Overview of Security in Oracle Business Intelligence

Overview of Security in Oracle Business IntelligenceOracle Business Intelligence 11g is tightly integrated with the Oracle Fusion Middleware Security architecture and delegates core security functionality to components of that architecture. Specifically, any Oracle Business Intelligence installation makes use of the following types of security providers:

•An authentication provider that knows how to access information about the users and groups accessible to Oracle Business Intelligence and is responsible for authenticating users.

•A policy store provider that provides access to Application Roles and Application Policies, which forms a core part of the security policy and determines what users can and cannot see and do in Oracle Business Intelligence.

•A credential store provider that is responsible for storing and providing access to credentials required by Oracle Business Intelligence.

By default, an Oracle Business Intelligence installation is configured with an authentication provider that uses the Oracle WebLogic Server embedded LDAP server for user and group information. The Oracle Business Intelligence default policy store provider and credential store provider store Credentials, Application Roles and Application Policies in files in the domain.

After installing Oracle Business Intelligence you can reconfigure the domain to use alternative security providers, if desired. For example, you might want to reconfigure your installation to use an Oracle Internet Directory, Oracle Virtual Directory, Microsoft Active Directory, or another LDAP server for authentication. You might also decide to reconfigure your installation to use Oracle Internet Directory, rather than files, to store Credentials, Application Roles, and Application Policies.

1.3 About Authentication
Each Oracle Business Intelligence 11g installation has an associated Oracle WebLogic Server domain. Oracle Business Intelligence delegates user authentication to the first authentication provider configured for that domain.

The default authentication provider accesses user and group information stored in the LDAP server embedded in the Oracle Business Intelligence's Oracle WebLogic Server domain. The Oracle WebLogic Server Administration Console can be used to create and manage users and groups in the embedded LDAP server.

You might choose to configure an authentication provider for an alternative directory. In this case, Oracle WebLogic Server Administration Console enables you to view the users and groups in your directory. However, you need to continue to use the appropriate tools to make any modifications to the directory. For example, if you reconfigure Oracle Business Intelligence to use OID, you can view users and groups in Oracle WebLogic Server Administration Console but you must manage them in OID Console.

For more information about managing users and groups in the embedded LDAP server, see Chapter 2, "Managing Security Using the Default Security Configuration".

For more information about Oracle WebLogic Server domains and authentication providers, see Oracle Fusion Middleware Securing Oracle WebLogic Server.

1.4 About Authorization
After a user has been authenticated, the next critical aspect of security is ensuring that the user can do and see what they are authorized to do and see. Authorization for Oracle Business Intelligence release 11g is controlled by a security policy defined in terms of applications roles.

1.4.1 About Application Roles
Instead of defining the security policy in terms of users in groups in a directory server, Oracle Business Intelligence uses a role-based access control model. Security is defined in terms of Application Roles that are mapped to directory server groups and users. For example, the Application Roles BIAdministrator, BIConsumer, and BIAuthor are installed out-of-the-box.

Application Roles represent a functional role that a User has, which gives that User the privileges required to perform that role. For example, having the Sales Analyst Application Role might grant a User access to view, edit and create reports on a company's sales pipeline.

This indirection between Application Roles and directory server users and groups allows the administrator for Oracle Business Intelligence to define the Application Roles and policies without creating additional users or groups in the corporate LDAP server. Instead, the administrator defines Application Roles that meet the authorization requirements and maps those roles to pre-existing users and groups in the corporate LDAP server.

In addition, the indirection afforded by Application Roles allows the artifacts of a business intelligence system to be easily moved between development, test and production environments. No change to the security policy is needed and all that is required is to map the Application Roles to the users and groups available in the target environment.

The Figure 1-1 shows an example using the default set of Users, Groups, Application Roles.

Figure 1-1 Example Users, Groups, Application Roles, and Permissions



Figure 1-1 shows the following:

•The Group named 'BIConsumers' contains User1, User2, and User3. Users in the Group 'BIConsumers' are assigned the Application Role 'BIConsumer', which enables the users to view reports.

•The Group named 'BIAuthors' contains User4 and User5. Users in the Group 'BIAuthors' are assigned the Application Role 'BIAuthors', which enables the users to create reports.

•The Group named 'BIAdministrators' contains User6 and User7. Users in the Group 'BIAdministrators' are assigned the Application Role 'BIAdministrator', which enables the users to manage responsibilities.

1.4.2 About the Security Policy
In Oracle Business Intelligence release 11g, the security policy definition is split across the following components:

•Presentation Catalog – This defines the catalog objects and Oracle BI Presentation Services functionality that the Users with specific Application Roles can access. Access to functionality is defined in the Managing Privileges page in terms of Presentation Catalog privileges and access to presentation catalog objects is defined in the Permission dialog.

•Repository – This defines which Application Roles and users have access to which items of metadata within the repository. The Oracle BI Administration Tool is used to define this security policy.

•Policy Store – This defines which Oracle BI Server, BI Publisher, and Real Time Decisions functionality can be accessed by given users or users with given Application Roles. In the default Oracle Business Intelligence configuration, the policy store is managed using Oracle Enterprise Manager Fusion Middleware Control. For more information about the policy store, see Oracle Fusion Middleware Security Guide.

OOPS concepts in C#

In this article we will discuss key concepts of object orientation with their practical implementation in C#. We will discuss here basics of OOPS including Interfaces, Access Modifiers, inheritance, polymorphism etc.
Key Concepts of Object Orientation
• Abstraction
• Encapsulation
• Polymorphism
• Inheritance.
Abstraction is the ability to generalize an object as a data type that has a specific set of characteristics and is able to perform a set of actions.
Object-oriented languages provide abstraction via classes. Classes define the properties and methods of an object type.
Examples:
• You can create an abstraction of a dog with characteristics, such as color, height, and weight, and actions such as run and bite. The characteristics are called properties, and the actions are called methods.
• A Recordset object is an abstract representation of a set of data.
Classes are blueprints for Object.
Objects are instance of classes.
C# Example of Class:

public class Draw
{
// Class code.
}
Object References

When we work with an object we are using a reference to that object. On the other hand, when we are working with simple data types such as Integer, we are working with the actual value rather than a reference.
When we create a new object using the New keyword, we store a reference to that object in a variable. For instance:
Draw MyDraw = new Draw;
This code creates a new instance of Draw. We gain access to this new object via the MyDraw variable. This variable holds a reference to the object.
Now we have a second variable, which also has a reference to that same object. We can use either variable interchangeably, since they both reference the exact same object. The thing we need to remember is that the variable we have is not the object itself but, rather, is just a reference or pointer to the object itself.
Early binding means that our code directly interacts with the object, by directly calling its methods. Since the compiler knows the object's data type ahead of time, it can directly compile code to invoke the methods on the object. Early binding also allows the IDE to use IntelliSense to aid our development efforts; it allows the compiler to ensure that we are referencing methods that do exist and that we are providing the proper parameter values.
Late binding means that our code interacts with an object dynamically at run-time. This provides a great deal of flexibility since our code literally doesn't care what type of object it is interacting with as long as the object supports the methods we want to call. Because the type of the object isn't known by the IDE or compiler, neither IntelliSense nor compile-time syntax checking is possible but we get unprecedented flexibility in exchange.
If we enable strict type checking by using Option Strict On at the top of our code modules, then the IDE and compiler will enforce early binding behavior. By default, Option Strict is turned off and so we have easy access to the use of late binding within our code.
Access Modifiers

Access Modifiers are keywords used to specify the declared accessibility of a member of a type.
Public is visible to everyone. A public member can be accessed using an instance of a class, by a class's internal code, and by any descendants of a class.


