Search results for 'My Guitar Shop'

PRG/420 Week 5 Java 5.19 LAB: Remove spaces - methods

Write a program that removes all spaces from the given input.
Ex: If the input is:
Hello my name is John.
the output is:
HellomynameisJohn.

Your program must define and call the following method. The method should return a string representing the input string without spaces.
public static String removeSpaces(String userString)

Note: This is a lab from a previous chapter that now requires the use of a method.

PRG/420 Week 3 Java 3.14 LAB: Remove spaces

Write a program that removes all spaces from the given input.

Ex: If the input is:
Hello my name is John.

the output is:
HellomynameisJohn.

PRG/420 Week 2 Java 2.18 LAB: Warm up: Text message abbreviation decoder

(1) If a user's input string matches a known text message abbreviation, output the unabbreviated form, else output: Unknown. Support two abbreviations: LOL -- laughing out loud, and IDK -- I don't know. (4 pts)

Sample input/output:
Input an abbreviation:
LOL
laughing out loud

(2) Expand to also decode these abbreviations. (3 pts)
BFF -- best friends forever
IMHO -- in my humble opinion
TMI -- too much information

WEB460 Lab 6 of 7: Sending E-mail and Testing Your Application

Lab Overview
This lab will not work if your Gmail, Yahoo, Outlook, or other email account is set up with two-factor authentication. You should use or create an account that does not have two-factor authentication to fully test this lab.
If you try to use your work or school email accounts, this lab has a better chance of working if you run it and try to send the email from your work computer or on campus. This is because some mail servers are set up to block sending emails from outside their domain.

TABLE OF CONTENTS
Scenario/Summary
This week, we add the ability to send e-mails from our application. Then you will develop and implement a test plan for your application. Here is an outline of the lab:
STEP A: Set up a Web Application — this should be a copy of your Week 5 Lab as a starting point.
STEP B: Implement E-mail Functionally in the Business Layer
STEP C: Add E-mail Fields to pgConfirm.aspx
STEP D: Add Send E-mail Functionality to pgConfirm.aspx.cs
STEP E: Develop a Test Plan and Test your Application
STEP F: (Optional) Add Functionality to Autofill the Recipient's E-mail Address
STEP G: Finalize the Lab

STEP A: Set up a Web Application
To begin this week's lab, create an empty Web Site and copy the files from the Week 5 Lab into your website folder.
Test your application. It should function the same as it did at the end of the Week 5 Lab.

STEP B: Implement E-mail Send Functionality in the Business Layer
1. Because e-mail is a form of communication, we implement the SendEmail method in the business layer. First we create a MailMessage object that has the information for the e-mail, such as To, From, Subject, and the message Body. Then, to connect to a mail server and send the e-mail, we create an SmtpClient object. We need to tell the server about these two ASP.NET classes, so place the following at the start of clsBusinessLayer.cs:
Modules for clsBusinessLayer.cs
using System.Net;
using System.Net.Mail;

2. Let's begin by stubbing out the SendMail method. The method accepts as parameters information needed to build and send the e-mail. We also return a message to the client that called the method indicating success or failure. We'll be optimistic and assume success. Stubbing a method is a useful development technique that lets your program compile and use the method, yet you don't have to have all the features implemented-only the correct return type.
SendMail method stub in clsBusinessLayer.cs
public string SendEmail(string emailFrom, string emailTo, string emailSubject, string emailBody, string acctPassword)
{
string mailSendMessage = "Email Status: The message was sent successfully to: " + emailTo;
//**** TODO: Create email message! *** //
//**** TODO: Add send mail functionality! *** //
return mailSendMessage;
}

3. Next we create the MailMessage object and set its data fields using the values in the parameters. Replace the TODO comment for creating an e-mail message with the following code:
Creating a Message in SendMail method
// Add your comments here
MailMessage objMailMessage = new MailMessage();
objMailMessage.From = new MailAddress(emailFrom);
objMailMessage.To.Add(new MailAddress(emailTo));
objMailMessage.Subject = emailSubject;
objMailMessage.Body = emailBody;

4. Now we create an SmptClient object to connect to your service provider and send thee-mail message.

Network Credentials
The two parameters for the NetworkCredential constructor should be the username (e-mail address) and account password for your web e-mail service. The values for these will be entered in the web form we build in a later step.
Do not hard code these values in your application—I don't want to know your e-mail password!

Connecting to the Mail Service
Two very important fields in the SmptClient object are the Host and Port fields. These must be set to the values required by your personal e-mail service! Normally these would be set to an organization's SMTP server, but because there is no company for this lab, you must use your own web mail service. Host values for several common web mail providers is provided in the code comments. If your provider is not listed, you can check its support instructions to see how a local client e-mail application, such as Outlook or Mac OS X Mail can connect. These two fields, alongwith the NetworkCredentials object, make it possible to send the e-mail.

Replace the TODO comment for adding send mail functionality with the following code:
Adding Send Functionality to SendEmail method
// Add your comments here
NetworkCredential objSMTPCredentials = new NetworkCredential(emailFrom,acctPassword);
// Add your comments here
SmtpClient mailObj = new SmtpClient();
// This needs to change based on your email Host
// to permit your application to send email
// for GMAIL
mailObj.Host = "smtp.gmail.com";
// for YAHOO, YMAIL, ROCKETMAIL, YAHOOMAIL
// mailObj.Host = "smtp.mail.yahoo.com";
// for HOTMAIL, MSN, OUTLOOK and LIVE.COM
// mailObj.Host = "smtp.live.com";
// for AOL
// mailObj.Host = "smtp.aol.com";
// Add your comments here
mailObj.Port = 587;
// if this does not work, try port 25
// Add your comments here
mailObj.UseDefaultCredentials = false;
mailObj.Credentials = objSMTPCredentials;
mailObj.EnableSsl = true;
mailObj.DeliveryMethod = SmtpDeliveryMethod.Network;
try
{
// Add your comments here
mailObj.Send(objMailMessage);
}
catch(Exception error)
{
mailSendMessage = " Email Status: An error has happened sending the email, " + emailTo;
}

STEP C: Add E-mail Fields to pgConfirm.aspx
In this step, we modify pgConfirm.aspx so the user can send an e-mail. For this application to successfully send an e-mail, it will need your e-mail credentials. You may hard code your e-mail address, but please do not hard code your password! It should be entered in the SENDAuthorization field. This field should have the TextMode property set to Password so that the password is not displayed when typed.

