What are ASP.NET Validation controls?

ASP.NET provides validation controls to help you check Web form data entries before the data is accepted and
saved in the Database. Validation controls can be used to address the following questions.
1. Did the user enter anything?
2. Is the entry the appropriate kind of data (For example, Date of Birth should be a valid Date, Name should be a
string etc.)?
3. Is the data within a required range?(For example age cannot be greater than 100 years)
The validation controls check the validity of data entered in associated server controls on the client before the page
is posted back to the server.Most validity problems can be caught and corrected by the user without a round-trip to
the server.

Where do the ASP.NET validation controls validate data, on the Client or on the Web Server?
ASP.NET validation controls validate data first on the client and then on the web server. If a client disables
javascript on the browser then, client side validations are bypassed and validations are performed on the web
server.

Client-side validation is provided by a JScript library named WebUIValidation.js, which is downloaded separately to
the client. Validation controls also automatically provide server-side validation. Server-side validation is always
performed, whether or not client-side validation has occurred. This double-checking ensures that custom
validations are performed correctly and that client-side validation has not been circumvented.

What are the 6 different validation controls provided by ASP.NET? 

RequiredFieldValidator:Checks whether a control contains data
CompareValidator:Checks whether an entered item matches an entry in another control
RangeValidator:Checks whether an entered item is between two values
RegularExpressionValidator:Checks whether an entered item matches a specified format
CustomValidator:Checks the validity of an entered item using a client-side script or a server-side code, or both
ValidationSummary:Displays validation errors in a central location or display a general validation error
description

What property of the validation control is used to specify which control to validate?
ControlToValidate property.

Explain in simple steps how to use validation controls? 

1.Draw a validation control on a Web form and set its ControlToValidate property to the control you want to
validate. 
2.If you’re using the CompareValidator control, you also need to specify the ControlToCompare property.
3.Set the validation control’s ErrorMessage property to the error message you want displayed if the control’s data
is not valid.
4.Set the validation control’s Text property if you want the validation control to display a message other than the
message in the ErrorMessage property when an error occurs. Setting the Text property lets you briefly indicate
where the error occurred on the form and display the longer ErrorMessage property in a ValidationSummary
control.
5.Draw a ValidationSummary control on the Web form to display the error messages from the validation controls in
one place.
6.Provide a control that triggers a postback event. Although validation occurs on the client side, validation doesn’t
start until a postback is requested.

Are the validation controls fired on the client side if javascript is disabled on the client browser?
No, validation controls are not fired on the client side if javascript is disabled on the client browser.

What is the use of CausesValidation property of an ASP.NET button control? 

CausesValidation property of an ASP.NET button control is used to determine if the validation controls should be
fired when the button is clicked. If CausesValidation property is set to true, then validation is performed and if the
CausesValidation property is set to false then validation is not done.

Give an example of real time scenario where you might use CausesValidation property of an ASP.NET
button control?
Let us assume we have a Page that collects user information like name, age, date of birth, gender with a submit
and reset buttons. When I click the submit button the information filled on the form should be validated and saved
to the database. If I click the reset button then all the controls on the webform should default to their initial values
without validation happening.So you have to set the CausesValidation property of the reset button to false for the
validation to be bypassed. Other wise you will not be able to post back the page to the server.

What is ASP.NET Custom Validator used for?

ASP.NET Custom Validator is used to perform complex types of validation not provided by the standard validation
control, use a CustomValidator control and write code to perform the validation on the server side and optionally
on the client side.

How do you programatically check, if the client side validation is not bypassed by disabling the
javascript on the client browser? 
We use Page.IsValid property to determine if all the validations have succeeded. For this property to return true, all
validation server controls in the current validation group must validate successfully.

How do you programatically invoke all validation controls on a page?

Call Page.Validate() method. When this method is invoked, it iterates through the validation controls contained in
the ValidatorCollection object associated with the Page.Validators property and invokes the validation logic for each
validation control in the current validation group.

What is a validation group? 

Validation groups allow you to group validation controls on a page as a set. Each validation group can perform
validation independently from other validation groups on the page.

How do you create a validation group?

You create a validation group by setting the ValidationGroup property to the same name for all the controls you
want to group. You can assign any name to a validation group, but you must use the same name for all members
of the group.

Explain how a validation group works when the Page is posted by clicking a button? 
During postback, the Page class's IsValid property is set based only on the validation controls in the current
validation group. The current validation group is determined by the control that caused validation to occur. For
example, if a button control with a validation group of LoginGroup is clicked, then the IsValid property will return
true if all validation controls whose ValidationGroup property is set to LoginGroup are valid.

Can a DropDownList fire validation controls?

Yes, DropDownList control can also fire validation if the control's CausesValidation property is set to true and the
AutoPostBack property is set to true.

How do you programatically force all validation controls in a particular validation group to be fired? 
Call the Page.Validate(string GroupName) method and pass the name of the validation group. This will fire only the
validation controls in that validation group.

What is SetFocusOnError property of a validation control used for?

Use the SetFocusOnError property to specify whether focus is automatically set to the control specified by the
ControlToValidate property when this validation control fails. This allows the user to quickly update the appropriate
control.

If multiple validation controls fail and this property is set to true, the control specified in the ControlToValidate
property for the first validation control receives focus.

What is InitialValue property of a RequiredFieldValidator?

Use this property to specify the initial value of the input control.Validation fails only if the value of the associated
input control matches this InitialValue upon losing focus.
Best pactices in developing asp.net applications - 
. Remove unused private fields and functions.

2. Do not cast unnecessarily. Avoid duplicate casts where possible, since there is a cost associated with them.

3. Properties that return arrays are prone to code inefficiencies. Consider using a collection or making this a method.

4. To test for empty strings, check if String.Length is equal to zero. Constructs such as "".Equals(someString) and
String.Empty.Equals(someString) are less efficient than testing the string length. Replace these with checks for someString.Length
== 0.

5. Methods in the same type that differ only by return type can be difficult for developers and tools to properly recognize. When
extending a type, be sure not to define new methods that differ from base type methods only by type.

6. Use stringbuilder instead of string types for string manipulation. 

7. Use String.Format instead of concatenating and appending strings.

8. Use Type.TryParse rather than Convert.ToDestinationType(). For example use int.TryParse() rather than Convert.ToInt32() which
might throw an exception.

9. Override Equals() method wherever applicable in your classes.

10. Consider passing base types as parameters - Using base types as parameters to methods improves re-use of these methods if
you only use methods & properties from the parameter's base class. E.g. use Stream instead of FileStream as a parameter when
only calling Stream.Read(), this makes the method work on all kind of streams instead of just File streams. 

ASP.NET Interview Questions on HTTP modules and HTTP Handlers

Click here for all WCF Interview Questions
What is an HTTP Handler? 
An ASP.NET HTTP handler is the process (frequently referred to as the "endpoint") that runs in response to a
request made to an ASP.NET Web application. The most common handler is an ASP.NET page handler that
processes .aspx files. When users request an .aspx file, the request is processed by the page through the page
handler. You can create your own HTTP handlers that render custom output to the browser.

What is HTTP module?An HTTP module is an assembly that is called on every request that is made to your
application. HTTP modules are called as part of the ASP.NET request pipeline and have access to life-cycle events
throughout the request. HTTP modules let you examine incoming and outgoing requests and take action based on
the request.

What is the interface that you have to implement if you have to create a Custom HTTP Handler? 
Implement IHttpHandler interface to create a synchronous handler.
Implement IHttpAsyncHandler to create an asynchronous handler.

