8 essential principles for ASP encoding

This article introduces eight principles we should abide by when writing code using ASP. I hope it will be helpful to you, let’s take a look together!

ASP is the abbreviation of Active Server Page, meaning dynamic server page. ASP is an application developed by Microsoft to replace CGI scripting programs. It can interact with databases and other programs and is a simple and convenient programming tool. Here we have only some simple discussions on code optimization.

1. Declare VBScript variables

In ASP, vbscript is provided with strong support and can seamlessly integrate vbscript functions and methods, which provides great convenience for extending the existing functions of ASP. Since the concept of variable types has been blurred in ASP, many programmers are accustomed to not declaring vbscript variables during the interaction between ASP and vbscript, which increases the parsing burden of the server and thus affects the server's response request speed .

In view of this, we can force the user to perform variable declarations in vbscript just like we force the user to perform variable declarations in VB. The implementation method is to place <% option explicit%> at the beginning of the ASP program line.

2. Encode the URL address

When we use asp to dynamically generate a URL address with parameters and jump, it is normal to parse in IE, but when browsing NetScrape, there are errors as follows:

1. HTTPError400
2. 400BadRequest
3. Duetomalformedsyntax, therequest could not beunderstory by theserver.
4. Theclient should notrepeattherequestwithoutmodifications.

The solution is to use the URLencode method of ASP built-in server object to URL encoding the generated URL parameters. The example is as follows:

1. <%
2. URL=xur.asp
3. var1=username=&server.URLencode(xur)
4. var2=&company=&server.URLencode(xurstudio)
5. var3=&phone=&server.URLencode(021-53854336-186)
6. response.redirectURL&?&var1&var2&var3
7. %>

3. Clear the object

After using the object, first use the Close method to free up the system resources occupied by the object; then set the object value to nothing to free up the object to occupy memory. Back then, I crashed my IIS by creating more than 100 recordsets on a page with no clear objects. The following code uses the database content to create a drop-down list. The code example is as follows:

1. <%myDSN=DSN=xur;uid=xur;pwd=xur
2. mySQL=select*fromauthorswhereAU_ID<100
3. setconntemp=server.createobject(adodb.connection)
4. conntemp.openmyDSN
5. setrstemp=conntemp.execute(mySQL)
6. ifrstemp.eofthen
7. response.write database is empty
8. response.writemySQL
9. conntemp.close
10. setconntemp=nothing
11. response.end
12. endif%>
13. <%dountilrstemp.eof%>
14. <%
15. rstemp.movenext
16. loop
17. rstemp.close
18. Setrstemp=nothing
19. conntemp.close
20. setconntemp=nothing
21. %>

4. Create SQL query using strings

Using strings to establish queries does not speed up the server's parsing speed. On the contrary, it will also increase the server's parsing time. But it is still recommended to use strings instead of simple query statements to query. The advantage of this is that it can quickly discover the problem of the program, thereby facilitating and efficiently generating the program. Examples are as follows:

1. <%mySQL=select*
2. mySQL=mySQL&fromempublishers
3. mySQL=mySQL&wherestate='NY'
4. response.writemySQL
5. setrstemp=conntemp.execute(mySQL)
6. rstemp.close
7. Setrstemp=nothing
8. %>

5. Use case to select the condition

When making conditional selection, try to use case statements and avoid using if statements. Using case statements can make the program flowable and execute faster than if statements. Examples are as follows:

1. <%
2. FORi=1TO1000
3. n=i
4. Response.WriteAddSuffix(n)&<br>
5. NEXT
6. %>
7. <%
8. FunctionAddSuffix(num)
9. numpart=RIGHT(num,1)
10. SelectCASEnumpart
11. CASE1
12. IFInStr(num,11)THEN
13. num=num&th
14. ELSE
15. num=num&st
16. ENDIF
17. CASE2
18. IFInStr(num,12)THEN
19. num=num&th
20. ELSE
21. num=num&nd
22. ENDIF
23. CASE3
24. IFInStr(num,13)THEN
25. num=num&th
26. ELSE
27. num=num&rd
28. ENDIF
29. CASE4
30. num=num&th
31. CASEELSE
32. num=num&th
33. ENDSelect
34. AddSuffix=num
35. ENDFUNCTION
36. %>

6. Use constants defined in adovbs.inc file to open the record set

When opening a record set, you can define the cursor type and lock type that the record set opens.