1. Begin by moving the Credit Card information and the Submit Order button into the left ContentArea of the Master Page. This leaves room for only our e-mail feature to be in the right ContentArea.
2. In this right ContentArea, add the controls as shown below. Structure the layout of your form to appear similar to an e-mail message.
ControlType Name or ID Text (if applicable)
Label lblFrom From:
TextBox txtFrom yourEmail@yourProvider.com
Label lblTo To:
TextBox txtTo
Label lblSubject Subject:
TextBox txtSubject
Label lblMessage Message:
TextBox txtMessage
Label lblPassword Enter SMTP account password for SEND authorization:
TextBox txtPassword
Button btnSendEmail Send Email

3. Several of the controls require the following special property settings.
Textbox txtMessage - Set the TextMode property to MultiLine so that the user can type several lines of text for the e-mail message body. You can also adjust the size of this text box to show several lines of text.
Textbox txtFrom - Set the Text property to the e-mail address from the account you use to send e-mail.
Textbox txtPassword - Set the TextMode property to Password so that your e-mail account password is not displayed.

4. When this step is complete, in Design Mode, pgConfirm.aspx should look similar to the image below:

STEP D: Sending an E-mail From pgConfirm.aspx
In pgConfirm.aspx.cs, create the method btnSendEmail_click() so that it calls SendEmail() and passes the data the user entered in the form.
1. Add a data field to represent the business layer object:
clsBusinessLayer myBusinessLayer;
2. Add the following line to the Page_Load method to instantiate the business layerobject:
myBusinessLayer = new clsBusinessLayer(Server.MapPath("~/App_Data/"));
3. Create the btnSendMail_Click method by entering the code below into pgConfirm.aspx.cs and enter your comments for each step being performed.
btnSendMail_Click method in pgConfirm.aspx.cs
protected void btnSendEmail_Click (object sender, EventArgs e)
{
Master.UserFeedBack.Text = myBusinessLayer.SendEmail(txtFrom.Text, txtTo.Text, txtSubject.Text, txtMessage.Text, txtPassword.Text);
}

STEP E: Develop a Test Plan and Test Your Application!
1. Develop a test plan that has at least ten different features to test. You should test *the entire* application, not just the email functionality from this week. You can test more; being thorough is a good thing!
An Excel spreadsheet (Wk6_Test_Plan.xlsx (https://devryu.instructure.com/courses/60316/files/9167014/download?wrap=1)) that you can use as a test plan template can be found in the Files section of the Course Menu.

2. Test your application! Make changes as appropriate until it works. Try sending several e-mails to yourself. If your application fails to send mail, try the following adjustments.
There are usually three possible values that cause issues: email username (usually your e-mail address), your password, and the host's STMP address.
Double-check that mailObj.Host matches the name of your e-mail or ISP's SMTPserver.
The From e-mail address and password should be what you use to log in to your e-mail account. If your username is different, change the emailFrom parameter in the call to the NetworkCredentials constructor to reflect your e-mail account username.
A fourth, less common problem is that some e-mail providers may use ports other than 587 for SSL e-mail. Try setting mailObj.Port to either 25 or 465.

3. Execute the tests in your test plan and record the results in the spreadsheet . Upload the spreadsheet as part of this week's deliverables.

STEP F: (OPTIONAL) Auto-fill Recipient's E-mail Address (OPTIONAL)
OPTIONAL ACTIVITY:
Each user record in the database has an e-mail address associated with it. To have pgConfirm automatically fill the To field with this address, two small changes need to be made to the application:
1. Modify the FindCustomer method in clsBusinessLayer.cs so that it validates the e-mailaddress in addition to the other fields in the record.
2. In the Page_Load method of pgConfirm.aspx.cs, call the business layer FindCustomer method and use the result to fill the txtTo control.
Then test away!

STEP G: Finalize the Lab
1. Save your work!
2. Test it! Make changes as appropriate until it works.
3. Remember to add comments for each step being performed.
4. Please zip and submit the entire web project folder and your test plan.

WEB460 Lab 5 of 7: Refactoring and Security

Scenario/Summary
In this week's Lab, we refactor our web application and add a secure login feature.

Part I: Refactoring
As applications grow and change with added features and fixed bugs, they can become unwieldy and very difficult to maintain. When an application is difficult to maintain, even a small change to the app can result in hard-to-find bugs. The original design of the application may no longer support the features and functionality present in the current application version.
The solution to this situation is refactoring the application code to better distribute the workload among the classes in the application. Refactoring does not change the external functionality of software; it changes the internal structure by reorganizing it. After refactoring our application, it should look the same to users but execute more efficiently and be easier to maintain.
pgCheckOut.aspx.cs has become fairly large, making it difficult to maintain. The reason for this is that we have the pgCheckOut class doing much of the work that belongs in the business layer and data layer. For this week, the goals of our refactoring are as follows.
1. Correctly distributing application functionality
The presentation layer (pgCheckOut) manages user interaction through the ASP form. It makes requests of the business layer for data to populate form fields, responds to button
presses, and sends form data to the business layer for processing.
The business layer (clsBusinessLayer) validates data, catches exceptions, and corrects them if possible. This layer handles communication between our application and others (through an XML file) and retrieves data from the data layer.
The data layer (clsDataLayer) interacts with database and responds to requests formthe business layer. When we are finished with our refactoring, pgCheckOut.aspx.cs should not need any knowledge or interaction with the data layer (clsDataLayer.cs)

2.Replace repeated or duplicate code with methods to improve maintainability We want to replace code that is duplicated in several places with either a method when it is a sequence of statements, or a data field when it is a reused piece of data, such as the data directory's Server.MapPath. We already reduce duplication on our forms by using master pages. This step allows us to reduce duplication in our code.

