ASP. Pagine attive per Windows

Transcription

1 ASP Pagine attive per Windows

2 ASP Server-side scripting technology di Microsoft per creare web pages interattive Una pagina asp è una pagina contenente HTML (ma non solo) inframmezzato da script tag da eseguire sul server Possibilità di usare oggetti COM e ADO di Windows e di manipolare documenti XML Master in web technology e security - Guido Boella 2

3 ASP ASP per IIS e PWS di Microsoft, ma anche altre piattaforme (Chili!ASP di ChiliSoft) Consente facile collegamento con ADO Il server riceve una richiesta dal client che riguarda una pagina.asp La pagina (date.asp) contiene un documento html inframmezzato con del codice (VBscript, javascript) Master in web technology e security - Guido Boella 3

4 Prima di inviare il documento, il server esegue lui stesso le parti di programma in un thread interno Il codice genera in output parte del documento che viene sostituito agli script tag Parametri ed output gestiti come oggetti da VBscript Introduce il concetto di sessione (ma utilizza comunque i cookies) Master in web technology e security - Guido Boella 4

5 ISAPI (internet server api) Permette legame con dynamic link libraries (DLL) che sono eseguite nello spazio di memoria del server ISAPI filter: permette il controllo delle informazioni dal client al server (per sicurezza) e viceversa Una pagina trovata dal server viene interpretata dal filtro ISAPI asp.dll che ne cambia il contenuto Master in web technology e security - Guido Boella 5

6 Pagine attive - tread del server Altre applicazioni ADO CLIENT (UA,browser) request response Web server (Apache, IIS).html ISAPI filter programmi Macchina del server Master in web technology e security - Guido Boella 6

7 CONFIGURAZIONE PWS Master in web technology e security - Guido Boella 7

8 DIRECTORY VIRTUALI Master in web technology e security - Guido Boella 8

9 Logfile [02/Aug/2000:22:25: ] "GET /Default.asp HTTP/1.1" [02/Aug/2000:22:25: ] "GET /IISSamples/Default/IE.GIF HTTP/1.1" [02/Aug/2000:22:27: ] "GET /asp/pro ASP 3.0/Chapter 08/Connection/Connection.asp? [Microsoft][Driver_ODBC_Micros oft_access_97]_impossibile_trovare_il_file_'(sconosciuto)'. HTTP/1.1" [02/Aug/2000:23:40: ] "GET /ASP/Pro ASP 3.0/Chapter 10/publishers.xml HTTP/1.1" [02/Aug/2000:23:45: ] "GET /ASP/Pro ASP 3.0/Chapter 11/RecordsetToList.xsl HTTP/1.1" [03/Aug/2000:00:31: ] "GET /asp/pro ASP 3.0/Chapter 08/Recordsets/Recordset.asp?Action=Fields HTTP/1.1" Master in web technology e security - Guido Boella 9

10 VBscript Il linguaggio per ASP

11 VBscript Sottoinsieme del linguaggio Visual Basic di Microsoft: senza tipi Linguaggio interpretato senza compilazione precedente per maggiore modificabilità Orientato agli oggetti, ma senza classi Un solo tipo di dato, implicito: Variant il tipo della variabile dipende dal contesto: string, integer, object, currency, date, boolean Operatori per conversione di tipo esplicita Master in web technology e security - Guido Boella 11

12 Variabili Dichiarazione implicita o esplicita di variabili: Dim x, y, z (return è fine espressione) Assegnazione x=1 w="stringa" (dichiarazione implicita) Array: Dim v(9), k(10,1) (v ha 10 indici, ) ReDim v(20) Redim preserve v(30) Master in web technology e security - Guido Boella 12

13 Stringhe Dim stra, strx strx = "una" stra = "sono" & strx & "stringa" & "spezzata _ e molto lunga" Master in web technology e security - Guido Boella 13

14 Subroutine e funzioni Come in Pascal, si distinguono dalle procedure le funzioni che restituiscono un valore Il valore di ritorno va assegnato ad una variabile speciale che ha lo stesso nome della funzione (come in Pascal) Parametri passati per call by reference Variabili locali hanno la durata della procedura e sono solo visibili in essa Master in web technology e security - Guido Boella 14

15 'subroutine Sub scrivi (strx, stry) dim strz strz = strx & stry response.write(strz) End Sub 'funzione Function square (intx) square = intx * intx End Function Master in web technology e security - Guido Boella 15

16 Strutture di controllo If condition Then statement If condition Then statement statements... Endif METAVARIABILE! BLOCCO! If condition Then statements Else statements Endif Master in web technology e security - Guido Boella 16

17 Select Case expression Case value statements... Case value statements End Select Select Case strop Case "+" x = x + y Case "-" x = x - y End Select Master in web technology e security - Guido Boella 17

18 For var = start To finish [Step value] statements Next For intx = 1 to 10 Step 2 Response.write(intX) Next output Master in web technology e security - Guido Boella 18

19 Do While condition statements Loop (While o Until) intx = 3 Do While intx > 0 Response.write(intX) intx = intx + 1 Loop output Master in web technology e security - Guido Boella 19

20 HTML fa parte del programma <html><body> <% Dim i for i = 1 to 10 step 2 %> <BR>passo <%= i %> <% next %> </body></html> Master in web technology e security - Guido Boella 20

21 Script per Client (IE5) <html><body> <script language="vbscript"> <!-- 'commento comandi VBscript --> </script>... </body></html> VBscript NON E' NECESSARIAMENTE IL LINGUAGGIO DI DEFAULT COMMENTO HTML PER COMPATIBILITA' Master in web technology e security - Guido Boella 21

22 Script per server <html><body> <script language="vbscript" runat="server"> Comandi VBscript </script> <p> <% Comandi VBscript %> <p> <% Comandi VBscript %> Sono le <%= time %> </body></html> LO SCRIPT E' PER IL SERVER IL TESTO PRODOTTO SOSTITUISCE LO SCRIPT TAG INTERPRETATO SOLO DAL SERVER TAG CHE RIPORTA VALORE DI UNA VARIABILE Master in web technology e security - Guido Boella 22

23 Non spezzare i tag... <html><body> <% Comandi VBscript %> <p><b>testo html</b> <% Comandi VBscript %> </body></html> 2 CONTEXT SWITCH <html><body> <% Comandi VBscript Response.write("<p><b>Testo html</b>") Comandi VBscript %> </body></html> TESTO HTML SCRITTO DA VBscript Master in web technology e security - Guido Boella 23

24 Inclusione script <html><body> <script language="vbscript" runat="server" src="/aspscript/script.inc" ></script> <p> <!--# include file="/aspscript/script1.inc" --> <p> <% response.write square(5) %> </body></html> SETTA LINGUAGGIO DI DEFAULT INCLUSIONE SSI STYLE: SSI PROCESSATE PRIMA DI ASP Master in web technology e security - Guido Boella 24

25 Efficienza e sicurezza Con Windows2000 i file html possono essere denominati.asp: prima di parsificarli o eseguirli si controlla la presenza del tag <% I file asp vengono compilati e mantenuti nella cache per essere eseguiti fino a modifiche I COM creati in pagina asp possono essere "run out-of-process" Asp script e client-side script possono essere codificati con BASE64 encription. Lo script engine li decodifica runtime Master in web technology e security - Guido Boella 25

26 Oggetti intriseci di ASP Request: mette a disposizioni informazioni mandate da client tramite metodi e variabili: HTTP metavariables cookies query string appese a URL certificati SSL Response: informazioni mandate al client: header http cookies output (message body): Response.write (Sostituiscono stdin e stdout di CGI) Master in web technology e security - Guido Boella 26

27 Application: creato al caricamento di asp.dll con la prima richiesta. Contiene variabili e oggetti globali accessibili ad ogni script Session: oggetto associato a ciascun utente al primo collegamento. Contiene le informazioni accessibili a tutte le pagine visitate da un dato utente. Timeout stabilisce la sua durata dopo ultimo collegamento. Server: offre metodi per creare nuovi processi e oggetti COM (e ADO) ASPError: informazione su ultimo errore Master in web technology e security - Guido Boella 27

28 Collection di Request Query string: coppie attributo-valore inviate da form con metodo GET (URL munging) Form: coppie attributo valore inviate da form con metodo POST Cookies ServerVariables: metavariabili HTTP ClientCertificate ESEMPIO Master in web technology e security - Guido Boella 28

29 Collection <TABLE CELLPADDING=0 CELLSPACING=0> <% For Each keyitem In Request.servervariables() stritemvalue = Request.servervariables(keyItem) Response.Write "<TR><TD>" & keyitem & " = " & stritemvalue & "</TD></TR>" Next %> </TABLE> Master in web technology e security - Guido Boella 29

30 Query string What is the capital city of Sweden? <BR> <A HREF="q2answer.asp?answer=Reykavik&rw=wrong">Reykavik</A> <A HREF="q2answer.asp?answer=Stockholm&rw=right">Stockholm</A> <% Response.Write("Your answer was " & Request.QueryString("answer") & "...<BR>") If Request.QueryString("rw")="right" Then Response.Write("That's the correct answer!") Else Response.Write("No, that's the wrong answer.") End If %> Master in web technology e security - Guido Boella 30

31 Form <% For Each Item in Request.Form Response.Write("For element '" & Item &_ "' you've entered the value '" & Request.Form(Item) &_ "'<BR>") Next %> Master in web technology e security - Guido Boella 31

32 Multivalue form <FORM NAME="MultiChoice" ACTION="DealWithForm3.asp" METHOD="POST"> <H2>Which continents have you visited? </H2><BR> <INPUT NAME="Cnent" TYPE=CHECKBOX VALUE="Africa"> Africa <BR> <INPUT NAME="Cnent" TYPE=CHECKBOX VALUE="North America"> North America <BR> <% Response.Write("You've really been to all these places?" & "<BR>") For i = 1 To Request.Form("Cnent").Count Response.Write (Request.Form("Cnent")(i) & "<BR>") Next Response.Write("<BR>" & "Impressive...") End If %> Master in web technology e security - Guido Boella 32

