PHP vs .Net

Manually validate an ASP.Net MVC form on the client side with MicrosoftMvcValidation.js and jQuery

morgan — Tue, 27 Apr 2010 06:16:51 +0000

A recent problem cropped up in my Asp.Net MVC application. Its using the standard setup of DataAnnotations + MicrosoftMvcValidation.js + jQuery 1.4.2, and I needed to check the validation state of a form before performing some client-side actions. No problem, right?

Obviously not.

This second part of this post gets in depth as to what's going on with the MicrosoftMvcValidation script, but to save you some time, I'll post the solution first.

To manually validate your form with MicrosoftMvcValidation.js:

~~In MicrosoftMvcValidation.js, change line 20 from:~~

return Sys.Mvc._ValidationUtil.$0($2.validate('submit'));})); return $2;

return Sys.Mvc._ValidationUtil.$0($2.validate('submit'));})); $0.MvcValidationFormContext = $2; return $2;

Alternately, if you're using the debug version of the script, you can achieve the same effect by adding the following to line 196 (the end of the _parseJsonOptions function):

formElement.MvcValidationFormContext = formContext;

UPDATE: As Morten Christiansen points out in the comments, there is a much cleaner way of accessing the FormContext object, without having to introduce a custom tracking property and modifying the script. Instead of a custom property, we can just use
$('form')[0]['__MVC_FormValidation']. Thanks to Morten for pointing this out!

Now we can use the following jQuery/javascript code to manually validate our form:

var $form = ("#MyForm");                            // Select our form with jQuery
var context = $form[0].MvcValidationFormContext;    // Access the new property we created
var errors;
if ($form[0]['__MVC_FormValidation']) {
    errors = $form[0]['__MVC_FormValidation'].validate("submit");        // Validate the form
}
if (!$form[0]['__MVC_FormValidation'] || errors.length == 0) {
    // No errors, do your stuff
}

Now for the explanation.

I assumed (incorrectly) that there must be a client-side API to MicrosoftMvcValidation.js, the javascript responsible for dynamic client side form validation that ships with the ASP.Net MVC framework. Unfortunately, in all my digging, I could not unearth one -- and it seems like a huge oversight. The amount of effort to expose an isValid property or a validate() function on the client would be pretty minimal!

Why would you need to do this? Doesn't the validation occur automatically? Well, yes it does -- when you submit the form, or click around in it. However, there are lots of cases where you might want to manually trigger the error messages or perform a client-side action based on whether or not the form is valid, without running the submit handler. In my case, I wanted to make sure the form was valid before trying to submit it, as our ajax pipeline puts up the "spinner" graphic when a submit event is triggered, which meant it was flashing briefly and looked dumb.

The most common response I ran across when searching for how to manually validate was -- give up and use the jQuery validate plugin. This would be my preferred solution to be honest, but I ran into at least two blockers with jQuery validate:

it doesn't seem to work with modal dialogs generated from jQuery UI,
it doesn't seem to work with forms that are loaded into the document via an ajax call.

So that was out. Since I already had most of what I needed working with the Microsoft scripts, I went back to them and started exploring the code to see if I could discover any sort of public API. This is what I came up with.

The key thing that I found was that MicrosoftMvcValidation creates a javascript object called a FormContext, which has a validate(eventName) method. This seemed promising, so I tried following the code to see how I could get at this validate method. Well -- I couldn't. Not without some modifications. Here's how it works.

When you include MicrosoftMvcValidation, the main piece of script that executes is this:

Sys.Mvc.FormContext._Application_Load = function Sys_Mvc_FormContext$_Application_Load() {
    var allFormOptions = window.mvcClientValidationMetadata;
    if (allFormOptions) {
        while (allFormOptions.length > 0) {
            var thisFormOptions = allFormOptions.pop();
            Sys.Mvc.FormContext._parseJsonOptions(thisFormOptions);
        }
    }
}

Adding <% Html.EnableClientValidation(); %> to your views causes a bunch of JSON data to be output to the page, and appended to the window.mvcClientValidationMetatdata javascript object. When the page is ready, the above function runs and calls FormContext._parseJsonOptions() on all the rules and data that were output to that object.

_parseJsonOptions is what creates the FormContext object that we're interested in. In fact, the return value of _parseJsonOptions is the FormContext… but sadly, Application_Load ignores the return value, and it's just thrown to the bitbucket, never to be seen again (at least by us).

Judging from the underscores on the function names, it's pretty clear that these are meant to be internal operations, so we can (perhaps) excuse them for not storing and exposing the FormContext for us. From the framework's point of view, it doesn't need to be stored anywhere, because it still has it -- _parseJsonOptions internally adds new event handlers for the form, and these handler delegates close over the FormContext object. The closures means that internally, the form handlers still have a saved reference to what they need, so the application load function doesn't need to do anything with the return value. The FormContext never surfaces -- so if we want to validate the form ourselves, we need to ~~expose~~ dig for it.

All that my code at the top of the post is doing is modifying the _parseJsonOptions function (minified to be named $12), to start adding a new property to the form element in the DOM, which will store the created FormContext object. I named this property MvcValidationFormContext, but you could call it anything you'd like. You can subsequently access this new property to get the FormContext and call validate("submit") on it, which fires the validation as though we were trying to submit the form, and returns a collection of errors we can check.

As Morten pointed out, the reference is, of course, still there. You can access the closed over FormContext by grabbing the DOM element and digging in it's properties array. The updated code reflects this.

I'd love to see an upgrade to MicrosoftMvcValidation.js to include a client API in the future. Even more, I'd love to see jQuery Validate get some attention to fix the blockers that I ran into, so I can dump the MicrosoftAjax scripts out of my project altogether.

An Exercise in Wordpress Integration, or Why Wordpress Sucks

blake — Tue, 08 Dec 2009 08:23:50 +0000

I'd like to prefix my upcoming rant with the fact that Wordpress is good at what it does: making basic blogs and publishing content. I use it, many other people use it, it works. Heck, I'm using it right now. But from a technical standpoint, Wordpress sucks. I'm going to relate my experience here trying write a quick function to store post output to a file, to be used by a separate application on the same server.