Private is hidden and usable only by the class itself. No code using a class instance can access a private member directly and neither can a descendant class.



Protected members are similar to private ones in that they are accessible only by the containing class. However, protected members also may be used by a descendant class. So members that are likely to be needed by a descendant class should be marked protected.



Internal/Friend is public to the entire application but private to any outside applications. Internal is useful when you want to allow a class to be used by other applications but reserve special functionality for the application that contains the class. Internal is used by C# and Friend by VB .NET.



Protected Internal may be accessed only by a descendant class that's contained in the same application as its base class. You use protected internal in situations where you want to deny access to parts of a class functionality to any descendant classes found in other applications.


Composition of an OBJECT
We use an interface to get access to an object's data and behavior. The object's data and behaviors are contained within the object, so a client application can treat the object like a black box accessible only through its interface. This is a key object-oriented concept called Encapsulation. The idea is that any programs that make use of this object won't have direct access to the behaviors or data-but rather those programs must make use of our object's interface.
There are three main parts of Object:
1. Interface
2. Implementation or Behavior
3. Member or Instance variables
Interface
The interface is defined as a set of methods (Sub and Function routines), properties (Property routines), events, and fields (variables or attributes) that are declared Public in scope.
Implementation or Behavior
The code inside of a method is called the implementation. Sometimes it is also called behavior since it is this code that actually makes the object do useful work.
Client applications can use our object even if we change the implementation-as long as we don't change the interface. As long as our method name and its parameter list and return data type remain unchanged, we can change the implementation all we want.
So Method Signature depends on:
• Method name
• Data types of parameters
• Either Parameter is passed ByVal or ByRef.
• Return type of method.
It is important to keep in mind that encapsulation is a syntactic tool-it allows our code to continue to run without change. However, it is not semantic-meaning that, just because our code continues to run, doesn't mean it continues to do what we actually wanted it to do.
Member or Instance Variables
The third key part of an object is its data, or state. Every instance of a class is absolutely identical in terms of its interface and its implementation-the only thing that can vary at all is the data contained within that particular object.
Member variables are those declared so that they are available to all code within our class. Typically member variables are Private in scope-available only to the code in our class itself. They are also sometimes referred to as instance variables or as attributes. The .NET Framework also refers to them as fields.
We shouldn't confuse instance variables with properties. A Property is a type of method that is geared around retrieving and setting values, while an instance variable is a variable within the class that may hold the value exposed by a Property.
Interface looks like a class, but has no implementation.
The only thing it contains is definitions of events, indexers, methods and/or properties. The reason interfaces only provide definitions is because they are inherited by classes and structs, which must provide an implementation for each interface member defined. So, what are interfaces good for if they don't implement functionality? They're great for putting together plug-n-play like architectures where components can be interchanged at will. Since all interchangeable components implement the same interface, they can be used without any extra programming. The interface forces each component to expose specific public members that will be used in a certain way.
Because interfaces must be defined by inheriting classes and structs, they define a contract. For instance, if class foo inherits from the IDisposable interface, it is making a statement that it guarantees it has the Dispose() method, which is the only member of the IDisposable interface. Any code that wishes to use class foo may check to see if class foo inherits IDisposable. When the answer is true, then the code knows that it can call foo.Dispose().
Defining an Interface: MyInterface.c

interface IMyInterface
{
void MethodToImplement();
}

Above listing shows defines an interface named IMyInterface. A common naming convention is to prefix all interface names with a capital "I", but this is not mandatory. This interface has a single method named MethodToImplement(). This could have been any type of method declaration with different parameters and return types. Notice that this method does not have an implementation (instructions between curly braces- {}), but instead ends with a semi-colon, ";". This is because the interface only specifies the signature of methods that an inheriting class or struct must implement.
All the methods of Interface are public by default and no access modifiers (like private, public) are allowed with any method of Interface.
Using an Interface: InterfaceImplementer.cs

class InterfaceImplementer : IMyInterface
{
public void MethodToImplement()
{
Console.WriteLine("MethodToImplement() called.");
}
}

The Interface Implementer class in above listing implements the IMyInterface interface. Indicating that a class inherits an interface is the same as inheriting a class. In this case, the following syntax is used:

class InterfaceImplementer : IMyInterface
Note that this class inherits the IMyInterface interface; it must implement its all members. While implementing interface methods all those needs to be declared public only. It does this by implementing the MethodToImplement() method. Notice that this method implementation has the exact same signature, parameters and method name, as defined in the IMyInterface interface. Any difference will cause a compiler error. Interfaces may also inherit other interfaces. Following listing shows how inherited interfaces are implemented.
Interface Inheritance: InterfaceInheritance.cs

using System;
interface IParentInterface
{
void ParentInterfaceMethod();
}
interface IMyInterface : IParentInterface
{
void MethodToImplement();
}
class InterfaceImplementer : IMyInterface
{
public void MethodToImplement()
{
Console.WriteLine("MethodToImplement() called.");
}
public void ParentInterfaceMethod()
{
Console.WriteLine("ParentInterfaceMethod() called.");
}
}

The code in above listing contains two interfaces: IMyInterface and the interface it inherits, IParentInterface. When one interface inherits another, any implementing class or struct must implement every interface member in the entire inheritance chain. Since the InterfaceImplementer class in above listing inherits from IMyInterface, it also inherits IParentInterface. Therefore, the InterfaceImplementer class must implement the MethodToImplement() method specified in the IMyInterface interface and the ParentInterfaceMethod() method specified in the IParentInterface interface.
In summary, you can implement an interface and use it in a class. Interfaces may also be inherited by other interface. Any class or struct that inherits an interface must also implement all members in the entire interface inheritance chain.
Inheritance is the idea that one class, called a subclass, can be based on another class, called a base class. Inheritance provides a mechanism for creating hierarchies of objects.
Inheritance is the ability to apply another class's interface and code to your own class.
Normal base classes may be instantiated themselves, or inherited. Derived classes can inherit base class members marked with protected or greater access. The derived class is specialized to provide more functionality, in addition to what its base class provides. Inheriting base class members in derived class is not mandatory.

