Relationships between the Tables

You create a new diagram from the Server Explorer: Drill down from Data Connections to your database (if you don't see your database you can add it as a new Data Connection), and then Database Diagrams. Right-click on Database Diagrams and select Add New Diagram. By following the wizard, you can add the tbh_Categories, tbh_Articles, and tbh_Comments tables to your diagram. As soon as the three tables are added to the underlying window, Server Explorer should recognize a relationship between tbh_Categories and tbh_Articles, and between tbh_Articles and tbh_Comments, and automatically create a parent-child relationship between them over the correct fields. However, if it does not, click on the tbh_Articles' CategoryID field and drag and drop the icons that appear over the tbh_Categories table. Once you release the button, a dialog with the relationship's properties appears, and you can ensure that the foreign key is the tbh_Articles' CategoryID field, while the primary key is tbh_Categories' CategoryID. Once the connection is set up, you also have to ensure that when a category record is deleted or updated, the action is cascaded to the child table too. To do this, select the connection, go to the Properties window (just press F4), and set the Delete Rule and Update Rule settings to Cascade, as shown in Figure 5-5.

Figure 5-5

The Update Rule = Cascade option ensures that if you change the CategoryID primary key in the tbh_Categories table, this change is propagated to the foreign keys in the tbh_Articles table. The primary key should never be changed, as it is an identity and the administration pages won't allow you to change it. The Delete Rule = Cascade option ensures that if you delete a category, all the related articles are deleted as well. This means you won't have to delete the child articles from the stored procedure that deletes a category because they will be deleted automatically. This option is very important and must be checked, because if you forget it you'll end up with a database filled with unreachable articles because the parent category no longer exists!

Now you have to create a relationship between tbh_Comments and tbh_Articles, based on the ArticleID field of both tables. As before, click the tbh_Comments' ArticleID field, drag and drop the icon over the tbh_Articles table and complete the Properties dialog as before. When you're done with the diagram, go up to the tab, right-click on it, and save the diagram. Make sure you let it change your tables as specified in the diagram.

Creating the Dtored Procedures

This section presents the code for some stored procedures. It covers a representative sample of the procedures, instead of every one, because the code is very similar whether you add, edit, or delete a category or article. The stored procedures that work with the articles are more complex than the respective procedures that manage the categories, because they have to join two tables, they have more parameters, and they support pagination, so these are the ones covered here.

CREATE PROCEDURE dbo.tbh_Articles_InsertArticle
(
   @AddedDate        datetime,
   @AddedBy          nvarchar(256),
   @CategoryID       int,
   @Title            nvarchar(256),
   @Abstract         nvarchar(4000),
   @Body             ntext,
   @Country          nvarchar(256),
   @State            nvarchar(256),
   @City             nvarchar(256),
   @ReleaseDate      datetime,
   @ExpireDate       datetime,
   @Approved         bit,
   @Listed           bit,
   @CommentsEnabled  bit,
   @OnlyForMembers   bit,
   @ArticleID        int OUTPUT
)
AS
SET NOCOUNT ON

INSERT INTO tbh_Articles
   (AddedDate, AddedBy, CategoryID, Title, Abstract, Body, Country, State, City,
      ReleaseDate, ExpireDate, Approved, Listed, CommentsEnabled, OnlyForMembers)
   VALUES (@AddedDate, @AddedBy, @CategoryID, @Title, @Abstract, @Body, @Country,
      @State, @City, @ReleaseDate, @ExpireDate, @Approved, @Listed,
      @CommentsEnabled, @OnlyForMembers)

SET @ArticleID = scope_identity()

CREATE PROCEDURE dbo.tbh_Articles_UpdateArticle
(
 @ArticleID        int,
 @CategoryID       int,
 @Title            nvarchar(256),
 @Abstract         nvarchar(4000),
 @Body             ntext,
 @Country          nvarchar(256),
 @State            nvarchar(256),
 @City             nvarchar(256),
 @ReleaseDate      datetime,
 @ExpireDate       datetime,
 @Approved         bit,
 @Listed           bit,
 @CommentsEnabled  bit,
 @OnlyForMembers   bit
)
AS

UPDATE tbh_Articles
   SET CategoryID = @CategoryID,
      Title = @Title,
      Abstract = @abstract,
      Body = @Body,
      Country = @Country,
      State = @State,
      City = @City,
      ReleaseDate = @ReleaseDate,
      ExpireDate = @ExpireDate,
      Approved = @Approved,
      Listed = @Listed,
      CommentsEnabled = @CommentsEnabled,
      OnlyForMembers = @OnlyForMembers
   WHERE ArticleID = @ArticleID

CREATE PROCEDURE dbo.tbh_Articles_ApproveArticle
(
 @ArticleID        int
)
AS

UPDATE tbh_Articles SET Approved = 1 WHERE ArticleID = @ArticleID

CREATE PROCEDURE dbo.tbh_Articles_InsertVote
(
   @ArticleID  int,
   @Rating     smallint
)
AS

UPDATE tbh_Articles
   SET Votes = Votes + 1,
       TotalRating = TotalRating + @Rating
   WHERE ArticleID = @ArticleID

CREATE PROCEDURE dbo.tbh_Articles_IncrementViewCount
(
   @ArticleID  int
)
AS

UPDATE tbh_Articles SET ViewCount = ViewCount + 1 WHERE ArticleID = @ArticleID

CREATE PROCEDURE dbo.tbh_Articles_DeleteArticle
(
 @ArticleID int
)
AS

DELETE tbh_Articles WHERE ArticleID = @ArticleID

CREATE PROCEDURE dbo.tbh_Articles_GetArticleByID
(
   @ArticleID int
)
AS
SET NOCOUNT ON