Part II: Secure Login
Because our application manages customer information, we should provide a secure login so that only authorized users can view and manipulate customer information. Our secure login page accepts a username and password. If the same user fails to correctly enter his or her password three times, that user's account is locked and the person must contact the system admin to unlock it. If there is a total of six failed login attempts during the session, no matter the user, the application locks by hiding the login/submit button.

Here is an outline of this lab:
PART 0: Prepare Your Project
Start your project as a copy of the Week 4 Lab

PART I: STEP A: Move the GetAllCustomers Functionality to the Business Layer
Add a method to clsBusinessLayer.cs and modify a method in pgCheckOut.aspx.cs.

PART I: STEP B: Move Update and Insert Customer Functionality to the Business Layer
Add two methods to clsBusinessLayer.cs, add a new method to pgCheckOut.aspx.cs, and modify two other methods in pgCheckOut.aspx.cs.

PART I: STEP C: Move Retrieving a Single Customer's Data to the Business Layer
Add a method to clsBusinessLayer.cs and modify a method in pgCheckOut.aspx.cs.

PART II: STEP D: Data Layer Functionality: Validating and Locking Users
Add two methods to clsDataLayer.cs.

Lab Steps
PART II: STEP E: Implement the Business Layer Functionality to Verify User Credentials
Add one method to clsBusinessLayer.cs.

PART II: STEP F: Create the Login Form
Create a form, user the site master page and add controls.

PART II: STEP G: Implement Login Functionality
Validate user credentials and redirect to pgCheckOut.aspx.

PART II: STEP H: Harden Your Application (Optional)
Optionally add features to obscure passwords and prevent SQL injection.

PART II: STEP I: Finalize the Lab
Deliverables
Please zip and submit the entire web project folder.

PART 0: Prepare Your Project
To begin this week's lab, create an Empty Web Site and copy the files from the Week 4 Lab into your website folder.
Test your application. It should function the same as it did at the end of the Week 4 Lab.

PART I: STEP A: Move the GetAllCustomersFunctionality to the Business Layer
We begin with an easy change. In pgCheckOut, the method BindCustomerGridView calls the clsDataLayer method GetAllCustomers. Calling this method should be done in the businesslayer (clsBusinessLayer) because the presentation layer (pgCheckOut) should not interact with the data layer. To fix this, we need to take two actions:
Create a method SelectAllCustomers in clsBusinessLayer that calls the clsDataLayer method GetAllCustomers.
Modify BindCustomerGridView to call SelectAllCustomers in clsBusinessLayer.

1. In clsBusinessLayer, add the SelectAllCustomers method:
SelectAllCustomer Method in clsBusinessLayer.cs
public dsAccounts SelectAllCustomers(){
return myDataLayer.GetAllCustomers();
}

2. In the BindCustomerGridView method in pgCheckOut.aspx.cs, change the line where GetAllCustomers is called to be:
dsAccounts customerListing = myBusinessLayer.SelectAllCustomers();

3. Test your application. It should function as it did at the end of the Week 4 Lab.

PART I: STEP B: Move Update and Insert CustomerFunctionality to the Business Layer
The btnAdd_Click and btnUpdate_Click methods in pgCheckOut have very similar functionality. They pass data from the form to the data layer and then handle any exceptions and errors that may occur. After that, both methods clear the form, display a message to the user, and bind the GridView. There are several optimizations we can make with these:
- Move the calls to the data layer and all exception handling into the business layer(clsBusinessLayer) where they belong. The business layer should also handle any exceptions or errors that could arise, relieving the presentation layer of this responsibility.
- Have the business layer methods return a string that indicates success or failure and can be displayed to the user.
- Place the duplicate code that clears the form, binds the GridView, and sets the feedback message in a private method that can be called from the btnAdd_Click and btnUpdate_Click methods. This should make maintaining the application easier.

1.Create the method UpdateCustomer in clsBusinessLayer.cs:
UpdateCustomer Method in clsBusinessLayer.cs
public string UpdateCustomer ( string firstName, string lastName, string street, string city, string state, string phoneNumber, int customerID)
{
// Add your comments here
string resultMessage = "Customer Updated Successfully.";
// Add your comments here
try
{
myDataLayer.UpdateCustomer(firstName,lastName,street,city,state,phoneNumber,customerID);
}
catch(Exception error)
{
resultMessage = "Error updating customer, please check form data. ";
resultMessage = resultMessage+error.Message;
}
return resultMessage;
}

2. Create the method InsertCustomer in clsBusinessLayer.cs:
InsertCustomer Method in clsBusinessLayer.cs
public string InsertCustomer ( string firstName, string lastName, string street, string city, string state, string phoneNumber)
{
// Add your comments here
string resultMessage = "Customer Added Successfully.";
// Add your comments here
try
{
// Add your comments here
myDataLayer.InsertCustomer(firstName,lastName,street,city,state,phoneNumber);
}
catch(Exception error)
{
// Add your comments here
resultMessage = "Error adding customer, please check form data.";
resultMessage = resultMessage + error.Message;
}
return resultMessage;
}

3. Create the private method updateForm in pgCheckOut.aspx.cs that clears the form, displays the message sent as a parameter, and binds the GridView:
updateForm Method in pgCheckOut.aspx.cs
private void updateForm(string results)
{
// Add your comments here
ClearInputs(Page.Controls);
// Add your comments here
Master.UserFeedBack.Text = results;
// Add your comments here
BindCustomerGridView();
}

4. Modify btnUpdate_Click in pgCheckOut.aspx.cs so that it calls UpdateCustomer in clsBusinessLayer and updateForm. The final version of the method should appear as below:
Revised btnUpdate_Click Method in pgCheckOut.aspx.cs
protected void btnUpdate_Click( object sender, EventArgs e)
{
// Add your comments here
string results = myBusinessLayer.UpdateCustomer(txtFirstName.Text,txtLastName.Text,txtStreet.Text,txtCity.Text,txtState.Text,txtPhone.Text,Convert.ToInt32(customerID.Text));
// Add your comments here
updateForm(results);
}