Access Keywords

base -> Access the members of the base class.
this -> Refer to the current object for which a method is called.
The base keyword is used to access members of the base class from within a derived class:
Call a method on the base class that has been overridden by another method. Specify which base-class constructor should be called when creating instances of the derived class. A base class access is permitted only in a constructor, an instance method, or an instance property accessor.
In following example, both the base class, Person, and the derived class, Employee, have a method named Getinfo. By using the base keyword, it is possible to call the Getinfo method on the base class, from within the derived class.
// Accessing base class members

using System;
public class Person
{
protected string ssn = "444-55-6666";
protected string name = "John L. Malgraine";
public virtual void GetInfo()
{
Console.WriteLine("Name: {0}", name);
Console.WriteLine("SSN: {0}", ssn);
}
}
class Employee: Person
{
public string id = "ABC567EFG";
public override void GetInfo()
{
// Calling the base class GetInfo method:
base.GetInfo();
Console.WriteLine("Employee ID: {0}", id);
}
}
class TestClass
{
public static void Main()
{
Employee E = new Employee();
E.GetInfo();
}
}

Output
Name: John L. Malgraine
SSN: 444-55-6666
Employee ID: ABC567EFG
Base class constructors can be called from derived classes. To call a base class constructor, use the base() constructor reference. This is desirable when it's necessary to initialize a base class appropriately.
Here's an example that shows the derived class constructor with an address parameter:

abstract public class Contact
{
private string address;
public Contact(string b_address)
{
this.address = b_address;
}
}
public class Customer : Contact
{
public Customer(string c_address) : base(C_address)
{
}
}

In this code, the Customer class does not have an address, so it passes the parameter to its base class constructor by adding a colon and the base keyword with the parameter to its declaration. This calls the Contact constructor with the address parameter, where the address field in Contact is initialized.
One more example which shows how base-class constructor is called when creating instances of a derived class:

using System;
public class MyBase
{
int num;
public MyBase()
{
Console.WriteLine("In MyBase()");
}
public MyBase(int i)
{
num = i;
Console.WriteLine("in MyBase(int i)");
}
public int GetNum()
{
return num;
}
}
public class MyDerived : MyBase
{
static int i = 32;
// This constructor will call MyBase.MyBase()
public MyDerived(int ii) : base()
{
}
// This constructor will call MyBase.MyBase(int i)
public MyDerived() : base(i)
{
}
public static void Main()
{
MyDerived md = new MyDerived(); // calls public MyDerived() : base(i) and
// passes i=32 in base class
MyDerived md1 = new MyDerived(1); // call public MyDerived() : base(i)
}
}

Output
in MyBase(int i)
in MyBase()
The following example will not compile. It illustrates the effects of not including a default constructor in a class definition:

abstract public class Contact
{
private string address;
public Contact(string address)
{
this.address = address;
}
}
public class Customer : Contact
{
public Customer(string address)
{
}
}

In this example, the Customer constructor does not call the base class constructor. This is obviously a bug, since the address field will never be initialized.
When a class has no explicit constructor, the system assigns a default constructor. The default constructor automatically calls a default or parameterless base constructor. Here's an example of automatic default constructor generation that would occur for the preceding example:
public Customer() : Contact()
{
}

When a class does not declare any constructors, the code in this example is automatically generated. The default base class constructor is called implicitly when no derived class constructors are defined. Once a derived class constructor is defined, whether or not it has parameters, a default constructor will not be automatically defined, as the preceding code showed.
Calling Base Class Members
Derived classes can access the members of their base class if those members have protected or greater access. Simply use the member name in the appropriate context, just as if that member were a part of the derived class itself. Here's an example:
abstract public class Contact
{
private string address;
private string city;
private string state;
private string zip;
public string FullAddress()
{
string fullAddress = address + '\n' + city + ',' + state + ' ' + zip;
return fullAddress;
}
}
public class Customer : Contact
{
public string GenerateReport()
{
string fullAddress = FullAddress();
// do some other stuff...
return fullAddress;
}
}

In above example, the GenerateReport() method of the Customer class calls the FullAddress() method in its base class, Contact. All classes have full access to their own members without qualification. Qualification refers to using a class name with the dot operator to access a class member-MyObject.SomeMethod(), for instance. This shows that a derived class can access its base class members in the same manner as its own.
More Tips regarding Inheritance:
• A static member cannot be marked as override, virtual, or abstract. So following is an error:
public static virtual void GetSSN()
• You can't call static methods of base class from derived class using base keyword.
In above example if you declare a static method as follows:
public class Person
{
protected string ssn = "444-55-6666";
protected string name = "John L. Malgraine";
public static void GetInfo()
{
// Implementation
}
}
now you can't call this method using base.GetInfo() from derived class instead you have to call Person.GetInfo() from derived class.
Inside Static members we can access only static fields, methods etc.
Following example will give error, because we can't access name in GetInfo() because name is not static.
public class Person
{
protected string ssn = "444-55-6666";
protected string name = "John L. Malgraine";
public static void GetInfo()
{
Console.WriteLine("Name: {0}", name);
Console.WriteLine("SSN: {0}", ssn);
}
}

Virtual or abstract members cannot be private.
• If you are not overriding a virtual method of base class in derived class, you can't use base class method by using base keyword in derived class. Also when you will create an instance of derived class, it will call derived class method and you will only be able to access base class method when you will create instance of base class.
• You can't decrease access level of a method in derived class when you are overriding a base class method in derived class, vice versa is possible.
Means you can make protected method of base class to public in derived class.
The "this" keyword refers to:
• the current instance for which a method is called. Static member functions do not have a this pointer. The this keyword can be used to access members from within constructors, instance methods, and instance accessors.
The following are common uses of this:
To qualify members hidden by similar names, for example:
public Employee(string name, string alias)
{
this.name = name;
this.alias = alias;
}

In above example, this.name refers to private variable name in the class. If we write name = name, then this will refer to argument name of the constructor Employee and not to private variable name in the class. In this case private variable name will never be initialized.
• To pass an object as a parameter to other methods, for example:
CalcTax(this);
To declare indexers, for example:
public int this [int param]
{
get
{
return array[param];
}
set
{
array[param] = value;
}
}