SELECT tbh_Articles.ArticleID, tbh_Articles.AddedDate, tbh_Articles.AddedBy,
   tbh_Articles.CategoryID, tbh_Articles.Title, tbh_Articles.Abstract,
   tbh_Articles.Body, tbh_Articles.Country, tbh_Articles.State, tbh_Articles.City,
   tbh_Articles.ReleaseDate, tbh_Articles.ExpireDate, tbh_Articles.Approved,
   tbh_Articles.Listed, tbh_Articles.CommentsEnabled, tbh_Articles.OnlyForMembers,
   tbh_Articles.ViewCount, tbh_Articles.Votes, tbh_Articles.TotalRating,
   tbh_Categories.Title AS CategoryTitle
   FROM tbh_Articles INNER JOIN
      tbh_Categories ON tbh_Articles.CategoryID = tbh_Categories.CategoryID
   WHERE ArticleID = @ArticleID

CREATE PROCEDURE dbo.tbh_Articles_GetArticles
(
   @PageIndex int,
   @PageSize int
)
AS
SET NOCOUNT ON

-- create a temporary table
CREATE TABLE #TempArticles
(
   ID int IDENTITY(1,1),
   ArticleID int

)

-- populate the temporary table
INSERT INTO #TempArticles (ArticleID)
   SELECT ArticleID FROM tbh_Articles ORDER BY ReleaseDate DESC

-- get a page of records from the temporary table,
-- and join them with the real table
SELECT ID, tbh_Articles.*
   FROM #TempArticles INNER JOIN tbh_Articles
      ON tbh_Articles.ArticleID = #TempArticles.ArticleID
   WHERE ID BETWEEN
      (@PageIndex*@PageSize+1) AND ((@PageIndex+1)*@PageSize)

CREATE PROCEDURE dbo.tbh_Articles_GetArticles
(
   @PageIndex  int,
   @PageSize   int
)
AS
SET NOCOUNT ON

SELECT * FROM
(
   SELECT tbh_Articles.ArticleID, tbh_Articles.AddedDate, tbh_Articles.AddedBy,
      tbh_Articles.CategoryID, tbh_Articles.Title, tbh_Articles.Abstract,
      tbh_Articles.Body, tbh_Articles.Country, tbh_Articles.State,
      tbh_Articles.City, tbh_Articles.ReleaseDate, tbh_Articles.ExpireDate,
      tbh_Articles.Approved, tbh_Articles.Listed, tbh_Articles.CommentsEnabled,
      tbh_Articles.OnlyForMembers, tbh_Articles.ViewCount, tbh_Articles.Votes,
      tbh_Articles.TotalRating, tbh_Categories.Title AS CategoryTitle,
      ROW_NUMBER() OVER (ORDER BY ReleaseDate DESC) AS RowNum
      FROM tbh_Articles INNER JOIN
         tbh_Categories ON tbh_Articles.CategoryID = tbh_Categories.CategoryID
) Articles
   WHERE Articles.RowNum BETWEEN
      (@PageIndex*@PageSize+1) AND ((@PageIndex+1)*@PageSize)
   ORDER BY ReleaseDate DESC

CREATE PROCEDURE dbo.tbh_Articles_GetArticleCount
AS
SET NOCOUNT ON

SELECT COUNT(*) FROM tbh_Articles

CREATE PROCEDURE dbo.tbh_Articles_GetPublishedArticlesByCategory
(
   @CategoryID    int,
   @CurrentDate   datetime,
   @PageIndex     int,
   @PageSize      int
)
AS
SET NOCOUNT ON

SELECT * FROM
(
   SELECT tbh_Articles.ArticleID, tbh_Articles.AddedDate, tbh_Articles.AddedBy,
      tbh_Articles.CategoryID, tbh_Articles.Title, tbh_Articles.Abstract,
      tbh_Articles.Body, tbh_Articles.Country, tbh_Articles.State,
      tbh_Articles.City, tbh_Articles.ReleaseDate, tbh_Articles.ExpireDate,
      tbh_Articles.Approved, tbh_Articles.Listed, tbh_Articles.CommentsEnabled,
      tbh_Articles.OnlyForMembers, tbh_Articles.ViewCount, tbh_Articles.Votes,
      tbh_Articles.TotalRating, tbh_Categories.Title AS CategoryTitle,
      ROW_NUMBER() OVER (ORDER BY ReleaseDate DESC) AS RowNum
      FROM tbh_Articles INNER JOIN
         tbh_Categories ON tbh_Articles.CategoryID = tbh_Categories.CategoryID
      WHERE Approved = 1 AND Listed = 1 AND
         ReleaseDate <= @CurrentDate AND ExpireDate > @CurrentDate
         AND tbh_Articles.CategoryID = @CategoryID
) Articles
   WHERE Articles.RowNum BETWEEN
      (@PageIndex*@PageSize+1) AND ((@PageIndex+1)*@PageSize)
   ORDER BY ReleaseDate DESC

CREATE PROCEDURE dbo.tbh_Articles_GetPublishedArticleCountByCategory
(
   @CategoryID    int,
   @CurrentDate   datetime
)
AS
SET NOCOUNT ON

SELECT COUNT(*) FROM tbh_Articles
   WHERE CategoryID = @CategoryID AND Approved = 1 AND Listed = 1 AND
      ReleaseDate <= @CurrentDate AND ExpireDate > @CurrentDate