I started off to write a function (let's call it a caching function for simplicity) that stores some HTML from the most recently published post. Sounds easy enough. I should be able to just put a function into the functions.php file of the custom template set I'm using. That's seems to be where the "userland" custom functions go.

So I check the function reference first. Hey, wp_get_recent_posts(). Looks promising, so I give it a shot. It goes ahead and gets the most recent post just fine. Things are ok so far.

A problem appears

Now, I want to output the post exactly as it would appear in the blog, and save that output to a file on disk. Surely there's a basic function that will output a post's content? You know... take the post_content field from the database record and format it properly? Suddenly, the skies darken. Evil laughter booms out. Ha ha ha! Wordpress mocks the folly of simplistic functional thinking!

The template files use functions like the_content() and the_title(). Just in case you can't tell from the excellent naming scheme, these actually produce echoed output. Checking out the_content(), we see it dutifully calls get_the_content(), then runs a couple of lines of formatting stuff on the results. So how about using get_the_content() for my caching function? I could run the other few formatting bits manually after that. Should be ok, right? After all, the doc comment for get_the_content() says the following:

/** * Retrieve the post content. *

So, I can go ahead assume it simply retrieves the basic post content then? Ha ha. NO. WHY WOULD IT DO THAT? Instead, it takes a bunch of globals that get set who-the-hell-knows-where, runs through a bunch of crap seemingly unrelated to the content of a post, and does a whole lot of textual modifications to some kind of content. Reading through the function is like jabbing red-hot fire pokeys into your eyes. Here's a portion of it:

>> show as plain text

PHP:



$content = $pages[$page-1];


if ( preg_match('/<\!--more(.*?)?-->/', $content, $matches) ) {


$content = explode($matches[0], $content, 2);


if ( !empty($matches[1]) && !empty($more_link_text) )

$more_link_text = strip_tags(wp_kses_no_null(trim($matches[1])))
$hasTeaser = true;
}

$pages is some kind of global that doesn't seem to have any relation to a post. Then apparently we're looking for HTML comments of , and replacing them with... well, something. I'd hate to think what would happen if I ever wrote a post with an HTML comment in it that happened to hit on whatever random content markers Wordpress has decided to use. (Oh wait! That just happened to me while I was trying to publish the above code fragment!) I didn't even bother to look into things like wp_kses_no_null. It probably involves dark rituals with live chicken sacrifice. Why is there so much going on in a function called get_the_content()?

In the end, it seems that get_the_content() will eventually get the content of a post, but only if you set a half-a-dozen or so globals before you call it. And what the hell post is it even getting?

"The Loop"

Digging further, it's clear that the template functions for output are all like that. They don't take any kind of parameters; they just operate on globals! There's no way to take the post data that I just retrieved with wp_get_recent_posts(), and format it using these functions. You have to be in "The Loop" in order to do that. And "The Loop" sucks. It's not a catchy, easy-to-use method of handling posts, despite Wordpress's efforts to pass it off as something neat or fun. It's a mish-mash of global functions with random naming and variable schemes (incidentally, just like the rest of Wordpress). You can only use "The Loop" if you're accessing Wordpress in a "normal", web-requested-and-template-loaded kind of way. It doesn't work if you're outside a template file (such as in functions.php before a template gets loaded).

So back to square one. Unfortunately, it appears that if I want to have the regular blog-formatted output, I need to harness "The Loop" somehow, and clearly you can't do that on your own (ie. outside of a template file) without knowing about every global variable in the system.

After some quick googling, I came across the query_posts() function, which you can use to set up "The Loop". Reading the documentation on it, you can find this little gem:

"The query_posts function overrides and replaces the main query for the page. To save your sanity, do not use it for any other purpose."

To paraphrase: "We've created a public API function that is pretty much useless except in a very specific page-dependent situation. Please enjoy how useless it is. But don't use it."

The fact that there is a "main query" for a page is another indicator of just how global-happy Wordpress is, and that in turn gives you an insight into why it has so many security holes. How do you keep track of so many globals across so many functions?

A solution... sort of.

Fortunately, the query_posts() doc page links to the WP_Query docs, which is marginally more helpful, and provides the path for a solution. Using WP_Query sets up the wacky global stuff necessary to use "The Loop", which means we can hack our way through to getting some formatted post content. While technically feasible, you have to emulate a bunch of $_REQUEST parameters to the query() method. I ended up with this:

>> show as plain text

PHP:



function cacheMostRecentPost()


{


$featuredPosts = new WP_Query();


$featuredPosts->query('showposts=1');


while ($featuredPosts->have_posts())


{


$featuredPosts->the_post();


ob_start();


//do output with stuff like the_title() and the_content()


$str = ob_get_contents();


ob_end_clean();


//write $str to cache fragment


}

}
//set up hooks for this file when a post is changed or deleted
add_action('save_post', 'cacheMostRecentPost');
add_action('deleted_post', 'cacheMostRecentPost');

So despite relying on a specific set up of incoming HTTP parameters (as a string) for the most part, at least you can pass paramters to the query if you know the right ones. In this case, "showposts=1" seems to be the total number of posts fetched, and they appear to come back ordered by posting date, most recent first. This works for what I want it to do, but guess what? It doesn't work if you try to run it anywhere that's not one of those action hooks, because "The Loop" overwrites all the globals necessary for doing output later! So I can't use that function, say, at the top of the index.php template file if I wanted to. If I do, thanks to the overwritten globals, Wordpress decides that I actually want the "Archive" page instead of the index page(!), and switches templates accordingly. So while I achieved my goal of being able to cache a post to a file with this function, it's certainly not portable, and it's certainly not elegant.