33 Collection e variabili di Response Cookies: le coppie attributo valore inviate dal server allo user agent client Buffer: output bufferizzato fino a flush (per gestire errori runtime dello script) Content-type = mime-type ("text/xml") CacheControl = public o private Expires minuti (per proxy servers) PICS("...") (per filtrare contenuto pagina) status = messaggio (200 OK, 404 not found) Master in web technology e security - Guido Boella 33

34 Metodi di Response AddHeader("name", "content") va usato prima di spedire il contenuto della pagina End(), Flush() Redirect("url") 303 Object Moved url Write(string) BinaryWrite(Array) per inviare immagini senza conversione di testo Master in web technology e security - Guido Boella 34

35 <FORM ACTION="show.asp"METHOD="POST"> firstname: <INPUT TYPE="TEXT" NAME="first"> lastname: <INPUT TYPE="TEXT" NAME="last"> <INPUT TYPE="SUBMIT"></FORM> <% firstname = Request.form("first") lastname = Request.form("last") Response.write(Request.form) For each objitem in Request.form Response.write objitem & ":" & Request.form(objitem) For intloop = 1 to Request.form.count Response.write Request.form(intloop) Next %> first=guido&last=boella... FORM HTML show.asp OUTPUT Master in web technology e security - Guido Boella 35

36 Cookies Vanno creati prima di creare output in quanto si trovano nell'header intcount = Request.Cookies("count") Response.Cookies("count") = intcount + 1 Response.Cookies("count").domain="di.unito.it" Response.Cookies("count").domain="/docsrv/guido/" Response.Cookies("count").expires = #date# Response.Write "Hai visitato questo sito " & _ intcount & "volte" VIRTUAL PATH Master in web technology e security - Guido Boella 36

37 <FORM ACTION=<% =Request.ServerVariables("SCRIPT_NAME") %> METHOD="GET"> login: <INPUT TYPE="TEXT" NAME="login" VALUE = <% = Request.QueryString("login") %> SCRIPT passwd: <INPUT TYPE="TEXT" NAME="passwd"> <INPUT TYPE="SUBMIT"></FORM> <% login = Request.form("login") passwd = Request.form("passwd") Response.Cookies("loginInfo")("login")= login Response.Cookies("loginInfo")("passwd")= passwd %> INDIRIZZO DELLO Master in web technology e security - Guido Boella 37

38 SECURE SOCKET LAYER REDIRECT (PORT 443) <% if Request.ServerVariables("SERVER_PORT") = 443 THEN Response.Redirect("/securepages/default.asp") else Response.Redirect("/normalpages/default.asp") %> Genera un messaggio HTTP/ Object Moved location /securepages/default.asp Stesso effetto su lato client <META HTTP-EQUIV="REFRESH" CONTENT="0;URL=/securepages/default.asp"> Master in web technology e security - Guido Boella 38

39 L'oggetto Application METODI E VARIABILI: Contents: collection di variabili (application("nomevar")) lock(), unlock(): solo una pagina.asp può essere eseguita per impedire interferenze EVENTI: onstart: subroutine eseguita alla creazione dell'oggetto Application onend: eseguita alla chiusura File di inizializzazione: GLOBAL.ASA Master in web technology e security - Guido Boella 39

40 L'oggetto Session METODI e VARIABILI: Contents: collection di variabili (session("nomevar")) Timeout: durata session; default 10 min. EVENTI: onstart: subroutine eseguita alla creazione dell'oggetto Session onend: eseguita alla chiusura File di inizializzazione: GLOBAL.ASA Master in web technology e security - Guido Boella 40

41 Global.asa <SCRIPT LANGUAGE=VBScript RUNAT=Server> Sub Application_OnStart Application("visits") = 0 Application("Active")= 0 End Sub Sub Application_OnEnd End Sub CONTINUA NELLA STESSA DIRECTORY DI GLOBAL.ASA VARS.ASP There have been <B><%=Session("VisitorID")%></B> total visits to this site. <BR>You are one of <B> <%=Application("Active")%></B> active visitors. <BR>Your session started at <%= Session("Start") %> Master in web technology e security - Guido Boella 41

42 Sub Session_OnStart Session.Timeout = 1 Session("Start")=Now Application.lock Application("visits")= Application("visits") + 1 inttotal_visitors = Application("visits") Session("VisitorID") = inttotal_visitors Application("Active")= Application("Active") + 1 Application.unlock End Sub Sub Session_OnEnd Application.lock Application("Active")= Application("Active") - 1 Application.unlock End Sub </SCRIPT> Master in web technology e security - Guido Boella 42

43 SessionID Asp mantiene automaticamente la gestione delle Session grazie ai Cookies Se non è attiva la ricezione dei Cookies nel browser, la Session non funziona Il server assume che richieste HTTP con stesso sessionid arrivino dallo stesso utente Il Cookie è generato in maniera casuale per evitare interferenze: può essere intercettato e sfruttato da hacker per spacciarsi per l'utente Connessione SSL permette il criptaggio dell'identificatore Session Master in web technology e security - Guido Boella 43

44 Il cookie sessionid viene inviato solo al momento di una assegnazione alla collection session (e.g., session("user")="guido"): ma senza buffering l'header è inviato senza id HTTP_COOKIE: ASPSESSIONIDFFFESKDR=FMCLMFDAKHFDCGHDCCPAPOCC; La session espira in base al valore di session.timeout (default=20min) o alla chiusura del browser (cookie ha expires = 0) La session è associata al singolo server: problemi con le server farm; violo load balance inviando stesso sessionid a stessa macchina Master in web technology e security - Guido Boella 44

45 Esempio session <% response.expires = DISABILITO CACHE if NOT request.querystring("user")="" then session.timeout=1 session("user")=request.querystring("user") response.write "You are " & session("user") & " " response.write "<br><a href=" & request.servervariables("script_name") & ">Go back to start page</a>" end if if session("user") = "" then %> <form method="get" action="<%= request.servervariables("script_name") %>"> <input type=text name="user">what's your name?</input></form><% else response.write "<Br>Hello " & session("user") end if %> Durata session 1min Master in web technology e security - Guido Boella 45

46 L'oggetto Server METODI e VARIABILI: createobject("id"): crea istanza di oggetto e restituisce reference (set). id è cslid "{RB23...}" o Progid: "ADODB.Connection" (vendor.component) Execute("url"), Transfer("url"): trasferisce il controllo a script url assieme al contesto (e ritorna) GetLastError(): reference ad errore File di errore è chiamato tramite server.transfer: C: WINDOWS HELP common 400.htm ecc. Per eliminare un oggetto x e recuperare la memoria: set x = nothing Master in web technology e security - Guido Boella 46

47 Counter <% Dim objfso, objcountfile ' object vars for FSO and File Dim strcountfilename ' filename of count text file Dim icount ' count variable strcountfilename=server.mappath(request.servervariables("script_name ") & ".cnt") Set objfso = Server.CreateObject("Scripting.FileSystemObject") ' Open the file as a text stream (1 = ForReading, True = Create) Set objcountfile = objfso.opentextfile(strcountfilename, 1, True) If Not objcountfile.atendofstream Then icount = CLng(objCountFile.ReadAll) Else icount = 0 End If objcountfile.close CONTINUA Master in web technology e security - Guido Boella 47

48 Set objcountfile = Nothing icount = icount + 1 Set objcountfile = objfso.createtextfile(strcountfilename, True) objcountfile.write icount objcountfile.close Set objcountfile = Nothing Set objfso = Nothing Response.Write "This page has been visited by " & icount _ & " people" %> Master in web technology e security - Guido Boella 48

49 Script di benvenuto <% Dim dhour dhour = Hour(Now) If dhour < 12 Then Response.Write "Good morning!" ElseIf dhour < 17 Then Response.Write "Good afternoon!" Else Response.Write "Good evening!" End If %> We hope you are enjoying our sample code.<br> <BR> If you are curious it is currently <%= Time() %> on <%= Date() %>.<BR> Master in web technology e security - Guido Boella 49

50 Time counter <% If Request.QueryString("time") = "" Then %>You... <BR> <% Else difftime = DateDiff("s", Request.QueryString("time"), Now()) %> You spent <%= difftime %> seconds.<br> <% End If %><BR><A HREF="time.asp?time=<%= Server.URLEncode(Now())%>">How long have I spent on this page?</a><br> <% totaltime = session("time") session("time") = difftime + totaltime application.lock atotaltime = application("atime") application("atime") = difftime + atotaltime application.unlock %><BR>You have spent <%= session("time") %> seconds during this session. Master in web technology e security - Guido Boella 50

51 File System I comandi per gestire i files sono metodi dell'oggetto "Scripting.FileSystemObject" Per manipolare files occorre quindi creare una istanza dell'oggetto file system Metodi: opentextfile(nomefile, r/w, create): apre il file nomefile ("c: asp file.txt") creando un oggetto stream corrispondente. r/w: forreading=1, forwriting=2, forappending=8. create è true o false createtextfile(nomefile, create): crea lo stream del file nomefile Master in web technology e security - Guido Boella 51

52 FileSystemObject Metodi: fileexists(nomefile): controlla esistenza di un file deletefile(nomefile): cancella il file Master in web technology e security - Guido Boella 52

53 Oggetto stream Uno stream è creato dal metodo di apertura file del filesystemobject o da openastextstream di un oggetto file Variabili: atendofstream: vero se lo stream è vuoto o è stato letto tutto Metodi: readall, readline: lettura file o linea write stringa: scrittura writeline stringa: scrittura con a capo close(): chiusura stream Master in web technology e security - Guido Boella 53

54 Stream Uno stream è un flusso di caratteri leggibili o scrivibili Con ADO2.1 esistono solo stream corrispondenti a files Con ADO2.5 si possono usare stream in memoria senza un file corrispettivo Gli oggetti Request e Response diventano stream di input e output Master in web technology e security - Guido Boella 54

55 Oggetto file Un oggetto file è creato con il metodo getfile(nomefile) dell'oggetto filesystemobject L'oggetto file contiene le proprietà del file e permette di accedere al contenuto creando una stream con openastextfile Variabili: name, datelastmodified, type Metodi openastextfile(): crea stream Master in web technology e security - Guido Boella 55