What is the difference between asynchronous and synchronous HTTP Handlers?A synchronous

handler does not return until it finishes processing the HTTP request for which it is called.

An asynchronous handler runs a process independently of sending a response to the user. Asynchronous

handlers are useful when you must start an application process that might be lengthy and the user does not have
to wait until it finishes before receiving a response from the server.

Which class is responsible for receiving and forwarding a request to the appropriate HTTP handler? 
IHttpHandlerFactory Class

Can you create your own custom HTTP handler factory class?Yes, we can create a custom HTTP
handler factory class by creating a class that implements the IHttpHandlerFactory interface.

What is the use of HTTP modules? 

HTTP modules are used to implement various application features, such as forms authentication, caching, session
state, and client script services.

What is the difference between HTTP modules and HTTP handlers?An HTTP handler returns a response to
a request that is identified by a file name extension or family of file name extensions. In contrast, an HTTP module
is invoked for all requests and responses. It subscribes to event notifications in the request pipeline and lets you
run code in registered event handlers. The tasks that a module is used for are general to an application and to all
requests for resources in the application.

What is the common way to register an HTTP module?The common way to register an HTTP module is to
have an entry in the application's Web.config file.

Much of the functionality of a module can be implemented in a global.asax file. When do you create an
HTTP module over using Global.asax File? 
You create an HTTP module over using Global.asax file if the following conditions are true

1. You want to re-use the module in other applications.

2. You want to avoid putting complex code in the Global.asax file.
3. The module applies to all requests in the pipeline.

ASP.NET Interview Questions on DataSet

What is a DataSet?DataSet is an in-memory cache of data.

In which namespace is the DataSet class present? 

System.Data

Can you add more than one table to a dataset?Yes

Can you enforce constarints and relations on tables inside a DataSet?Yes, the DataSet consists of a
collection of DataTable objects that you can relate to each other with DataRelation objects. You can also enforce
data integrity in the DataSet by using the UniqueConstraint and ForeignKeyConstraint objects.

What happens when you invoke AcceptChanges() method on a DataSet? 

Invoking AcceptChanges() method on the DataSet causes AcceptChanges() method to be called on each table
within the DataSet.

Both the DataRow and DataTable classes also have AcceptChanges() methods. Calling AcceptChanges() at the
DataTable level causes the AcceptChanges method for each DataRow to be called.

When you call AcceptChanges on the DataSet, any DataRow objects still in edit-mode end their edits successfully.
The RowState property of each DataRow also changes. Added and Modified rows become Unchanged, and Deleted
rows are removed.

If the DataSet contains ForeignKeyConstraint objects, invoking the AcceptChanges method also causes the
AcceptRejectRule to be enforced.

Is there a way to clear all the rows from all the tables in a DataSet at once?Yes, use the DataSet.Clear()
method to clear all the rows from all the tables in a DataSet at once.

What is the difference between DataSet.Copy() and DataSet.Clone()? 

DataSet.Clone() copies the structure of the DataSet, including all DataTable schemas, relations, and constraints.
Does not copy any data.

DataSet.Copy() copies both the structure and data.

How do you get a copy of the DataSet containing all changes made to it since it was last loaded? 
Use DataSet.GetChanges() method

What is the use of DataSet.HasChanges() Method? 

DataSet.HasChanges method returns a boolean true if there are any changes made to the DataSet, including new,
deleted, or modified rows. This method can be used to update a DataSource only if there are any changes.

How do you roll back all the changes made to a DataSet since it was created? Invoke the
DataSet.RejectChanges() method to undo or roll back all the changes made to a DataSet since it was created.

What happnes when you invoke RejectChanges method, on a DataSet that contains 3 tables in it? 
RejectChanges() method will be automatically invoked on all the 3 tables in the dataset and any changes that were
done will be rolled back for all the 3 tables.

When the DataTable.RejectChanges method is called, any rows that are still in edit-mode cancel their edits. New
rows are removed. Modified and deleted rows return back to their original state. The DataRowState for all the
modified and deleted rows will be flipped back to unchanged.

What is the DataSet.CaseSensitive property used for? 

When you set the CaseSensitive property of a DataSet to true, string comparisons for all the DataTables within
dataset will be case sensitive. By default the CaseSensitive property is false. 

ASP.NET Interview Questions on caching

What is caching?
High-performance Web applications should be designed with caching in mind. Caching is the technique of storing
frequently used items in memory so that they can be accessed more quickly. Caching is important to Web
applications because each time a Web form is requested, the host server must process the Web form’s HTML and
run Web form code to create a response. By caching the response, all that work is bypassed. Instead, the request
is served from the reponse already stored in memory.

Caching an item incurs considerable overhead, so it’s important to choose the items to cache wisely. A Web form is
a good candidate for caching if it is frequently used and does not contain data that frequently changes. By storing a
Web form in memory, you are effectively freezing that form’s server-side content so that changes to that content
do not appear until the cache is refreshed.

What directive is used to cache a web form?

The @OutputCache page directive is used to cache a Web form in the server’s memory.

What is the use of duration attribute of @OutputCache page directive?

The @OutputCache directive’s Duration attribute controls how long the page is cached. For example if you set
the duration attribute to 60 seconds, the Web form is cached for 60 seconds.

The first time any user requests the Web form, the server loads the response in memory and retains that response
for 60 seconds. Any subsequent requests during that time receive the cached response.

After the cache duration has expired, the next request for the Web form generates a new response, which is then
cached for another 60 seconds. Thus the server processes the Web form once every 60 seconds at most.

What are the 2 required attributes of the @OutputCache directive?

The @OutputCache directive has two required attributes:
1. Duration
2. VaryByParam.

How do you cache multiple responses from a single Web form?

The VaryByParam attribute lets you cache multiple responses from a single Web form based on varying HTTP
POST or query string parameters. Setting VaryByParam to None caches only one response for the Web form,
regardless of the parameters sent.

You can also cache multiple responses from a single Web form using the VaryByHeaders or VaryByCustom
attribute.

The VaryByCustom attribute lets you cache different responses based on a custom string. To use VaryByCustom,
override the GetVaryByCustomString method in the Web application’s Global.asax file.

Is it possible to cache a web form without using @OutputCache directive?

Yes, you can cache a web form using the Response object’s Cache property, which returns an HttpCachePolicy
object for the response. The HttpCachePolicy object provides members that are similar to
the OutputCache directive’s attributes.

Give a simple example to show how to cache a web form without using @OutputCache directive?
For example, the following code caches the Web form’s response for 60 seconds:
private void Page_Load(object sender, System.EventArgs e)
{
// Cache this page
DateTimeLabel.Text = System.DateTime.Now.ToString();
// Set OutputCache Duration. Response.Cache.SetExpires(System.DateTime.Now.AddSeconds(60));
// Set OutputCache VaryByParams.
Response.Cache.VaryByParams["None"] = true;
// Set OutputCache Location.
Response.Cache.SetCacheability(HttpCacheability.Public);
}

The preceding code is equivalent to the following OutputCache directive:

@ OutputCache Duration="5" VaryByParam="None" Location="Any"

What is @OutputCache directive’s Location attribute and the HttpCachePolicy object’s SetCacheability
property used for?
The @OutputCache directive’s Location attribute and the HttpCachePolicy object’s SetCacheability property
determine where Microsoft ASP.NET stores cached responses. By default, ASP.NET caches responses at any
available location that accepts cache items - the client, proxy servers, or the host server. In practice, those
locations might or might not allow caching, so you can think of the Location/SetCacheability setting as more of
a request than a command.