The ArticleDetails Class

This class is implemented in the ~/App_Code/DAL/ArticleDetails.cs file. It wraps the article's entire data read from tbh_Articles. The constructor takes values as inputs, and saves them in the object's properties (the code that defines many properties is omitted for brevity's sake):

namespace MB.TheBeerHouse.DAL
{
   public class ArticleDetails
   {
      public ArticleDetails() { }

      public ArticleDetails(int id, DateTime addedDate, string addedBy,
         int categoryID, string categoryTitle, string title, string artabstract,
         string body, string country, string state, string city,
         DateTime releaseDate, DateTime expireDate, bool approved,
         bool listed, bool commentsEnabled, bool onlyForMembers,
         int viewCount, int votes, int totalRating)
      {
         this.ID = id;
         this.AddedDate = addedDate;
         this.AddedBy = addedBy;
         this.CategoryID = categoryID;
         this.CategoryTitle = categoryTitle;
         this.Title = title;
         this.Abstract = artabstract;
         this.Body = body;
         this.Country = country;
         this.State = state;
         this.City = city;
         this.ReleaseDate = releaseDate;
         this.ExpireDate = expireDate;
         this.Approved = approved;
         this.Listed = listed;

         this.CommentsEnabled = commentsEnabled;
         this.OnlyForMembers = onlyForMembers;
         this.ViewCount = viewCount;
         this.Votes = votes;
         this.TotalRating = totalRating;
      }

      private int _id = 0;
      public int ID
      {
         get { return _id;}
         set { _id = value;}
      }

      private DateTime _addedDate = DateTime.Now;
      public DateTime AddedDate
      {
         get { return _addedDate; }
         set { _addedDate = value; }
      }

      private string _addedBy = "";
      public string AddedBy
      {
         get { return _addedBy; }
         set { _addedBy = value; }
      }

      private int _categoryID = 0;
      public int CategoryID
      {
         get { return _categoryID; }
         set { _categoryID = value; }
      }

      private string _categoryTitle = "";
      public string CategoryTitle
      {
         get { return _categoryTitle; }
         set { _categoryTitle = value; }
      }

      private string _title = "";
      public string Title
      {
         get { return _title; }
         set { _title = value; }
      }

      /* The code for all other properties would go here... */Country,
   }

The BaseArticle Class

The first business class we'll implement is BaseArticle, which is used as the base class for the Article, Category, and Comment classes. It descends from the BizObject class developed in Chapter 3, adding some article-specific properties. It starts by defining three properties, ID, AddedDate, and AddedBy, that are common to all business classes in the articles module:

namespace MB.TheBeerHouse.BLL.Articles
{
   public abstract class BaseArticle : BizObject
   {
      private int _id = 0;
      public int ID
      {
         get { return _id; }
         protected set { _id = value; }
      }
      private DateTime _addedDate = DateTime.Now;
      public DateTime AddedDate
      {
         get { return _addedDate; }
         protected set { _addedDate = value; }
      }

      private string _addedBy = "";
      public string AddedBy
      {
         get { return _addedBy; }
         protected set { _addedBy = value; }
      }

It then defines a Settings property that returns an instance of the ArticlesElement configuration class:

      protected static ArticlesElement Settings
      {
         get { return Globals.Settings.Articles; }
      }

Finally, it has a CacheData method that takes a key and a value, and if the value is not null it creates a new entry in the Cache object returned by the base class:

      protected static void CacheData(string key, object data)
      {
         if (Settings.EnableCaching && data != null)
         {
            BizObject.Cache.Insert(key, data, null,
               DateTime.Now.AddSeconds(Settings.CacheDuration), TimeSpan.Zero);
         }
      }
   }
}

The CacheData method is located here instead of in the BizObject base class because it will cache the data only if caching is enabled, which is a module-specific setting (the forums module will have the EnableCaching setting as well, but it may have a different value).

The Category Class

The Category class (implemented in the file ~/App_Code/BLL/Articles/Category.cs) is not much different from the Article class, but it's shorter and simpler because it doesn't have as many wrapper properties and methods, no support for pagination (and thus fewer overloads), and nothing other than the basic CRUD methods. The most interesting properties are AllArticles and PublishedArticles, both of which use the lazy load pattern to retrieve the list of child articles. They use the Article's GetArticles static method, but they each use a different overload of it. PublishedArticles uses the overload that takes in a Boolean value indicating that you want to retrieve only published articles, and passes true:

private List<Article> _allArticles = null;
public List<Article> AllArticles
{
   get
   {
      if (_allArticles == null)
         _allArticles = Article.GetArticles(this.ID, 0, Category.MAXROWS);
      return _allArticles;
   }
}

private List<Article> _publishedArticles = null;
public List<Article> PublishedArticles
{
   get
   {
      if (_publishedArticles == null)
         _publishedArticles = Article.GetArticles(true, this.ID,
            0, Category.MAXROWS);
      return _publishedArticles;
   }
}

The ManageCategories.aspx Page

This page, located under the ~/Admin folder, allows the administrator and editors to add, delete, and edit article categories, as well as directly jump to the list of articles for a specific category. The screenshot of the page, shown in Figure 5-6, demonstrates what I'm talking about, and then you'll learn how to build it.

Figure 5-6

There's a GridView control that displays all the categories from the database (with the title, the description, and the graphical icon). Moreover, the icons on the very far right of the grid are, respectively, a HyperLink to the ManageArticles.aspx page, which lists the child articles of that category; a LinkButton to delete the category; and another one to edit it. When the pencil icon is clicked, the grid is not turned into edit mode as it was in the first edition of the book, but instead, the record is edited through the DetailsView box at the bottom of the page. This makes the page cleaner, and it doesn't mess with the layout if you need to edit more fields than those shown in Read mode. That is actually the case in this page, because the Importance field is not shown in the grid, but you can still edit it in the DetailsView.