5. Modify btnAdd_Click in pgCheckOut.aspx.cs so that it calls InsertCustomer in clsBusinessLayer and updateForm. The final version of the method should appear as below:
Revised btnAdd_Click Method in pgCheckOut.aspx.cs
protected void btnAdd_Click (object sender,EventArgs e)
{
// Add your comments here
string results = myBusinessLayer.InsertCustomer(txtFirstName.Text,txtLastName.Text,txtStreet.Text,txtCity.Text,txtState.Text,txtPhone.Text);
// Add your comments here
updateForm(results);
}

6. Test your application. It should function the same is it did at the end of the Week 4 Lab.

PART I: STEP C: Move Retrieving a Single Customer's Data to the Business Layer
In this step, we move the functionality that accesses the data layer and performs exception handling from pgCheckOut to clsBusinessLayer as in the previous steps. Generally, fetching records from the database is safer than updating and inserting. If there is a problem, a DataSet object is still created but it contains no records. Our presentation layer can test for that and display a message to the user that "No records were found", just as our current method does.
If a record is returned from the database, empty fields in the record may contain the value DBNull, which represents a NULL value in the database. Because of this, an exception may occur when a field's value is retrieved so it can be placed in a TextBox on the form. We want to prevent any exceptions from occurring in the presentation layer, so our business layer must find a way to fix fields that have a value of DBNull before the DataSet is passed to the presentation layer for display on the form.

1. Here is the code for the FindCustomer method in clsBusinessLayer. Notice that before returning the DataSet to the presentation layer, it checks each field for DBNull. If a field has that value, it is set to the empty string, which is safe for a form to display.
FindCustomer Method in clsBusinessLayer.cs
public dsAccounts FindCustomer (string LastName)
{
// Add your comments here
dsAccounts dsFoundCustomer = myDataLayer.FindCustomer(LastName);
// Add your comments here
if(dsFoundCustomer.tblCustomers.Rows.Count>0)
{
// Add your comments here
System.Data.DataRow customerRecord = dsFoundCustomer.tblCustomers.Rows[0];
if( customerRecord["FirstName"]==DBNull.Value)
customerRecord["FirstName"]=string.Empty;
if(customerRecord["LastName"]==DBNull.Value)
customerRecord["LastName"]=string.Empty;
if(customerRecord["Street"]==DBNull.Value)
customerRecord["Street"]=string.Empty;
if(customerRecord["City"]==DBNull.Value)
customerRecord["City"]=string.Empty;
if(customerRecord["State"]==DBNull.Value)
customerRecord["State"]=string.Empty;
if(customerRecord["PhoneNumber"]==DBNull.Value)
customerRecord["PhoneNumber"]=string.Empty;
}
return dsFoundCustomer;
}

2. Because the business layer handles all the problems, our presentation layer can simply take the work of the business layer and display it for the user. Here is the final version of the modified btnFindLastName_Click method in pgCheckOut.aspx.cs:
Revised btnFindLastName_Click Method in pgCheckOut.aspx.cs
protected void btnFindLastName_Click (object sender, EventArgs e)
{
// Add your comments here
dsAccounts dsFindLastName = myBusinessLayer.FindCustomer(txtLastName.Text);
// Add your comments here
if(dsFindLastName.tblCustomers.Rows.Count>0)
{
// Add your comments here
txtFirstName.Text=dsFindLastName.tblCustomers[0].FirstName;
txtLastName.Text=dsFindLastName.tblCustomers[0].LastName;
txtStreet.Text=dsFindLastName.tblCustomers[0].Street;
txtCity.Text=dsFindLastName.tblCustomers[0].City;
txtState.Text=dsFindLastName.tblCustomers[0].State;
txtPhone.Text=dsFindLastName.tblCustomers[0].PhoneNumber;
customerID.Text=dsFindLastName.tblCustomers[0].CustomerID.ToString();
Master.UserFeedBack.Text="Record Found";
}
else
{
// Add your comments here
Master.UserFeedBack.Text="No records were found!";
}
}

3. Test your application. It should function the same is it did at the end of the Week 4 Lab. You should also scan through your code to see if there are any other optimizers or clean-ups you can make, such as removing statement setting tempPath because we no longer need it.
Refactored Code
At this point, even though your application has no new features compared to the Week 4 Lab, it is much easier to maintain and modify.
As you scroll through pgCheckOut.aspx.cs, you'll see the class has been greatly simplified and the code performs two main tasks in keeping with the rules of the presentation layer:
Passing data from the form to the business layer for processing
Receiving data from the business layer to display on the form
The data layer code in clsDataLayer.cs is only for interacting with the database. It doesn't validate or display data.
The business layer, clsBusinessLayer.cs ,is the workhorse layer. It communicates data requests from the presentation layer to the data layer, handles errors, and passes clean data back to the presentation layer. It also handles communication with outside applications through XML files. In the next part of the lab, we'll see how we can apply business rules
in the business layer also.

PART II: STEP D: Data Layer Functionality: Validating and Locking Users
As we implement our secure login, we'll begin at the lowest tier and work our way up. The Microsoft Access database Accounts.mdb has two tables. tblCustomers, which we have been working with so far, contains the site customers. The second table, tblUsers, has user account information, such as login credentials. Our site users are company employees and are not customers.

1. To validate a user's login credentials, we need to match the username and password to a username and password in the database. We can do that with a simple select that returns a record if the username and password match someone in the database. We then return a bool to indicate whether the credentials were valid.
ValidateUser Method in clsDataLayer.cls
public bool ValidateUser (string username, string passwd)
{
// Add your comments here
dbConnection.Open();
// Add your comments here
string sqlStmt = "SELECT * FROM tblUsers WHERE UserID = @id AND Pwd = @passwd AND Locked = FALSE";
// Add your comments here
OleDbCommand dbCommand = new OleDbCommand(sqlStmt,dbConnection);
// Add your comments here
dbCommand.Parameters.Add(new OleDbParameter("@id",username));
dbCommand.Parameters.Add(new OleDbParameter("@passwd",passwd));
// Add your comments here
OleDbDataReader dr = dbCommand.ExecuteReader();
//Add your comments here
Boolean isValidAccount = dr.Read();
//Add your comments here
dbConnection.Close();
returnis ValidAccount;
}