Wharrgarbl

The entire code flow is mind-boggling. Basing the output functions around a bunch of globals reminds me of code someone would have written in PHP 3 a decade ago, or something a very inexperienced programmer would write. Definitely not something you would expect in an application used by what is probably now millions of people. What's wrong with having some data fetching functions, and some output functions? You could, and I know I'm talking crazy here, but you could fetch some data, and then pass it to the output functions. Then (bear with me here), you could probably fetch posts (or whatever) at any time, and get some formatted output at any time, without overwriting some important global that might be used later in the code flow. Revolutionary, I know. Sorry if I went too fast on that. I'll repeat it louder and/or slower for any Wordpress core developers that happen to be reading.

So, Wordpress? How about something like:

$postObjects = getRecentPostsByDate(1); $output = formatPostContent($postObject[0]);

The mere concept of having individual posts exist inside their own little encapsulated world would make the APIs a hundred times more useful (and easier to understand). You could even keep those crap the_title() and the_content() and the_something_lol_naming_scheme_lol() functions if you wanted. Just make them take parameters. Better yet, put them inside a formatting object, or even the post object itself. $post->the_content() would still work, but it would have context!

The reason this gets me worked up is not that it's so frustrating to use (although that helps). I've had to deal with a lot of frustrating code in my career. It's more the fact that it's this kind of thing that gives PHP programmers a bad name. The code is just bad. The design is random. The API functions are random. The naming schemes are random. Functions don't do what their name (or their doc comment) indicates they should do. Integrating wordpress into another application or site is next to impossible (try it, I dare you), and the other way around, integrating another application or site into wordpress is much more difficult than it should be. Global usage is rampant and ridiculous to follow.

You don't have to look any farther than a single Wordpress code file to understand why there have been so many security holes over the last couple of years. And there's a lot of PHP code out there that's the quality of Wordpress, or worse.

To re-iterate my opening, if you don't need to get anything special out of it, Wordpress does the job. They've filled their market niche well, and it's encouraging that development is ongoing and releases occur often. I've worked with it on occasion over the last few years, and the improvements are obvious, interface-wise especially, and to some extent code-wise as well (the WP_Query object is a step forward). But working with the code is not fun. Even modifying the template files is an exercise in counter-intuitiveness.

I'm sure there are reasons the code is what it is at this point, and I'm equally as sure I don't have the full picture to go with my condemnations. I guess I should just be thankful that I don't have to maintain it.

ASP.Net MVC – How to route to images or other file types

morgan — Fri, 07 Aug 2009 04:23:51 +0000

A recent question on Stack Overflow (and subsequent answer that I wrote for it) inspired this post. I had recently been discussing URL rewriting in depth with my brother, and have also been doing some introductory work with the routing engine in ASP.Net MVC, and the question piqued my interest since I had been meaning to look at this more closely for some time.

The question on Stack Overflow is titled "How do I route images with ASP.Net MVC", but fundamentally the question is really asking "how can I use ASP.Net MVC to re-route URL's to actual physical files, rather than methods of a controller?"

To be clear, lets address the conceptual differences between routing and url rewriting. Url rewriting takes the requested URL and modifies it before your code ever sees it. As far as your application is concerned, the client requested the rewritten URL. All that URL rewriting does is to change one URL into another URL, based on pattern matching.

Routing is a different and much more powerful beast. The ASP.Net routing engine maps an URL to a "resource", based on a set of routes. The first route to match the requested URL wins the prize, and sends the request off to the resource it chooses. For the ASP.Net MVC framework (which uses System.Web.Routing under the hood), a resource is something that can handle the request object, which is always a piece of code.

So where does that leave physical files? If a request is always parsed by the routing engine and then handed off to some function somewhere, how can we ever route a request for an image to actually return the physical image?

Well, it takes a tiny bit of legwork, but once we're through it, I'm confident you will see the huge advantages that routing has over simple url-rewriting. We will show the equivalent of url-rewriting by handling a request for an image using an URL that doesn't map to a physical path, but be able to return the image anyway.

Handling the Request

First off, we need to handle the request that we want to re-route to a physical file. Out of the box, ASP.Net MVC uses an instance of the MvcRouteHandler object to handle every request. MvcRouteHandler hides all the complexities of taking the requested URL, breaking it down into parts, finding the right controller in your application, instantiating it and passing it all the data it needs.

The end result of MvcRouteHandler is not what we desire. We want to return an image, not instantiate a controller and run a method. We want to skip dealing with controllers altogether in this case. So lets create our own route handler that we'll use instead.

To do so, we simply implement IRouteHandler, an interface exposed by ASP.Net MVC that actually inherits from IHttpHandler. This means that what we're writing is the ASP.Net MVC equivalent of an .ashx file for a webforms app - we're inserting our own handling module into the ASP.Net pipeline, that will handle the request much closer to the webserver/http level, rather than at the ASP.Net application level.

IRouteHandler only has one method that we need to implement, which is GetHttpHandler().

using System;
using System.Collections.Generic;
using System.IO;
using System.Linq;
using System.Web;
using System.Web.Compilation;
using System.Web.Routing;
using System.Web.UI;

namespace MvcApplication1
{
    public class ImageRouteHandler : IRouteHandler
    {
        public IHttpHandler GetHttpHandler(RequestContext requestContext)
        {
            string filename = requestContext.RouteData.Values["filename"] as string;

            if (string.IsNullOrEmpty(filename))
            {
                requestContext.HttpContext.Response.Clear();
                requestContext.HttpContext.Response.StatusCode = 404;
                requestContext.HttpContext.Response.End();
            }
            else
            {
                requestContext.HttpContext.Response.Clear();
                requestContext.HttpContext.Response.ContentType = GetContentType(requestContext.HttpContext.Request.Url.ToString());

                // find physical path to image here.  
                string filepath = requestContext.HttpContext.Server.MapPath("~/test.jpg");

                requestContext.HttpContext.Response.WriteFile(filepath);
                requestContext.HttpContext.Response.End();
            }
            return null;
        }

        private static string GetContentType(String path)
        {
            switch (Path.GetExtension(path))
            {
                case ".bmp": return "Image/bmp";
                case ".gif": return "Image/gif";
                case ".jpg": return "Image/jpeg";
                case ".png": return "Image/png";
                default: break;
            }
            return "";
        }
    }
}

The above IRouteHandler is pretty simple. Ignoring the GetContentType helper method, there's really only two things happening. First, we check for a "filename" parameter that got passed in to our handler (more on that in a second). If it's not there, we return a 404 response. Otherwise, we attempt to open up the physical file "test.jpg", and stream it to the browser.