The DetailsView is also used to show additional fields, even if in read-only mode, such as ID, AddedDate, and AddedBy. Finally, it is also used to insert a new category — the insert mode is the default in this case, so it is used when the page loads, or if you click the Cancel command while you're editing a current category. At the very bottom of the page is a control used to upload a file, typically an image used to graphically represent a category.

Now we'll examine the page's source code piece-by-piece. The first step is to create the ObjectDataSource that will be the data source for the GridView control that displays the categories. You only need to define the Select and Delete methods, because the updates and the inserts will be done by the DetailsView control, which has a different ObjectDataSource:

<asp:ObjectDataSource ID="objAllCategories" runat="server"
   TypeName="MB.TheBeerHouse.BLL.Articles.Category"
   SelectMethod="GetCategories" DeleteMethod="DeleteCategory">
</asp:ObjectDataSource>

The declaration of the GridView is similar to what you might use for ASP.NET 1.1's DataGrid, in that it has a <Columns> section where you define its columns. In particular, it has the following fields:

• An ImageField to show the image whose URL is returned by the Article's ImageUrl. This type of column is very convenient because you define everything in a single line. In ASP.NET 1.x you would have needed a TemplateColumn instead.

• A TemplateField to define a template column that shows the category's title and description.

• A HyperLinkField to create a link to ManageArticles.aspx, with the category's ID on the querystring, so that the page will retrieve it and display only that category's child articles.

• A CommandField of type Select that will be used to edit the category. We use the Select command instead of the Edit command because an Edit command would put that GridView's row into edit mode, and that isn't what we want. Instead, we want to select (highlight) the row and have the DetailsView below enter the edit mode for the selected row.

• A CommandField of type Delete.

Of course, there are also some other GridView properties to set, the most important being the DataSourceID that hooks up the ObjectDataSource to the grid, and DataKeyNames, to specify that the ID field is the key field. Here is the GridView's complete declaration:

<asp:GridView ID="gvwCategories" runat="server" AutoGenerateColumns="False"
   DataSourceID="objAllCategories" Width="100%" DataKeyNames="ID"
   OnRowDeleted="gvwCategories_RowDeleted" OnRowCreated="gvwCategories_RowCreated"
   OnSelectedIndexChanged="gvwCategories_SelectedIndexChanged" ShowHeader="false">
   <Columns>
      <asp:ImageField DataImageUrlField="ImageUrl">
         <ItemStyle Width="100px" />
      </asp:ImageField>
      <asp:TemplateField>
         <ItemTemplate>
            <div class="sectionsubtitle">
            <asp:Literal runat="server" ID="lblCatTitle"
               Text='<%# Eval("Title") %>' />
            </div>
            <br />
            <asp:Literal runat="server" ID="lblDescription"
               Text='<%# Eval("Description") %>' />
         </ItemTemplate>
      </asp:TemplateField>
      <asp:HyperLinkField
         Text="<img border='0' src='../Images/ArrowR.gif' alt='View articles' />"

         DataNavigateUrlFormatString="ManageArticles.aspx?ID={0}"
            DataNavigateUrlFields="ID">
         <ItemStyle HorizontalAlign="Center" Width="20px" />
      </asp:HyperLinkField>
      <asp:CommandField ButtonType="Image" SelectImageUrl="~/Images/Edit.gif"
         SelectText="Update category" ShowSelectButton="True">
         <ItemStyle HorizontalAlign="Center" Width="20px" />
      </asp:CommandField>
      <asp:CommandField ButtonType="Image" DeleteImageUrl="~/Images/Delete.gif"
         DeleteText="Delete category" ShowDeleteButton="True">
         <ItemStyle HorizontalAlign="Center" Width="20px" />
      </asp:CommandField>
   </Columns>
</asp:GridView>

There's a second ObjectDataSource used to handle the data retrieval, inserts, and updates from the bottom DetailsView. All parameters for the insert and update are automatically inferred from the DetailsView's fields. The only specific parameter is the category ID for the GetCategoryByID select method, which is set to the GridView's selected value (i.e., the key of the selected row):

<asp:ObjectDataSource ID="objCurrCategory" runat="server"
   TypeName="MB.TheBeerHouse.BLL.Articles.Category"
   InsertMethod="InsertCategory" SelectMethod="GetCategoryByID"
   UpdateMethod="UpdateCategory">
   <SelectParameters>
      <asp:ControlParameter ControlID="gvwCategories" Name="categoryID"
         PropertyName="SelectedValue" Type="Int32" />
   </SelectParameters>
</asp:ObjectDataSource>

The DetailsView control defines template fields for the Title, Importance, ImageUrl, and Description information, which are the fields that are not read-only. TemplateFields are usually better than an editable BoundFields because you typically need to validate input, and you can do that directly on the client side with some validators put into the TemplateField, which is better than doing the validation in the code-behind or in a business class:

<asp:DetailsView ID="dvwCategory" runat="server" AutoGenerateRows="False"
   DataSourceID="objCurrCategory" Height="50px" Width="50%"
   AutoGenerateEditButton="True" AutoGenerateInsertButton="True"
   HeaderText="Category Details" OnItemInserted="dvwCategory_ItemInserted"
   OnItemUpdated="dvwCategory_ItemUpdated" DataKeyNames="ID"
   OnItemCreated="dvwCategory_ItemCreated" DefaultMode="Insert"
   OnItemCommand="dvwCategory_ItemCommand">
   <FieldHeaderStyle Width="100px" />
   <Fields>
      <asp:BoundField DataField="ID" HeaderText="ID" ReadOnly="True"
         SortExpression="ID" InsertVisible="False" />
      <asp:BoundField DataField="AddedDate" HeaderText="AddedDate"
         InsertVisible="False" ReadOnly="True" SortExpression="AddedDate" />
      <asp:BoundField DataField="AddedBy" HeaderText="AddedBy"
         InsertVisible="False" ReadOnly="True" SortExpression="AddedBy" />
      <asp:TemplateField HeaderText="Title" SortExpression="Title">
         <ItemTemplate>