What is HttpCachePolicy object’s SetAllowResponseInBrowserHistory method used for?

You can override the cache location settings using the HttpCachePolicy object’s
SetAllowResponseInBrowserHistory method. Setting that method to True allows the response to be stored in the
client’s history folder even if the location setting is None or Server.

What are the 2 build options for an ASP.NET web application?

1. Debug
2. Release

What are the 3 levels at which we can have a configuration file for an ASP.NET web application?
1. At the web server level : The Machine.config file located in the
Windows\Microsoft.NET\Framework\version\config directory. This sets the base configuration for all .NET
assemblies running on the server.
2. At the application or web site level : The Web.config file located in the IIS root directory.This sets the base
configuration for all Web applications and overrides settings in Machine.config.
3. In the sub directory of an application root folder : These settings override the settings in the root folder's
web.config file.

What happens when you make changes to an application’s Web.config file?

When you make changes to an application’s Web.config file, IIS automatically restarts the application and applies
the changes. This has the side effect of resetting current Application or Session state variables, which can
adversely affect users.

What happens when you access the Web.config file from a browser?
For security reasons, you can’t access the Web.config file from a browser. If a user requests the Web.config file
from your Web site, he or she will receive an "This type of page is not served" error message.

What happens when you access the Global.asax file from a browser?
For security reasons, you can’t access the Global.asax file from a browser. If a user requests the Global.asax file
from your Web site, he or she will receive an "This type of page is not served" error message.

What are the steps to follow to host a web application on a web server?
1. Use IIS to set up a virtual folder for the application.
2. Copy the Web application to the virtual directory.
3. Add any shared .NET components to the server’s global assembly cache (GAC).
4. Set the security permissions on the server to allow the application to access required resources.

What are the 2 components that should be installed on a web server where, the ASP.NET web
application runs?
ASP.NET Web applications run under IIS, so both IIS and the Microsoft .NET Framework must be installed on the
server before that server can host Web applications.

What is the purpose of default start page in IIS?

A default page enables IIS to display a page if the user does not specify one in his or her request. For example, a
user might make a request using only your domain name, such as http://www.venkataspinterview.blogspot.com/.
If a default page is enabled, IIS will respond with http://www.venkataspinterview.blogspot.com/default.aspx.

Don’t confuse IIS default pages with the Web Forms application start page in Visual Studio .NET. Visual Studio .NET
requires that you set a start page for each project so that the development environment knows which page to
display first during debugging. This setting has no effect on the IIS default page settings.

How do you copy the COM component to the server and register?
COM components generally provide a setup program to install or remove them from the system. If the component
doesn’t provide a setup program, you can copy it to the server and register it using the MFC RegSvr32.exe utility,
as shown below:
RegSvr32 MyComname.dll

What is GAC?
GAC stands for Global Assembly Cache. The global assembly cache (GAC) is a special subfolder within the Windows
folder that stores the shared .NET components.

What is the difference between weak-named .NET components and strong-named .NET components?
This difference is how the names are stored within the assembly. Weak names are not guaranteed to be unique
and thus cannot be shared without potentially causing conflicts. Strong names are digitally signed and provide a
public key that ensures there are no conflicts. Furthermore, .NET components with strong names can’t call
unmanaged code (such as COM components) and thus avoid potential conflicts with dependencies.

Weak-named .NET components must be individually copied to the /bin directories of the Web applications where
they are used. Strong-named .NET components can be copied into the server’s GAC

What is the account under which the ASP.NET worker process run?
By default, the ASP.NET worker process runs using the ASPNET account, which is created when you install the .NET
Framework. This account has limited privileges, which can cause permission-denied errors if your application writes
files or tries to read files outside the current Web application’s boundaries.

What are the 3 ways in which you can modify the additional permissions required by your application.?
1. Grant the ASPNET user access to the required files. To use this option, the server must be using the Windows
NT file system(NTFS).
2. Change the group the ASPNET user belongs to.
3. Use impersonation to run the process as another user.

Why is it not a good idea to add ASPNET user to the Administrators group?
Adding the ASPNET user to the Administrators group gives your Web application full privileges on the server;
however, it also poses a potential security risk because outside users might be able to manipulate your application
to hack your server.
How do you impersonate the ASP.NET worker process?
To use impersonation to run the ASP.NET worker process as a user other than ASPNET, set the identity element’s
impersonation attribute in the application’s Web.config file.

What are Master Pages in ASP.NET? or What is a Master Page?

ASP.NET master pages allow you to create a consistent layout for the pages in your application. A single master
page defines the look and feel and standard behavior that you want for all of the pages (or a group of pages) in
your application. You can then create individual content pages that contain the content you want to display. When
users request the content pages, they merge with the master page to produce output that combines the layout of
the master page with the content from the content page.

What are the 2 important parts of a master page?

The following are the 2 important parts of a master page
1. The Master Page itself
2. One or more Content Pages

Can Master Pages be nested?

Yes, Master Pages be nested.

What is the file extension for a Master Page?

.master

How do you identify a Master Page?

The master page is identified by a special @ Master directive that replaces the @ Page directive that is used for
ordinary .aspx pages.

Can a Master Page have more than one ContentPlaceHolder?

Yes, a Master Page can have more than one ContentPlaceHolder

What is a ContentPlaceHolder?
ContentPlaceHolder is a region where replaceable content will appear.

How do you bind a Content Page to a Master Page?

MasterPageFile attribute of a content page's @ Page directive is used to bind a Content Page to a Master Page.

Can the content page contain any other markup outside of the Content control?
No.

What are the advantages of using Master Pages?

1. They allow you to centralize the common functionality of your pages so that you can make updates in just one
place.
2. They make it easy to create one set of controls and code and apply the results to a set of pages. For example,
you can use controls on the master page to create a menu that applies to all pages.
3. They give you fine-grained control over the layout of the final page by allowing you to control how the
placeholder controls are rendered.
4. They provide an object model that allows you to customize the master page from individual content pages.

What are the 3 levels at which content pages can be attached to Master Page?
At the page level - You can use a page directive in each content page to bind it to a master page

At the application level - By making a setting in the pages element of the application's configuration file
(Web.config), you can specify that all ASP.NET pages (.aspx files) in the application automatically bind to a master
page.

At the folder level - This strategy is like binding at the application level, except that you make the setting in a
Web.config file in one folder only. The master-page bindings then apply to the ASP.NET pages in that folder.
What is @MasterType directive used for?
@MasterType directive is used to create a strongly typed reference to the master page.

Are controls on the master page accessible to content page code?

Yes, controls on the master page are accessible to content page code.

At what stage of page processing master page and content page are merged?
During the initialization stage of page processing, master page and content page are merged.

Can you dynaimically assign a Master Page?

Yes, you can assign a master page dynamically during the PreInit stage using the Page class MasterPageFile
property as shown in the code sample below.
void Page_PreInit(Object sender, EventArgs e)
{
this.MasterPageFile = "~/MasterPage.master";
}

Can you access non public properties and non public methods of a master page inside a content page?
No, the properties and methods of a master page must be public in order to access them on the content page.

