Tales from the Evil Empire : IIS

New tools to prevent SQL injection attacks

Bertrand Le Roy — Wed, 25 Jun 2008 17:00:00 GMT

I've blogged in the past about injection attacks. Microsoft publishes additional new tools to detect and protect against injection attacks. The first tool, developed by HP, crawls web sites to automatically detect possible attacks, the second blocks dangerous requests from being executed, and the last one analyzes code to look for dangerous practice.

http://www.microsoft.com/technet/security/advisory/954462.mspx

Generating thumbnails in ASP.NET (DotNetSlackers)

Bertrand Le Roy — Fri, 20 Jun 2008 23:06:07 GMT

I just published a new article on DotNetSlackers. The post is about generating scalable and secure image thumbnails.

http://dotnetslackers.com/articles/aspnet/Generating-Image-Thumbnails-in-ASP-NET.aspx

Improving PHP by running it in IIS

Bertrand Le Roy — Fri, 25 Jan 2008 20:13:00 GMT

Mike Volodarsky wrote a fantastic article in the January 2008 issue of MSDN magazine in which he explains how you can take an existing PHP application (he uses QDig, a popular image gallery) and improve it without touching a line of its code. This is a great demonstration of the power of IIS 7's modular and pluggable architecture. Mike was able to add the following features to this PHP application using only managed code modules and configuration:

Access control using the ASP.NET membership APIs.
Forms authentication.
Pretty URLs (http://myphpgallery/index.php/Mike/Flower.jpg instead of the default http://myphpgallery/index.php?Qwd=./Mike&Qif=Flower.jpg) and rewriting of all URLs that are generated by the application to be pretty.
Output caching (which is a feature Zend charges for but that comes with IIS), leading to a whopping >15x improvement in throughput over the already performant FastCGI.

It really is amazing that you can add such complex features to an existing web application without touching its code. It is also super-simple to do. It looks very much like aspect-oriented programming if you think about it, only it's easy to set-up and understand.

The only thing I'd have liked to see and that isn't in the article is a comparison between the performance of the application on a LAMP setting with Zend's platform configured and the performance of the same application with Mike's improvements on IIS.

http://msdn.microsoft.com/msdnmag/issues/08/01/PHPandIIS7/default.aspx