It is an error to refer to this in a static method, static property accessor, or variable initializer of a field declaration.
In this example, this is used to qualify the Employee class members, name and alias, which are hidden by similar names. It is also used to pass an object to the method CalcTax, which belongs to another class.
// keywords_this.cs
// this example
using System;
public class Employee
{
public string name;
public string alias;
public decimal salary = 3000.00m;
// Constructor:
public Employee(string name, string alias)
{
// Use this to qualify the fields, name and alias:
this.name = name;
this.alias = alias;
}
// Printing method:
public void printEmployee()
{
Console.WriteLine("Name: {0}\nAlias: {1}", name, alias);
// Passing the object to the CalcTax method by using this:
Console.WriteLine("Taxes: {0:C}", Tax.CalcTax(this));
}
}
public class Tax
{
public static decimal CalcTax(Employee E)
{
return (0.08m*(E.salary));
}
}
public class MainClass
{
public static void Main()
{
// Create objects:
Employee E1 = new Employee ("John M. Trainer", "jtrainer");
// Display results:
E1.printEmployee();
}
}

Output
Name: John M. Trainer
Alias: jtrainer
Taxes: $240.00
Abstract Classes
Abstract classes are a special type of base classes. In addition to normal class members, they have abstract class members. These Abstract class members are methods and properties that are declared without an implementation. All classes derived directly from abstract classes must implement all of these abstract methods and properties.
Abstract classes can never be instantiated. This would be illogical, because of the members without implementations.So what good is a class that can't be instantiated? Lots! Abstract classes sit toward the top of a class hierarchy. They establish structure and meaning to code. They make frameworks easier to build. This is possible because abstract classes have information and behavior common to all derived classes in a framework. Take a look at the following example:
abstract public class Contact // Abstract Class Contact.
{
protected string name;
public Contact()
{
// statements...
}
public abstract void generateReport();
abstract public string Name
{
get;
set;
}
}

Contact, is an abstract class. Contact has two abstract members, and it has an abstract method named generateReport(). This method is declared with the abstract modifier in front of the method declaration. It has no implementation (no braces) and is terminated with a semicolon. The Name property is also declared abstract. The accessors of properties are terminated with semicolons.
public class Customer : Contact // Customer Inherits Abstract Class Contact.
{
string gender;
decimal income;
int numberOfVisits;
public Customer()
{
// statements
}
public override void generateReport()
{
// unique report
}
public override string Name
{
get
{
numberOfVisits++;
return name;
}
set
{
name = value;
numberOfVisits = 0;
}
}
}
public class SiteOwner : Contact
{
int siteHits;
string mySite;
public SiteOwner()
{
// statements
}
public override void generateReport()
{
// unique report
}
public override string Name
{
get
{
siteHits++;
return name;
}
set
{
name = value;
siteHits = 0;
}
}
}

The abstract base class Contact has two derived classes, Customer and SiteOwner. Both of these derived classes implement the abstract members of the Contact class. The generateReport() method in each derived class has an override modifier in its declaration. Likewise, the Name declaration contains an override modifier in both Customer and SiteOwner.
C# requires explicit declaration of intent when overriding methods. This feature promotes safe code by avoiding the accidental overriding of base class methods, which is what actually does happen in other languages. Leaving out the override modifier generates an error. Similarly, adding a new modifier also generates an error. Abstract methods must be overridden and cannot be hidden, which the new modifier or the lack of a modifier would be trying to do.
The most famous of all abstract classes is the Object class. It may be referred to as object or Object, but it's still the same class. Object is the base class for all other classes in C#. It's also the default base class when a base class is not specified. The following class declarations produce the same exact results:

abstract public class Contact : Object
{
// class members
}
abstract public class Contact
{
// class members
}

Object is implicitly included as a base class if it is not already declared. Besides providing the abstract glue to hold together the C# class framework, object includes built-in functionality, some of which is useful for derived classes to implement.
Difference between Interface and Abstract Class
• Interfaces are closely related to abstract classes that have all members abstract.
• For an abstract class, at least one method of the class must be an abstract method that means it may have concrete methods.
• For an interface, all the methods must be abstract
• Class that implements an interface much provide concrete implementation of all the methods definition in an interface or else must be declare an abstract class
• In C#, multiple inheritance is possible only through implementation of multiple interfaces. Abstract class can only be derived once.
• An interface defines a contract and can only contains four entities viz methods, properties, events and indexes. An interface thus cannot contain constants, fields, operators, constructors, destructors, static constructors, or types.
• Also an interface cannot contain static members of any kind. The modifiers abstract, public, protected, internal, private, virtual, override is disallowed, as they make no sense in this context.
• Class members that implement the interface members must be publicly accessible.
Overriding Summery:

A derived class may override a virtual method of the base class with the keyword override. The following restrictions must be followed.
• Keyword override is used in the definition of child class method that is going to override the base class's virtual method.
• The return type must be the same as the virtual method have in base class.
• The name of the method should also be same.
• The parameter-list must also be same in order, number and type of parameters.
• The accessibility of the overriding method should not be more restricted than that of the accessibility defined with virtual method of the base class. This accessibility either be the same or less restricted.
• The virtual methods can be sealed in the child or derived classes to prevent further modifications in the implementation of the virtual method in the derived classes, by declaring them as sealed methods.
Hiding Base Class Members
Sometimes derived class members have the same name as a corresponding base class member. In this case, the derived member is said to be "hiding" the base class member.
When hiding occurs, the derived member is masking the functionality of the base class member. Users of the derived class won't be able to see the hidden member; they'll see only the derived class member. The following code shows how hiding a base class member works.
abstract public class Contact
{
private string address;
private string city;
private string state;
private string zip;
public string FullAddress()
{
string fullAddress =address + '\n' +city + ',' + state + ' ' + zip;
return fullAddress;
}
}
public class SiteOwner : Contact
{
public string FullAddress()
{
string fullAddress;
// create an address...
return fullAddress;
}
}

In this example, both SiteOwner and its base class, Contact, have a method named FullAddress(). The FullAddress() method in the SiteOwner class hides the FullAddress() method in the Contact class. This means that when an instance of a SiteOwner class is invoked with a call to the FullAddress() method, it is the SiteOwner class FullAddress() method that is called, not the FullAddress() method of the Contact class.
Although a base class member may be hidden, the derived class can still access it. It does this through the base identifier. Sometimes this is desirable. It is often useful to take advantage of the base class functionality and then add to it with the derived class code. The next example shows how to refer to a base class method from the derived class.
abstract public class Contact
{
private string address;
private string city;
private string state;
private string zip;
public string FullAddress()
{
string fullAddress =address + '\n' +city + ',' + state + ' ' + zip;
return fullAddress;
}
}
public class SiteOwner : Contact
{
public string FullAddress()
{
string fullAddress = base.FullAddress();
// do some other stuff...
return fullAddress;
}
}