From the content page code how can you reference a control on the master page?
Use the FindControl() method as shown in the code sample below.
void Page_Load()
{
// Gets a reference to a TextBox control inside
// a ContentPlaceHolder
ContentPlaceHolder ContPlaceHldr = (ContentPlaceHolder)Master.FindControl ("ContentPlaceHolder1");
if(ContPlaceHldr != null)
{
TextBox TxtBox = (TextBox)ContPlaceHldr.FindControl("TextBox1");
if(TxtBox != null)
{
TxtBox.Text = "TextBox Present!";
}
}
// Gets a reference to a Label control that not in
// a ContentPlaceHolder
Label Lbl = (Label)Master.FindControl("Label1");
if(Lbl != null)
{
Lbl.Text = "Lable Present";
}
}

Can you access controls on the Master Page without using FindControl() method?
Yes, by casting the Master to your MasterPage as shown in the below code sample.
protected void Page_Load(object sender, EventArgs e)
{
MyMasterPage MMP = this.Master;
MMP.MyTextBox.Text = "Text Box Found";
}

 Passport Authentication
What is Passport Authentication?
Passport authentication identifies users via Microsoft Passport’s single sign-on service. Microsoft Passport is
meant to provide Internet users with a single identity that they can use to visit a wide variety of Web sites that
require authentication. Information about the user is available to your application through a profile that is stored
with Microsoft.

What are the advantages of Passport authentication?

The advantages of Passport authentication are that the user doesn’t have to remember separate user names and
passwords for various Web sites and that the user can maintain his or her profile information in a single location.
Passport authentication also provides access to other Microsoft services, such as Passport Express Purchase.

What is passport software development kit (passport SDK)?

To use Passport authentication in your Web application, you must install the Passport SDK. The Passport SDK is
free for preproduction development and testing. To deploy a site for public use, you must obtain an annual license
from Microsoft.

How does Passport authentication work?

When a user accesses an application that implements Passport authentication, ASP.NET checks the user’s machine
for a current passport authentication cookie. If none is found, ASP.NET directs the user to a Passport sign-on page.
Once the user signs in, the Passport service authenticates the user, stores an authentication cookie on the user’s
computer, and directs the user back to the originally requested Web page.

What are the steps to follow to use Passport authentication?

1. Install the Passport SDK. Passport is not included with Visual Studio, although the .NET Framework does include
classes for working with the Passport SDK once it is installed.
2. Set the application’s authentication mode to Passport in Web.config. Set authorization to deny unauthenticated
users.
3. Use the PassportAuthentication_OnAuthenticate event to access the user’s Passport profile to identify and
authorize the user.
4. Implement a sign-out procedure to remove Passport cookies from the user’s machine.

Where is PassportAuthentication_OnAuthenticate event present?

PassportAuthentication_OnAuthenticate event is present in Global.asax.

forms Authentication

What is the advantage of using Forms authentication?

The advantage of using Forms authentication is that users do not have to be member of a domain-
based network to have access to your application. Another advantage is that many Web applications,
particularly commercial sites where customers order products, want to have access to user
information. Forms authentication makes these types of applications easier to create.

List the steps to use Forms authentication in a web application?

1.Set the authentication mode in Web.config to Forms.
2.Create a Web form to collect logon information.
3.Create a file or database to store user names and passwords.
4.Write code to add new users to the user file or database.
5.Write code to authenticate users against the user file or database.

What happens when someone accesses a Web application that uses Forms authentication?
When someone accesses a Web application that uses Forms authentication, ASP.NET displays the logon
Web form specified in Web.config. Once a user is authorized, ASP.NET issues an authorization
certificate in the form of a cookie that persists for an amount of time specified by the authentication
settings in Web.config.

What is the difference between Windows authentication and Forms authentication?

The difference between Windows authentication and Forms authentication is that in Forms
authentication your application performs all the authentication and authorization tasks. You must
create Web forms and write code to collect user names and passwords and to check those items
against a list of authorized users.

What is the use of mode attribute in authentication element in a web.config file?

You use the mode attribute to specify the type of authentication your web application is using. Set the
mode attribute to forms to enable Forms authentication.
What is the use of name attribute and loginUrl attribute of a forms element in a web.config file?
Name attribute of forms element is used to set the name of the cookie in which to store the user’s
credential. The default is .authaspx. If more than one application on the server is using Forms
authentication, you need to specify a unique cookie name for each application.
loginUrl attribute of forms element is used to set the name of the Web form to display if the user has
not already been authenticated. If omitted, the default is Default.aspx.

What is protection attribute in a forms element used for in web.config file?

The protection attribute of a forms element of web.config file is used for setting how ASP.NET protects
the authentication cookie stored on the user’s machine. The default is All, which performs encryption
and data validation. Other possible settings areEncryption, Validation, and None.

What is timeout attribute in a forms element used for in web.config file?

Timeout attribute is used to set the number of minutes the authentication cookie persists on the user’s
machine. The default is 30, indicating 30 minutes. ASP.NET renews the cookie automatically if it
receives a request from the user and more than half of the allotted time has expired.

In which namespace the FormsAuthentication class is present?

System.Web.Security namespace

Which method checks the user name and password against the user list found in the credentials
element of Web.config?
The FormsAuthentication class’s Authenticate method checks the user name and password against the
user list found in the credentials element of Web.config.

Which method can be used to remove forms authentication cookie?

Use the signout() method of FormsAuthentication class to sign out when the user has finished with the
application or when you want to remove the authentication cookie from his or her machine. For
example, the following code ends the user’s access to an application and requires him or her to sign
back in to regain access
FormsAuthentication.SignOut();

What is the advantage of Authenticating Users with a Database?

You can authenticate users based on a list in Web.config. The FormsAuthentication class’s Authenticate
method is set up to read from web.config file automatically. That’s fine if user names and passwords
are created and maintained by a system administrator, but if you allow users to create their own user
names or change their passwords, you’ll need to store that information outside the Web.config file.
This is because changing Web.config at run time causes the Web application to restart, which resets
any Application state and Session state variables used by the application.

What are the advantages of storing user names and passwords in a database rather than a file?
You can store user names and passwords in any type of file; however, using a database has the
following significant advantages:
1. User names can be used as primary keys to store other information about the user.
2. Databases can provide high performance for accessing user names and passwords.
3. Adding, modifying, and accessing records are standardized through SQL.

Can you encrypt user names and passwords stored in a file or a database?
Yes, you encrypt user names and passwords stored in a file or a database. You can encrypt them using
the FormsAuthentication class’s HashPasswordForStoringInConfigFile method. This method uses
the SHA1 or MD5 algorithms to encrypt data, as shown below:
Password = FormsAuthentication.HashPasswordForStoringInConfigFile(Password, "SHA1");

Can you change authentication type in a subfolder's web.config file?

Authentication type (Windows, Forms, or Passport) can be set only at the application’s root folder. To
change authentication type in a subfolder's web.config file, you must create a new Web application
project and application starting point for that subfolder.

How can you control access to subfolders in a web application?

The authorization settings in the Web.config file apply hierarchically within the folder structure of a
Web application. For instance, you might want to allow all users access to the root folder of a Web
application but restrict access to Web forms (and tasks) available from a subfolder. To do this, set the
authentication type in the root folder’s Web.config file, and then use the authorization element in the
subfolder’s Web.config file to restrict access.
windows authentication
What is the advantage of using Windows authentication in a Web application?
Windows authentication uses the security features integrated into the Windows NT and Windows XP
operating systems to authenticate and authorize Web application users. The advantage of Windows
authentication is that your Web application can use the exact same security scheme that applies to
your corporate network - user names, passwords, and permissions are the same for network resources
and Web applications. One of the key advantages of Windows authentication is that users who are
logged on to the network don’t have to log on again to access the Web application.