Clearly, this should be adapted to your needs by actually using the filename parameter to find the physical files on your system. But moving on - how do we invoke this from our MVC app? And how do we pass in the filename parameter, of which we'd like to reroute to some other physical path?

Routing the Request to the Custom Handler

Well, this is the easy part. Where you'd normally define your routes in Global.asax, simply use routes.Add(), instead of routes.MapRoute(). Just like this:

routes.Add("ImagesRoute",
                 new Route("graphics/{filename}", new ImageRouteHandler()));

This method of adding our route allows us to specify our custom IRouteHandler, rather than routes.MapRoute(), which by default uses an instance of MvcRouteHandler. So now, we've defined a route that matches against any requested URL containing "graphics/", and puts the rest of the URL into the "filename" bucket of the RouteDataDictionary, and hands it off to our IRouteHandler. This is how we pass the filename parameter into our custom route handler - basically the same way we pass things into controllers, by defining the variables in the route pattern.

We've successfully routed all URL's containing "graphics/", which doesn't physically exist in our web application, and returning "temp.jpg", which could exist anywhere. With a bit of coding around the file IO, you could return files from anywhere.

And that's pretty much it! You might be thinking, "this seems like a lot of extra work just to re-route a URL to a physical file that already existed in my web app!". If you take a step back though, you'll see the power of this approach. What if you wanted to log every request to the original URL to a special log file? What if you wanted to also transform the image before returning it? Perhaps launch a system executable or asynchronously hit a web service? What if you wanted to...?

In a nutshell, by inserting your own HttpHandlers into the ASP.Net pipeline to handle routed requests, you can code anything that you'd like to happen when a request comes in, rather than just rewriting it to some other URL.

Facebook Notifications – "An unknown error occurred (out of memory)"

blake — Sun, 19 Jul 2009 18:54:04 +0000

Over the last few months, I've worked with the Facebook Notification system many times, and there has always been a moderate-to-high level of frustration with it. It is difficult to test on a development application, because you simply don't have the same number of users as a live application, and the application settings on a dev app are different, which affects your allocation of allowed notifications.

One of the prevalent errors I was getting for a long time was that a notification sent to a large number of users (application-to-user notification) would invariably fail with an Exception thrown from the Facebook PHP client library. My notification controller code in a particular application was set up to catch Exceptions and display the error into the administration control panel. However, "An unknown error occurred (out of memory)" is about as helpful as you might imagine. Yay Facebook. The only thing going for this particular error is that it's an iota more helpful than Facebook's documentation, which you quickly learn to distrust as out-of-date or just plain wrong.

The logic

My notification function logic was fairly simple: Accept an array of Facebook user ids, run an FQL query against Facebook to make sure the users all had the application installed, remove any ids that didn't, then use the Notifications.send() method (via the PHP client library's $facebook->api_client->notifications_send() method) to fire off the message.

No problems on development. On production, it was a giant party of "An unknown error occurred (out of memory)" errors.

At first I thought that Notifications.send() couldn't handle a lot of user ids (I was giving it at least 5000), so I put a loop in to break it up into several small "chunk sends". I went all the way down to 500 users per request, and nothing seemed to change, other than I was probably wasting my allocated notifications. The only silver lining to doing this testing on a production server was that the failed notifications didn't seem to go out to anyone, although that's impossible to tell for sure.

It's not the size of the notification, it's how you verify it.

I struggled with this for a long while until I realized that there was only one other possible location for Facebook to throw this error, and that was with the FQL query. I moved my "chunking" loop to work with the FQL as well, and I finally had relief from the "unknown" error. My conclusion therefore is that FQL queries might not be able to handle a large result set.

Since the documentation and forums couldn't give me any help, I thought I'd post my working code and explanation here, in the hopes that someone might find it useful.

Note that the Facebook object has been previously set as a property of the Controller that is executing this function, so it is accessed via $this->facebook here. You can see how the original array is broken into separate requests of approximately 500 users each, with each chunk of users being verified in turn. I have no idea what a safe number of users would be, however 500 seems to be working for me (for now).

/**
 * Sends a Facebook Notification message to all given users of an application.
 *
 * @param array $facebookIds Array of Facebook IDs to send the notification to.
 * @param string $msg Notification message to send.
 * @return int Count of how many users were sent the message.
 * @link http://wiki.developers.facebook.com/index.php/Notifications.send
 */
public function notifyMultipleUsers($facebookIds, $msg)
{
	if (! is_array($facebookIds) || count($facebookIds) == 0) {
		throw new Exception('No user ids given to notifyMultipleUsers().');
	}
	$reqSize = 500;
	$numUsers = 0;
	while(count($facebookIds) > 0) {
		$tmpIds = array_splice($facebookIds,0,$reqSize);
		//Check against Facebook database to verify which users have the app installed.
		$fql = 'SELECT uid FROM user '.
		       'WHERE is_app_user=1 AND uid IN ('.implode(',',$tmpIds).')';
		$fqlRes = $this->facebook->api_client->fql_query($fql);
		$appUsers = array();
		foreach($fqlRes as $a) {
			$appUsers[] = $a['uid'];
		}
		$c = count($appUsers);
		if ($c > 0) {
			$this->facebook->api_client->notifications_send(
				implode(',',$appUsers),$msg,'app_to_user'
			);
			$numUsers += $c;
		}
	}
	return $numUsers;
}

.Net Mocking Frameworks – Capability Comparison

morgan — Sun, 26 Apr 2009 06:04:40 +0000

I have a couple years of experience of TDD under my belt, but it's only recently that I've felt like I am a relatively decent practitioner of it. I attribute this to forcing myself to take the plunge into mocking, and the knowledge of patterns and loosely-coupled design that I've gained from it.