            <asp:Label ID="lblTitle" runat="server"
               Text='<%# Eval("Title") %>'></asp:Label>
         </ItemTemplate>
         <EditItemTemplate>
            <asp:TextBox ID="txtTitle" runat="server" Text='<%# Bind("Title") %>'
               MaxLength="256" Width="100%"></asp:TextBox>
            <asp:RequiredFieldValidator ID="valRequireTitle" runat="server"
               ControlToValidate="txtTitle" SetFocusOnError="true"
               Text="The Title field is required."
               ToolTip="The Title field is required." Display="Dynamic" />
         </EditItemTemplate>
      </asp:TemplateField>
      <asp:TemplateField HeaderText="Importance" SortExpression="Importance">
         <ItemTemplate>
            <asp:Label ID="lblImportance" runat="server"
               Text='<%# Eval("Importance") %>'></asp:Label>
         </ItemTemplate>
         <EditItemTemplate>
            <asp:TextBox ID="txtImportance" runat="server"
               Text='<%# Bind("Importance") %>' MaxLength="256"
               Width="100%"></asp:TextBox>
            <asp:RequiredFieldValidator ID="valRequireImportance" runat="server"
               ControlToValidate="txtImportance" SetFocusOnError="true"
               Text="The Importance field is required."
               ToolTip="The Importance field is required." Display="Dynamic" />
            <asp:CompareValidator ID="valInportanceType" runat="server"
               Operator="DataTypeCheck" Type="Integer"
               ControlToValidate="txtImportance"
               Text="The Importance must be an integer."
               ToolTip="The Importance must be an integer." Display="dynamic" />
         </EditItemTemplate>
      </asp:TemplateField>
      <asp:TemplateField HeaderText="Image" ConvertEmptyStringToNull="False">
         <ItemTemplate>
            <asp:Image ID="imgImage" runat="server"
               ImageUrl='<%# Eval("ImageUrl") %>'
               AlternateText='<%# Eval("Title") %>'
               Visible='<%# !string.IsNullOrEmpty(
                 DataBinder.Eval(Container.DataItem, "ImageUrl").ToString()) %>' />
         </ItemTemplate>
         <EditItemTemplate>
            <asp:TextBox ID="txtImageUrl" runat="server"
               Text='<%# Bind("ImageUrl") %>' MaxLength="256" Width="100%" />
         </EditItemTemplate>
      </asp:TemplateField>
      <asp:TemplateField HeaderText="Description" SortExpression="Description"
         ConvertEmptyStringToNull="False">
         <ItemTemplate>
            <asp:Label ID="lblDescription" runat="server"
               Text='<%# Eval("Description") %>' Width="100%"></asp:Label>
         </ItemTemplate>
         <EditItemTemplate>
            <asp:TextBox ID="txtDescription" runat="server"
               Text='<%# Bind("Description") %>' Rows="5" TextMode="MultiLine"

               MaxLength="4000" Width="100%"></asp:TextBox>
         </EditItemTemplate>
      </asp:TemplateField>
   </Fields>
</asp:DetailsView>

The page ends with the declaration of a control used to upload files on the server. This is done with a custom user control (which will be used in other pages as well) that will be covered soon.

public partial class ManageCategories : BasePage
{
   protected void gvwCategories_SelectedIndexChanged(object sender, EventArgs e)
   {
      dvwCategory.ChangeMode(DetailsViewMode.Edit);
   }

   protected void gvwCategories_RowDeleted(object sender,
      GridViewDeletedEventArgs e)
   {
      gvwCategories.SelectedIndex = -1;
      gvwCategories.DataBind();
      dvwCategory.ChangeMode(DetailsViewMode.Insert);
   }

   protected void gvwCategories_RowCreated(object sender, GridViewRowEventArgs e)
   {
      if (e.Row.RowType == DataControlRowType.DataRow)
      {
         ImageButton btn = e.Row.Cells[4].Controls[0] as ImageButton;
         btn.OnClientClick =

            " if (confirm(‘Are you sure you want to delete this category?') ==
false) return false; ";
      }
   }

   protected void dvwCategory_ItemInserted(object sender,
      DetailsViewInsertedEventArgs e)
   {
      gvwCategories.SelectedIndex = -1;
      gvwCategories.DataBind();
   }

   protected void dvwCategory_ItemUpdated(object sender,
      DetailsViewUpdatedEventArgs e)
   {
      gvwCategories.SelectedIndex = -1;
      gvwCategories.DataBind();
   }

   protected void dvwCategory_ItemCommand(object sender,
      DetailsViewCommandEventArgs e)
   {
      if (e.CommandName == "Cancel")
      {
         gvwCategories.SelectedIndex = -1;
         gvwCategories.DataBind();
      }
   }

   protected void dvwCategory_ItemCreated(object sender, EventArgs e)
   {
      if (dvwCategory.CurrentMode == DetailsViewMode.Insert)
      {
         TextBox txtImportance = (TextBox)dvwCategory.FindControl("txtImportance");
         txtImportance.Text = "0";
      }
   }
}

The ArticleListing.ascx User Control

As mentioned before, the code that lists articles in the administrative ManageArticles.aspx page, and the end-user BrowseArticles.aspx page, is located not in the pages themselves but in a separate user control called ~/Controls/ArticleListing.ascx. This control displays a paginable list of articles for all categories or for a selected category, allows the user to change the page size, and can highlight articles referring to events that happen in the user's country, state, or city (if that information is present in the user's profile). In Figure 5-7, you can see what the control will look like once it's plugged into the ManageArticles.aspx page. Note that because the current user is an editor, each article row has buttons to edit or delete it (the pencil and trashcan icons). These won't be displayed if the control is put into an end-user page and the current user is not an editor or administrator.