What is the default authentication method when you create a new Web application project? 
Windows authentication is the default authentication method when you create a new Web application
project.

How do you allow or deny access to specific users using an authorization list from Web.config file, when
using windows authentication? 
When the application uses Windows authentication, ASP.NET checks the project’s Web.config
authorization list to see which network users are allowed to access the application. The asterisk (*)
and question mark (?) characters have special meaning in the authorization list. The * character
indicates all users. The ? character indicates unauthenticated users.

To restrict access to specific users, list their names separated by commas in an element. When
ASP.NET checks the authorization list in Web.config, it accepts the first match that it finds. Be sure to
end the authorization list with a element to deny access to any nonapproved users.

What is Role-Based authorization in windows authentication?

Role-based authorization lets you identify groups of users to allow or deny based on their role in your
organization. In Windows NT and Windows XP, roles map to names used to identify user groups.
Windows defines several built-in groups, including Administrators, Users, and Guests. You can view,
modify, or add groups using the Computer Management console

To allow or deny access to certain groups of users, add the element to the authorization list in your
Web application’s Web.config file.

How do you get a User Identity?

Once a user is authenticated and authorized, your application can get information about the user by
using the User object’s Identity property. The Identity property returns an object that includes the user
name and role information, as shown in the following code:

private void Page_Load(object sender, System.EventArgs e)

{
Label1.Text = User.Identity.IsAuthenticated.ToString();
Label2.Text = User.Identity.Name;
Label3.Text = User.Identity.AuthenticationType;
}

How do you determine, what is the role of the current user? 

The User object provides an IsInRole method to determine the role of the current user, as shown in the
following example:
if(User.IsInRole("Administrators"))
{
// Do something.
}

Can you specify authorization settings both in Web.config and in IIS? 

Yes, you can specify authorization settings both in Web.config and in IIS. The IIS setting is evaluated
first and then the setting in Web.config is evaluated. In general, this means that the most restrictive
setting will be used.

What is the user account under which an ASP.NET web application runs by default?
Web application runs under the identity of the ASPNET user account by default.

How can you set the web application to run under a specific user’s account? 
You can set the application to run under a specific user’s account by setting the application’s identity
element to enable impersonation

How can you see the impersonated identity under which code is executing?
To see the impersonated identity under which code is executing, use the WindowsIdentity class’s
GetCurrent method, as shown in the sample code below
Response.Write(System.Security.Principal.WindowsIdentity.GetCurrent().Name); 

The identity element can be used with any type of authentication; however, it is most useful with
Windows authentication because Windows authentication users have accounts with specific
permissions.

Questions on ASP.NET controls

What are the 2 types of controls that you can use on a webform in ASP.NET?
Web Server Controls
HTML Controls

What’s the difference between Server controls and HTML controls? 

1. Server controls can trigger control-specific events on the server.HTML controls can trigger only
page- level events on server (postback).
2. Data entered in a server control is maintained across requests. Server controls retain state.Data is
not maintained in an HTML control. Data must be saved and restored using page-level scripts.
3. The Microsoft .NET Framework provides a set of properties for each server control. Properties allow
you to change the server control’s appearance and behavior within server-side code.HTML controls
have HTML attributes only.
4. Server controls automatically detect browser and adapt display as appropriate.HTML controls do not
adapt automatically. You must detect browser in code or write for least common denominator.

What are the 2 Layouts supported by a Web form in ASP.NET?

Grid layout - Controls are placed exactly where you draw them, and they have absolute positions on the
page. Use grid layout for Microsoft Windows–style applications, in which controls are not mixed with
large amounts of text. Pages using grid layout will not always display correctly in non-Microsoft
browsers.
Flow layout - This layout positions controls relative to other elements on the page. If you add elements
at run time, the controls that appear after the new element move down. Use flow layout for document-
style applications, in which text and controls are intermingled.

When do you choose between GridLayout and Flow layout for Web forms?
You use GridLayout for Web forms that have a fixed appearance. You use FlowLayout for Web forms
that incorporate text and controls.When you create controls with GridLayout, Visual Studio adds style
attributes to each control that set the position of the control.When you create controls with
FlowLayout, Visual Studio omits the style attribute.

Give 3 reasons why we use HTML controls over Server Controls? 

Migration from earlier versions of Active Server Pages (ASP) : You can load an ASP application into
Visual Studio and revise it gradually, rather than rewrite it completely. Earlier versions of ASP
supported only HTML elements, and these elements become HTML controls when you load the project
in Visual Studio .NET.
Not all controls require server-side events or state management : This is particularly true when you’re
doing data binding. Bound items are usually refreshed from the data source with each request, so it’s
more efficient not to maintain state information for bound controls. This means that you can use HTML
controls or turn off state management for bound server controls.
You have complete control over what is rendered with HTML controls : ASP.NET adjusts the appearance
of server controls based on the browser making the request. HTML controls are not adjusted, so you
have direct control over their appearance.

How can you prevent users from editing Text in TextBox control on a web form?
By making the TextBox a readonly TextBox. To make a TextBox readonly set the ReadOnly property to
True.

How do you convert an ASP.NET TextBox to accept passwords? 

To convert and ASP.NET TextBox to accept passwords set the TextMode property to "Password"

What happens when you set the AutoPostBack property of a TextBox to true?
When AutoPostBack property is set to True, the TextBox control fires a TextChanged postback event
when the user leaves the TextBox control after changing the contents. By default, this property is set
to False and the TextChanged event is cached until some other postback event occurs.

What are the 3 values that a TextMode property of TextBox can have? 
SingleLine : Single Line TextBox
MultiLine : Multi Line TextBox(scrollable)
Password : When set to Password, the text box displays dots in place of the characters typed.

How do you limit the number of characters entered by a user in the ASP.NET TextBox?
By setting the MaxLength property of the TextBox. If you set the MaxLength property to 10, a user can
enter only 10 characters into the TextBox.

Interview Questions on Cookies

What are Cookies in ASP.NET? 
Cookies are small pieces of information stored on the client computer.Use cookies to store small
amounts of information on the client’s machine. Web sites often use cookies to store user preferences
or other information that is client-specific. Because cookies can be refused, it is important to check
whether the browser allows them before you try to create them.They are limited to storing only
character data and they are limited to 4K in size.

What are different types of Cookies?

Session Cookies
Persistent Cookies

What are Session Cookies? 

Session cookies are stored in-memory during the client browser session. When the browser is closed
the session cookies are lost.

How can you create Session Cookies?

You can create session cookies by calling the Add method of the Cookies collection on the Response
object. The Cookies collection contains individual cookie objects of type HttpCookie.

//Code to create a UserName cookie containing the name David.

HttpCookie CookieObject = new HttpCookie("UserName", "David");
Response.Cookies.Add(CookieObject); 

//Code to read the Cookie created above

Request.Cookies["UserName"].Value;

What is the difference between Session Cookies and Persistent Cookies?

Persistent Cookies are same as Session Cookies except that, persistent cookies have an expiration
date. The expiration date indicates to the browser that it should write the cookie to the client's hard
drive. Keep in mind that because a user can delete cookies from their machine that there is no
guarantee that a cookie you "drop" on a user machine will be there the next time they visit your site.

What are Persistent Cookies used for? 

Persistent cookies are generally used to store information that identifies a returning user to a Web site.
Typical information found in Persistent Cookies includes user names or user IDs.

How do you create a Persistent Cookie?

You create a persistent cookie the same way as session cookies except that you set the Expires
property to a Date in the future which will store the Cookie to the client computer harddrive.