You see, I work on a pretty large and complex ASP.Net webforms product, and tests were introduced late into the development cycle of the initial release. We favored integration testing with real data sources over actual unit tests. While I did write some tests, I knew that our product was not very testable by design.

Recently we put together a public facing API for programming against the product, that we were able to build from scratch. This was a natural opening to apply test driven practices and start building unit tests from the get-go. Due to the service oriented nature of the data that the product consumes, I soon found myself realizing that I needed mocks in a big way. I gritted my teeth and dove head-first into Rhino.mocks.

Several weeks down the road, it was obvious that Rhino just isn't right for our environment. The learning curve is too steep to win quick success with all our developers (and therefore by extension, our project managers). I began looking for another framework.

This led me on a frustrating research mission to find the differences between frameworks without actually trying them all. Due to a lack of in-depth comparisons of the actual capabilities of the various mocking frameworks, I've ended up putting together this chart. I'm hoping it helps some people. My interest is very high in this arena, so I will be keeping it up to date.

(Just for interest's sake - we ended up choosing Moq, due to the ease of the API. The philosophy of Moq jives perfectly with our relatively fast-paced and efficient development environment. We don't care about purism - we care about getting it done.)

.Net Mocking Framework Comparison

Other Notes

Rhino

Mature, flexible framework

Built on Castle DynamicProxy

Very large array of "syntaxes" leads to extreme confusion when writing tests - documentation mixed for the new 3.5 fluent syntax

Large community of users

Moq

New(ish) framework also built on Castle

Requires .Net 3.5 due to its lambda heavy syntax

No distinction between mocks & stubs, record/playback (joy!!)

Responsive and active developers and community

NMock2

Uses "magic strings" for mocking - makes tests brittle

Confusing product version #'s - Nmock2 is actually a new team that picked up NMock and continued development

TypeMock.Net

Powerful framework that uses redirection at the IL level to create mocks

Expensive ($450/license)

TDD Purists argue that the power of it leads to poorer design

The above observations were gleaned from many web pages, documentation repositories and blog posts, and reflect my limited understanding of each framework. There may be errors. If you think I'm wrong, or you can think of other capability aspects that I've overlooked, please let me know!

Fixing "Error 320 (net::ERR_INVALID_RESPONSE): Unknown error" with Google Chrome

blake — Thu, 26 Mar 2009 16:29:11 +0000

Without starting a browser flamewar, I'll just say that Google Chrome is a nice idea, but I won't be switching any time soon. As software evolves, competitors always appear, distilling out the good parts of existing products to create their take on something, and make it better. Google has done that with Chrome; it's light and fast and responsive. Unfortunately, it's still a bit green on the battlefield.

Take this particular error for instance: Error 320 (net::ERR_INVALID_RESPONSE): Unknown error. Have you seen this? I was emailed the other day by someone who was browsing a site I am responsible for that "the site is down! when will it be fixed?!". Seeing that it was fine in all my "normal" test browsers (Firefox, Safari, Opera, IE6, IE7), I gritted my teeth against the inevitable email conversation to follow that would be necessary to get even the slightest helpful detail out of this person.

Eventually, it came out that this person was using Chrome, and sure enough, I immediately got the same error when I fired it up. Not only was this particular site down, but every site on the server gave the same response. Chrome would not load a single page from any site, complaining only that "Error 320 (net::ERR_INVALID_RESPONSE): Unknown error" was upon it, like some kind of HTTP Götterdämmerung.

Googling wasn't immediately helpful; mostly forum threads complaining about the same problem, but no real fixes were presented. Amusingly, it seemed that at one time a lot of Chrome users couldn't use Chrome to access Gmail because of this error. However, I managed to find a thread on Google code which turned out to be somewhat enlightening. The problem appears to be in the way that Chrome handles HTTP headers, where certain forms of some HTTP headers will trigger the error, causing Chrome to pack it in. To be fair, it's really a Windows/Microsoft problem, as the bug is apparently in the underlying WinHTTP service, which Chrome utilizes.

The good news is that the Google devs have apparently solved the problem by switching away from WinHTTP, and it has apparently been fixed in the development branches already. Unfortunately, that's only good news if your average user has downloaded the development version of Chrome, and not if you're a website owner and someone is complaining about your site.

Armed with the knowledge that it was a header problem, without doing any further research I went ahead and upgraded Apache. The server in question had been running version 2.2.6, and I upgraded to Apache 2.2.11.

I was extremely pleased to discover that this actually fixed the problem. Chrome immediately worked just fine, and I immediately cracked open a self-congratulatory beer.

Without examining the Apache changelogs to discover what might have fixed it, I'm happy to just give kudos to those people that deal with that level of the web, and were clever enough to change/fix whichever header it was (I have a hunch it was a mod_rewrite issue, but I'm talking out my posterior on that one). That being said, Chrome (and WinHTTP) should be able to handle invalid HTTP headers, especially if it's an unimportant one and the page content can be salvaged. It's the web... things get garbled and junky all the time (have you ever seen a MySpace page?)

Unfortunately, the end result of this is that now I have yet another browser that I have to check things with when doing web development.

Just what I wanted Chrome to be.

Defend PHP

morgan — Sun, 22 Mar 2009 04:27:47 +0000

I ran across a great discussion at StackOverflow today that started with this question:

I made a tongue-in-cheek comment in another question thread calling PHP a terrible language and it got down-voted like crazy. Apparently there are lots of people here who love PHP.

So I'm genuinely curious. What am I missing? Why makes PHP a good language?