Figure 5-7

The control starts with the declaration of an ObjectDataSource that uses the Category's GetCategory method to retrieve the data, consumed by a DropDownList that serves as category picker to filter the articles:

<asp:ObjectDataSource ID="objAllCategories" runat="server"
   TypeName="MB.TheBeerHouse.BLL.Articles.Category"
   SelectMethod="GetCategories"></asp:ObjectDataSource>

<asp:Literal runat="server" ID="lblCategoryPicker">
   Filter by category:</asp:Literal>
<asp:DropDownList ID="ddlCategories" runat="server" AutoPostBack="True"
   DataSourceID="objAllCategories"
   DataTextField="Title" DataValueField="ID" AppendDataBoundItems="true"
   OnSelectedIndexChanged="ddlCategories_SelectedIndexChanged">
   <asp:ListItem Value="0">All categories</asp:ListItem>
</asp:DropDownList>

Note that an "All categories" ListItem is appended to those categories that were populated via databinding, so that the user can choose to have the articles of all categories displayed. To make this work, you also need to set the DropDownList's AppendDataBoundItems to true; otherwise, the binding will first clear the DropDownList and then add the items. There's another DropDownList that lets the user select the page size from a preconfigured list of values:

<asp:Literal runat="server" ID="lblPageSizePicker">Articles per page:</asp:Literal>
<asp:DropDownList ID="ddlArticlesPerPage" runat="server" AutoPostBack="True"
   OnSelectedIndexChanged="ddlArticlesPerPage_SelectedIndexChanged">
   <asp:ListItem Value="5">5</asp:ListItem>
   <asp:ListItem Value="10" Selected="True">10</asp:ListItem>
   <asp:ListItem Value="25">25</asp:ListItem>
   <asp:ListItem Value="50">50</asp:ListItem>
   <asp:ListItem Value="100">100</asp:ListItem>
</asp:DropDownList>

As you may remember from the "Design" section, the <articles> configuration element has a pageSize attribute that will be used as default for this PageSize DropDownList. If the value saved in the config file is not already present in the list, it will be appended and selected dynamically. This is handled in the code-behind file.

The remainder of the page contains a GridView for listing the articles. It needs an ObjectDataSource that uses the Article class as a business object, and its GetArticles and DeleteArticle methods are used to select and delete articles. Because it uses pagination, you must also specify the method that returns the total number of articles: GetArticleCount. The overload of GetArticles used in this situation is the one that takes a Boolean value indicating whether you want all the articles or only published ones, the ID of the parent category, the index of the first row to retrieve, and the page size. You don't have to specify the last two parameters explicitly — they are implicitly added and their value filled in when the control has the EnablePaging property set to true. The ID of the parent category is set to the selected value of the ddlCategories DropDownList. Finally, the publishedOnly parameter is set to true by default, but this can be changed from the code-behind according to a custom property added to the user control, which you'll see shortly. This is the code for the ObjectDataSource:

<asp:ObjectDataSource ID="objArticles" runat="server"
   TypeName="MB.TheBeerHouse.BLL.Articles.Article"
   DeleteMethod="DeleteArticle" SelectMethod="GetArticles"
   SelectCountMethod="GetArticleCount" EnablePaging="True" >
   <DeleteParameters>
      <asp:Parameter Name="id" Type="Int32" />
   </DeleteParameters>
   <SelectParameters>
      <asp:Parameter Name="publishedOnly" Type="Boolean" DefaultValue="true" />
      <asp:ControlParameter ControlID="ddlCategories" Name="categoryID"
         PropertyName="SelectedValue" Type="Int32" />
   </SelectParameters>
</asp:ObjectDataSource>

Next we'll cover the GridView that displays articles. Generally, a GridView is used to display data with a tabular format. In this case, however, we're building a single-column grid of type TemplateField, which shows the article's title, abstract, location, author, release date, and view count each on a separate line. We couldn't fit all these items on separate columns of the same line because some of them are very wide (title and abstract), so why not just use a Repeater or a DataList in this case? Because the GridView has built-in support for pagination, whereas the other two databound controls do not. The template also includes a Panel with ImageButton controls to delete and approve the article, and a link to AddEditArticle.aspx to edit the article. The Panel's Visible property is bound to an expression that returns true (and thus makes the panel and its content visible) only if the current user is an administrator or an editor:

<asp:GridView SkinID="Articles" ID="gvwArticles" runat="server" AllowPaging="True"
   AutoGenerateColumns="False" DataKeyNames="ID" DataSourceID="objArticles"
   PageSize="10" ShowHeader="False"
   EmptyDataText="<b>There is no article to show for the selected category</b>"
   OnRowDataBound="gvwArticles_RowDataBound" OnRowCommand="gvwArticles_RowCommand">
   <Columns>
      <asp:TemplateField
         HeaderText="Article List (including those not yet published)">
         <HeaderStyle HorizontalAlign="Left" />
         <ItemTemplate>
            <div class="articlebox">
            <table cellpadding="0" cellspacing="0" style="width: 100%;"><tr><td>
               <div class="articletitle">
               <asp:HyperLink runat="server" ID="lnkTitle" CssClass="articletitle"
                  Text='<%# Eval("Title") %>'