In this particular example, the FullAddress() method of the Contact class is called from within the FullAddress() method of the SiteOwner class. This is accomplished with a base class reference. This provides another way to reuse code and add on to it with customized behavior.
Versioning
Versioning, in the context of inheritance, is a C# mechanism that allows modification of classes (creating new versions) without accidentally changing the meaning of the code. Hiding a base class member with the methods previously described generates a warning message from the compiler. This is because of the C# versioning policy. It's designed to eliminate a class of problems associated with modifications to base classes.
Here's the scenario: A developer creates a class that inherits from a third-party library. For the purposes of this discussion, we assume that the Contact class represents the third-party library. Here's the example:
public class Contact
{
// does not include FullAddress() method
}
public class SiteOwner : Contact
{
public string FullAddress()
{
string fullAddress = mySite.ToString();
return fullAddress;
}
}

In this example, the FullAddress() method does not exist in the base class. There is no problem yet. Later on, the creators of the third-party library update their code. Part of this update includes a new member in a base class with the exact same name as the derived class:
public class Contact
{
private string address;
private string city;
private string state;
private string zip;
public string FullAddress()
{
string fullAddress =address + '\n' +city + ',' + state + ' ' + zip;
return fullAddress;
}
}
public class SiteOwner : Contact
{
public string FullAddress()
{
string fullAddress = mySite.ToString();
return fullAddress;
}
}

In this code, the base class method FullAddress() contains different functionality than the derived class method. In other languages, this scenario would break the code because of implicit polymorphism. However, this does not break any code in C# because when the FullAddress() method is called on SiteOwner, it is still the SiteOwner class method that gets called.
This scenario generates a warning message. One way to eliminate the warning message is to place a new modifier in front of the derived class method name, as the following example shows:
using System;
public class WebSite
{
public string SiteName;
public string URL;
public string Description;
public WebSite()
{
}
public WebSite( string strSiteName, string strURL, string strDescription )
{
SiteName = strSiteName;
URL = strURL;
Description = strDescription;
}
public override string ToString()
{
return SiteName + ", " +URL + ", " +Description;
}
}
public class Contact
{
public string address;
public string city;
public string state;
public string zip;
public string FullAddress()
{
string fullAddress =address + '\n' +city + ',' + state + ' ' + zip;
return fullAddress;
}
}
public class SiteOwner : Contact
{
int siteHits;
string name;
WebSite mySite;
public SiteOwner()
{
mySite = new WebSite();
siteHits = 0;
}
public SiteOwner(string aName, WebSite aSite)
{
mySite = new WebSite(aSite.SiteName,aSite.URL,aSite.Description);
Name = aName;
}
new public string FullAddress()
{
string fullAddress = mySite.ToString();
return fullAddress;
}
public string Name
{
get
{
siteHits++;
return name;
}
set
{
name = value;
siteHits = 0;
}
}
}
public class Test
{
public static void Main()
{
WebSite mySite = new WebSite("Le Financier","http://www.LeFinancier.com","Fancy Financial Site");
SiteOwner anOwner = new SiteOwner("John Doe", mySite);
string address;
anOwner.address = "123 Lane Lane";
anOwner.city = "Some Town";
anOwner.state = "HI";
anOwner.zip = "45678";
address = anOwner.FullAddress(); // Different Results
Console.WriteLine("Address: \n{0}\n", address);
}
}

Here's the output:
Address:
Le Financier, http://www.LeFinancier.com, Fancy Financial Site
This has the effect of explicitly letting the compiler know the developer's intent. Placing the new modifier in front of the derived class member states that the developers know there is a base class method with the same name, and they definitely want to hide that member. This prevents breakage of existing code that depends on the implementation of the derived class member. With C#, the method in the derived class is called when an object of the derived class type is used. Likewise, the method in the base class is called when an object of the Base class type is called. Another problem this presents is that the base class may present some desirable new features that wouldn't be available through the derived class.
To use these new features requires one of a few different workarounds. One option would be to rename the derived class member, which would allow programs to use a base class method through a derived class member. The drawback to this option would be if there were other classes relying upon the implementation of the derived class member with the same name. This scenario will break code and, for this reason, is considered extremely bad form.
Another option is to define a new method in the derived class that called the base class method. This allows users of the derived class to have the new functionality of the base class, yet retain their existing functionality with the derived class. While this would work, there are maintainability concerns for the derived class.
Sealed Classes
Sealed classes are classes that can't be derived from. To prevent other classes from inheriting from a class, make it a sealed class. There are a couple good reasons to create sealed classes, including optimization and security.
Sealing a class avoids the system overhead associated with virtual methods. This allows the compiler to perform certain optimizations that are otherwise unavailable with normal classes.
Another good reason to seal a class is for security. Inheritance, by its very nature, dictates a certain amount of protected access to the internals of a potential base class. Sealing a class does away with the possibility of corruption by derived classes. A good example of a sealed class is the String class. The following example shows how to create a sealed class:
public sealed class CustomerStats
{
string gender;
decimal income;
int numberOfVisits;
public CustomerStats()
{
}
}
public class CustomerInfo : CustomerStats // error
{
}

This example generates a compiler error. Since the CustomerStats class is sealed, it can't be inherited by the CustomerInfo class.The CustomerStats class was meant to be used as an encapsulated object in another class. This is shown by the declaration of a CustomerStats object in the Customer class.
public class Customer
{
CustomerStats myStats; // okay
}

Polymorphism
Polymorphism is reflected in the ability to write one routine that can operate on objects from more than one class-treating different objects from different classes in exactly the same way. For instance, if both Customer and Vendor objects have a Name property, and we can write a routine that calls the Name property regardless of whether we're using a Customer or Vendor object, then we have polymorphism.
A vehicle is a good example of polymorphism. A vehicle interface would only have those properties and methods that all vehicles have, a few of which might include paint color, number of doors, accelerator, and ignition. These properties and methods would apply to all types of vehicles including cars, trucks, and semi-trucks.
Polymorphism will not implement code behind the vehicle's properties and methods. Instead, polymorphism is the implementation of an interface. If the car, truck, and semitruck all implement the same vehicle interface, then the client code for all three classes can be exactly the same.
C# gives us polymorphism through inheritance. C# provides a keyword virtual that is used in the definition of a method to support polymorphism.
Child class are now free to provide their own implementation of this virtual method, that is called overriding. The following points are important regarding virtual keyword:-

If the method is not virtual, the compiler simply uses the reference type to invoke the appropriate method.
If the method is virtual, the compiler will generate code to checkup the reference type at runtime it is actually denoting to, then the appropriate method is called from the class of the reference type.
When a virtual method is called, runtime check (late method binding) is made to identify the object and appropriate method is invoked, all this is done at runtime.
In case of non-virtual methods, this information is available at compile time, so no runtime check to identify the object is made, so slightly efficient in the way non-virtual methods are called. But the behavior of virtual method is useful in many ways; the functionality they provide is fair enough to bear this slight loss of performance.
Implementing Polymorphism

The key factor here is the ability to dynamically invoke methods in a class based on their type. Essentially, a program would have a group of objects, examine the type of each one, and execute the appropriate method. Here's an example:
using System;
public class WebSite
{
public string SiteName;
public string URL;
public string Description;
public WebSite()
{
}
public WebSite( string strSiteName, string strURL, string strDescription )
{
SiteName = strSiteName;
URL = strURL;
Description = strDescription;
}
public override string ToString()
{
return SiteName + ", " +URL + ", " +Description;
}
}

When we inherit above class, we have two choices to invoke constructor of the class. So this is an example of design time polymorphism. Here at design time we have to decide which method we need to invoke while inheriting the class.
Polymorphism is the capability of a program to carry out dynamic operations by implementing methods of multiple derived classes through a common base class reference. Another definition of polymorphism is the ability to treat different objects the same way. This means that the runtime type of an object determines its behavior rather than the compile-time type of its reference.
Summery:
It was a long trip, but I tried to explain all the basics of Object Orientation in C# with some practical examples.