2. If the business layer has decided a user needs to be locked out of the application, the data layer can oblige this request by setting the LOCKED field for the user to TRUE. Because the SELECT in the previous method would only return a record if the LOCKED field was FALSE, setting LOCKED to TRUE prevents the user's record from ever being found, effectively locking them out.
LockUserAccount Method in clsDataLayer
public void LockUserAccount(string username)
{
// Add your comments here
dbConnection.Open();
// Add your comments here
string sqlStmt = "UPDATE tblUsers SET Locked = True WHERE UserID = @id";
// Add your comments here
OleDbCommand dbCommand=new OleDbCommand(sqlStmt,dbConnection);
// Add your comments here
dbCommand.Parameters.Add(new OleDbParameter("@id",username));
//Add your comments here
dbCommand.ExecuteNonQuery();
//Add your comments here
dbConnection.Close();
}

PART II: STEP E: Implement the Business Layer Functionality to Verify User Credentials
The business layer calls the data layer to validate login credentials, but must also implement our business rules restricting the number of login attempts. We have two rules that must be implemented:
If the same user fails to correctly enter his or her password three times, that user's account is locked and the person must contact the system admin to unlock it.
If there is a total of six failed login in attempts during the session, no matter the user, the application locks by hiding the login/submit button.
To accomplish these tasks, clsBusinessLayer needs access to the Session variable. This is only directly available on forms, so our presentation layer form will need to pass that to the business layer as an argument.
Here is the method we need to add to our business layer to validate the user's credentials and possibly lock the user's account:
CheckUserCredentials Method in clsBusinessLayer
public bool CheckUserCredentials(System.Web.SessionState.HttpSessionState currentSession, string username, string passwd)
{
// Add your comments here
currentSession["LockedSession"] = false;
// Add your comments here
int totalAttempts = Convert.ToInt32(currentSession["AttemptCount"])+1;
currentSession["AttemptCount"]=totalAttempts;
// Add your comments here
int userAttempts=Convert.ToInt32(currentSession[username])+1;
currentSession[username]=userAttempts;
// Add your comments here
if((userAttempts>3)||(totalAttempts>6))
{
currentSession["LockedSession"]=true;
myDataLayer.LockUserAccount(username);
}
return myDataLayer.ValidateUser(username,passwd);
}

PART II: STEP F: Create the Login Form
Now that the backend processing code is complete, we need to create a login form.

1. Create a new Web Form named pgLogin.aspx.
2. Edit the form to use the master page we created in Week 2, Web460Store.master.
3. In the left content area of the form, add the following fields:
Control Type ID / Name Value
Label lblUserID User ID:
TextBox txtUserID
Label lblPassword Password:
TextBox txtPassword **Should have TextMode set to Password
Button btnLogin Login
4. When you are finished, the form in design view should look similar to this image:

PART II: STEP G: Implement Login functionality
1. Last, we'll implement the code for the pgLogin form to tie together all the previous work in this lab. In the Click handler for btnLogin, we'll pass the login credentials to the business layer for verification. If the user is a valid user, we'll redirect to pgCheckOut.aspx.cs. If the account is locked, we display the appropriate message and hide the Login
button to prevent further login attempts. If the user simply entered an incorrect password or username, we'll display a message indicating the mistake.
btnLogin_Click Method in pgLogin.aspx.cs
protected void btnLogin_Click(object sender,EventArgs e)
{
// Add your comments here
// Please verify that your data directory path is correct!!!!
clsBusinessLayer myBusinessLayer = new clsBusinessLayer(Server.MapPath("~/App_Data/"));
// Add your comments here
bool isValidUser = myBusinessLayer.CheckUserCredentials(Session,txtUserID.Text,txtPassword.Text);
// Add your comments here
if(isValidUser)
{
// Add your comments here
Response.Redirect("~/pgCheckOut.aspx");
}
else if(Convert.ToBoolean(Session["LockedSession"]))
{
Master.UserFeedBack.Text="Account is disabled. Contact System Administrator";
// Hide login button :-)
btnLogin.Visible=false;
}
else
{
// Add your comments here
Master.UserFeedBack.Text="The User ID and/or Password supplied is incorrect. Please try again!";
}
}

2. We can modify the Page_Load method in pgLogin to prompt the user for their credentials.
Revised Page_Load Method in pgLogin.aspx.cs
protected void Page_Load(object sender, EventArgs e)
{
Master.UserFeedBack.Text="Please enter username and password.";
}

3. Set pgLogin.aspx as your Start Page and test your application. You should be able to log in with the username jsmith and password password1 or jdoe and password2. Also test the validation and lockout code.

PART II: STEP H: Harden Your Application (Optional)
This is an optional step that you can complete on your own. Below are two actions that can make our web application even more secure.
SQL Injection Prevention
Our application is vulnerable to an SQL injection attack since ValidateUser only checks to see if a record is found and not if the found record is the correct user record. Attackers can fool our application into always returning records by sending carefully crafted SQL as the username or password on our login form. The ValidateUser method will then return true
as if the correct username and password were given.
A quick fix for this is to modify our Data Layer ValidateUser method to verify that the username in the record returned matches the one we were sent as an argument. To implement this, you need to change the query to be similar to the query used in the FindCustomer method. Then compare the UserID field in the record returned from the database to the username
sent as an argument.
Encrypting Passwords in the Database
Our application stores user passwords in plaintext. If an attacker gains access to our server through a vulnerability in our application or possibly another application on the same server,user account passwords are exposed and easily compromised. The passwords should be stored as SHA1 hashes which will make them nearly impossible to reverse engineer.
Unless you have a hashing application available, it is easiest to create new user accounts and store the passwords for these new users as the SHA1 hash. Once you have new users created with hashed passwords stored in the database, you can delete the current user accounts that have unencrypted passwords.
Here is an overview of the steps needed to implement securely stored passwords:
- On the form pgLogin.aspx, add fields (User ID,Password,Verify Password) and a button to Create New User Account.
- Verify the two password fields match.
- Create a new record in tblUsers for this user and store the SHA1 hash of the password instead of the password.
- When a user logs in, search for the username in the database.
-- If a record is found, compute the SHA1 hash of the password the user supplied during the login attempt. Compare the SHA1 of the password entered by the user to the SHA1 password hash stored in the database. If they match, we have a valid user.
The following code uses the ASP .NET class SHA1CryptoServiceProvider to create theSHA1 hash of the variable userPassword and store it in the variable hashedPassword:
UnicodeEncoding encoding = new UnicodeEncoding();
SHA1 sha1Hasher = new SHA1CryptoServiceProvider();
byte[] hashedPassword = new byte[encoding.GetByteCount(userPassword)];
hashedPassword=sha1Hasher.ComputeHash(hashedPassword);
You can make your application even more secure by using salt with a SHA1 password hash, but that is beyond the scope what we can cover here.

