Eight Reasons C# is the Best Language for Mobile Development

mobilecsharp

The statisticians behind the Popularity of Programming Languages (PYPL) index have named C# the language of the year for 2012. Their data shows that C# popularity grew by 2.3 percent in 2012, more than any other programming language during the same period.

What accounts for the growth of C# in 2012? Well, the launch of Windows 8 has probably played a role — C# remains the dominant language of third-party application development on Windows devices.

But we think there’s more to it than that. Here are eight reasons why C# is increasingly the programming language of choice for mobile development:

Read the entire post here: http://blog.xamarin.com/eight-reasons-c-sharp-is-the-best-language-for-mobile-development/

VB.NET and C# Comparison

Sometimes we need a simple VB.NET & C# side by side comparison. This sheet doesn’t include all features, but its great place to start with.

Microsoft Source Analysis for C#

Microsoft announce the public release of a new developer tool –  Source Analysis for C#.

Inside Microsoft this tool’s name is StyleCop and it enforces code style guidelines on the code we write

Source Analysis comes with a set of default rules analyzers covering approximately 200 best practice rules. These rules are full compatible with the default layout settings in Visual Studio 2005 and Visual Studio 2008.

Specifically, these rules cover the following, in no particular order:

  • Layout of elements, statements, expressions, and query clauses
  • Placement of curly brackets, parenthesis, square brackets, etc
  • Spacing around keywords and operator symbols
  • Line spacing
  • Placement of method parameters within method declarations or method calls
  • Standard ordering of elements within a class
  • Formatting of documentation within element headers and file headers
  • Naming of elements, fields and variables
  • Use of the built-in types
  • Use of access modifiers
  • Allowed contents of files
  • Debugging text

After installation, Source Analysis can be run from within the Visual Studio IDE. You can set this up to be run as a part of your build process as documented here. Since this is plugged in as a MsBuild project you can use it in as a part of Team Foundation Build process as well.

Running Source Analysis:

sca1

And the results are:

sca2

Download it from: http://code.msdn.microsoft.com/sourceanalysis

Read full details:http://blogs.msdn.com/sourceanalysis/archive/2008/05/23/announcing-the-release-of-microsoft-source-analysis.aspx

Visual Studio 2008 and .NET Framework 3.5 Training Kit

Microsoft released a nice training kit (~126MB) (it’s a real treasure!) for the latest technologies.

This package covers a bunch of technologies and includes presentations, hands-on labs, and demos. This content is designed to help you learn how to utilize the Visual Studio 2008 features and a variety of framework technologies vs2008 training kitincluding:

  • Visual Studio Tools for Office
  • Visual Studio Team System
  • Application Lifecycle Management
  • C# 3.0
  • VB 9.0
  • LINQ
  • WPF
  • WCF
  • WF
  • Silverlight
  • ASP.NET
  • AJAX
  • CardSpace
  • Mobile

Download here.

How to prevent SQL injections

Many applications include code that looks like:

   1:  string sqlStmt = "SELECT * FROM USERS WHERE UserName= '" + un + "' AND Password='" + pwd + "'";

Admit it…it’s ugly, but you constructed SQL statements like this one.

The variables un,pwd are provided by the user. The problem with this SQL string is that the attacker can piggyback SQL statements in one of them.

What if the attacker enters this:

un = maor, pwd = 123456′ OR 1=1. The following malicious statement is built:

   1:  string sqlStmt = "SELECT * FROM USERS WHERE UserName= 'maor' AND Password='123456' OR 1=1";

The statement will return all columns for all rows…Bad!

And what if the attacker enters this:

un=maor , pwd = 123456′ DROP TABLE Users. The following malicious statement is built:

   1:  string sqlStmt = "SELECT * FROM USERS WHERE UserName= 'maor' AND Password='123456' DROP TABLE Users";

This builds SQL statement that queries for a user and then drops the users table.

What can you do prevent these attacks?