56 Gestione file <% Dim objfso Dim objfile Dim datemodified Set objfso = Server.CreateObject("Scripting.FileSystemObject") Set objfile = objfso.getfile(server.mappath("modified.asp")) datemodified = objfile.datelastmodified %> This file was modified on <%= datemodified %> or <% FormatDateTime(dateModified, 1) %> <% Set objfile = Nothing Set objfso = Nothing %> Master in web technology e security - Guido Boella 56

57 Text file <!--METADATA TYPE="TypeLib" FILE="c: Programmi File comuni System ADO MSADOr15.dll"--> <% strtextfile = Server.MapPath("MyFile.txt") Set objfso = Server.CreateObject("Scripting.FileSystemObject") If Len(Request.Form("cmdUpdate")) Then strnewtext = Request.Form("txtContent") arrlines = Split(strNewText, vbcrlf) Set objtstream = objfso.opentextfile(strtextfile, 2) For intline = 0 To UBound(arrLines) strthisline = arrlines(intline) If Len(strThisLine) > 4 Then objtstream.writeline Mid(strThisLine, 6) Next objtstream.close End If Master in web technology e security - Guido Boella 57

58 <FORM ACTION="<% = Request.ServerVariables("SCRIPT_NAME") %>" METHOD="POST"> The contents of the disk file <B><% = strtextfile %></B> are:<p> <TEXTAREA NAME="txtContent" ROWS="10" COLS="50" > <% Set objtstream = objfso.opentextfile(strtextfile, 1) Do While Not objtstream.atendofstream intlinenum = objtstream.line strlinenum = Right("00" & CStr(intLineNum), 3) strlinetext = objtstream.readline Response.Write strlinenum & ": " & strlinetext & vbcrlf Loop objtstream.close %></TEXTAREA><P> <INPUT TYPE="SUBMIT" NAME="cmdUpdate" VALUE=" "> </FORM></BODY></HTML>s Master in web technology e security - Guido Boella 58

59 Oggetto Dictionary Una tabella associativa in ASP è una istanze dell'oggetto Dictionary: "Scripting.Dictionary" Variabili: keys: restituisce l'array delle chiavi items: restituisce l'array dei valori count: numero elementi della tabella Master in web technology e security - Guido Boella 59

60 Oggetto Dictionary Metodi: item("chiave"): il valore associato alla chiave. Abbreviazione: ("chiave") add chiave, valore: inserisce la coppia chiave-valore nella tabella exists("chiave"): vero se alla chiave è associato un valore nella tabella Master in web technology e security - Guido Boella 60

61 Oggetto Dictionary <% Set objdictionary = CreateObject("Scripting.Dictionary") objdictionary.add "Apple", "Red" objdictionary.add "Lemon", "Yellow" strvalue = objdictionary.item("apple") if objdictionary.exists("apple") then objdictionary.item("apple") = "Green" end if arkeys = objdictionary.keys for i = 0 to objdictionary.count -1 Response.Write "<BR>Key = " & arkeys(i) & " -- Value = " & objdictionary.item(arkeys(i)) next aritems = objdictionary.items %> Master in web technology e security - Guido Boella 61

62 Gestione directory <% strpathinfo = Request.ServerVariables("PATH_INFO") strphysicalpath = Server.MapPath(strPathInfo) Set objfso = CreateObject("Scripting.FileSystemObject") set objfile = objfso.getfile(strphysicalpath) set objfolder = objfile.parentfolder set objfoldercontents = objfolder.files%><table><% For Each objfileitem in objfoldercontents %> <TR><TD><A HREF="<%= objfileitem.name %>"> <%= objfileitem.name %></A></TD> <TD><%= objfileitem.type %></TD> <TD><%= objfileitem.size %></TD> <TD><%= objfileitem.datelastmodified %></TD></TR> <% Next %> Master in web technology e security - Guido Boella 62

63 VBscript non e' l'unico linguaggio LANGUAGE = PerlScript %> <html> <BODY> <BODY BGCOLOR=#FFFFFF> <TABLE CELLPADDING=3 BORDER=0 CELLSPACING=0> <TR VALIGN=TOP ><TD WIDTH=400> </TD></TR></TABLE> <% for ($i = 3; $i < 8; $i++) { %> <font size=<%= $i %>> "Hello World!" </font> <BR> <% } %> </BODY></HTML> Master in web technology e security - Guido Boella 63

64 VBscript non e' l'unico linguaggio LANGUAGE = Javascript %> <html> <BODY> <BODY BGCOLOR=#FFFFFF> <TABLE CELLPADDING=3 BORDER=0 CELLSPACING=0> <TR VALIGN=TOP ><TD WIDTH=400> </TD></TR></TABLE> <% for (i = 3; i < 8; i++) { %> <font size=<%= i %>> "Hello World!" </font> <BR> <% } %> </BODY></HTML> Master in web technology e security - Guido Boella 64

65 Negozio elettronico Master in web technology e security - Guido Boella 65

66 Negozio elettronico Master in web technology e security - Guido Boella 66

67 Shopping cart <% ' Sub AddItemToCart(iItemID, iitemcount) If dictcart.exists(iitemid) Then dictcart(iitemid) = dictcart(iitemid) + iitemcount Else dictcart.add iitemid, iitemcount End If Response.Write iitemcount & " of item # " & iitemid & " have been added to your cart.<br><br>" & vbcrlf End Sub Master in web technology e security - Guido Boella 67

68 Sub RemoveItemFromCart(iItemID, iitemcount) If dictcart.exists(iitemid) Then If dictcart(iitemid) <= iitemcount Then dictcart.remove iitemid Else dictcart(iitemid) = dictcart(iitemid) - iitemcount End If Response.Write iitemcount & " of item # " & iitemid & " have been removed from your cart.<br><br>" & vbcrlf Else Response.Write "Couldn't find any of that item your cart.<br><br>" & vbcrlf End If End Sub Master in web technology e security - Guido Boella 68

69 Sub ShowItemsInCart() Dim Key Dim aparameters ' as Variant (Array) Dim stotal, sshipping %> <TABLE Border=1 CellPadding=3 CellSpacing=1> <TR><TD>Item #</TD>... </TR> <% stotal = 0 For Each Key in dictcart aparameters = GetItemParameters(Key) %> <TR><TD ALIGN="Center"><%= Key %></TD> <%= aparameters(1) %><%= dictcart(key) %> <A HREF="./shopping.asp?action=del&item=<%= Key%> &count=1">remove One</A> &nbsp <TD>$<%= aparameters(2) %></TD> <TD>$<%=FormatNumber(dictCart(Key) * CSng(aParameters(2)),2) %></TD> </TR> <% stotal = stotal + (dictcart(key) * CSng(aParameters(2))) Next Master in web technology e security - Guido Boella 69

70 <% stotal = stotal + (dictcart(key) * CSng(aParameters(2))) Next If stotal <> 0 Then sshipping = 7.5 Else sshipping = 0 End If stotal = stotal + sshipping %> $<%= FormatNumber(sShipping,2) $<%= FormatNumber(sTotal,2) %></TD></TR></TABLE> <% End Sub Master in web technology e security - Guido Boella 70

71 Sub ShowFullCatalog() iitemcount = 3 %> <TABLE Border=1 CellPadding=3 CellSpacing=1> <TR><TD>Image</TD> </TR> <% For I = 1 to iitemcount aparameters = GetItemParameters(I) %> <TR> <TD><IMG SRC="<%= aparameters(0) %>"></TD> <TD><A HREF="./shopping.asp?action=add&item=<%= I %>&count=1">add this to my cart!</a></td> </TR><% Next %></TABLE><% End Sub Master in web technology e security - Guido Boella 71

72 GetItemParameters(iItemID) Dim aparameters ' 3 stringhe image path, description, price Select Case iitemid Case 1 aparameters = Array("./images/shop_shirt.gif", "ASP T-Shirt", "15.00") Case 2 aparameters = Array("./images/shop_kite.gif", "ASP Kite", "17.50") Case 3 aparameters = Array("./images/shop_watch.gif", "ASP Watch", "35.00") End Select GetItemParameters = aparameters End Function %> Master in web technology e security - Guido Boella 72

73 <% If IsObject(Session("cart")) Then Set dictcart = Session("cart") Else Set dictcart = Server.CreateObject("Scripting.Dictionary") End If saction = CStr(Request.QueryString("action")) iitemid = CInt(Request.QueryString("item")) iitemcount = CInt(Request.QueryString("count")) Select Case saction Case "add" AddItemToCart iitemid, iitemcount ShowItemsInCart %> <A HREF="./shopping.asp?action=">Continue Looking</A> <A HREF="./shopping.asp?action=checkout>Checkout"></A> Master in web technology e security - Guido Boella 73

74 <% Case "del" RemoveItemFromCart iitemid, iitemcount ShowItemsInCart Case "viewcart" ShowItemsInCart Case "checkout" PlaceOrder Case Else ' Shop ShowFullCatalog End Select ' Return cart to Session for storage Set Session("cart") = dictcart %> Master in web technology e security - Guido Boella 74

75 SQL Comunicare nel linguaggio dei database

76 SQL: Structured Query Language (SeQueL) Linguaggio per l'interazione con database tramite ActiveX Data Object (ADO) Operazioni: leggere informazioni selezionare informazioni cambiare e cancellare dati (modificare la struttura del database) Ispirato al linguaggio naturale Sintassi: keyword arguments keyword arguments... Master in web technology e security - Guido Boella 76

77 TABELLA FIELD Category ID Room ID Description Manufacturer Sports Equipment Bedroom Exercise Bike Adventure Works Furniture Living Room Gray three-cushion sofa Fitch & Mather Sports Equipment Garage Mountain Bike Crawford & Bicycles Electronic Den Computer Bits, Bytes & Chips, Inc. Tool Garage Cordless drill ProElectron, Inc. Furniture Dining Room Ebony inlaid table unknown Tool Garage Table saw Shear Savvy Collectible Den Baseball card collection Jewelry Bedroom Pearl neclace Electronic Living Room Audio-Visual Receiver AVTech RECORD Furniture Living Room Gray three-cushion sofa Fitch & Mather Master in web technology e security - Guido Boella 77

78 Select Reperimento dati specificando: tabella colonne tabella ordine restrizioni SELECT * FROM household inventory (prendi tutti (*) i record (con tutte le colonne) dalla tabella household invenctory) Master in web technology e security - Guido Boella 78

79 Selezione campi (colonne) SELECT description, manufacturer FROM household inventory Selezione record room id diventa roomid SELECT roomid, description FROM household inventory WHERE roomid = livingroom SELECT roomid, description FROM household inventory WHERE date BETWEEN #20/01/90# AND #01/03/99# SELECT roomid, description FROM household inventory WHERE roomid LIKE '%room' Master in web technology e security - Guido Boella 79

80 Ordinamento del recordset SELECT roomid, description FROM household inventory ORDER BY roomid SELECT roomid, description FROM householdinventory ORDER BY date DESC Unione tabelle: JOIN SELECT a.roomid AS roomid, b.manufacturer AS manufacturer FROM a INNER JOIN b ON a.description = b.description Master in web technology e security - Guido Boella 80

81 STESSO ORDINE CAMPI DEI VALORI Inserimento di un record INSERT INTO inventory (roomid, description, manufacturer,...) VALUES ('bedroom', 'lamp', 'Brigthlight inc.',...) Modifica di (un) record specifici(o): UPDATE inventory SET manufacturer='darklight' WHERE description='lamp' AND roomid='bedroom' (modifica tutti i record che matchano i criteri) Master in web technology e security - Guido Boella 81

82 Category ID Room ID Description Manufacturer Sports Equipment Bedroom Exercise Bike Adventure Works Furniture Living Room Gray three-cushion sofa Fitch & Mather Sports Equipment Garage Mountain Bike Crawford & Bicycles Electronic Den Computer Bits, Bytes & Chips, Inc. Tool Garage Cordless drill ProElectron, Inc. Furniture Dining Room Ebony inlaid table unknown Tool Garage Table saw Shear Savvy Collectible Den Baseball card collection Jewelry Bedroom Pearl neclace Electronic Living Room Audio-Visual Receiver AVTech Description Manufacturer Exercise Bike Adventure Works Gray three-cushion sofa Fitch & Mather Mountain Bike Crawford & Bicycles Computer Bits, Bytes & Chips, Inc. Cordless drill ProElectron, Inc. Ebony inlaid table unknown Table saw Shear Savvy Baseball card collection Pearl neclace Audio-Visual Receiver AVTech SELECT description, manufacturer FROM household inventory SELECT room id, description FROM household inventory WHERE room id = living room Room ID Living Room Living Room Description Gray three-cushion sofa Audio-Visual Receiver Master in web technology e security - Guido Boella 82

83 Room ID Bedroom Living Room Description Exercise Bike Gray three-cushion sofa A B Garage Mountain Bike Den Computer Garage Cordless drill Room ID Manufacturer Dining Room Ebony inlaid table Bedroom Adventure Works Garage Table saw Living Room Fitch & Mather Den Baseball card collection Bedroom Pearl neclace Garage Crawford & Bicycles Living Room Audio-Visual Receiver Den Bits, Bytes, Inc. Description Manufacturer Garage ProElectron, Inc. Exercise Bike Adventure Works Dining Room unknown Gray three-cushion sofa Fitch & Mather Garage Shear Savvy Den Mountain Bike Crawford & Bicycles Bedroom Computer Bits, Bytes, Inc. Living Room AVTech Cordless drill ProElectron, Inc. Ebony inlaid table unknown Table saw Shear Savvy Baseball card collection Pearl neclace Audio-Visual Receiver AVTech Master in web technology e security - Guido Boella 83

84 Gerarchia di Windows ASP ActiveX Data Object (ADO) OLEDB provider per ODBC OLEDB provider per EXCEL ODBC XSL DB Master in web technology e security - Guido Boella 84

85 ActiveX Data Object (ADO) ADO è parte di COM (MS component object model) E' costituito da una gerarchia di oggetti: Connection Command Parameter Recordset Fields Si opera creando gli oggetti e manipolandoli Master in web technology e security - Guido Boella 85

86 Gli oggetti Connection, Command e Recordset Connection: la connessione con il database indicando Command: per eseguire comandi sul database a cui ci si è collegati con la connessione. I comandi sono espressi in SQL Recordset: insieme di record di un database. Offre metodi per manipolare l'insieme (spostamento, lettura...) Command e Recordset possono creare implicitamente una connessione anche senza connection Master in web technology e security - Guido Boella 86

87 Connection L'oggetto connection crea una connessione ad un database che puo' essere utilizzata per più operazioni di consultazione o modifica del database L'oggetto creato può essere passato all'oggetto Recordset per indicare il database a cui si sta accedendo Specifica del DB: o tramite DSN creato dal driver ODBC di Microsoft o indicando il driver specifico del DBMS da usare ed il nome del file. Master in web technology e security - Guido Boella 87

88 Oggetto Connection Variabili: state: 1 se la connessione ha avuto successo (costante adstateopen) Metodi: execute(querysql): invia un query al database e restituisce un recordset close(): chiude la connessione (implicito a fine script) BeginTrans, CommitTrans, RollbackTrans per gestione transazioni Master in web technology e security - Guido Boella 88

89 Permessi La connessione fra server e database con NT è condizionata dal settaggio di permessi Su IIS è possibile indicare per ogni file o directory quale utente utilizzare per il collegamento: utente associato a richiesta anonima (di default IUS_nomemacchina) utente e password passate tramite HTTP e controllate con elenco password di sistema Master in web technology e security - Guido Boella 89

90 Security Nella stringa di connessione è possibile specificare IUD e PWD per utente e password Settaggio utente e password nel database o nel driver ODBC di Microsoft Master in web technology e security - Guido Boella 90

91 Gli oggetti Connection, Command e Recordset Dim dbrcs Set dbrcs = Server.CreateObject(ADODB.Recordset) sqlstatement = "SELECT * FROM household inventory" dbrcs.open sqlstatement, DSN="nomedb" dbrcs.movefirst Response.Write dbrcs("name") dbrcs.close Master in web technology e security - Guido Boella 91

92 Connessione implicita Dim dbrcs 'dichiaro variabile per contenere recordset 'creo oggetto ADO Set dbrcs = Server.CreateObject(ADODB.Recordset) 'preparo SQL statement e poi riempio recordset sqlstatement = "SELECT * FROM household inventory" dbrcs.open sqlstatement, DNS="db.mdb" 'connessione dbrcs.movefirst 'indice del recordset Response.Write dbrcs("name") 'accesso a field "name" dbrcs.close Master in web technology e security - Guido Boella 92

93 Dim stp Connessione 'indico driver da usare in connessione e file stp="driver={microsoft Access Driver (*.mdb)}; _ DBQ=C: guido master inventario.mdb" 'file di MS Access 'creo oggetto connessione set objc =Server.CreateObject("ADODB.Connection") objc.open stp 'apro la connessione ed eseguo un comando objc.execute("insert INTO vv _ '_ è a capo in VBscript (description, money) VALUES ('lampada', 100)") set rsauthors = Server.CreateObject("ADODB.Recordset") rsauthors.open "authors", objc 'nome connessione rsauthors.movefirst... Master in web technology e security - Guido Boella 93

94 Connessione Dim stp 'connessione tramite Data Source Name stp = "DSN=pubs" 'creo oggetto connessione set objc =Server.CreateObject("ADODB.Connection") objc.open stp 'apro la connessione ed eseguo un comando objc.execute("insert INTO vv _ '_ è a capo in VBscript (description, money) VALUES ('lampada', 100)") Master in web technology e security - Guido Boella 94

95 Master in web technology e security - Guido Boella 95

96 ODBC DSN: data source name Master in web technology e security - Guido Boella 96

97 SCELTA DRIVER Master in web technology e security - Guido Boella 97

98 Oggetto recordset Struttura dati formata dalla lista di record provenienti dal database e da un indicatore di quale è il record corrente Il record è formato da un insieme di coppie attributo valore (variabili name e value) Permette la modifica in locale dei dati e il loro aggiornamento sul database Master in web technology e security - Guido Boella 98

99 Oggetto recordset Variabili: state: 1 se la connessione ha avuto successo EOF e BOF: l'indicatore ha sorpassato l'ultimo (o il primo) record (EOF e BOF sono entrambe veri se il recordset è vuoto) Fields: collezione dei campi del record corrente RecordCount: numero di record nel recordset Master in web technology e security - Guido Boella 99

100 Oggetto recordset Metodi Open querysql, connessione, [cursor], [lock] MoveFirst, MoveNext, MovePrevious, MoveLast: spostamento indicatore nella lista dei record addnew: aggiunge nuovo record Find: cerca il record che soddisfa un vincolo Update: aggiorna le modifiche del record corrente su database UpdateBatch: aggiorna tutti i record Master in web technology e security - Guido Boella 100

101 Cursor Dynamic cursor allows you to view additions, changes, and deletions by other users; allows all types of movement through the Recordset that doesn't rely on bookmarks; and allows bookmarks if the provider supports them. Keyset cursor behaves like a dynamic cursor, except that it prevents you from seeing records that other users add, and prevents access to records that other users delete. Data changes by other users will still be visible. It always supports bookmarks and therefore allows all types of movement through the Recordset. Master in web technology e security - Guido Boella 101

102 Cursor Static cursor provides a static copy of a set of records for you to use to find data or generate reports; always allows bookmarks and therefore allows all types of movement through the Recordset. Additions, changes, or deletions by other users will not be visible. This is the only type of cursor allowed when you open a client-side Recordset object. Forward-only cursor allows you to only scroll forward through the Recordset. Additions, changes, or deletions by other users will not be visible. This improves performance in situations where you need to make only a single pass through a Recordset. Master in web technology e security - Guido Boella 102

103 Locking del recordset adlockbatchoptimistic 4 Indicates optimistic batch updates. Required for batch update mode. adlockoptimistic 3 Indicates optimistic locking, record by record. The provider uses optimistic locking, locking records only when you call the Update method. adlockpessimistic 2 Indicates pessimistic locking, record by record. The provider does what is necessary to ensure successful editing of the records, usually by locking records at the data source immediately after editing. adlockreadonly 1 Indicates read-only records. You cannot alter the data. adlockunspecified -1 Does not specify a type of lock. For clones, the clone is created with the same lock type as the original. Master in web technology e security - Guido Boella 103

104 Creazione Recordset Set rsauthors = Server.CreateObject("ADODB.Recordset") With rsauthors Select Case Request.QueryString("Action") Case "Create".Open "authors", "Driver={Microsoft Access _ Driver (*.mdb)};dbq=c: asp Pro ASP 3.0 pubs.mdb" If.State = adstateopen Then response.write "Recordset created successfully" else Response.Write "Recordset creation failed" end if Master in web technology e security - Guido Boella 104

105 Display records Case "Display".Open "authors", strconn If.State = adstateopen Then If not.eof and not.bof then While not.eof response.write.fields("au_fname") & ", " & _.Fields("au_lname") & "<BR>" rsauthors.movenext wend else response.write "Recordset empty end if else Response.Write = "Recordset creation failed" end if Master in web technology e security - Guido Boella 105

106 Mostra campi di un record Case "Fields".Open "authors", strconn If.State = adstateopen Then If not.eof and not.bof then for each fld in.fields response.write fld.name & " : " & _ fld.value & "<BR>" next else response.write "Recordset empty" end if else Response.Write = "Recordset creation failed" end if Master in web technology e security - Guido Boella 106

107 Tabella per form dati.open "authors", strconn, adopendynamic, adlockoptimistic If.State = adstateopen Then Response.write "<TABLE><TR><TD>Field</TD><TD>Value</TD>" For each fld in.fields response.write "<TR><TD>" & fld.name & "</TD><TD><INPUT _ TYPE=""TEXT"" NAME=" & fld.name & " SIZE=""21"" VALUE= _ & fld.value & "></TD>" next response.write "</TABLE><P><INPUT TYPE=""SUBMIT"" NAME =""Submit"" VALUE=""Edit Record"">" else Response.Write = "Recordset creation failed" end if Master in web technology e security - Guido Boella 107

108 Gestione errori If objconn.errors.count > 0 Then For each objerror in objconn.errors If objerror.number <> 0 then Response.Write "<TABLE BORDER=1>" & _ "<TR><TD>Error Property</TD><TD>Contents</TD>" & _ "</TR><TR><TD>Number</TD><TD>" & objerror.number & _ "</TD></TR><TR><TD>NativeError</TD><TD>" & _ objerror.nativeerror & "</TD></TR>" & _ "<TR><TD>SQLState</TD><TD>" & objerror.sqlstate & _ "</TD></TR><TR><TD>Source</TD><TD>" & _ objerror.source & "</TD></TR>" & _ "<TR><TD>Description</TD><TD>" & _ objerror.description & "</TD></TR></TABLE><P>" End If Next Master in web technology e security - Guido Boella 108

109 Aggiunta record rsauthors.open "authors", strconn, adopenkeyset, _ adlockoptimistic rsauthors.find "au_lname = '" & request.form("clastname") _ & "'" If rsauthors.state = adstateopen then rsauthors.addnew rsauthors.fields("au_id") = request.form("au_id") rsauthors.fields("au_lname") = request.form("au_lname") rsauthors.fields("zip") = request.form("zip") rsauthors.fields("contract") = request.form("contract") rsauthors.update response.write "Record added - Record Number = " & _ rsauthors.absoluteposition Master in web technology e security - Guido Boella 109

110 XMLDOM ASP parla XML

111 XMLDOM Asp offre una serie di metodi per gestire file XML Il contenuto di un file XML diventa un oggetto di ASP e non solo una stringa di caratteri I recordset di un database possono essere trasformati in un file XML Necessari IE5, IIS5 con ADO2.5 per piena funzionalità Master in web technology e security - Guido Boella 111

112 IE5 e XML Il browser IE5 (e forse Netscape 6) offrono la possibilità di incorporare file XML all'interno di una pagina HTML e di manipolarli con VBscript (come con ASP) o Jscript I dati XML (xml data island) possono essere visualizzati in tabelle o in singoli elementi XML tramite DATAFLD XMLHTTP permette di trasmettere oggetti XML al server e viceversa Master in web technology e security - Guido Boella 112

113 Perché passare dati al client? Per avere applicazioni che rispondono in maniera più veloce Per alleggerire il carico di lavoro del server: one page web applications Master in web technology e security - Guido Boella 113

114 IE5, XML e XSL Il browser IE5 permette di visualizzare un file XML facendolo tradurre da uno stylesheet CSS <?xml version="1.0"?> <?xml-stylesheet type="text/css" href="menu.css"?> Master in web technology e security - Guido Boella 114

115 CSS per XML menu.xml <?xml version="1.0"?> <?xml-stylesheet type="text/css" href="menu.css"?> <Menu effective=" " expires=" "> <Appetizers> <Item> <Name>Deep Fried Mushrooms with Stuff in Them</Name> <Price>6.00</Price> <Description>All mushrooms look alike. Focus on the conversation</description> </Item> menu.css: NAME {BACKGROUND-COLOR: teal; COLOR: white; DESCRIPTION {BACKGROUND-COLOR: white; COLOR: blue;} Master in web technology e security - Guido Boella 115

116 XSL PER DHTML links.xml XML file contiene la descrizione gerarchica del menu links.xsl regole XSL per generare i link dei menu' con gli appositi comandi onclick, id, e attributo display menu.js contiene funzioni javascript per attivare attributo display di un DIV e la chiamata alla traduzione xsl da links.xml tramite links.xsl Master in web technology e security - Guido Boella 116

117 ESEMPIO DTD <!ELEMENT Team (Manager, Members, Person+ )> <!ATTLIST Team project ID #REQUIRED > <!ELEMENT Manager EMPTY> <!ATTLIST Manager person IDREF #REQUIRED > <!ELEMENT Members EMPTY> <!ATTLIST Members people IDREFS #REQUIRED > <!ELEMENT Person (Name )> <!ATTLIST Person sn ID #REQUIRED > <!ELEMENT Name (First, Last )> <!ELEMENT First (#PCDATA )> <!ELEMENT Last (#PCDATA )> Master in web technology e security - Guido Boella 117

118 <?xml version="1.0"?><!doctype Team SYSTEM "team.dtd"> <Team project="a134"> <Manager person="a1"/> <Members people="b1 c2 c9"/> <Person sn="a1"> <Name> <First>John</First> <Last>Doe</Last> </Name> </Person> <Person sn="b1"> <Name> <First>Dudley</First> <Last>Doright</Last> </Name> </Person></Team> ESEMPIO XML Master in web technology e security - Guido Boella 118

119 ESEMPIO XML con XSL <?xml version="1.0"?> <?xml-stylesheet type="text/xsl" href="stylecontacts.xsl"?> <CONTACT_INFO> <BUSINESS><CONTACT> <NAME>John Doe</NAME> <PHONE> </PHONE></CONTACT> </BUSINESS> <PERSONAL><CONTACT relation="family"> <NAME>Mary Jones</NAME> <PHONE> </PHONE></CONTACT> <CONTACT> <NAME>Mike Wilson</NAME> <PHONE> </PHONE></CONTACT> </PERSONAL></CONTACT_INFO> Master in web technology e security - Guido Boella 119

120 <xsl:stylesheet xmlns:xsl=" <xsl:template match="/"> <HTML> <BODY> <xsl:apply-templates /> </BODY></HTML> </xsl:template> Master in web technology e security - Guido Boella 120

121 <xsl:template match="contact_info"> <xsl:for-each select="./*"> <xsl:choose> <xsl:when test="[!nodename()='personal']"> <DIV STYLE="background-color:teal;"> Personal Contacts </DIV> </xsl:when> <xsl:otherwise> <DIV STYLE="background-color:black;"> Business Contacts</DIV> </xsl:otherwise></xsl:choose> <xsl:apply-templates /><P/></xsl:for-each> </xsl:template> PROVA DI STYLESHEETS Master in web technology e security - Guido Boella 121

122 <xsl:template match="contact"> <xsl:for-each select="."> <DIV> <xsl:if = 'family']"> <xsl:attribute name="style">font-weight:bold</xsl:attribute> </xsl:if> <xsl:value-of select="name"/> <DIV STYLE="font-size:10pt;left:.25cm;position:relative;"> <xsl:value-of select="phone"/> </DIV> </DIV> </xsl:for-each> </xsl:template> </xsl:stylesheet> Master in web technology e security - Guido Boella 122

123 NUOVO STYLESHEET <xsl:stylesheet xmlns:xsl=" <xsl:template match="/">traduzione root element<br/> Elenco contatti: <xsl:apply-templates select="*" /></xsl:template> <xsl:template match="personal"> <xsl:apply-templates select="*" /> </xsl:template> <xsl:template match="contact"><a> <xsl:attribute name="href">chiama.asp?<xsl:value-of select="./phone"> </xsl:value-of>"</xsl:attribute></a><br/> <xsl:value-of select="./name"></xsl:value-of> <xsl:value-of </xsl:template></xsl:stylesheet> Master in web technology e security - Guido Boella 123

124 Data island Due modi per includere XML dentro una pagina html <XML ID="XMLID"> <XMLDATA> <DATA>TEXT</DATA> </XMLDATA> </XML> <XML SRC=" Master in web technology e security - Guido Boella 124

125 Data island Il contenuto è accessibile (in javascript) tramite il suo id nella proprietà all del document (in DHTML) o direttamente function returnxmldata(){ return document.all("xmlid").xmldocument.nodevalue; } function returnxmldata(){ return XMLID.documentElement.text; } RESTITUISCONO LA ROOT XML Master in web technology e security - Guido Boella 125

126 Data binding Oppure il contenuto è accessibile in DHTML tramite gli attributi DATASRC e DATAFLD DATASRC fa riferimento all'id del data island preceduto da # DATAFLD si riferisce ad un elemento XML DATASRC può essere associato ad una TABLE, ma DATAFLD non può essere associato a TD direttamente: solo tramite altro tag come DIV Master in web technology e security - Guido Boella 126

127 Data binding Si può settare il contenuto di un elemento HTML direttamente usando la property innertext o InnerHTML: <div id="testo"></div> <script>test.innertext="prova"</script> <script>test.innerhtml=xmlid.documentelement.text </script> Master in web technology e security - Guido Boella 127

128 Esempio <HTML> <BODY> <XML ID="xmlMeetings"> <?xml version="1.0"?> <meetings> <meeting> <date>1/1/99</date> <time>9:00</time> <location>104</location> </meeting> <meeting> <date>2/1/99</date> <time>13:00</time> <location>34</location> </meeting> </meetings> </XML> <table datasrc="#xmlmeetings"> <tr> <td><div datafld="date"></div></td> <td><div datafld="time"></div></td> <td><div datafld="location"></div></td> </tr> </table> </BODY> </HTML> Master in web technology e security - Guido Boella 128

129 XML in HTML <XML ID="dsoData" SRC="authorsasxml.xml"></XML> <TABLE DATASRC="#dsoData"> <TR> <TD> <INPUT TYPE="TEXT" DATAFLD="au_id"></INPUT> </TD> <TD> <INPUT TYPE="TEXT" DATAFLD="au_fname"></INPUT> </TD> </TR> </TABLE> Master in web technology e security - Guido Boella 129

130 XML in HTML <XML ID="dsoData" SRC="authors.xml"></XML> <TABLE ID="tblData" BORDER="1" DATASRC="#dsoData" DATAFLD="rs:data"> LEGATO AD UN SOTTOINSIEME <TR><TD> DEL DOCUMENTO <TABLE ID="tblData" BORDER="1" DATASRC="#dsoData" DATAFLD="z:row"> <THEAD><TR><TD>au_id</TD></TR></THEAD> <TBODY> <TR> <TD><SPAN DATAFLD="au_id"></SPAN></TD> <TD><SPAN DATAFLD="au_fname"></SPAN></TD> <TD><SPAN DATAFLD="au_lname"></SPAN></TD> </TR></TBODY></TABLE> Master in web technology e security - Guido Boella 130

131 XML DOM e ASP Il modello ad oggetti DOM permette di vedere un documento XML come una struttura dati di un linguaggio di programmazione (API) Il parser XML è il programma che permette di caricare il file XML, verificare la sua corrispondenza con il DTD e creare la struttura dati manipolabile da XML Master in web technology e security - Guido Boella 131

132 La struttura dati è un albero dove la radice è la root del documento XML: / Comandi di ASP (ma anche Jscript o PHP4) permettono di accedere o modificare la struttura dati Traduzione tramite XSL in ASP sul server Creazione oggetto XML: Set source = Server.CreateObject("Microsoft.XMLDOM") source.async = false source.validateonparse= true Caricamento file source.load(sourcefile) 'non necessario: è default Master in web technology e security - Guido Boella 132

133 APPLICAZIONE STILE ON SERVER (ON CLIENT) Language=VBScript %> <% sourcefile = Request.ServerVariables("APPL_PHYSICAL_PATH") + " Chapter 08 contacts_basic.xml" stylefile = Request.ServerVariables("APPL_PHYSICAL_PATH") + " Chapter 08 stylecontacts_basic.xsl" Set source = Server.CreateObject("Microsoft.XMLDOM") source.async = false source.load(sourcefile) Set style = Server.CreateObject("Microsoft.XMLDOM") style.async = false style.load(stylefile) Response.Write(source.transformNode(style)) %> Master in web technology e security - Guido Boella 133

134 Compatibilità con vecchi browser Language="JavaScript" %><% var useragent = new String(Request.ServerVariables("HTTP_USER_AGENT")); if (useragent.indexof("msie 5") >= 0) Response.Redirect("contacts.xml"); else Response.Write(OnServer()); function OnServer() { var doc, stylesheet; doc = Server.CreateObject("microsoft.xmldom"); stylesheet = Server.CreateObject("microsoft.xmldom"); if (doc!= null && stylesheet!= null){ doc.load(server.mappath("contacts.xml")); stylesheet.load(server.mappath("stylecontacts.xsl")); Master in web technology e security - Guido Boella 134

135 <authors> <author> <name>graham Greene</name> <id> </id> </author> <author> <name>james Joyce</name> <id> </id> </author> </authors> author authors author name id name id Master in web technology e security - Guido Boella 135

136 documentelement firstchild authors lastchild childnodes firstchild author parentnode author name id name id nextsibling previoussibling Master in web technology e security - Guido Boella 136

137 authors author author name id name id documentelement.firtchild author (1) documentelement.childnodes.item(1) author (1) documentelement.firtchild.parentnode document namednodemap("name").item(1) name (1) documenteelement.firtchild.firstchild.text G. Greene documentelement.firtchild.nextsibling author (2) documentelement.lastchild.previoussibling author (1) Master in web technology e security - Guido Boella 137

138 Accesso a documento XML Creazione oggetto set objxml = Server.CreateObject("Microsoft.XMLDOM") oppure Microsoft.FreeThreadedXMLDOM in global.asa come variabile di applicazione ATTENZIONE: bisogna fare riferimento alla libreria giusta <!-- METADATA TYPE="typelib"FILE="c: Progammi file comuni system msxml.dll" --> Caricamento oggetto da file: objxml.load(strsourcefile) e.g. strsourcefile = server.mappath("asp") & " file.xml" Selezione di un nodo: set objcolor = objxml.selectsinglenode("color") restituisce un oggetto node Master in web technology e security - Guido Boella 138

139 Esempi <XML attributo1="valore1" attributo2="valore2"> <Team project="a134"> <Manager person="a1"/> <Members people="b1 c2 c9"> <Person sn="a1"> <Name> <First>John</First><Last>Doe</Last></Name> </Person> <Person sn="b1"> <Name> <First>Dudley</First><Last>Doright</Last></Name> </Person></Members></Team> </XML> Master in web technology e security - Guido Boella 139

140 VALIDAZIONE E GESTIONE ERRORI IN XML <% Language = VBScript %> <HTML> <HEAD> <TITLE> Verifire - an XML Verify utility</title> </HEAD> <BODY> <FORM ACTION="verifire.asp" METHOD="POST"> Enter File to Verify: <INPUT TYPE="TEXT" VALUE="<%=Request.Form("TestFile")%>" NAME="TestFile"> <BR>Display the file (if it is ok?) <INPUT TYPE="CHECKBOX" NAME="Show"> <BR> <INPUT TYPE="SUBMIT" VALUE="Test This"> </FORM> CONTINUA VERIFILE Master in web technology e security - Guido Boella 140

141 <% If Request.Form("TestFile") <> "" Then Dim ObjXML, objrootelement Set objxml = Server.CreateObject("Microsoft.XMLDOM") objxml.validateonparse = True objxml.load(server.mappath(request.form("testfile"))) If objxml.parseerror.errorcode <> 0 Then Response.Write ("Error: " & objxml.parseerror.reason ) Response.Write ("At Line " & objxml.parseerror.line & ", ") Else Response.Write (Request.Form("TestFile") & "is valid") If Request.Form("Show") = "on" Then Set objrootelement = objxml.documentelement Response.Write (objrootelement.xml) End If End IfEnd If %> </BODY></HTML> Master in web technology e security - Guido Boella 141

142 Percorrimento nodelist (di foglie): Selezione per nome: set objnames = bjxml.getelementsbytagname("name") ' restituisce una nodelist dim strarr(objnames.length) for itemx = 0 to objnames.lenght -1 strarr(itemx) = objnames.item(strarr).text next Master in web technology e security - Guido Boella 142

143 Conteggio nodi XML <% var nodes = 0; var doc = new ActiveXObject("microsoft.xmldom"); doc.async = false; doc.load(server.mappath("menu.xml")); if (doc.readystate == 4 && doc.parseerror.errorcode == 0) {Traverse(doc.documentElement); Response.Write("Nodes in the DOM for menu.xml: " + nodes);} else Response.Write("Error: " + doc.parseerror.reason); doc = null; function Traverse(node){ nodes += 1; if (node.attributes!= null) nodes += node.attributes.length; for (var i = 0; i < node.childnodes.length; i++) Traverse(node.childNodes(i));} %> Master in web technology e security - Guido Boella 143

144 PROPRIETA' di XMLDOM async* Indicates whether asynchronous download is permitted. Read/write. attributes Contains the list of attributes for this node. Read-only. basename* Returns the base name for the name qualified with the namespace. Read-only. childnodes Contains a node list containing the children (for nodes that can have children). Read-only. datatype* Specifies the data type for this node. Read/write. definition* Returns the definition of the node in the DTD or schema. Read-only. doctype Contains the document type node that specifies the DTD for this document. Read-only. documentelement Contains the root element of the document. Read/write. firstchild Contains the first child of this node. Read-only. Master in web technology e security - Guido Boella 144

145 implementation Contains the XMLDOMImplementation object for this document. Read-only. lastchild Returns the last child node. Read-only. namespaceuri* Returns the URI for the namespace. Read-only. nextsibling Contains the next sibling of this node in the parent's child list. Read-only. nodename Contains the qualified name of the element, attribute, or entity reference, or a fixed string for other node types. Read-only. nodetype Specifies the XML DOM node type, which determines valid values and whether the node can have child nodes. Read-only. nodetypedvalue* Contains this node's value, expressed in its defined data type. Read/write. nodetypestring* Returns the node type in string form. Read-only. nodevalue Contains the text associated with the node. Read/write. ondataavailable* Specifies the event handler for the ondataavailable event. Read/write. Master in web technology e security - Guido Boella 145

146 onreadystatechange* Specifies the event handler to be called when the readystate property changes. Read/write. ontransformnode* Specifies the event handler for the ontransformnode event. Read/write. ownerdocument Returns the root of the document that contains this node. Read-only. parentnode Contains the parent node (for nodes that can have parents). Read-only. parsed* Contains True if this node and all descendants have been parsed and instantiated; False if any nodes remain to be parsed. Readonly. parseerror* Returns an XMLDOMParseError object that contains information about the last parsing error. Read-only. prefix* Returns the namespace prefix. Read-only. preservewhitespace* Contains True if default processing preserves white space; False otherwise. Read/write. previoussibling Contains the left sibling of this node. Read-only. Master in web technology e security - Guido Boella 146