1. Optionally add features to obscure passwords and prevent SQL injection
2. Finalize the Lab

PART II: STEP I: Finalize the Lab
1. Save your work!
2. Test it! Make changes as appropriate until it works. Try adding new records to the database.
3. Remember to add comments for each step being performed.
4. Please zip and submit the entire web project folder.

DBM 405A Lab 3 Database Creation and Table Manipulation

I. OBJECTIVES
1. Understand and become familiar with Table Manipulation.

II. PARTS LIST
1. EDUPE Omnymbus Environment (https://devry.edupe.net:8300); and/or
2. MySQL (dev.mysql.com/downloads).

III. PROCEDURE
By now you have set up either the Omnymbus environment or the MySQL Server Community environment, or both. You may do the labs in this class on your own computer equipped with MySQL or you may use the MySQL environment hosted by the vendor Omnymbus. You may even use both.

Lab Procedure Continued (common to both environments)
1. Add a table named "Season" to your Baseball database, which consists of the following fields:
a. Season (Integer)
b. PlayDate (date)
c. HomeTeam (character 5)
d. HomeTeamScore (Integer)
e. AwayTeam (character 5)
f. AwayTeamScore (Integer)
2. Populate the table with 56 unique games where each plays the other 7 twice (once as the home team and once as the away team). Make the season equal to this year. Leave the scores blank and use any date for the PlayDate.
3. Create another table called "PastSeasons" by copying the structure of the table "Season" and copying all the data from "Season" into the new table.
4. Replace the Season field in the table Season with next year for all records.
5. Unload the Season table data to a comma-delimited file.
6. Load the comma-delimited file to PastSeasons table, appending the data to the data that is already there.

WEB460 Lab 4 of 7: Create a Business Layer Class and Use an XML File

Scenario/Summary
This week, we add the business layer to our application. This layer handles business rules and data validation based on those rules. It also handles communication with external websites and applications, so this layer is where we implement creating, reading, and writing an XML file for data transfer.
If you haven't noticed, pgCheckOut.aspx.cs has become fairly large, making it difficult to maintain. The reason for this is that we have the pgCheckOut class doing much of the work that belongs in the business layer and data layer. Next week, we deal with this situation and refactor our code to better distribute the workload among the classes in our application.
Refactoring does not change the external functionality of software, but it changes the internal structure by reorganizing it. After refactoring our application, it should look the same to users but execute more efficiently and be easier to maintain. More on this next week. For now, let's add some GridView controls and XML interaction.

Here is an overview of the steps in this lab:
Step A: Set up a new website with a copy of the Week 3 Lab.
Step B: In the data layer, fill a DataSet with data on all the customers. We'll later bind this DataSet to a GridView.
Step C: Add control to pgCheckOUt.aspx. We will add two GridViews and two labels for the GridViews and a Button to update an XML file.
Step D: Bind one of the GridViews to the DataSet listing all customers in the database. We have it automatically update when the page is loaded and when customers are updated or added.
Step F: We build our business layer and have it read from and write to the XML file.
Step G: We bind the second GridView in pgCheckOut.aspx to the parsed data in the XML file and connect the Click event of btnUpdateXML to a method that updates the XML file.
This diagram shows the major components we will be working with in this lab and how they interact.
We have a lot to accomplish, so let's get started!

Lab Steps
STEP A: Set Up a New Web Site
1. Create a new Empty Web Site project.
2. Copy all the files from last week's Lab into the website folder for this week.
3. Test that your application functions and runs the same as it did last week.

STEP B: In the Data Layer, Fill a DataSet With all Customers
In our previous lab, we filled a DataSet with data on a single customer from the database. In this lab, we want to show the user a list of all customers, so we need to add a method to our data layer that fetches all the customers and fills a DataSet with this list.
In clsDataLayer.cs, add the following code for the GetAllCustomers method:
GetAllCustomers Method in clsDataLayer.cs
public dsAccounts GetAllCustomers()
{
//Add your comments here
OleDbDataAdapter sqlDataAdapter = new OleDbDataAdapter ( "select * from tblCustomers;", dbConnection );
//Add your comments here
dsAccounts myStoreDataSet = new dsAccounts();
sqlDataAdapter.Fill(myStoreDataSet.blCustomers);
// Add your comments here
return myStoreDataSet;
}

STEP C: Add Controls to pgCheckOut.aspx
In this step, we add two Labels, two GridViews, and a Button to pgCheckOut.aspx. One GridView will be bound to the database and the other to an XML file. The labels will label the GridView so that the user knows which each is. The Button is used to update the XML file after changes have been made to the database.
We do not bind the GridViews to a data source at this time! This will be done later in our C# code.
The first GridView, gvCustomerList, will be bound to a DataSet with records from the database.
The second GridView, gvXML, will be bound to a DataSet comprised of record from an XMLfile that we can use to transmit customer information to another application.
1. Add the two Label and GridView controls by adding the following statements after the lines for the Phone Number textbox on the left column of the web page:
<asp:Label ID="lblGVDataBase" runat="server" Text="Customers in Database:"></asp:Label><br/>
<asp:GridView ID="gvCustomerList" runat="server" Font-Size="9"></asp:GridView><br/>
<asp:Label ID="lblGVXML" runat="server" Text="Customers in XML File:"></asp:Label><br/>
<asp:GridView ID="gvXML" runat="server" Font-Size="9"></asp:GridView>
2. On the right column of the web page, add the following line to place a Button for updating the XML file below the Submit Order button:
<br/><br/>
<asp:Button ID="btnUpdateXML" runat="server" Text="Update XML File"/>
3.When you have completed this step, the design view of pgCheckOut.aspx should be similar to this image:

