All user input is evil: Microsoft Web Protection Library

This application is something that should be under the belt of all web developers. I'm surprised that this library is not already bundled into ASP.NET MVC, which shows how little developers worry about securing an application. The good news is that there's a NuGet package already available.


If you're not sure what the AntiXSS library is, you should go and download it right now. It provides functions to sanitize user input, including but not limited to HTML and Javascript. The bad news is that you probably won't find a lot of documentation about it, but that's just because the library is really easy to use. Check it out here.

SQL Azure: Invalid object name 'sys.configurations'

This is a rather dumb error. I am able to connect to SQL Azure from SQL Server Management Studio in my work computer but not from my home computer. But if I connect to it from a query window in my home computer it works!


I'm guessing it has to do with the SSMS version or with Object Explorer. It's better not to waste time with these errors because you'll probably end up uninstalling the software (and spend a bunch of time on that) to make it work.


This thread helped me http://social.msdn.microsoft.com/Forums/en-US/windowsazuredata/thread/9e5b6854-9e5a-4e7d-b771-313aa5683b72/.

Failed to start Storage Emulator: the SQL Server instance ‘localhost\SQLExpress’ could not be found

I wonder why when you follow a tutorial there are always errors in the process which are not mentioned in the tutorial. It happened to me when following a Windows Azure "Hello, World" tutorial. This error is simple to solve though, just do this:

1) Open a command window and go to C:\Program Files\Windows Azure Emulator\emulator\devstore

2) Execute dsinit /server:localhost

In my case I don't use SQL Express, so I had to run the command above to point the Emulator to SQL Server.

Scaling guidlines from StackOverflow

If you build software using Microsoft technologies you might want to read this article. It outlines a set of lessons learned from StackOverflow on how to scale software and hardware.


One thing that is not clear to me is how to put a database in memory. In fact, it doesn't sound possible for SQL Server... I wonder what Jeff and Joel meant when they wrote that.

Fluent NHibernate tip of the day: Don't use table names that represent other database objects

But if you have to, you can escape the table name using the back-tick (when you create the mapping). I found the answer on stackoverflow. In general I think you should rename your table instead of using the back-tick. However, sometimes you have to work with legacy databases and there's no other choice.

Debugging ASP.NET MVC when the default model binder doesn't work

A few days ago I came across a strange problem with the default model binder in ASP.NET MVC. It turned out that the name of the parameter in an Action was "request", and this was confusing the default model binder.

It sounds simple to fix (just change the variable name), but the process to figure it out is not that easy. What will help you solve the problem is diving into the ASP.NET MVC framework source code. Follow this post to learn how to debug it. I also had to download the source code, add it to my solution and reference those projects.

To mock or not to mock

Obviously the answer is yes. The real question is which mock framework to use. I personally recommend using moq. It is easy to use, provides strong-typed programming and has good examples/documentation. If you look at Google Trends, it also seems to be really popular.