Basics of QTP

What’s the QTP?
QTP is Mercury Interactive Functional Testing Tool.
What’s the basic concept of QTP?QTP is based on two concepts-
Recording
Playback

Which scripting language used by QTP?
QTP uses VB scripting.

How many types of recording facility are available in QTP?
QTP provides three types of recording methods-
Context Recording (Normal)
Analog Recording
Low Level Recording

How many types of Parameters are available in QTP?
QTP provides three types of Parameter-
Method Argument
Data Driven
Dynamic

What’s the QTP testing process?
QTP testing process consist of seven steps-
Preparing to recoding
Recording
Enhancing your script
Debugging
Run
Analyze
Report Defects

What’s the Active Screen?
It provides the snapshots of your application as it appeared when you performed a certain steps during recording session.

What’s the Test Pane?
Test Pane contains Tree View and Expert View tabs.
What’s Data Table?It assists to you about parameterizing the test.

What’s the Test Tree?
It provides graphical representation of your operations which you have performed with your application.

Which all environment QTP supports?
ERP/ CRMJava/ J2EEVB, .NETMultimedia, XMLWeb Objects, ActiveX controlsSAP, Oracle, Siebel, PeopleSoftWeb Services, Terminal EmulatorIE, NN, AOL

How can you view the Test Tree?
The Test Tree is displayed through Tree View tab.

What’s the Expert View?
Expert View display the Test Script.

Which keyword used for Normal Recording?
F3
Which keyword used for run the test script?
F5
Which keyword used for stop the recording?
F4
Which keyword used for Analog Recording?
Ctrl+Shift+F4
Which keyword used for Low Level Recording?
Ctrl+Shift+F3
Which keyword used for switch between Tree View and Expert View?
Ctrl+Tab
Note:
> QTP records each step you perform and generates a test tree and test script.
> QTP records in normal recording mode.
> If you are creating a test on web object, you can record your test on one browser and run it on another browser.
> Analog Recording and Low Level Recording require more disk space than normal recording mode.

What’s the Transaction?
You can measure how long it takes to run a section of your test by defining transactions.

Where you can view the results of the checkpoint?
You can view the results of the checkpoints in the Test Result Window.
Note:
If you want to retrieve the return value of a checkpoint (a Boolean value that indicates whether the checkpoint passed or failed) you must add parentheses around the checkpoint argument in the statement in the Expert View.

What’s the Standard Checkpoint?
Standard Checkpoints checks the property value of an object in your application or web page.

Which environments are supported by Standard Checkpoint?
Standard Checkpoint are supported for all add-in environments.

What’s the Image Checkpoint?
Image Checkpoint checks the value of an image in your application or web page.

Which environments are supported by Image Checkpoint?
Image Checkpoint is supported only Web environment.

What’s the Bitmap Checkpoint?
Bitmap Checkpoint checks the bitmap images in your web page or application.

Which environments are supported by Bitmap Checkpoints?
Bitmap checkpoints are supported all add-in environment.

What are the Table Checkpoints?
Table Checkpoint checks the information with in a table.

Which environments are supported by Table Checkpoint?
Table Checkpoints are supported only ActiveX environment.

What’s the Text Checkpoint?
Text Checkpoint checks that a test string is displayed in the appropriate place in your application or on web page.

Which environments are supported by Test Checkpoint?
Text Checkpoints are supported all add-in environments

How to Back up your computer?

Back up your computer
It’s an essential task for any computer user, but it’s also pretty intimidating for most. Here’s a simple guide to backing up the data on your computer
There are many reasons why you should back up your computer—possibilities of hard disk corruption or crash due to malicious programs or technical faults, accidents such as fires or thefts, and so on. However, for most users, a ‘backup’ is either inessential or too technical. It needn’t be either of these; here are guidelines you could follow to make backing up a routine task.
What to back up
You should back up data that cannot be replaced easily, balancing this with the need to keep backup sizes within reasonable control. If you have hundreds of gigabytes of music, it may not be possible to back up all of it within reasonable costs.
You could decide to back up your work-related files, Internet downloads that you’ve paid for, photographs, music that you’ve purchased from the Internet, any financial records, your Outlook Address Book and so on.
Once you decide what you would like to backup, you can estimate the amount of storage space you would need for this. The estimate should also include the possibility of data growth in future. The amount of storage space you need will help you decide where you would create your backups.
Where to back up
A backup should ideally be created on a separate hard disk or at least a separate hard-disk partition. You could also take backups on Zip drives, CDs or DVDs, or even USB pen drives. Remember that taking backups is a regular task, so you need adequate space for them. If you decide to backup to removable media like CDs or DVDs, remember to buy RW disks, so that you can update your backups by erasing the older ones and burning the new ones.
Another way of taking backups is to do it online. Here, you connect to a website, such as Xdrive, which gives you a backup utility that creates your backup, compresses it, encrypts it, and then transfers it to a third-party location. You can connect to this location to view or update your backups, when your system information or data changes. Online backups have the advantage that your data is stored in two separate locations—your PC and a remote location.
CD-RWs and DVD-RWs are relatively inexpensive. Moreover, a CD-RW can store up to 700 MB of data, while a DVD-RW can store a few GB. However, you need to check that your PC comes with the appropriate drive for the media you want to use. Otherwise, you’ll need to invest in the drive as well. Most USB drives can hold up to 2 GB of data and are not too expensive, but due to their small size, are easy to misplace. Zip drives and disks are relatively expensive, but usually come with backup software that helps in taking backups.
How to back up
There are many ways of taking backups. Windows XP and Vista come with backup utilities. In Windows XP, this is available under Start > All Programs > Accessories > System Tools. In Windows Vista, go to Start > Control Panel > System and Maintenance > Back up your computer.
If you don’t have the backup utility in Windows, you can install it from the CD. Apart from the Windows utilities, you can also use any of the numerous free backup utilities that are available online. Only remember to download these from trusted sites, such as download.com.
Backup utilities take you through the process of backing up—choosing what to back up, where to back up, creating the backup, usually with compression so that more data can be stored. You can also create a backup schedule with the utility.
If the data you want to backup is not too large in size, you can create manual backups. Go to the folder that you want to backup, copy it and paste it to the location or disc where you want to create the backup.
You can also create an image of your hard disk by using utilities meant for this, so that your system can be restored to its current state in case of a crash. Several free utilities are available for this as well.
You’ll need to backup regularly, especially those parts of your essential data that change frequently. You can do this manually if the data isn’t too large or use the backup utility all over again.