The article lists a dozen or so "flaws" with the language, and then continues:

Worst of all, PHP convinces people that designing web applications is easy. And it does indeed make much of the effort involved much easier. But the fact is, designing a web application that is both secure and efficient is a very difficult task.

By convincing so many to take up programming, PHP has taught an entire subgroup of programmers bad habits and bad design. It's given them access to capabilities that they lack the understanding to use safely. This has led to PHP's reputation as being insecure.

Are the flaws in PHP really any different from any other language?

I'm a C# programmer, and I have to disagree with what some of what the original poster asserted were flaws with PHP. Overly broad implicit type conversions? Too easy to couple presentation with logic? Heck, those are the reasons it's so popular in the first place! Making web programming easy is a flaw? Wut?

After wrestling with the back and forth in that discussion, I came to a simple conclusion. This person has fallaciously concluded that PHP is a bad language based on his perception of its compliance with ivory-tower, computer science academia concepts. Most of his criteria could basically describe Perl, Javascript, VBScript, heck, even VB6, HTML and C.

Of course PHP isn't a horrible language. It's simply a tool, and based on its wild popularity and simple learning curve, only a fool could conclude that it was a bad one. Even if it breeds more "unsafe programmers" (which I doubt highly), it's simply not the language's responsibility to restrict what you can do just because you might do it.

Every programmer should be able to see that.

ASP.Net Load Testing and Optimization Toolkit – So you want to be a hero

morgan — Mon, 11 Aug 2008 20:52:49 +0000

One of my passions is optimization. There's no code related task I like more than making something run better, faster, snappier - from tweaking UI registry keys to stripping out crap code - I want results. Usually if something is noticeably slow on the user's end, there's something fundamentally wrong that can be made faster - a lot faster.

Why do I love optimization? It's because it's the opposite of a thankless job. Everyone thanks you. Your sales team thanks you. Project Managers thank you. Executive management drools over your optimization report - they can take it straight to the bank. Product leads take your report and put it into the release notes. Or a press release. You're the hero! And it's downright fun.

Long story short, my team was recently assigned optimization targets for our app for increasing user capacity (+30%) and decreasing startup and postback times (-20%). During the iteration, the rest of the team was sucked away to emergency projects, and I singlehandedly blew so far past the targets I couldn't even see them anymore. Final optimizations included 100% increased concurrent user load and a 97% reduction in postback execution time. Application startup time was decreased by 40%. Total code changes was 40 lines. Call it precision strike coding. Toss in one nicely formatted "before and after" optimization report, and I'd say it's been a pretty good couple of weeks.

But you need to know what you're doing, and where to get started. You can't simply sit down in front of the code and start randomly caching things or turning every '+' operator into a StringBuilder. (Note: that's not a good idea anyway). But if you get familiar with the following tools, you'll already know where to start. So without further ado...

The ASP.Net Optimizer's Toolbox

If you want to optimize, you need to have an arsenal of tools to troubleshoot and profile your app. You should be familiar with as many of these tools as possible.

Code Profiler

Pretty much no exceptions here - you have to have a profiler. It's extremely time consuming and ugly to start adding TimeSpan calculations around every block of code in your app. For the amount of time it would take to track down one slow line of code "manually", you could have run four profiler sessions and have your top ten "target list" ready to go, made yourself a sandwich and played a game of foosball. Not only that, but profilers will identify fast blocks of code that are getting executed ridiculous numbers of times, making them slow overall.

Since I've used RedGate's Ants Profiler pretty much exclusively, that's all I can recommend here, but others exist. RedGate is great at profiling code, but I find their memory profiling to be pretty lackluster, so if I need to dig into memory I'll generally fire up Windbg (see further down).

Application Stress Tool

You need to be able to load test your application to see how it performs. When does it crash? How many users does it support? How does your memory, disks, network and processors hold up? Load testing uncovers errors you couldn't even dream of by looking at your code - concurrency issues, how your application performs when resources are unavailable, etc.

Load testing tools pose a problem however, because there is a huge gap between free tools and proprietary tools. Here's a list of some of the ones I know for Windows/IIS:

TinyGet (Free) - run some HTTP requests sequentially in a loop. Part of IIS 6 Resource Toolkit
WAST (Free)- an oldie but a goodie - record basic web browsing and simulate lots of users
MS ACT - (Application Center Test) - Next generation from WAST, allows for dynamic variables. It comes with Enterprise Edition level MSDN subscription. Thanks to mike for pointing it out.
NeoLoad - good bang for the buck, all the functionality you'll need for even complex AJAX applications, but not cheap and has a predatory pricing model shared by higher end software
Visual Studio Team Edition for Testers - you can buy a lot of NeoLoad virtual users for this kind of cash.
HP LoadRunner - you could probably hire a thousand testers, buy them all computers and have them generate load manually for what you'd pay for this kind of software.

The problem is that the free stuff (TinyGet, WAST) is next to useless for testing sessions and AJAX apps, they're just not built to handle it. I've recently gotten a lot of experience using Neoload and it's pretty good software with fantastic support behind it - you can record complex user sessions with many dynamic parameters, multiple viewstates and have multiple recorded sessions make up a "population" of users to test your app under a broad range of conditions. It also hooks into the perfmon API to give you flexible reporting and graphs. Unfortunately they charge per "virtual user" you want to have running, and it's not real cheap. Small businesses may find it worthwhile depending on the situation. Freelancers may want to stick with WAST, look at some other options, or roll their own.

The top range stuff is for medium-very large businesses that can shell out the dough, and I don't have any experience with them. For the money, they'd better be good!

Performance Monitor

Recommended: Performance Monitor (perfmon.exe) (Free)
Also good: NeoLoad

At what point does your app spike the CPU? How's that CLR request queue going? What's your heap memory look like? Microsoft's perfmon API is very rich and if you don't have a custom app that hooks into it already, simply type "perfmon.exe" at the command prompt and you have everything you need in Microsoft's simple MMC app. You can monitor as many machines as necessary all in the same window or log. Experiment with recording counter log files and replaying them - this data can be exported and included for that extra-demanding CTO. If you're unfamiliar with perfmon, play around with it - it's not too hard to figure out even though the interface is a bit dated.