There are some constants defined in the adovbs.inc file to define these types. The adovbs.inc file is saved in the /inetpub/iissamples/IISamples directory. Below are a few commonly used cursor types and lock types.

Cursor type:

adOpenFowardOnly cursor can only move forward;

The adOpenKeyset cursor can be forward or backward. If a user adds a record, new records will not appear in the record set;

adOpenDynamic cursor dynamic and random;

The adOpenStatic record set does not reflect record modifications caused by other users.

Lock type:

adLockReadOney cannot modify records in the record set;

adLockPessimistic locks a record when editing it;

The record is locked only when adLockOptimstic calls the record set Update method;

adLockBatchOpeimstic records can only be updated in batches.

1. <!--#INCLUDEVIRTUAL=/ADOVBS.INC-->
2. <%
3. connectme=DSN=xur;uid=xur;pwd=xur
4. sqltemp=select*frommpublisherswherename='xur'
5. setrstemp=Server.CreateObject(adodb.Recordset)
6. rstemp.opensqltemp, connectme, adOpenStatic, adLockOptimstic
7. response.writerstemp.recordcount&recordsin<br>&sqltemp
8. rstemp.close
9. Setrstemp=nothing
10. %>

7. Avoid object definition in the global.asa file

Since the contents in the global.asa file can be referenced by all files in the site, undoubtedly, defining objects in the global.asa file can save a lot of duplication.

For example, in the application_onstart function in global.asa, the following definition is made:

1. <%SUBapplication_onstart
2. setapplication(theCONN)=server.createobject(adodb.connection)
3. ENDSUB%>;

This allows you to make similar references in any code on the site:

1. <%
2. mySQL=select*frommpublisherswherestate='xur'
3. setrstemp=application(theconn).execute(mySQL)
4. %>

Similarly, the record set object can be created in the session_onstart function

1. <%SUBsession_onstart
2. setsession(rstemp)=server.createobject(adodb.recordset)
3. ENDSUB%>

Then, the following quotes are made in the site:

1. <%
2. mySQL=select*frommpublisherswherestate='xur'
3. setsession(rstemp)=conntemp.execute(mySQL)
4. %>

However, doing this also has a great negative impact. Since both Application and session variables only release the occupied resources when closing the website, the session parameters will waste a lot of unnecessary memory, and at this time the application variable becomes a bottleneck in server performance. .

Solution:

Create an asp page to define objects, and introduce this asp page on the page where these objects need to be called. Assuming that the asp page name of the defined object is defined.asp, the page can be introduced by adding the following statement to the corresponding asp page.

When introducing pages, it is best not to include <%@LANGUAGE=VBSCRIPT%> statement in the asp file to be introduced. Because in the asp file, there can only be one script parsing language defined by @.

8. Safety protection

Asp provides a good code protection mechanism, and all asp code is executed on the server side and only returns the result of the client code execution. Even so, in the old version of IIS, you can view the source code of asp after the file name::$DATA, which already falls within the scope of Web Server security and is not within the scope of this article. The following are two simple safety precautions.

Although it is recommended to introduce files with inc asp as the extension, it is still recommended to use asp as the extension to introduce files here. When these codes run on a Web Server with poor security mechanism, you can browse the contents of the imported file by simply entering the address bar (inc is the extension). This is because on Web Server, If the dynamic connection library of a certain type (such as inc) is not defined, the file is displayed in source code.

Do not put the database file inside the website structure, so that when a malicious person obtains the database path, he can easily obtain the database and then change the database content arbitrarily. A better approach is to establish a DSN (Date Source Name) for the database, and access the DSN directly when accessing the database.

Through the introduction of eight principles on ASP encoding in this article, I hope it can help you.