//Code to create a UserName Persistent Cookie that lives for 10 days

HttpCookie CookieObject = new HttpCookie("UserName", "David");
CookieObject.Expires = DateTime.Now.AddDays(10);
Response.Cookies.Add(CookieObject); 

//Code to read the Cookie created above

Request.Cookies["UserName"].Value; 

What is Cookie Dictionary? 

A cookie dictionary is a single cookie object that stores multiple pieces of information. You use the
Values property to access and assign new values to the cookie dictionary.

Give an example using Cookie Dictionary?

//Code to create a Cookie Dictionary
HttpCookie CookieObject = new HttpCookie("UserPreference"); 

//Use the Values property to assign new values to the cookie dictionary
CookieObject.Values.Add("UserName", "David");
CookieObject.Values.Add("Country", "USA");
CookieObject.Values.Add("PreviousVisit", DateTime.Now.ToString());
CookieObject.Expires = DateTime.MaxValue; 

//Add the Cookie to the client machine using the Response object
Response.Cookies.Add(CookieObject);

//Code to read the Cookie created above

HttpCookie ObjectCookie = Request.Cookies["UserPreference"];
string UserName = ObjectCookie.Values["UserName"];
string Country = ObjectCookie.Values["Country"];
string PreviousVisit = ObjectCookie.Values["PreviousVisit"];

What are the advantages of Using Cookies? 

1. Cookies do not require any server resources since they are stored on the client.
2. Cookies are easy to implement.
3. You can configure cookies to expire when the browser session ends (session cookies) or they can
exist for a specified length of time on the client computer (persistent cookies).

What are the disadvantages of Using Cookies?

1. Users can delete a cookies.
2. Users browser can refuse cookies,so your code has to anticipate that possibility.
3. Cookies exist as plain text on the client machine and they may pose a possible security risk as
anyone can open and tamper with cookies.

How do you create a Cookie that never expires?

To create a Cookie that never expires set the Expires property of the Cookie object to
DateTime.MaxValue.

Are Cookies secure? 

No, Cookies are not secure. You must pay attention to the type of data you store in cookies.
1. Cookies are not designed to store critical information so storing passwords in a cookie is a bad idea.
2. Keep the lifetime of a cookie as short as practically possible.
3. Encrypt cookie data to help protect the values stored in the cookie.

Managed Code and Unmanaged Code related 

hat is Managed Code and Unmanaged Code? 
Microsoft ASP.NET Web applications run under the control of the common language runtime (CLR). The
CLR controls how the application’s assembly executes, allocates, and recovers memory; therefore,
ASP.NET applications are said to use managed code. In contrast, most other Windows executables use
unmanaged code because the executable itself determines how memory is used.

Examples of unmanaged code include the Microsoft Win32 API, legacy DLLs and EXEs created for
Windows applications prior to the Microsoft .NET Framework, and COM objects.

What is Platform Invoke or pinvoke?

The process of executing native code from within a .NET assembly is called platform invoke, or pinvoke
for short. You use platform invoke to call the Win32 API directly, to access existing (legacy) DLLs your
company uses, or to access procedures compiled to native code for performance reasons.

What are the steps to follow to use Platform Invoke? 

To use platform invoke, follow the following steps:
1. Import the System.Runtime.InteropServices namespace.
2. Declare the unmanaged procedure using the DllImport attribute or the Declare statement.
3. Map the data types of the procedures parameters to the equivalent .NET types.
4. Call the unmanaged procedure and test its return value for success.
5. If the procedure did not succeed, retrieve and handle the exception code using the Marshal object’s
GetLastWin32Error method.

What are the limitations of using Unmanaged Code from within a .NET assembly?
Performance : Although native-code DLLs can perform some operations more quickly than equivalent
code managed by the CLR, these benefits might be offset by the time it takes to marshal the data to
pass between the unmanaged procedure and the .NET assembly.
Type safety : Unlike .NET assemblies, unmanaged procedures might not be type-safe. This can affect
the reliability of your .NET application. In general, reliability is a paramount concern with ASP.NET Web
applications.
Code security : Unmanaged procedures do not use the .NET Framework’s model for code security.
Versioning:Unmanaged code does not support .NET versioning; therefore, assemblies that call
unmanaged procedures might lose the benefit of being able to coexist with other versions of the same
assembly.

What are COM objects?

COM objects are another type of unmanaged code that you can use from .NET assemblies. Because COM
is widely used, Visual Studio includes built-in tools for importing and using COM objects within .NET
assemblies. Visual Studio also includes the option of automatically registering .NET class library
assemblies for use from COM.

List the steps in order, to use a COM object from a .NET assembly in Visual Studio? 
1. Install and register the COM object on your system.
2. Open the .NET project in Visual Studio, and add a reference to the COM object, as shown in diagram
below. If the COM object does not appear on the COM tab of the Add Reference dialog box, you can add
a reference directly to the executable by clicking Browse. 

3. Create an instance of the COM object in code, and use it as you would any other object.

What happens when you add a reference to a COM object from with in a dot net application?
When you add a reference to a COM object, Visual Studio automatically generates an interop assembly
for the object and places it in the project’s /bin folder. The interop assembly is created from the COM
object’s type information and contains the metadata that the CLR uses to call the unmanaged code in
the COM object. You can then use COM objects from within .NET code the same way that you use .NET
classes.

You can view this interop assembly using the Microsoft Intermediate Language Disassembler
(Ildasm.exe) included in the .NET Framework.

Can we create a .NET object for use from COM? 

Yes, Visual Studio can automatically generate type library information and register a .NET class library
assembly for use from COM. These automatic tools do not work for ASP.NET Web applications, so you
must isolate the code you want to use from COM in its own Class Library project.

How do you hide Public .NET Classes and other public members from COM?
In some cases, you might want to hide selected .NET classes from COM but keep them public for use
from other .NET assemblies. The ComVisible attribute allows you to select which public .NET classes
and members are included in the generated type library. This attribute applies hierarchically for the
assembly, class, and member levels.
How do you handle exceptions between .NET and COM? 
.NET handles errors through exception classes. COM handles errors through 32-bit data types called
HRESULTs. All of the .NET exception classes include HResult properties that map to COM HRESULT
codes.

If an exception occurs in a .NET object, the exception is automatically mapped to the appropriate
HRESULT and returned to COM. Similarly, if an exception occurs in a COM object, the COM HRESULT is
mapped to the appropriate exception class, which is returned to .NET, where it can be handled just like
any other exception.

If you are creating your own .NET exception classes for use with COM, be sure to set the class’s
HResult property so that the exception can be handled within COM.

What are the technical limitations of COM Interop?

The .NET Framework was developed to address the limitations of COM. Because of this evolution, there
are limits to the .NET features that you can use from COM. The following list describes these limits:
Static members : COM requires objects to be created before use, so it does not support .NET Static
members.
New members : COM flattens the inheritance tree of .NET objects, so members in a derived class that
hides members inherited from a base class are not callable.
Constructors with parameters : COM can’t pass parameters to an object’s constructor.

What are the practical limitations of using COM objects? 

The following are the practical limitations of using COM objects from .NET:
Shared solutions might not allow COM objects : ASP.NET host service providers that use nondedicated
servers can limit or prohibit the installation of COM objects on their servers.
COM objects are prone to memory leaks : COM uses reference counting to determine when to destroy
objects and free memory. It is possible for this reference count to become incorrect, leaving objects in
memory indefinitely.
Type libraries might be inaccurate : Because COM separates the object’s description from its
implementation, it’s possible for this description to not accurately reflect the object. In this case, the
generated interop assembly will also include those inaccuracies.
COM is unmanaged code : All the limitations of unmanaged code apply to COM objects as well.