Web Services

A 'Web service' (also Web Service) is defined by the W3C as "a software system designed to support interoperable machine-to-machine interaction over a network"^[1]. Web services are frequently just Web APIs that can be accessed over a network, such as the Internet, and executed on a remote system hosting the requested services.

The W3C Web service definition encompasses many different systems, but in common usage the term refers to clients and servers that communicate using XML messages that follow the SOAP standard. In such systems, there is often machine-readable description of the operations offered by the service written in the Web Services Description Language (WSDL). The latter is not a requirement of a SOAP endpoint, but it is a prerequisite for automated client-side code generation in many Java and .NET SOAP frameworks (frameworks such as Spring, Apache Axis2 and Apache CXF being notable exceptions). Some industry organizations, such as the WS-I, mandate both SOAP and WSDL in their definition of a Web service.

More recently, RESTful Web services have been regaining popularity. These also meet the W3C definition, and are often better integrated with HTTP than SOAP-based services. They do not require XML messages or WSDL service-API definitions.

Files in C#

With any programming language there is always a need to read and write to files. In C#, this is done quite easily compared to many other programming languages.Like other languages, C# utilizes a Stream class, which gives basic functionality when working with streams (any situation where you need to read and write data to some endpoint). The class FileStream, which is actually derived from the Stream class, adds to Stream the functionaly needed to read and write to files.

Now, let's get started!The first thing you need to do is add the correct library at the top:using System.IO;
This provides us with the functionality we will need for this tutorial.Now, create an instance of FileStream:FileStream file = new FileStream("path.txt", FileMode, FileAccess);
There are several overloads for this constructor, but this is the easiest to use for this tutorial.FileMode specifies what the FileStream should do with the file to begin with. The options are: Append, Create, CreateNew, Open, OpenOrCreate, or Truncate, and can be accessed by FileMode.option.FileAccess specifies the file priveledges. The options are: Read, ReadWrite, or Write, and can be accesed by FileAccess.option.Writing to a file:To write to a file we will need to use class StreamWriter, which is derived from the TextWriter class.StreamWriter sw = new StreamWriter(file);
The constructor for StreamWriter also has several overloads. The one showed here takes an instance of FileStream, instantiated above (file).With StreamWriter, you have two options for writing to a file: Write, or WriteLine. The Write method has 21 overloads, and the WriteLine method has 18, so you should have no problem finding the correct functionality to suit your programming needs.Here is a simple example:sw.Write("Hello file system world!");
Now don't forget to close the stream when you are done!sw.Close();
Reading from a file:To read from a file we will need to use class StreamReader. Similar to StreamWriter, StreamReader is derived from the TextReader class.StreamReader sr = new StreamReader(file);
Just like StreamWriter there are several posibilities for constructor overloads. This one takes an instance of FileStream.With StreamReader, there are four options for reading from a file: Read, ReadBlock, ReadLine, or ReadToEnd. Each one of these functions has several overloads. For the purposes of this example, I will use ReadToEnd, which just like the title implies, reads the entire file.string s = sr.ReadToEnd();
Again, don't forget to close the stream!sr.Close();
And when you are all done with the file, make sure to close that too.file.Close();
Thats it! Thats all there is to it! Pretty simple if you ask me.For those of you who learn better by visually looking at code samples, here is the entire thing one more time:// *** Write to file ***
// Specify file, instructions, and privelegdes
FileStream file = new FileStream("test.txt", FileMode.OpenOrCreate, FileAccess.Write);

// Create a new stream to write to the file
StreamWriter sw = new StreamWriter(file);
// Write a string to the file
sw.Write("Hello file system world!");
// Close StreamWriter
sw.Close();
// Close file
file.Close();
// *** Read from file ***
// Specify file, instructions, and privelegdes
file = new FileStream("test.txt", FileMode.OpenOrCreate, FileAccess.Read);
// Create a new stream to read from a file
StreamReader sr = new StreamReader(file);
// Read contents of file into a string
string s = sr.ReadToEnd();
// Close StreamReader
sr.Close();
// Close file
file.Close();
This is by no means the only way to read and write to files. FileStream, StreamWriter, and StreamReader each provide many more advanced features.

How to test a Web Application?

Testing Your Web Application
A Quick 10-Step Guide

by Naveen


Interested in a quick checklist for testing a web application? The following 10 steps cover the most critical items that I have found important in making sure a web application is ready to be deployed. Depending on size, complexity, and corporate policies, modifies the following steps to meet your specific testing needs.

Step 1 - Objectives

Make sure to establish your testing objectives up front and make sure they are measurable. It will make your life a lot easier by having written objectives that your whole team can understand and rally around. In addition to documenting your objectives, make sure your objectives are prioritized. Ask yourself questions like “What is most important: minimal defects or time-to-market?”

Here are two examples of how to determine priorities:

If you are building a medical web application that will assist in diagnosing illnesses, and someone could potentially die based on how correctly the application functions, you may want to make testing the correctness of the business functionality a higher priority than testing for navigational consistency throughout the application.

If you are testing an application that will be used to solicit external funding, you may want to put testing the aspects of the application that impact the visual appeal as the highest testing priority.

Your web application doesn't have to be perfect; it just needs to meet your intended customer's requirements and expectations.

Step 2 – Process and Reporting

Make sure that everyone on your testing team knows his or her role. Who should report what to whom and when? In other words, define your testing process. Use the following questions to help you get started:

How will issues be reported?
Who can assign issues?
How will issues be categorized?
Who needs what report and when do they need it?
Are team meetings scheduled in advance or scheduled as needed?

You may define your testing process and reporting requirements formally or informally, depending on your particular needs. The main point to keep in mind is to organize your team in a way that supports your testing objectives and takes into account the individual personalities on your team. One size never fits all when dealing with people.

Step 3 - Tracking Results

Once you start executing your test plans, you will probably generate a large number of bugs, issues, defects, etc. You will want a way to easily store, organize, and distribute this information to the appropriate technical team members. You will also need a way to keep management informed on the status of your testing efforts. If your company already has a system in place to track this type of information, don't try to reinvent the wheel. Take advantage of what's already in place.