STEP D: Bind the First GridView inpgCheckOut.aspx.cs
Now that we have a method in our data layer that returns all the customers in a DataSetobject, we can bind that DataSet to our GridView control.
1. The private method BindCustomerGridView calls the data layer to fetch a list of all customers and then binds that to the GridView. Additionally, it stores the DataSet in the cache. Later, we'll use the cache to update the XML file.
Add the following to pgCheckOut.aspx.cs:
BindCustomerGridView Method for pgCheckOut.aspx.cs
private dsAccounts BindCustomerGridView()
{
// Add your comments here
// Depending on where you placed your Access database,
// one of the following lines may work better:
// tempPath = Server.MapPath("Accounts.mdb")
// tempPath = Server.MapPath("~/FPDB/Accounts.mdb")
string tempPath = Server.MapPath("~/App_Data/Accounts.mdb");
clsDataLayer myDataLayer=new clsDataLayer(tempPath);
// Add your comments here
dsAccounts customerListing=myDataLayer.GetAllCustomers();
// Add your comments here
gvCustomerList.DataSource=customerListing.tblCustomers;
// Add your comments here
gvCustomerList.DataBind();
Cache.Insert("CustomerDataSet",customerListing);
return customerListing;
}
2. We must now call this method so the GridView, gvCustomerList, is updated to reflect the customers in the database. There are three times we must call this method if we want the GridView to update without user interaction:
In the method Page_Load: When the page first loads, we perform the initial binding of the GridView.
In the method btnAdd_Click: After creating a new customer record, we ensure that it shows up in the GridView.
In the method btnUpdate_Click: After updating customer information, we ensure that the new information shows up in the GridView.
Add the following statements to the end of the Page_Load, btnUpdate_Click and btnAdd_Click methods in pgCheckOut.aspx.cs.
// Add your comments here
BindCustomerGridView();
3. Test your to code to ensure the gvCustomerList is properly bound and updated.

STEP E: Implementing the Business Layer
The business layer is implemented in C# class clsBusinessLayer. For this lab, there are three methods and two data fields that we need to create in clsBusinessLayer. In our next lab, we will refactor our application and add more functionality to this class.
The business layer functionality we need in this lab is the ability to read and write the XML file customers.xml. This is handled in the business layer because it does not directly involve the database and is part of the communication our application does with other applications. The XML file we create can be read from the disk by another application on our server or transmitted to a remote application.
1. Add a new class to your application, name it clsBusinessLayer.cs, and add the statement:
using System.Data;
2. Add two data fields to your class.
dataPath is the path on the server to the App_Data directory or whichever directory the user wants the XML file stored. This will be passed as an argument to the clsBusinessLayer constructor and initialized there.
The data field myDataLayer represents an instance of the data layer. We use this for our database interaction. Like all data fields, it is initialized in the constructor.
Data Fields for the Class clsBusinessLayer
// Add your comments here
string dataPath;
// Add your comments here
clsDataLayer myDataLayer;
3. Our clsBusinessClass constructor serves to initialize all our data fields (a programming best practice).
Constructor for clsBusinessLayer
public clsBusinessLayer(string serverMappedPath)
{
// Add your comments here
dataPath = serverMappedPath;
myDataLayer = new clsDataLayer(dataPath + "Accounts.mdb");
}
4. The next functionality to add to our business layer is the ability to read (or get) the XML file with customer data ( customers.xml). This method creates a DataSet to hold the customer records parsed from the XML file. It then attempts to read the XML file. If the file is not found, we catch the exception and fix the situation by creating a fresh XML file. We can read the new file and place it in the DataSet object.
Add this code to clsBusinessLayer.cs:
GetCustomerXMLFile Method in clsBusinessLayer.cs
public DataSet GetCustomerXMLFile()
{
// Add your comments here
DataSet xmlDataSet = new DataSet();
try
{
// Add your comments here
xmlDataSet.ReadXml(dataPath+"customers.xml");
}catch(System.IO.FileNotFoundException error)
{
// Add your comments here
dsAccounts customerListing = myDataLayer.GetAllCustomers();
customerListing.tblCustomers.WriteXml(dataPath+"customers.xml");
xmlDataSet.ReadXml(dataPath+"customers.xml");
}
// Add your comments here
return xmlDataSet;
}
5. Our last task with clsBusinessLayer.cs is to add a function that writes the XML data file, customers.xml. To do this, we will read the current list of customers from the Cache object. If you remember, previously, we saved the updated list of customer to the cache as a way to save returning to the database to read customer data. We can read from the cache, which is a much quicker operation.
Add this code to clsBusinessLayer.cs:
WriteCustomerXMLFile Method in clsBusinessLayer.cs
public DataSet WriteCustomerXMLFile(System.Web.Caching.Cache appCache)
{
// Add your comments here
DataSet xmlDataSet = (DataSet) appCache["CustomerDataSet"];
// Add your comments here
xmlDataSet.WriteXml(dataPath+"customers.xml");
// Add your comments here
return xmlDataSet;
}
We'll be able to test this code after we complete the next step.