HTTP Recorder

Recommended: Fiddler2 (Free)

Optimizing your AJAX app? Confused about how chatty your application is being? You need to be able to see exactly what's going between client and server - requests, responses, headers, what's compressed and what isn't. Enter Fiddler2 - this little proxy server sits between IE and any web page and records all the traffic, and reports it for you in an easy to see format. Tip: if you're looking at your pages on your local machine, use http://machinename instead of http://localhost, since IE ignores going through a proxy for localhost addresses.

Fiddler2 is especially useful for ASP.Net apps because it's not always clear exactly what kind of HTML is being generated by webcontrols.

Interface Manipulation

Recommended: Firebug (Free)
Also good: Developer Toolbar for IE (Free)

Any web developer by now has heard of the Firebug plug-in for Firefox. It lets you manipulate CSS, HTML and javascript on the fly on any webpage you're viewing, complete with a javascript debugger and DOM explorer. In fact, I don't know what we did without it, back in the good 'ol Web 1.5.6.18 days. If you must develop with IE (*shudder*) you can get the Developer Toolbar for IE, which isn't nearly as good, but does the job in a pinch.

Debugger

Recommended: Windbg (Free)
Also good: DebugDiag (Free)

A good debugger/memory dump analyzer is probably the single most powerful tool in your arsenal if you know how to use it. Windbg will let you take a snapshot of your application as it's running or when it crashes, and you can quickly narrow down what's causing crashes, hangs, excessive memory usage, or identify potential optimizations. You can explore the runtime stacks, native and CLR, see what every thread was doing, and see what's in every memory address on your heaps. If you've never used Windbg, there are fantastic lab-style tutorials at Tess' blog at MSDN. These tutorials will also introduce you to perfmon and tinyget.

FXCop (Free)

FXCop can be a useful tool but depending on your environment, it might be more trouble than it's worth. Simply put, it scans your code looking for bad coding practices and comes up with a report about how sloppy you are. Unfortunately, some of the default rules may not apply to your development environment, but with a little effort you can certainly weed out the rules you don't need and make it more useful for your team.

Viewstate Decoder

Recommended: Fritz Onion's Viewstate Decoder (Free)

At some point most ASP.Net apps undergo a Viewstate optimization. Let's face it, Viewstate can be downright disgusting. If you're jumping into the middle of an application, it's helpful to have some guidance on where the hell it's all coming from. Just copy and paste it into a Viewstate decoder and you might find a ton of clues.

Text editor

Recommended: Ultraedit (45 day free trial, $49.95 to buy)
Also good: Notepad2 (Free)

As every experienced coder knows, sometimes, you just don't want to look at something in your IDE. You just want to open a file fast and be done with it. I've used UltraEdit for a long time and it has great features, useful for optimization. For example, you can copy a recorded request from Fiddler, paste it into Ultraedit, and immediately count how many times your ultra-long image pathname occurs, and immediately know how many bytes you can shave out of your file. It has quick and easy syntax highlighting for pretty much any programming language, line numbers, and tracks the file and asks to reload it if it detects changes. It also detects blocks of code or xml for expanding/collapsing, and hundreds of other features.

Although I didn't include Lutz Roeder's Reflector in the list since I don't find that I use it that often when I'm debugging, it's something you should always have for easy reference, especially if you're dealing with unfamiliar assemblies.

Good luck optimizing! Remember to spellcheck your optimization report, and don't forget to put in a one page executive summary of what a hero you are.

PHP Variable Test reference

blake — Mon, 30 Jun 2008 02:08:33 +0000

I thought I'd post a link to this PHP Variable Tests reference page. It's a great reference that's kept up to date with the current version of PHP. I use it sometimes when I'm waffling over what function to use to validate a variable.

Something I've noticed lately with the newer versions of PHP is that ctype_digit no longer returns true when you give it an empty string (ie. ctype_digit('')). This is great, since I always thought that returning true on an empty string was counter-intuitive; by definition, it should only return true "if every character in $text is a decimal digit", so if there's no characters, it can't be true. It's also great because that means that there's lots of places in some of my code where I can change

if (ctype_digit((string) $x) && $x != '')

to just

if (ctype_digit((string) $x)),

which is cleaner and nicer.

It looks like they may have made this change back around PHP 5.1, but I never noticed it until I checked that variable reference page. Nice to see it!

Ten PHP Best Practices Tips that will get you a job

blake — Wed, 04 Jun 2008 22:06:09 +0000

The last couple of weeks have been quite the experience for me. I was part of a big layoff at my former company, which was interesting. I've never been in that position before, and it's hard not to take it personally. I started watching the job boards, and a nice-looking full-time PHP position caught my eye, so I sent out a resume and landed an interview. Before the face-to-face portion, I chatted with the owner and head programmer on a conference call, and they ended up sending me a technical assessment quiz. One particular question caught my eye on this quiz... it looked something like this:

Find the errors in the following code:

";
	}
} 

?>

So, give it a shot. How many can you find?

If you got the missing comma in the parameter list, the "new Array()" error, the colon instead of a semi-colon, the '=' instead of '=>' in the foreach statement, and the erroneous use of '+' on the echo line, then congratulations, you found all the errors! You have the basic PHP technical skills to pay the bills.

That's not how I answered the question though. I noted the errors, obviously, but I went further than that. For instance, did you notice that there were no single quotes around the array indexes ($x[sales] and $x[profit])? That won't cause a fatal PHP error, but it is a coding error! Did you also notice the use of double-quoted strings instead of single-quoted strings on the echo line? Or the usage of the opening PHP short tag? Or the usage of "
" instead of "
"?