1. Quoting the input

Quoting the input is not a remedy, but its often proposed to solve the problem.

if we use the statement of:

   1:  string pwd;
   2:  pwd = pwd.Replace("'","''");

The code replaces single quotes with 2 single quotes in the input. The single quote is escaped and its render to invalid SQL statement. However its not perfect. If the statement has a integer field the attacker can use it to attack.

2. Use stored procedures

Many of us probably believe that the application is immune to SQL injection if we use stored procedures. WRONG!

When we enter the 123456′ OR 1=1 to a parameter the sp will fail cause we cannot perform join across a stored procedure call. However, performing data manipulation is valid.

   1:  exec sp_getUser 'maor','123456' INSERT INTO Users Values('123','123')

This command will fetch data about the user and then insert a new row into the users table! What we can do? secure the stored procedure. How?

  1. Use quotename function for object names. It’s built in T-SQL function that adds delimiters to object names to help nullify invalid characters.
  2. Use sp_executesql to execute sql statements built dynamically, instead of just concatenating a string. This makes sure no malformed parameters are passed along to the database server.

3. Never connect as sysadmin

If you see that your web application connects to the database as sysadmin account – its a BUG. Most of the web applications don’t need the capabilities of a sysadmin to run; If there is a bug in the SQL statements and the application connects as sysadmin account, the attacker can: delete any database or table in the server; delete any table data; change data; alter tables; deletes log; and more… The potential damage is unlimited.

4. Build secure SQL statements

Instead of dynamically building a string, as shown in the bad examples above, use parameters. Anything placed into a parameter will be treated as field data, not part of the SQL statement, which makes your application much more secure.

Using parameterized queries is a three step process:

  1. Construct the SqlCommand command string with parameters.
  2. Declare a SqlParameter object, assigning values as appropriate.
  3. Assign the SqlParameter object to the SqlCommand object’s Parameters property.

   1:  // 1. declare command object with parameter
   2:  SqlCommand cmd = new SqlCommand(
   3:      "SELECT * FROM USERS WHERE UserName= @UN AND Password= @PWD", conn);
   4:   
   5:  // 2. define parameters used in command object
   6:  SqlParameter param1 = new SqlParameter();
   7:  param1.ParameterName = "@UN";
   8:  param1.Value = userName;
   9:   
  10:  SqlParameter param2 = new SqlParameter();
  11:  param2.ParameterName = "@PWD";
  12:  param2.Value = password;
  13:   
  14:   
  15:  // 3. add new parameter to command object
  16:  cmd.Parameters.Add(param1);
  17:  cmd.Parameters.Add(param2);

Summary

  • Don’t trust the user’s input.
  • Be strict about what represent valid input and reject everything else. RegEx are your friend!!!
  • Use parameterized queries not string concatenation.
  • Connect to the database server by using a least-privilege account, not the sysadmin account.

Code secure!!!!

Technorati Tags: , , ,

C# 3.0 var keyword

C# 3.0 has many-a-new features. This post will explain the ‘var’ keywork and the concept of Implicitly Typed Variables.

The var keyword is not a late-bound or un-typed variable reference. The var keyword always generates a strongly typed variable reference. The main idea is that the developer is not required to define the type of the variable at the time of declaration, but it is the task of the compiler to decide what type of the object the variable is. The compiler infer the type of the variable from the expression used to initialize the variable when it is first declared.

Important points about var keyword:

  • The type of the variable is defined by the value declared and decided at the compile time. (Size depends on the type of the value initialised)
  • Type casting is simple and handled by CLR.
  • Explicit functions for parsing to specific type.
  • Can be used to reference any type in C#.
  • The CLR actually never knows that the var keyword is being used.

What rules shuold you force to use the var keyword?

When you declare variable with the var keyword, you must to always do an initial value assignment.  This is because the var keyword produces a strongly-typed variable declaration. Hence, the compiler needs to be able to infer the type to declare based on its usage.   If you don’t, the compiler will produce a compiler error.