                  NavigateUrl='<%# "~/ShowArticle.aspx?ID="+ Eval("ID") %>'/>
               <asp:Image runat="server" ID="imgKey" ImageUrl="~/Images/key.gif"
                  AlternateText="Requires login"
                  Visible='<%# (bool)Eval("OnlyForMembers") &&
                     !Page.User.Identity.IsAuthenticated %>' />
               <asp:Label runat="server" ID="lblNotApproved" Text="Not approved"
                  SkinID="NotApproved" Visible='<%# !(bool)Eval("Approved") %>' />
               </div>
            </td>
            <td style="text-align: right;">
               <asp:Panel runat="server" ID="panEditArticle"
                  Visible='<%# UserCanEdit %>'>
               <asp:ImageButton runat="server" ID="btnApprove"
                  ImageUrl="~/Images/checkmark.gif" CommandName="Approve"
                  CommandArgument='<%# Eval("ID") %>'
                  AlternateText="Approve article"
                  Visible='<%# !(bool)Eval("Approved") %>'
                  OnClientClick="if (confirm(‘Are you sure you want to approve
this article?') == false) return false; "/>
               &nbsp;&nbsp;
               <asp:HyperLink runat="server" ID="lnkEdit" ToolTip="Edit article"
                  NavigateUrl='<%# "~/Admin/AddEditArticle.aspx?ID="+
                     Eval("ID") %>' ImageUrl="~/Images/Edit.gif" />
               &nbsp;&nbsp;
               <asp:ImageButton runat="server" ID="btnDelete"
                  ImageUrl="~/Images/Delete.gif"
                  CommandName="Delete" AlternateText="Delete article"
                  OnClientClick="if (confirm(‘Are you sure you want to delete this
article?') == false) return false; "/>
               </asp:Panel>
            </td></tr></table>
            <b>Rating: </b>
            <asp:Literal runat="server" ID="lblRating"
               Text='<%# Eval("Votes") + "user(s) have rated this article "%>' />
            <mb:RatingDisplay runat="server" ID="ratDisplay"
               Value='<%# Eval("AverageRating") %>' />
            <br />

            <b>Posted by: </b> <asp:Literal runat="server" ID="lblAddedBy"
               Text='<%# Eval("AddedBy") %>' />, on
            <asp:Literal runat="server" ID="lblAddedDate"
               Text='<%# Eval("ReleaseDate", "{0:d}") %>' />, in category "
            <asp:Literal runat="server" ID="lblCategory"
               Text='<%# Eval("CategoryTitle") %>' />"
            <br />
            <b>Views: </b>
            <asp:Literal runat="server" ID="lblViews"
               Text='<%# "this article has been read "+
                  Eval("ViewCount") + "times" %>' />
            <asp:Literal runat="server" ID="lblLocation"
               Visible='<%# Eval("Location").ToString().Length > 0 %>'
               Text='<%# "<br /><b>Location: </b>" + Eval("Location") %>' />
            <br />
            <div class="articleabstract">
            <b>Abstract: </b>

            <asp:Literal runat="server" ID="lblAbstract"
               Text='<%# Eval("Abstract") %>' />
            </div>
            </div>
         </ItemTemplate>
      </asp:TemplateField>
   </Columns>
</asp:GridView>

The two ImageButton controls use the OnClientClick property to specify a JavaScript Confirm dialog that will execute the postback only after an explicit user confirmation. This isn't done from the grid's RowCreated event as it is in the ManageCategories.aspx page because here the ImageButton controls are defined explicitly (and thus you can set their OnClientClick property directly from the markup code), while in the previous page the ImageButton was created dynamically by the CommandField column.

The code for the Article rating is defined here also, and it's in a RatingDisplay control, whose Value property is bound to the Article's AverageRating property.

Finally, on the right side of the article's title there is an Image representing a key indicating that the article requires the user to login before viewing it. This image is only displayed when the article's OnlyForMembers property is true and the current user is anonymous.

The RatingDisplay.ascx Control

The ArticleListing control uses a secondary user control that you haven't seen yet. It's the RatingDisplay.ascx user control, which shows an image representing the average rating of an article. Many sites use star icons for this, but TheBeerHouse, in keeping with its theme, uses glasses of beer for this rating! There are nine different images, representing one glass, one glass and a half, two glasses, two glasses and a half, and so on until we get to five full glasses. The proper image will be chosen according to the average rating passed in to the Value property's setter function. The markup code only defines an Image and a Label:

<asp:Image runat="server" ID="imgRating" AlternateText="Average rating" />
<asp:Label runat="server" ID="lblNotRated" Text="(Not rated)" />

All the code is in the code-behind's setter function, which determines which image to display based on the value:

private double _value = 0.0;
public double Value
{
   get {return _value; }
   set
   {
      _value = value;
      if (_value >= 1)
      {
         lblNotRated.Visible = false;
         imgRating.Visible = true;
         imgRating.AlternateText = "Average rating: " + _value.ToString("N1");
         string url = "~/images/stars{0}.gif";
         if (_value <= 1.3)
            url = string.Format(url, "10");
         else if (_value <= 1.8)
            url = string.Format(url, "15");
         else if (_value <= 2.3)
            url = string.Format(url, "20");
         else if (_value <= 2.8)
            url = string.Format(url, "25");
         else if (_value <= 3.3)
            url = string.Format(url, "30");
         else if (_value <= 3.8)
            url = string.Format(url, "35");
         else if (_value <= 4.3)
            url = string.Format(url, "40");
         else if (_value <= 4.8)
            url = string.Format(url, "45");
         else
            url = string.Format(url, "50");
         imgRating.ImageUrl = url;
      }
      else
      {
         lblNotRated.Visible = true;
         imgRating.Visible = false;
      }
   }
}

In addition to the graphical representation, a more accurate numerical value is shown in the image's alternate text (tooltip).