After pointing out the actual errors, I made a point of adding comments about those things I just mentioned. It was enough to push the answer from "correct" to "impressive", and it scored me a lot of points with the programmers who were reviewing my application. Enough so that they offered me the job! (I eventually turned it down, as I have been seduced by the siren call of the contracting life, and I intend to flex my PHP skills to the benefit of my clients, and not a faceless corporate overlord who dabbles in telemarketing. I need a shower).

So, read on for my Ten PHP Best Practices Tips that will get you a job:

1. Single-quoted strings are your friend. When you surround a PHP string in double quotes, it is subsequently parsed by the PHP interpreter for variables and special characters, such as "\n". If you just want to output a basic string, use single quotes! There is a marginal performance benefit, since the string does not get parsed. If you have variables or special characters, then by all means use double-quotes, but pick single quotes when possible.

2. String output. Which line of code do you think runs faster?
print "Hi my name is $a. I am $b"; echo "Hi my name is $a. I am $b"; echo "Hi my name is ".$a.". I am ".$b; echo "Hi my name is ",$a,". I am ",$b;
This might seem weird to you, but the last one is actually the fastest operation. print is slower than echo, putting variables inline in a string is slower than concatenating them, and concatenating strings is slower than using comma-separated echo values! Not only does not-inlining your variables give you a performance boost, but it also makes your code easier to read in any editor that has syntax highlighting (your variables will show up in nice colors). The little-known use of echo as a function that takes a comma-separated list of values is the fastest of them all, since no string operations are performed, it just outputs each parameter. If you combine all this with Tip #1 and use single quotes, you're on your way to some finely-tuned strings.

3. Use single-quotes around array indexes. As you saw in the quiz question above, I pointed out that $x[sales] is technically incorrect! You should quote associative array indexes, like so: $x['sales']. This is because PHP considers the unquoted index as a "bare" string, and considers it a defined constant. When it can't find a matching symbol for this constant in the symbol table however, it converts it to a real string, which is why your code will work. Quoting the index prevents this constant-checking stuff, and makes it safer in case someone defines a future constant with the same name. I've also heard that it is up to seven times faster than referencing an unquoted index, although I haven't tested this. For more on this, see the section called "Array do's and don'ts" in the Array section of the PHP manual.

4. Don't use short open tags. Eww... are you really using these? is just bad form. It can cause conflicts with XML parsers, and if you ever distribute code, it's going to annoy the heck out of people who have to start modifying their PHP ini directives to get it to work. There's just no good reasons to use short open tags. Use the full .


5.  Don't use regular expressions if you don't need to. If you're doing basic string operations, stay away from the preg and ereg function groups whenever possible.  str_replace is much faster than preg_replace, and strtr is even faster than str_replace!  Save those crunch cycles... your enterprise applications will thank you.

6.  Don't use functions inside a loop declaration. This isn't a PHP-specific tip, but you'll see it in a lot of code.
Bad:



for ($i = 0; $i < count($array); $i++) {

//stuff

}



Good:



$count = count($array);

for($i = 0; $i < $count; $i++) {

//stuff

}



That should be pretty self-explanatory, but it's amazing how many people would rather save a line of code at the expense of performance.  If you use a function like count() inside a loop declaration, it's going to get executed at every iteration!  If your loop is large, you're using a lot of extra execution time.
7.  Never rely on register_globals or magic quotes. register_globals and magic quotes are both old features of PHP that seemed like a good idea at the time (ten years ago), but in reality turned out to be not that great.  Older installations of PHP would have these features on by default, and they cause security holes, programming errors, and all sorts of bad practices, such as relying on user input to create variables.  Both these features are now deprecated, and everyone needs to stop using them.  If you are ever working on code that relies on these features, get it out of there as soon as you can!
8.  Always initialize your variables.  PHP will automatically create a variable if it hasn't been initialized, but it's not good practice to rely on this feature.  It makes for sloppy code, and in large functions or projects can become quite confusing if you have to track down where it's being created.  In addition, incrementing an uninitialized variable is much slower than if it was initialized.  It's just a good idea.
9.  Document your code. You've heard it many times, but this can't be said enough.  I know places that won't hire people who don't document code.  I even got my previous job after an interview where the VP sat-in with the interviewer and I, where I had brought my laptop in and I was just scrolling through some code I had written for one of my sites.  He saw my documented functions and was impressed enough to ask me about my documenting habits.  A day later I had the job.
I know a lot of self-declared PHP gurus out there like to pretend that their code is so good that they don't have to spend time documenting it, and these people are full of $largeAnimal poop.  Learn docblock syntax, familiarize yourself with some PHP Documentation packages like phpDocumentor or Doxygen, and take the extra time to do it.  It's worth it.
10.  Code to a standard. This is something that you should ask potential employers about during interviews.  Ask them what kind of coding standards they use... PEAR?  Zend?  In-house?  Mention that you code to a specific standard, whether it be your own, or one of the more prevalent ones out there.  The problem with loosely-typed languages like PHP is that without a proper coding standard, code tends to start looking like huge piles of garbage.  Stinky, disgusting garbage.  A basic set of rules that includes whitespace standards, brace matching, naming conventions, etc. is a must-have, must-follow for anyone who prides themselves on their code quality.
That being said, I hate all you space-indenters.  I mean, what the hell?  4 space characters as an indent?  That's exactly four times as much whitespace to parse as a tab.  More importantly, you can set your tab-stops to any value you want if you're using any text-editor more advanced than Notepad, so every developer can having something that they like the looks of.  Set it to 4 if you want, or 0 if you're a masochist.  I don't care, but you can't do that with spaces!  You're stuck with exactly the amount that Mr. Monkey Pants in cubicle 17 decided to put in.  So why are spaces so popular?  This "4-space indent" standard everyone uses is stupid!  Stop it!  Stop doing it!
... sorry, pet peeve.
Anyway, I hope these tips are helpful.  If you want to impress at a job interview, it's the little details that will get you noticed!  Maybe don't rant about your coding standards though.