STEP F: Calling the Business Layer and Binding aGridView
The last task we have is to bind the GridView, gvXML, to the data parsed from the XML file and update the XML file based on data stored in the Cache object.
1. Because our presentation layer class, pgCheckOut, will need to access the business layer frequently, let's create a data field of type clsBusinessLayer and initialize it in our Page_Load method. This activity is similar to how we handled the clsDataLayer object in our business layer class. Add the following data field to pgCheckOut.aspx.cs:
clsBusinessLayer myBusinessLayer;
Then in the Page_Load, add the following to initialize the data field:
//Add your comments here
// Ensure the argument to MapPath reflects the path
// To where the database is stored. This is also where the
// XML file will be saved. Don't forget the closing '/'
// If you are using Citrix, the directory should be ~/FPDB/
myBusinessLayer = new clsBusinessLayer(Server.MapPath("~/App_Data/"));
2.We can easily bind the GridView to the data in the XML file by asking the business layer to process the file and handle any errors. We can expect back a DataSet that webind to the GridView. Add the following code to pgCheckOut.aspx.cs:
BindXMLGridView Method in pgCheckOut.aspx.cs
public void BindXMLGridView()
{
// Add your comments here
gvXML.DataSource = myBusinessLayer.GetCustomerXMLFile();
gvXML.DataBind();
}
3. This method needs to be called when the page first loads so that gvXML displays data. Add the following statement to the end of the Page_Load method:
BindXMLGridView();
4. For this lab, we want to update gvXML manually (as opposed to automatically as we do with gvCustomerList). The following click method will be called from the Button btnUpdateXML. It updates the XML from the Cache object and then binds gvXML.
btnUpdateXML_Click Method in pgCheckOut.aspx.cs
public void btnUpdateXML_Click(object sender, EventArgs e)
{
// Add your comments here
gvXML.DataSource = myBusinessLayer.WriteCustomerXMLFile(Cache);
gvXML.DataBind();
}
5. Finally, we need to set the Click event for btnUpdateXML. In the ASP file pgCheckOut.aspx , add the following to the definition for btnUpdateXML :
OnClick="btnUpdateXML_Click"
6. At this point, you should be able to test the entire application's functionality.

STEP G: Finalize the Lab.
1. Save your work!
2. Test it! Make changes as appropriate until it works. Try updating or adding new records to the database.
3. Remember to add comments for each step being performed.
4. Please zip and submit the entire web project folder.

DBM 405A Lab 2 SQL Review

I. OBJECTIVES
1. Get access to a MySQL environment.
2. Familiarize yourself with the environment.

II. PARTS LIST
3. EDUPE Omnymbus Environment (https://devry.edupe.net:8300); and/or
4. MySQL (dev.mysql.com/downloads).

III. PROCEDURE
You may do the labs in this class on your own computer equipped with MySQL or you may use the MySQL environment hosted by the vendor Omnymbus. You may even use both.

Using MySQL on your own computer means downloading a version from dev.mysql.com/downloads and installing the database engine on your computer. This can be done easily and there are a number of resources on the web to help you with this process.

You may also use the MySQL environment hosted by Omnymbus by logging in with your credentials to https://devry.edupe.net:8300. 

Using the first approach will give you experience writing programs on a desktop computer and accessing a database. Using the second approach will give you experience writing applications that access a database in a cloud environment.

You are encouraged to use both approaches.

In the previous lab (Week 1), you have established a database environment (either MySQL Community Server or the Omnymbus environment). You may continue to use that environment or you my return to Week 1 to set up the alternate environment.

Lab Procedure Continued (common to both environments)
1. Use the database named “Baseball” created in last week’s lab.
2. Use the table named “Teams” which consists of the following fields:
a. TeamCode (character 5)
b. TName (character 20)
c. TAddress (character 30)
d. TCity (character 20)
e. TState (character 2)
f. TZip (character 9)
g. Wins (integer)
h. Losses (integer)
3. You should have a table with 8 teams.
4. Use the table named “Players”, which consists of the following fields:
a. FirstName (character 20)
b. LastName (character 30)
c. MidInit (character 1)
d. PAddress (character 30)
e. PCity (character 20)
f. PState (character 2)
g. PZip (character 9)
h. Phone (character 11)
i. Team (character 5)
5. You should have a table with 80 players (10 on each team). Players are identified by the Team field which matches the TeamCode in the Teams table.
6. Demonstrate the use of the WHERE clause by selecting and displaying only the players from one team.
7. Demonstrate the use of the COUNT function by determining how many players are on each team and displaying the results.
8. For each City, find the number of players who list their home in that city.
9. Demonstrate the ORDER BY clause by listing all the players in alphabetical order by last name within Team.

DBM 405A Lab 1 SQL Review

I. OBJECTIVES
a. Get access to a MySQL environment.
b. Familiarize yourself with the environment.

II. PARTS LIST
1. EDUPE Omnymbus Environment (https://devry.edupe.net:8300); and/or
2. MySQL (dev.mysql.com/downloads).

III. PROCEDURE
You may do the labs in this class on your own computer equipped with MySQL or you may use the MySQL environment hosted by the vendor Omnymbus. You may even use both.

Using MySQL on your own computer means downloading a version from dev.mysql.com/downloads and installing the database engine on your computer. This can be done easily and there are a number of resources on the web to help you with this process.

You may also use the MySQL environment hosted by Omnymbus by logging in with your credentials to https://devry.edupe.net:8300.

Using the first approach will give you experience writing programs on a desktop computer and accessing a database. Using the second approach will give you experience writing applications that access a database in a cloud environment.

You are encouraged to use both approaches.

Desktop MySQL Environment
1. Download the MySQL Community Server from the http://dev.mysql.com/downloads/ website.
2. Install MySQL on your computer.
3. Open the MySQL Environment on your computer.

Omnymbus Environment
1. Login to the MySQL Omnymbus Environment by following the instruction located in Doc Sharing (document titled “Login MySQL Omnymbus Environment”).

Lab Procedure Continued (common to both environments)
1. Create a database named “Baseball”.

2. Create a table named “Teams” and add the following fields:
a. TeamCode (character 5)
b. TName (character 20)
c. TAddress (character 30)
d. TCity (character 20)
e. TState (character 2)
f. TZip (character 9)
g. Wins (integer)
h. Losses (integer)

3. Populate the table with 8 teams.

4. Create a table named “Players” and add the following fields:
a. FirstName (character 20)
b. LastName (character 30)
c. MidInit (character 1)
d. PAddress (character 30)
e. PCity (character 20)
f. PState (character 2)
g. PZip (character 9)
h. Phone (character 11)
i. Team (character 5)

5. Populate the table with 80 players (10 on each team). For the team, use the TeamCode from the first table to identify the Team the player is on.
6. Display or list the data from both table to the screen or printer.