Page navigation techniques

What are different page navigation techniques in ASP.NET? 
Hyperlink control : Navigate to another page.
Response.Redirect : Navigate to another page from code. This is equivalent to clicking a hyperlink.
Server.Transfer : End the current Web form and begin executing a new Web form. This method works
only when navigating to a Web Forms page (.aspx).
Server.Execute : Begin executing a new Web form while still displaying the current Web form. The
contents of both forms are combined. This method works only when navigating to a Web Forms page
(.aspx).
Window.Open script method : Display a page in a new browser window on the client.

What is the difference between Response.Redirect and Server.Transfer?

1. When we use Server.Transfer the redirection happens on the server where as when we use
Response.Redirect the redirection happens from the browser.
2. Server.Transfer is faster as there is no round trip involved while navigating from one webform to
another webform.Response.Redirect is slower than Server.Transfer as there is round trip from the
server to the client browser.
3. Server.Transfer works only with .aspx files where as Response.Redirect works with .aspx and .Htm
pages.
4. Server.Transfer will work with files on the same web server. You can't use Server.Transfer to send
the user to an external site where as Response.Redirect can do that.
5. Server.Transfer does not update the URL in the browser. For example when you navigate from
WebForm1.aspx to WebForm2.aspx using Server.Transfer the URL in the browser still shows
WebForm1.aspx while you are actually looking at WebForm2.aspx. Response.Redirect updates the URL
in the browser.

What is the use of Server.Execute method?

Server.Execute method is used to process a second Web form without leaving the first Web form. This
technique lets you direct the results from a Web form to a region on the current page.

Is it possible to send a webform's QueryString, ViewState, and event procedure information to another
webform? 
Yes, we can use Server.Transfer or Server.Execute to send a webform's QueryString, ViewState, and
event procedure information to another webform.

For this to work you have to set the preserveForm argument to True.To be able to read one Web form’s
ViewState from another, you must first set the EnableViewStateMac attribute in the Web form’s Page
directive to False. By default, ASP.NET hashes ViewState information, and setting this attribute to False
disables that hashing so that the information can be read on the subsequent Web form.

web application Security

What is the difference between Authentication and Authorization? 
Authentication is the process of identifying users. Authorization is the process of granting access to those users
based on identity. Together, authentication and authorization provide the means to keeping
your Web application secure from intruders.

What is Anonymous access?

Anonymous access is the way most public Web sites work. Sites containing public information allow anyone to see
that information, so they don’t authenticate users. ASP.NET Web applications provide anonymous access to
resources on the server by impersonation. Impersonation is the process of assigning a user account to an unknown
user.

What is the account that is associated with Anonymous access? 

By default, the anonymous access account is named IUSER_machinename. You use that account to control
anonymous users’ access to resources on the server.

What is the default user account under which an ASP.NET web application run on a web server?
Under the default settings, ASP.NET uses the ASPNET account to run the Web application. This means that if the
application attempts to perform any tasks that are not included in the ASPNET account’s privileges, a security
exception will occur and access will be denied.

How do you restrict the access of anonymous users? 

You restrict the access of anonymous users by setting Windows file permissions. To be secure, your server must
use the Microsoft Windows NT file system (NTFS). The earlier FAT or FAT32 file systems do not provide file-level
security.
What are the 3 major ways to authenticate and authorize users within an ASP.NET Web application?
Windows authentication : Identifies and authorizes users based on the server’s user list. Access to resources on
the server is then granted or denied based on the user account’s privileges. This works the same way as regular
Windows network security.
Forms authentication : Directs users to a logon Web form that collects user name and password information, and
then authenticates the user against a user list or database that the application maintains.
Passport authentication : Directs new users to a site hosted by Microsoft so that they can register a single user
name and password that will authorize their access to multiple Web sites. Existing users are prompted for their
Microsoft Passport user name and password, which the application then authenticates from the Passport user list.

What is the namespace where all security related classes are present? 
System.Web.Security

What type of authentication can be used for Public Internet Web application?
Anonymous access. This is the common access method for most Web sites. No logon is required, and you secure
restricted resources using NTFS file permissions.

What type of authentication can be used for Intranet Web application? 

Windows authentication. Windows authentication authenticates network users through the domain controller.
Network users have access to Web application resources as determined by their user privileges on the server.

What type of authentication can be used for Private corporate Web application?
Windows authentication. Corporate users can access the Web application using their corporate network user names
and passwords. User accounts are administered using the Windows network security tools.

What type of authentication can be used for Commercial Web application? 

Forms authentication. Applications that need to collect shipping and billing information should implement Forms
authentication to gather and store customer information.

What type of authentication can be used for Multiple commercial Web applications?
Passport authentication. Passport authentication allows users to sign in once through a central authority. The user’s
identity is then available to any application using the Passport SDK. Customer information is maintained in a
Passport profile, rather than in a local database.

Can you use ASP.NET Authentication with HTM and HTML Files? 

The three ASP.NET authentication modes apply to files that are part of the Web application. That includes Web
forms (.aspx), modules (.asax), and other resources that are processed through the Web application’s executable.
It does not automatically include HTML pages (.htm or .html). Those pages are handled by Internet Information
Services (IIS), rather than ASP.NET. If you want to authenticate users who access HTML pages from within your
Web application using Windows, Forms, or Passport authentication modes, you must map those files to the
ASP.NET executable.

How do map .htm and .html files to the ASP.NET executable using the IIS snap-in? 
To map .htm and .html files to the ASP.NET executable using the IIS snap-in, follow these steps:
1. In the IIS snap-in, select the folder containing your Web application, and then choose Properties from the Action
menu. IIS displays the Properties dialog box.
2. Click the Home Directory or Virtual Directory tab, and then click Configuration. IIS displays the Application
Configuration dialog box, as shown in the diagram below.

3. Click Add. IIS displays the Add/Edit Application Extension Mapping dialog box, as shown in the diagram below.
4. Click Browse, and select the aspnet_isapi.dll file. That file is stored in the Windows Microsoft .NET Framework
directory; the path will be something like C:\Windows\Microsoft.NET\Framework\versionnumber\aspnet_isapi.dll.
5. Type .htm in the File Extension box, and click OK.
6. Repeat steps 3 through 5 for the .html file extension. Cli

web user controls

What are ASP.NET Custom controls?
Custom controls extend the tools available to Web developers. Using custom controls, you can encapsulate key
aspects of the visual interface and program logic that you want to reuse throughout your application, or throughout
your organization.

What are the 3 types of custom controls in ASP.NET?

Microsoft Visual Studio .NET provides three types of custom control for use on Web forms.
1. Web user controls
These combine existing server and HTML controls by using the Visual Studio .NET Designer to create functional
units that encapsulate some aspect of the user interface. User controls reside in content files, which must be
included in the project in which the controls are used.
2. Composite custom controls
These create new controls from existing server and HTML controls. Although similar to user controls, composite
controls are created in code rather than visually, and therefore they can be compiled into an assembly (.dll), which
can be shared between multiple applications and used from the Toolbox in Visual Studio .NET.
3. Rendered custom controls
These create entirely new controls by rendering HTML directly rather than using composition. These controls are
compiled and can be used from the Toolbox, just like composite controls, but you must write extra code to handle
tasks that are performed automatically in composite controls.