   1: var vAge = 32; 
   2: var vHeight = 175.2; 
   3: var vName = “Maor David“;  

 

The compiler will infer the type of the “age”, “height” and “name” variables based on the type of their initial assignment value. This means it will generate IL that is absolutely identical to the code below:

   1: int age = 32;
   2: double height = 175.2;
   3: string name = "Maor David";

You can also use it to other data types:

   1: foreach (var vTable in ds.Tables) 
   2: {
   3:     foreach (var vRow in ((DataTable) vTable).Rows) 
   4:     {
   5:  
   6:     }
   7: }

This is equal to:

   1: foreach (DataTable table in ds.Tables)
   2: {
   3:     foreach (DataRow vRow in table.Rows)
   4:     {
   5:     }
   6: }

Technorati Tags: , ,

You can read this post also at Maor David’s Blog: http://blogs.microsoft.co.il/blogs/maordavid/archive/2007/09/15/C_2300_-3.0-var-keyword.aspx

Save datagrid changes in the database

Once you want edit a recore, add new or deleted a recored in your data grid you may want to save it in the database.

How do we do it?

  1. Create UpdateCommand handler for the data grid
  2. Identify what DataGrid row was updated by getting the ItemIndex property of the row (Item object) passed in the event object. Then use the index value to get the corresponding value out of the grid’s DataKeys collection:
    • string key = DataGrid1.DataKeys[e.Item.ItemIndex].ToString();
  3. Get the changed values out of the DataGrid row. How?
    • From the item passed in the event object, get the appropriate cell (zero-based) out of the Cells collection from the item passed in the event object. For example, the left-most column in the grid is Cells(0).
    • For each cell, get its Controls collection, which contains all the elements that appear in the cell.
    • Get the first (and only) control out of the collection — for this example, a TextBox control. To get the TextBox, declare a local variable of type TextBox and cast the object in the Controls collection to it.
    • Get the TextBox control’s value (its Text property).
  4. Find the corresponding row in the data table. The dataset contains a special FindBy method — that locates a row by its primary key and returns a reference to it.
  5. Update the row by changing values in the row you located in Step 4.
  6. Send changes from the dataset to the database by calling the data adapter’s Update method.
  7. Switch the current row in the grid out of editing mode.
  8. Data-bind the DataGrid control.

Code example:

private void myDataGrid_UpdateCommand(object source, System.Web.UI.WebControls.DataGridCommandEventArgs e)
{
string productName, productDescription;
// Gets the value of the key field of the row being updated
string key = myDataGrid.DataKeys[e.Item.ItemIndex].ToString();
// Gets get the value of the controls (textboxes) that the user
// updated.
// Each cell has a collection of controls. In this case, a TextBox control.
// The first column — Cells(0) — contains the Update and Cancel buttons.
TextBox tb;
// Gets the value the TextBox control in the third column
tb = (TextBox)(e.Item.Cells[2].Controls[0]);
productName = tb.Text;
// Gets the value the TextBox control in the fourth column
tb = (TextBox)(e.Item.Cells[3].Controls[0]);
productDescription = tb.Text;
// Finds the row in the dataset table that matches the
// one the user updated in the grid. This example uses a
// special Find method defined for the typed dataset, which
// returns a reference to the row.
dsProducts.CategoriesRow r;
r = dsProducts.Categories.FindByProductID(int.Parse(key));
// Updates the dataset table.
r.ProductName = productName;
r.ProductDescription = productDescription;
// Calls a SQL statement to update the database from the dataset
sqlDataAdapter1.Update(dsProducts);
// Takes the DataGrid row out of editing mode
myDataGrid.EditItemIndex = -1;
// Refreshes the grid
myDataGrid.DataBind();
}

For more information about DataSet updates, navigate to: http://msdn2.microsoft.com/en-US/library/y2ad8t9c(VS.71).aspx

%d bloggers like this: