IIS 3.0 Active Server Pages

Microsoft Internet Information Server (IIS) 3.0 provides only minor improvements to IIS 2.0's base Internet serverfunctionality, but IIS 3.0 offers several important new features. The most significant new feature is its richserver-side code scripting that uses Active Server Pages (ASP). With ASP, you can build high-powered, dynamic Web serverapplications from a development environment that combines HTML, scripts, and ActiveX components on the server. (For abrief description of IIS 3.0's other key features, see the sidebar, "What's New in IIS 3.0.") Let's take alook at what ASP is and the role it plays in IIS 3.0.

Active Server Pages

ASP (formerly code-named Denali) integrates Web scripting and components in IIS 3.0, as Figure 1, illustrates. Justas Internet Explorer (IE) 3.0 hosts Visual Basic Scripting Edition (VBScript) and JScript on the client, ASP hosts thosescripting languages on the server. The name Active Server Pages comes from the files: For the most part, thepages are HTML files with embedded scripting code that executes on the server and can reference ActiveX ServerComponents. An ASP file can contain both server-side scripting and, embedded in standard HTML, client-side script code.When a client requests an ASP file, the server loads the file into memory and passes off any server-side scripting codeto the corresponding scripting engine. Everything else in the file (including any client-side script code) ends up inthe HTTP response that returns to the client.

Running script code on the server provides several important advantages. First, the code is secure: Each page canuse the access control lists (ACLs) in Windows NT's security system. Also, because the code executes on the server, theWeb client never sees the code--only the results. This feature prevents users from looking at or otherwise appropriatingyour code. Furthermore, because you can tightly administer servers, you can keep unauthorized code off the server. Thesecond major advantage is that the server can better manage expensive resources (e.g., database connections) to supporta higher volume of client requests. ASP supports apartment model threading, which offers improved scalability andperformance on the server. (In apartment model threading, each thread gets a copy of the program and global data, andruns in a protected area or "apartment.") Third, code on the server runs closer to the data and back-endsystems. This arrangement eliminates a lot of low-bandwidth network traffic. Finally, because the code executes on theserver, you can develop sophisticated Web applications that users can run from any browser.

Probably the only advantage to running code on the client is that the client can validate individual fields withoutan expensive round-trip to the server. Of course, because users with browsers can change individual pages rendered ontheir machine, you still must validate all data on the server.

The ASP architecture is a little more complicated than I've described so far. ASP can maintain state informationacross multiple calls from the same user (called a session in ASP). You can also build a long-lived serverapplication that handles many different clients (called an application in ASP). IIS 3.0 stores each ASPapplication in a separate virtual directory; a request for any file in the directory starts the application. When aclient requests new pages, NT loads them into memory, compiles (and can execute) the code, and returns the output (ifany) in the HTTP response. NT then watches the disk for any pages that have changed since loading. If NT finds anupdated file, it recompiles the code and replaces the code that was already in memory. The global.asa file definesapplication startup and shutdown, and initializes global variables.

ASP Intrinsic Objects
To complement and extend the scripting code that ASP files contain, the ASP architecture handles the creation andmanagement of server and application-building objects. Similar to the way Microsoft makes the IE object model availableto VBScript hosted on the client, Microsoft gives developers a handful of useful intrinsic server objects to work with.Intrinsic server objects are always available--you do not need to load a corresponding object library. ASP includes thefollowing five intrinsic server objects.

Application. The Application object handles globally scoped variables, which affect allusers of a given application. The Application object defines a set of application initialization and terminationsubroutines and provides a method for temporarily locking an application for administrative purposes or to controlaccess to a global variable.

Session. Session objects store information about user sessions. They control session lifetimes,maintain session-scoped variables, and provide initialization and termination subroutines each time a session is createdor destroyed. Sessions have unique SessionIDs, which ASP encrypts and IIS transmits to and from the client via cookies.

Request. The Request object is a meta-object for five different collections: ClientCertificate,Cookies, Form, QueryString, ServerVariables. Request collections generally store information parsed from the HTTPrequest.

Response. The Response object is the Request object's complement: It contains the information usedin the HTTP response, including the body of the response, the Cookies collection, expiration and status data, andclient-side redirection.

Server. The Server object provides a limited set of utility functions. These functions includeCreateObject, HTMLEncode, MapPath, URLEncode.

Because Microsoft built the ASP architecture on component object model (COM), you can use almost any COM-basedserver objects. You can develop server objects in-house or purchase them from third-party vendors.

ASP Base Components
There's really no limit to what you can do with ActiveX Server Components, and you can include existing componentsdeveloped in languages such as C++, VB, and Java into your Web applications on IIS servers. Fortunately, Microsoftdecided to include a base set of application component objects with IIS 3.0 that incorporate the most commonly requestedWeb server functions.

ActiveX Data Object. Microsoft developed a new data access solution for ASP: ActiveX Data Object(ADO). In early betas of ASP, ADO closely mirrored VB's Remote Data Objects (RDO). By the time Microsoft released ASP,the company had rearchitected ADO to be the object interface to the new OLE DB data access layer. OLE DB is Microsoft'snew Object Linking and Embedding (OLE) access layer for enterprise databases. ADO lets an ASP Web page connect to anOpen Database Connectivity (ODBC) database or an OLE DB data source and work with its data. One potentially importantfeature of ADO is that third- party developers can use a type library to create upwardly compatible implementations ofADO that expose additional back-end database features. For more information about ADO, checkhttp://www.microsoft.com/ado.

Advertisement Rotator. Many Web site designs incorporate banner areas that display constantlychanging content. The Advertisement Rotator component--originally created for The Microsoft Network (MSN)News--automates image presentation. It's ideal for displaying constantly changing advertising, news, or entertainmentimages. Individual ASP files use this object to access a list of images: The site administrator creates the list (a textfile) and includes image information such as image size, which image files to use, and the percentage of time to displayeach file. Another management file maintained on the server records the number of times users click on the returnedimages.

Browser Capabilities. Another handy component, the Browser Capabilities component, identifies thebrowser type entered in the HTTP header and creates an object with read-only properties for the browser's capabilities(e.g., forms or scripting) that affect your server-side code. The component examines a table-based feature list of knownbrowsers to get the object's properties. The feature list is a simple text file that you can easily maintain as newbrowsers are introduced into the marketplace.

Content Linking. Content Linking, another component originally created for MSN News, enablesnavigation among multiple pages in a long composition, such as online documentation or a lengthy news story. A simpletext file stores a table of filename pairs: Navigating forward or backward retrieves the following or previous page,accordingly. The advantage of this technique is that someone other than a developer can maintain the composition. Whenyou add, delete, or reorder pages, this component automatically handles the content linking via the text file, withouthaving to update links in Web pages or scripts.

File Access. For security reasons, VBScript has no native file I/O. Two ASP components,FileSystemObject and TextStream, provide basic text-based file operations. These components let ASP create, read, andwrite Unicode and ASCII files.

What Else Is Needed?
Although these base components are a nice start, Microsoft needs to add more ASP components to IIS. The most glaringomission is the lack of any email support: Microsoft included a Simple Mail Transfer Protocol (SMTP) component in theoriginal specification for the product, but the company pulled the component before the product reached widespread beta.

Microsoft has two other server-side products that offer mail support: the Active Messaging mail server in Exchange5.0 and an Internet Mail Server (IMS) included with Internet Personalization System (IPS) in Microsoft CommercialInternet System (MCIS, formerly code-named Normandy). Microsoft aims these two products at very different markets:Exchange, for corporations, and MCIS, for large Internet service providers. Neither mail support product is appropriatefor the many small Web servers that will run ASP.

Fortunately, developing a server-side mail solution is not very difficult. However, rather than developingsomething from scratch, many ASP sites now use an inexpensive ($55) third-party component, ASPMail (http://www.genusa.com/asp/aspcomp.stm#aspmail), developed by Stephen Genusa. This utility lets you send SMTP mail directly from a Web pageand includes support for multiple file attachments as well as MIME and UUEncoding.

Application Design
One disadvantage of ASP is that it runs in a black box. Services run in separate, noninteractive window stations.IIS runs as a service under NT, and ASP is an Internet Server API (ISAPI) DLL in that server process. However, like anywell-architected service, ASP makes good use of NT's performance counters. The list shown in Figure 2 contains all theNT performance counters that ASP tracks.

ASP simplifies building full-featured Web applications that run under IIS 3.0. Because script code in ASP isfamiliar

VBScript or JScript, corporate VB developers can easily leverage their skills to build new, dynamic Webapplications. Although ASP comes with a set of starter objects, you can easily extend ASP with COM components written inany language.