What are the limitations of user controls in ASP.NET?

As the user controls are not compiled into assemblies, they have the following limitations:
1. A copy of the control must exist in each Web application project in which the control is used.
2. User controls can’t be loaded in the Visual Studio .NET Toolbox; instead, you must create them by dragging the
control from Solution Explorer to the Web form.
3. User control code is initialized after the Web form loads, which means that user control property values are not
updated until after the Web form’s Load event.

What are the steps to follow for creating and using a user control in a Web application?
1. Add a Web user control page (.ascx) to your project.
2. Draw the visual interface of the control in the designer.
3. Write code to create the control’s properties, methods, and events.
4. Use the control on a Web form by dragging it from Solution Explorer to the Web form on which you want to
include it.
5. Use the control from a Web form’s code by declaring the control at the module level and then using the control’s
methods, properties, and events as needed within the Web form.

How do you identify user controls?

User controls are identified by their .ascx file extensions.

What is the base class from which user controls derive?

User controls derive from System.Web.UI.UserControl base class. This base class provides the base set of
properties and methods you use to create the control.

What are the steps to follow to create properties and methods for the user control that you can use
from a Web form?
To create properties and methods for the user control that you can use from a Web form, follow these steps:
1. Create the public property or method that you want to make available on the containing Web form.
2. Write code to respond to events that occur for the controls contained within the user control. These event
procedures do the bulk of the work for the user control.
3. If the property or method needs to retain a setting between page displays, write code to save and restore
settings from the control’s ViewState.

What happens when you drag a user control from solution explorer and drop it on a web form?
When you drag a user control from solution explorer and drop it on a web form, Visual Studio .NET generates a
@Register directive and HTML tags to create the control on the Web form.

Custom Controls
What are composite custom controls?
Composite custom controls combine one or more server or HTML controls within a single control class, which can
be compiled along with other control classes to create an assembly (.dll) that contains a custom control library.
Once created, the custom control library can be loaded into Visual Studio .NET and used in the same way as the
standard server and HTML controls.

Composite custom controls are functionally similar to user controls, but they reside in their own assemblies, so you
can share the same control among multiple projects without having to copy the control to each project, as you
must do with user controls. However, composite controls are somewhat more difficult to create because you can’t
draw them visually using the Visual Studio .NET Designer.

What are the steps to follow create and use a custom control in a Web application?
1. Create a solution containing a custom control project.
2. Add a Web application project to the solution, and set it as the startup project. You will use the Web application
project to test the custom control during development.
3. Add a project reference from the Web application to the custom control project, and add an HTML @Register
directive and control element to use the custom control on a Web form.
4. Create the custom control’s visual interface by adding existing controls to it through the custom control’s
CreateChildControls method.
5. Add the properties, methods, and events that the custom control provides.
6. Build and test the custom control.

In general what is the base class for every composite custom control?
System.Web.UI.WebControls.WebControl

Which directive is used to add a custom control to a Web form?

Register directive.

What are the 3 Register directive's attributes?

TagPrefix 
This name identifies the group that the user control belongs to. For example, the tag prefix for
ASP.NET server controls is “asp”. You use this prefix to create a naming convention to organize your custom
controls.
Namespace 
This is the project name and namespace within the custom control assembly that contains the controls to register.
Microsoft Visual Basic .NET uses the project name as an implicit namespace, so for controls written in Visual
Basic .NET, use the project name.
Assembly 
This is the name of the assembly (.dll) containing the custom controls. The control assembly must be referenced by
the Web application. Referencing the assembly maintains a copy of it in the Web application’s /bin directory.
What are the differences between User Controls and Custom Controls?
1. User Controls are easy to create where as Custom Controls are difficult to create.
2. User Controls cannot be compiled into an assembly, where as Custom Controls can be compiled into an
assembly.
3. User Controls cannot be added to tool box, where as Custom controls can be added to the toolbox.
4. You need to have a copy of user control in every project where you want to use it, where as this is not the case
with custom controls. You can install a single copy of the Web custom control in the global assembly cache and
share it between applications, which makes maintenance easier.
5. User controls are used for reusing existing user interface elements and code, but are not useful for developing
reusable components for multiple web applications.

cascading style sheets

What are the 2 ways provided by ASP.NET to format output in a Web application? 
1. Use cascading style sheets (CSS) to control the appearance of elements on a Web form.These styles can set
the color, size, font, and behavior of the HTML elements on a Web page.

2. Use Extensible Stylesheet Language Transformations (XSLT) to convert information from an Extensible

Markup Language (XML) file to HTML output and position that information on a Web form. XSLT puts data from the
XML file into HTML elements and applies styles to those elements.

What are Cascading style sheets? 

Cascading style sheets (CSS) collect and organize all of the formatting information applied to HTML elements on
a Web form. Because they keep this information in a single location, style sheets make it easy to adjust the
appearance of Web applications.

What are the 3 levels at which formatting can be applied with in a web application?
1. Styles can be defined in a style sheet file. Styles in a style sheet can be applied to all webforms referencing the
style sheet.

2. You can also define styles in the page’s head element. These styles can be applied to all elements on the current
page.

3. You can also define styles inline, in the HTML tag itself. Inline styles are applicable only to the HTML element in
which these styles are defined.

Inline formatting takes precedence over local formatting, which, in turn, takes precedence over global
formatting. These precedence rules are the reason style sheets are referred to as cascading.

What are the advantages of storing style definitions in a style sheet file (.css) rather than locally in
each Web form or inline with each HTML element? 
1. Formatting can be maintained in one location so that you make changes only once for an entire application.

2. Several sets of parallel formatting rules can be maintained in separate style sheets for formatting output on
different devices or for different user needs. For example, an application might provide standard, enlarged-type,
and printer-friendly style sheets that the user can select at run time.

3. In general, you should use page and inline styles only when you have a really good reason to override the global
styles. Relying heavily on page and inline styles can make it difficult to maintain the formatting in a Web
application.

What HTML element is used to reference a style sheet on webform?

To reference a style sheet on webform you must add a link element to the page’s head element, as shown below.

<link href="Styles.css" type="text/css" rel="stylesheet">

What is the use of Style Builder?

Style Builder is used to change the appearance of any of the styles in a style sheet. Changes to the style sheet
change the appearance of all Web forms that reference that style sheet.

How do you modify a style sheet using style builder?

To modify a style sheet using style builder, follow these steps:

1. Open the style sheet in Visual Studio. Visual Studio .NET displays the style definitions in the Document window
and an outline of the style sheet in the Tool window

2. Select the style to modify from the Tool window. Visual Studio .NET displays the definition for that style in the
Document window.

3. Right-click in the style definition or right-click the style in the Tool window, and select Build Style from the
shortcut menu. Visual Studio .NET displays the Style Builder Wizard.

4. Use the Style Builder to compose the formatting that you want to add or modify in the selected style, and then
click OK.

5. When you have finished, you’ll see that the Style Builder adds the new or modified style attributes to the style
definition.

Can you apply styles using class names or element IDs?

Yes, Using class names allows you to apply a single style to a number of different elements or to style the same
element differently, depending on how the element is used. Using element IDs allows you to apply a style to a
unique element on one or more Web forms.

When you create a style rule for a class, Visual Studio .NET adds a style definition to the style sheet using
a .classnameidentifier.

You apply the style class to HTML elements by using the class attribute. You apply the style to server controls by
using theCssClass attribute.

Can you change style sheets at run time?

Yes.