Step 4 - Test Environment

Set up a test environment that is separate from your development and production environment. This includes a separate web server, database server, and application server if applicable. You may or may not be able to utilize existing computers to setup a separate test environment.

Create an explicitly defined procedure for moving code to and from your test environment and make sure the procedure is followed. Also, work with your development team to make sure each new version of source code to be tested is uniquely identified.


Step 5 - Usability Testing

In usability testing, you'll be looking at aspects of your web application that affect the user's experience, such as:

How easy is it to navigate through your web application?

Is it obvious to the user which actions are available to him or her?

Is the look-and-feel of your web application consistent from page to page, including font sizes and colors?

The book, "Don't Make Me Think! A Common Sense Approach to Web Usability" by Steve Krug and Roger Black, provides a practical approach to the topic of usability. I refer to it often, and recommend it highly.

In addition to the traditional navigation and look-and-feel issues, Section 508 compliance is another area of importance. The 1998 Amendment to Section 508 of the Rehabilitation Act spells out accessibility requirements for individuals with certain disabilities.

For instance, if a user forgets to fill in a required field, you might think it is a good idea to present the user with a friendly error message and change the color of the field label to red or some other conspicuous color. However, changing the color of the field label would not really help a user who has difficulty deciphering colors. The use of color may help most users, but you would want to use an additional visual clue, such as placing an asterisk beside the field in question or additionally making the text bold.

For more details, refer to http://www.section508.gov. Another great resource that can help analyze your HTML pages for Section 508 compliance can be found at http://www.cast.org/bobby/. If you are working with the United States federal government, Section 508 compliance is not only good design, it most likely is a legal requirement. You may want to utilize the following information regarding techniques for accessibility evaluation and repair tools, which can be found at http://www.w3.org/TR/AERT.

Step 6 – Unit Testing

Unit testing is focused on verifying small portions of functionality. For example, an individual unit test case might focus on verifying that the correct data has been saved to the database when the Submit button on a particular page is clicked.

An important subset of unit testing that is often overlooked is range checking. That is, making sure all the fields that collect information from the user, can gracefully handle any value that is entered. Most people think of range checking as making sure that a numeric field only accepts numbers. In addition to traditional range checking make sure you also check for less common, but just as problematic exceptions. For example, what happens when a user enters his or her last name and the last name contains an apostrophe, such as O’Brien? Different combinations of databases and database drivers handle the apostrophe differently, sometimes with unexpected results. Proper unit testing will help rid your web application of obvious errors that your users should never have to encounter.

Step 7 - Verifying the HTML

Hyper Text Markup Language (HTML) is the computer language sent from your web server to the web browser on your users' computer to display the pages that make up your web application. The World Wide Web Consortium (www.w3.org) manages the HTML specification. One major objective of HTML is to provide the ability for anyone from anywhere to access information on the World Wide Web. This concept generally holds true if you conform strictly to the relevant version of the HTML specification that you will support. Unfortunately, in the real world, it is possible for a developer to inadvertently use a proprietary HTML tag that may not work for all of your intended users.

Verifying HTML is simple in concept but can be very time consuming in practice. A good place to start is with the World Wide Web Consortium's free HTML Validation Service (http://validator.w3.org). There are also other online and downloadable applications to help in this area such as Net Mechanic (http://www.netmechanic.com). There are two main aspects of verifying the validity of your HTML. First, you want to make sure that your syntax is correct, such as verifying that all opening and closing tags match, etc. Secondly, you want to verify how your pages look in different browsers, at different screen resolutions, and on different operating systems. Create a profile of your target audience and make some decisions on what browsers you will support, on which operating systems, and at what screen resolutions.

In general, the later versions of Microsoft Internet Explorer are very forgiving. If your development team has only been using Internet Explorer 5.5 on high-resolution monitors, you may be unpleasantly surprised when you see your web application on a typical user's computer. The sooner you start verifying your HTML, the better off your web application will be.

Step 8 - Load Testing

In performing load testing, you want to simulate how users will use your web application in the real world. The earlier you perform load testing the better. Simple design changes can often make a significant impact on the performance and scalability of your web application. A good overview of how to perform load testing can be found on Microsoft's Developer Network (MSDN) website.

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnserv/html/server092799.asp

A topic closely related to load testing is performance tuning. Performance tuning should be tightly integrated with the design of your application. If you are using Microsoft technology, the following article is a great resource for understanding the specifics of tuning a web application.

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnserv/html/server03272000.asp

People hate to wait for a web page to load. As general rule, try to make sure that all of your pages load in 15 seconds or less. This rule will of course depend on your particular application and the expectations of the people using it.

Step 9 - User Acceptance Testing

By performing user acceptance testing, you are making sure your web application fits the use for which it was intended. Simply stated, you are making sure your web application makes things easier for the user and not harder. One effective way to handle user acceptance testing is by setting up a beta test for your web application.

One article to help you get started planning an effective beta test is: Supercharged Beta Test by Joshua Grossnickle and Oliver Raskin, May 14, 2001 which can be found at: http://hotwired.lycos.com/webmonkey/01/20/index1a.html?tw=design. This article points out the critical aspects of setting up a beta test including how to identify beta testers and how to obtain their feedback. The main point to remember in user acceptance testing is to listen to what the people using your web application are saying. Their feedback will be critical to the ultimate success of your web application.

Step 10 - Testing Security

With the large number of highly skilled hackers in the world, security should be a huge concern for anyone building a web application. You need to test how secure your web application is from both external and internal threats. The security of your web application should be planned for and verified by qualified security specialists.

If you think security is a subject that is over-hyped, check out Steve Gibson's account of how a 13 year old hacker took his company's website down for an extended period of time at will. You can find this eye-opening security case study at:

http://grc.com/dos/grcdos.htm

Some additional online resources to help you stay up to date on the latest Internet security issues include:

CERT Coordination Center
http://www.cert.org/

Computer Security Resource Center
http://csrc.nist.gov/

After performing your initial security testing, make sure to also perform ongoing security audits to ensure your web application remains secure over time as people and technology change.

Testing a web application can be a totally overwhelming task. The best advice I can give you is to keep prioritizing and focusing on the most important aspects of your application and don’t forget to solicit help from your fellow team members.

By following the steps above coupled with your own expertise and knowledge, you will have a web application you can be proud of and that your users will love. You will also be giving your company the opportunity to deploy a web application that could become a run away success and possibly makes tons of money, saves millions of lives, or slashes customer support costs in half. Even better, because of your awesome web application, you may get profiled on CNN, which causes the killer job offers to start flooding in.

Proper testing is an integral part of creating a positive user experience, which can translate into the ultimate success of your web application. Even if your web application doesn’t get featured on CNN, CNBC, or Fox News, you can take great satisfaction in knowing how you and your team’s diligent testing efforts made all the difference in your successful deployment.