147 readystate* Indicates the current state of the XML document. Readonly. resolveexternals* Indicates whether external definitions (resolvable namespaces, DTD external subsets, and external entity references) are to be resolved at parse time, independent of validation. Read/write. specified* Indicates whether the node (usually an attribute) is explicitly specified or derived from a default value in the DTD or schema. Readonly. text* Contains the text content of the node and its subtrees. Read/write. url* Returns the canonicalized URL for the last loaded XML document. Read-only. validateonparse* Indicates whether the parser should validate this document. Read/write. xml* Contains the XML representation of the node and all its descendants. Read-only. * denotes an extension to the W3C DOM. Master in web technology e security - Guido Boella 147

148 Metodi di XMLDOM abort* Aborts an asynchronous download in progress. appendchild Appends newchild as the last child of this node. clonenode Creates a new node that is an exact clone of this node. createattribute Creates a new attribute with the specified name. createcdatasection Creates a CDATA section node that contains the supplied data. createcomment Creates a comment node that contains the supplied data. createdocumentfragment Creates an empty DocumentFragment object. createelement Creates an element node using the specified name. createentityreference Creates a new EntityReference object. createnode* Creates a node using the supplied type, name, and namespace. createprocessinginstruction Creates a processing instruction node that contains the supplied target and data. Master in web technology e security - Guido Boella 148

149 createtextnode Creates a text node that contains the supplied data. getelementsbytagname Returns a collection of elements that have the specified name. haschildnodes Returns True if this node has children. insertbefore Inserts a child node to the left of the specified node or at the end of the list. load* Loads an XML document from the specified location. loadxml* Loads an XML document using the supplied string. nodefromid* Returns the node whose ID attribute matches the supplied value. removechild Removes the specified child node from the list of children and returns it. replacechild Replaces the specified old child node with the supplied new child node in the set of children of this node, and returns the old child node. save* Saves an XML document to the specified location. Master in web technology e security - Guido Boella 149

150 selectnodes* Applies the specified pattern-matching operation to this node's context and returns the list of matching nodes. selectsinglenode* Applies the specified pattern-matching operation to this node's context and returns the first matching node. transformnode* Processes this node and its children using the supplied XSL style sheet and returns the resulting transformation. transformnodetoobject* Processes this node and its children using the supplied XSL style sheet and returns the resulting transformation in the supplied object. Eventi di XMLDOM ondataavailable* Indicates that XML document data is available. onreadystatechange* Indicates when the readystate property changes. ontransformnode* Fires before each node in the style sheet is applied to each node in the XML source. Master in web technology e security - Guido Boella 150

151 XMLDOM DOMDocument Represents the top node of the XML DOM tree. XMLDOMNode Represents a single node in the document tree; the base interface for accessing data in the XML object model. Valid node types are defined in the DOMNodeType enumeration. This interface includes support for data types, namespaces, DTDs, and XML schemas. XMLDOMNodeList Supports iteration and indexed access operations on the live collection of XMLDOMNode objects. XMLDOMNamedNodeMap Provides iteration and access by name to the collection of attributes. This interface includes support for namespaces. XMLDOMParseError Returns detailed information about the last error, including the error number, line number, character position, and a text description. Master in web technology e security - Guido Boella 151

152 XMLHttpRequest Provides client-side protocol support for communication with HTTP servers. XTLRuntime style sheets. DOM Objects XMLDOMAttribute Implements methods that can be called from XSL Represents an attribute object. XMLDOMCDATASection Quotes or escapes blocks of text so that text is not interpreted as markup language. XMLDOMCharacterData Provides text manipulation methods used by several objects. XMLDOMComment comment. Represents the content of an XML XMLDOMDocumentFragment Represents a lightweight object that is useful for tree insert operations. Master in web technology e security - Guido Boella 152

153 XMLDOMDocumentType Contains information associated with the document type declaration. XMLDOMElement XMLDOMEntity the XML document. XMLDOMEntityReference node. Represents the element object. Represents a parsed or unparsed entity in Represents an entity reference XMLDOMImplementation Provides methods that are independent of any particular instance of the document object model. XMLDOMNotation schema. Contains a notation declared in the DTD or XMLDOMProcessingInstruction Represents a processing instruction, which XML defines to keep processor-specific information in the text of the document. Master in web technology e security - Guido Boella 153

154 XMLDOMText Represents the text content of an element or attribute. The DOMNodeType enumeration lists all valid node types. Master in web technology e security - Guido Boella 154

155 SCHEMAs L'alternativa al DTD

156 XML Schema Microsoft ha (giustamente) proposto una alternativa al formalismo DTD (document type definition) per specificare documenti XML perchè un DTD non è un documento XML Uno Schema XML specifica gli elementi che possono essere presenti in un documenti e gli attributi a loro associati usando XML come sintassi Uniformità e possibile utilizzo di XSL Master in web technology e security - Guido Boella 156

157 DTD e XML <!DOCTYPE PGROUP [ <!ELEMENT PGROUP (PERSONA+, GRPDESCR) > <!ELEMENT PERSONA (#PCDATA) > <!ELEMENT GRPDESCR (#PCDATA) > ]> <?xml version="1.0"?> <PGROUP> <PERSONA>MACBETH</PERSONA> <PERSONA>BANQUO</PERSONA> <GRPDESCR>generals of the king's army.</grpdescr> </PGROUP> Master in web technology e security - Guido Boella 157

158 Schema e XML <?xml version="1.0"?> <Schema name="schema_sample_1" xmlns="urn:schemas-microsoft-com:xml-data" xmlns:dt="urn:schemas-microsoft-com:datatypes"> <ElementType name="persona" content="textonly" model="closed"/> <ElementType name="grpdescr" content="textonly" model="closed"/> <ElementType name="pgroup" content="eltonly" model="closed"> <element type="persona" minoccurs="1" maxoccurs="*"/> <element type="grpdescr" minoccurs="1" maxoccurs="1"/> </ElementType> </Schema> Master in web technology e security - Guido Boella 158

159 Content model di un elemento Definizione di elementi e attributi: <elementtype name="nometag"> <attributetype name="nomeatt"> Occorrenza di elementi e attributi come parte di altri: <elementtype name="autore"> <element type="nome"/> <attribute type="elenco"/> </elementtype> TYPE, non NAME attributetype può essere locale o globale per essere condiviso Master in web technology e security - Guido Boella 159

160 ElementType ed element Attributi ElementType: content: textonly, eltonly, mixed (default), empty (mixed: <nome>bill <tag/> Gates</nome>) order: seq (default), one (solo uno dei figli), many (duplicazioni) model (novità): open (default), closed se un content model è open, può contenere elementi e attributi appartenenti ad altri namespace senza che siano dichiarati localmente Master in web technology e security - Guido Boella 160

161 Attributi ElementType: content: textonly, eltonly, mixed (default), empty (mixed: <nome>bill <tag/> Gates</nome>) order: seq (default), one (solo uno dei figli), many (duplicazioni) model (novità): open (default), closed se un content model è open, può contenere elementi e attributi appartenenti ad altri namespace senza che siano dichiarati localmente (diventa possibile riutilizzare schemi standard senza ridefinirli, vedi SOAP e Biztalk) Master in web technology e security - Guido Boella 161

162 SCHEMA aperto <ElementType name="shipto" xmlns:e-com=" <element type="e-com:address"/> </ElementType> ELEMENTO DI ALTRO NAMESPACE <PurchaseOrder xmlns:e-com=" <shipto> <e-com:address> <e-com:name>alice Smith</e-com:name> <e-com:street>123 Maple Street</e-com:street> </e-com:address> </shipto> <orderdate> </orderdate> <shipdate> </shipdate> </PurchaseOrder> DOCUMENTO aperto Master in web technology e security - Guido Boella 162

163 Attributi di Element: Element minoccurs e maxoccurs: numero di occorrenze possibili dell'elemento nel content model 0,1,..., * (infinite) Raggruppamento di Elementi (con proprietà "order", "minoccurs", "maxoccurs"): <elementtype name="autore"> <element type="nome"/> <group order="one"> <element type="address"/> <element type=" "/> </group> </elementtype> SOLO UNO DEI DUE ELEMENTI Master in web technology e security - Guido Boella 163

164 Attributi Gli attributi non possono contenere sottoelementi, non hanno ordinamento, nè si possono porre alternative, occorrono una sola volta Opzionalità od obbligatorietà: required = yes o no Range di valori e default: <AttributeType="number" default = "no" dt:values= "yes no" required=yes> NAMESPACE dei tipi Master in web technology e security - Guido Boella 164

165 Elementi e attributi si possono tipare namespace dei tipi: xmlns:dt="urn:schemas-microsoft-com:datatypes"> <Schema name="myschema" xmlns="urn:schemas-microsoft-com:xml-data" xmlns:dt="urn:schemas-microsoft-com:datatypes"> <ElementType name="pages" dt:type="int"/> <AttributeType="number" required=yes> <datatype dt:type= "int"/> </ElementType> </Schema> NAMESPACE dt Master in web technology e security - Guido Boella 165

166 Estensione per vincoli semantici <ElementType name="pages" xmlns:myext="urn:myschemaextensions"> <datatype dt:type="int" /> <myext:min>50</myext:min> <myext:max>100</myext:max> </ElementType> RESTRIZIONI NON SINTATTICHE, CIOE' NON VERIFICATE DA XML MA DA APPLICAZIONE CHE USA XML Master in web technology e security - Guido Boella 166

167 <Schema xmlns="urn:schemas-microsoft-com:xml-data" xmlns:dt="urn:schemas-microsoft-com:datatypes"> <ElementType name="au_id" content="textonly"/> <ElementType name="au_lname" content="textonly"/> <ElementType name="au_fname" content="textonly"/> <ElementType name="phone" content="textonly"/> <ElementType name="author" content="eltonly"> <element type="au_id"/> <element type="au_lname"/> <element type="au_fname"/> <element type="phone"/> </ElementType> <ElementType name="authors" content="eltonly"> <element type="author" maxoccurs="*"/> </ElementType> </Schema> Master in web technology e security - Guido Boella 167

