wed, 08 Jul 2009 18:51:39 GMT

iMicros is a plug in for FireFox that lets you automate repetitive tasks. This is a fantastic tool for anyone that develops websites as the flow through the site can be recorded and played back quickly and repeatedly. It reduces tester error by taking the mundane parts out of performing user tests. It can also deal with AJAX, has a stopwatch so you can time page loads, and many other things.

Tip of the day #10 (XP Pro IIS Admin)

Colin Angus Mackay — Tue, 07 Jul 2009 19:17:54 GMT

If you are in the same situation as me where you have to develop web applications on Windows XP and have many projects on the go and for what ever reason cannot just stick each into its own virtual directory then XP Pro IIS Admin is the tool that you need.

What it does is allow you to create multiple web sites in Windows XP (as it only permits one web site) and gives you a little interface for easily switching between them. This makes it much easier to work on multiple projects, especially when the projects expect to be sitting at the top of a website, rather than stuck away in some virtual directory somewhere.

Tip of the Day #9 (The Project Location Is Not Trusted)

Colin Angus Mackay — Mon, 23 Mar 2009 23:52:10 GMT

This tip is to get a tool called ZoneStripper by James Kovaks to stop the annoying "project location not trusted" dialog box, below, appearing when you open downloaded solutions in Visual Studio.

If you download zipped source code from the web, unzip it and then open the solution in Visual Studio 2008 (and apparently VS 2003 and VS 2005 as well) you may get a dialog that says "The project location is not trusted" ... "Running the application may result in security exceptions when it attempts to perform actions which require full trust." A bit like this:

What happens is that when you download something from the internet Windows (from Windows XP SP2 onwards) will add an alternate stream to the file called zone.identifier. If the file is a zip it will then add that alternate stream to each of the files as it unzips.

You can view this stream by typing something like the following at a command prompt:

notepad DevWeek2009_PreCon.zip:zone.identifier

You can then read the contents of the alternate stream:

What the ZoneStripper program does is delete the zone.identifier alternate stream from the file so that zone aware applications (and the OS) treat the file normally.

Note: If you unzip the files to a FAT based file system then you won't have a zone.identifier in the first place as the FAT file system does not support alternate file streams.

Tip of the Day #8 (string performance)

Colin Angus Mackay — Mon, 04 Aug 2008 12:00:54 GMT

Concatenating strings in .NET can be very easy. There is the overloaded + operator that makes stringA + stringB + stringC statements very easy to write. But, it isn't very performant. The reason is that strings are immutable, and concatenating strings in this way causes lots of short-lived objects to be created and thrown away, which in turn causes the garbage collector to run frequently.

There are two better ways in .NET to concatenate strings. One is to use the string.Concat() method. The other is to use the StringBuilder class. They both perform better than adding strings together, but you still have to know when to use each.

According to this article on "Performance considerations for strings in C#" string.Concat() is good up to 600 strings. But, only if you have 600 strings to concatenate in a single statement. StringBuilder is better if you have more than 600 strings to concatenate, but you can do so over multiple statements. In reality, I think the benefits of appending strings over multiple statements with StringBuilder will work out better even with much less than 600 strings because to get the performance out of string.Concat() you'll have to perform some form of setup operation to line all those strings up - and that will take time.

So, today's tip is don't use the plus operator to combine strings except in quick / throw-away applications. Use string.Concat() or StringBuilder instead.

Technorati Tags: string,concatenation,concat,stringbuilder

Tip of the Day #7 (SysInternals)

Colin Angus Mackay — Wed, 30 Jul 2008 14:47:33 GMT

I've visited the SysInternals site a few times over the course of my career because of some strange problem that I just couldn't track down. The amount of information about what is actually happening on your system that the SysInternals tools provide is phenomenal. The site was run by Mark Russinovich and Bryce Cogswell until they got hired by Microsoft. However, the tools are still available and being updated, only now they are hosted by Microsoft themselves.

So, today's tip is to visit the SysInternals page on Microsoft's TechNet site and familiarise yourself with what is available. You might find that one day it will save you hours of frustration.