168 <Authors> <Author> <au_id> </au_id> <au_lname>white</au_lname> <au_fname>johnson</au_fname> <phone> </phone> <address>10932 Bigge Rd.</address> </Author> <Author> <au_id> </au_id> <au_lname>green</au_lname> <au_fname>marjorie</au_fname> <phone> </phone> <address>309 63rd St. #411</address> </Author></Authors> Master in web technology e security - Guido Boella 168

169 <xml xmlns:s="uuid:bdc6e3f0-6da3-11d1-a2a3-00aa00c14882" xmlns:dt="uuid:c2f b3-11d1-a29f-00aa00c14882" xmlns:rs="urn:schemas-microsoft-com:rowset" xmlns:z="#rowsetschema"> <s:schema id="rowsetschema"> <s:elementtype name="row" content="eltonly"> <s:attributetype name="au_id" rs:number="1" rs:writeunknown="true"> <s:datatype dt:type="string" dt:maxlength="11" rs:maybenull="false" /> </s:attributetype> <s:attributetype name="au_lname" rs:number="2" rs:writeunknown="true"> <s:datatype dt:type="string" dt:maxlength="40" rs:maybenull="false" /> </s:attributetype> <s:attributetype name="au_fname" rs:number="3" rs:writeunknown="true"> <s:datatype dt:type="string" dt:maxlength="20" rs:maybenull="false" /> </s:attributetype>... <s:extends type="rs:rowbase" /> </s:elementtype> </s:schema> Master in web technology e security - Guido Boella 169

170 XML e XSL <rs:data> <z:row au_id=" " au_lname="white" au_fname="johnson" phone=" " address="10932 Bigge Rd." city="menlo Park" state="ca" zip="94025" contract="true" /> <z:row au_id=" " au_lname="green" au_fname="marjorie" phone=" " address="309 63rd St. #411" city="oakland" state="ca" zip="94618" contract="true" /> <z:row au_id=" " au_lname="carson" au_fname="cheryl" phone=" " address="589 Darwin Ln." city="berkeley" state="ca" zip="94705" contract="true" /> <z:row au_id=" " au_lname="o'leary" au_fname="michael" phone=" " address="22 Cleveland Av. #14" city="san Jose" state="ca" zip="95128" contract="true" /> <z:row au_id=" " au_lname="straight" au_fname="dean" phone=" " address="5420 College Av." city="oakland" state="ca" zip="94609" contract="true" /> </rs:data> </xml> Master in web technology e security - Guido Boella 170

171 Salvare recordset in XML <% strsql = request.querystring("sql") if NOT strsql="" then strfile="c: asp file2.xml" Set rsauthors = Server.CreateObject("ADODB.Recordset") Set objfso = CreateObject("Scripting.FileSystemObject") if objfso.fileexists(strfile) then objfso.deletefile strfile end if set objfso = nothing Master in web technology e security - Guido Boella 171

172 With rsauthors.open strsql, "Driver={Microsoft Access Driver (*.mdb)}; DBQ=c: asp Pro ASP 3.0 pubs.mdb" If (.state = 1) then.save strfile, 1 'adpersistent.close() end if End with Set objfso = CreateObject("Scripting.FileSystemObject") set objfile = objfso.getfile(strfile) set objstream = objfile.openastextstream() response.write "<textarea>"& objstream.readall()&"</textarea>" objfile.close Master in web technology e security - Guido Boella 172

173 XML da DB <?xml version="1.0"?> <?xml-stylesheet type="text/xsl" href="contatti1.xsl"?> <rs:data xmlns:s="uuid:bdc6e3f0-6da3-11d1-a2a3-00aa00c14882" xmlns:dt="uuid:c2f b3-11d1-a29f-00aa00c14882" xmlns:rs="urn:schemas-microsoft-com:rowset" xmlns:z="#rowsetschema"> <z:row au_id=" " au_lname="white" au_fname="johnson" phone=" " address="10932 Bigge Rd." city="menlo Park" state="ca" zip="94025" contract="true" /> <z:row au_id=" " au_lname="green" au_fname="marjorie" phone=" " address="309 63rd St. #411" city="oakland" state="ca" zip="94618" contract="true" /> <z:row au_id=" " au_lname="carson" au_fname="cheryl" phone=" " address="589 Darwin Ln." city="berkeley" state="ca" zip="94705" contract="true" /> </rs:data> Master in web technology e security - Guido Boella 173

174 XSL per XML e DB <xsl:stylesheet xmlns:xsl=" <xsl:template match="/">traduzione root element<br/> Elenco contatti: <xsl:apply-templates select="*" /></xsl:template> <xsl:template match="rs:data"><xsl:apply-templates select="*" /></xsl:template> <xsl:template match="z:row"><a> <xsl:attribute name="href">chiama.asp?<xsl:value-of select="./@au_id"> </xsl:value-of>"</xsl:attribute></a><br/> <xsl:value-of select="./@au_lname"></xsl:value-of> <xsl:value-of select="./@au_fname"></xsl:value-of> </xsl:template></xsl:stylesheet> Master in web technology e security - Guido Boella 174

175 Recordset data island <INPUT TYPE=TEXT DATASRC=#xmlPeople DATAFLD=NAME> <INPUT DATASRC=#xmlPeople DATAFLD="ADDRESS"> <INPUT DATASRC=#xmlPeople DATAFLD="TEL"> <INPUT ID="first" TYPE=button VALUE="<<" onclick="xmlpeople.recordset.movefirst()"> <INPUT ID="prev" TYPE=button VALUE="<" onclick= "if (xmlpeople.recordset.absoluteposition > 1) xmlpeople.recordset.moveprevious()"> <INPUT ID="next" TYPE=button VALUE=">" onclick= "if (xmlpeople.recordset.absoluteposition < xmlpeople.recordset.recordcount) xmlpeople.recordset.movenext()"> <INPUT ID="last" TYPE=button VALUE=">>" onclick="xmlpeople.recordset.movelast()"> <INPUT ID="add" TYPE=BUTTON VALUE="Add Person" onclick="xmlpeople.recordset.addnew()"> Master in web technology e security - Guido Boella 175

176 Asynchronous loading docparser.ondataavailable = DataAvailHandler docurl = FileURL.value; docparser.load(docurl);... function DataAvailHandler() { // Get the number of attributes of the root var nodecount = docparser.childnodes.length; var docroot = docparser.documentelement; // Count the first level nodes in the tree if (docroot!= null) { nodecount += docroot.childnodes.length; } document.all("status").innerhtml = nodecount + " XML nodes loaded so far";} Master in web technology e security - Guido Boella 176

177 XMLHTTP Comunicazione client-server

178 Comunicare XML Se una pagina sul client ha bisogno non solo di ricevere ma anche di inviare informazioni in XML si può usare protocollo XMLHTTP di Microsoft Non è necessario usare GET e POST, né ricaricare l'intera pagina sul client Possibilità di gestione sincrona o asincrona della risposta Master in web technology e security - Guido Boella 178

179 Post Client Page A XML file A POST HTTP RESPONSE Server XML file A Master in web technology e security - Guido Boella 179

180 Post Client Page B Server XML file B Master in web technology e security - Guido Boella 180

181 XMLHTTP Client Page A XML file A XMLHTTP HTTP RESPONSE Server XML file A Master in web technology e security - Guido Boella 181

182 XMLHTTP Client Page A Server XML file B Master in web technology e security - Guido Boella 182

183 XMLHttpRequest Properties, Properties Methods, and Events onreadystatechange* Specifies the event handler to be called when the readystate property changes. Read/write. readystate Represents the state of the request. Read-only. responsebody Represents the response entity body as an array of unsigned bytes. Read-only. responsestream Represents the response entity body as an IStream. Read-only. responsetext Represents the response entity body as a string. Read-only. responsexml Represents the response entity body as parsed by the MSXML parser. Read-only. Master in web technology e security - Guido Boella 183

184 status Represents the HTTP status code returned by a request. Read-only. statustext Read-only. Represents the HTTP response line status. * denotes an extension to the W3C DOM. Methods abort Cancels the current HTTP request. getallresponseheaders HTTP headers. Retrieves the values of all the getresponseheader Retrieves the value of an HTTP header from the response body. open Initializes a Microsoft.XMLHTTP request, and specifies the method, URL, and authentication information for the request. Master in web technology e security - Guido Boella 184

185 send Sends an HTTP request to the server and receives a response. setrequestheader Specifies the name of an HTTP header. Master in web technology e security - Guido Boella 185

186 XMLHTTP Request <script language="javascript"> function sendit(){ var omsg = new ActiveXObject("Microsoft.XMLHTTP") omsg.open("post", "<%=surl%>", false) omsg.setrequestheader("methodname", "enterorder") omsg.setrequestheader("messagetype", "Call") omsg.setrequestheader("content-type", "text/xml-soap") omsg.send(oorder.xmldocument) alert(omsg.responsetext)</script> <xml id="oorder"><root> <description>personal Stereo</description> <price>76.34</price></root></xml> Master in web technology e security - Guido Boella 186

187 XMLHTTP Response <% Response.ContentType = "text/xml" Response.Expires = 0 Dim fso, logfile, xmldoc, strresult Set xmldoc = Server.CreateObject("Microsoft.XMLDOM") xmldoc.async=false xmldoc.load(request) if xmldoc.parseerror.errorcode <> 0 then end if strprocdate = server.htmlencode(cstr(formatdatetime(now, vblongdate))) strresult = "<orderconfirmation>your order " response.write strresult %> Master in web technology e security - Guido Boella 187

188 XMLHTTP request II <script> function postxml() { var xmlhttp = new ActiveXObject("Microsoft.XMLHTTP"); xmlhttp.open("post", " false); alert(xml.value); xmlhttp.send(xml.value); alert("round tripped XML document: n n" + xmlhttp.responsexml.xml); }</script> <textarea id=xml rows=12 cols=60> <XML>This is the XML document that will be round tripped...</xml></textarea> Master in web technology e security - Guido Boella 188

189 XMLHTTP Response II <script language=javascript runat=server> Response.Expires = -1000; var doc = Server.CreateObject("Microsoft.XMLDOM"); doc.load(request); Response.ContentType = "text/xml"; doc.save(response); </script> Master in web technology e security - Guido Boella 189