The ManageArticles.aspx Page

This page just has an instance of the ArticlesListing control, with the PublishedOnly property set to false so that it displays all articles:

<%@ Register Src="../Controls/ArticleListing.ascx"
   TagName="ArticleListing" TagPrefix="mb" %>
...
<mb:ArticleListing id="ArticleListing1" runat="server" PublishedOnly="False" />

The AddEditArticle.aspx Page

This page allows Administrators, Editors, and Contributors to add new articles or edit existing ones. It decides whether to use edit or insert mode according to whether an ArticleID parameter was passed on the querystring. If it was, then the page loads in edit mode for that article, but only if the user is an Administrator or Editor (the edit mode is only available to Administrators and Editors, while the insert mode is also available to Contributors as well). This security check must be done programmatically, instead of declaratively from the web.config file. Figure 5-8 is a screenshot of the page while in edit mode for an article.

Figure 5-8

As you might guess from studying this picture, it uses a DetailsView with a few read-only fields (ID, AddedDate, and AddedBy as usual, but also ViewCount, Votes, and Rating) and many other editable fields. The Body field uses the open-source FCKeditor described earlier. It is declared on the page as any other custom control, but it requires some configuration first. To set up FCK you must download two packages from www.fckeditor.net:

1. FCKeditor (which at the time of writing is in version 2.1) includes the set of HTML pages and JavaScript files that implement the control. The control can be used not only with ASP.NET, but also with ASP, JSP, PHP, and normal HTML pages. This first package includes the "hostindependent" code, and some ASP/ASP.NET/JSP/PHP pages that implement an integrated file browser and file uploader.

2. FCKedit.Net is the .NET custom control that wraps the HTML and JavaScript code of the editor.

You unzip the first package into an FCKeditor folder, underneath the site's root folder. Then you unzip the second package and put the compiled dll underneath the site's bin folder. The .NET custom control class has a number of properties that let you customize the look and feel of the editor; some properties can only be set in the fckconfig.js file found under the FCKeditor folder. The global FCKConfig JavaScript editor enables you to configure many properties, such as whether the File Browser and Image Upload commands are enabled. Here's how to disable them in code (we already have our own file uploader so we don't want to use it here, and we don't want to use the file browser for security reasons):

FCKConfig.LinkBrowser = false;
FCKConfig.ImageBrowser = false;
FCKConfig.LinkUpload = false;
FCKConfig.ImageUpload = false;

You can even create a customized editor toolbar by adding the commands that you want to implement. For example, this shows how you can define a toolbar named "TheBeerHouse" with commands to format the text, insert smileys and images, but not insert input controls or Flash animations:

FCKConfig.ToolbarSets["TheBeerHouse"] = [
 [‘Source','Preview','Templates'],
 [‘Cut','Copy','Paste','PasteText','PasteWord','-','Print','SpellCheck'],
 [‘Undo','Redo','-','Find','Replace','-','SelectAll','RemoveFormat'],
 [‘Bold','Italic','Underline','StrikeThrough','-','Subscript','Superscript'],
 [‘OrderedList','UnorderedList','-','Outdent','Indent'],
 [‘JustifyLeft','JustifyCenter','JustifyRight','JustifyFull'],
 [‘Link','Unlink','Anchor'],
 [‘Image','Table','Rule','Smiley','SpecialChar','UniversalKey'],
 [‘Style','FontFormat','FontName','FontSize'],
 [‘TextColor','BGColor'],
 [‘About']
];

Many other configurations can be set directly from the ASP.NET page that hosts the control, as you'll see shortly.

The AddEditArticle.aspx page first declares the ObjectDataSource, as usual. Then it uses the Article's GetArticleByID, DeleteArticle, InsertArticle, and UpdateArticle methods for the complete management of a single article:

<asp:ObjectDataSource ID="objCurrArticle" runat="server"
   TypeName="MB.TheBeerHouse.BLL.Articles.Article"
   DeleteMethod="DeleteArticle" InsertMethod="InsertArticle"
   SelectMethod="GetArticleByID" UpdateMethod="UpdateArticle">
   <SelectParameters>
      <asp:QueryStringParameter Name="articleID"
         QueryStringField="ID" Type="Int32" />
   </SelectParameters>
</asp:ObjectDataSource>

The only explicit parameter is the optional articleID value passed on the querystring. The parameters for the Delete, Update, and Insert methods are automatically inferred from the DetailsView's fields and the method's signature. Two other ObjectDataSource controls are used on the page: one for the DropDownList with the available categories, and the other for the DropDownList with countries:

<asp:ObjectDataSource ID="objAllCategories" runat="server"
   TypeName="MB.TheBeerHouse.BLL.Articles.Category" SelectMethod="GetCategories">
</asp:ObjectDataSource>
<asp:ObjectDataSource ID="objAllCountries" runat="server"
   TypeName="MB.TheBeerHouse.UI.Helpers" SelectMethod="GetCountries">
   <SelectParameters>
      <asp:Parameter DefaultValue="true" Name="insertEmpty" Type="Boolean" />
   </SelectParameters>
</asp:ObjectDataSource>

The DetailsView control uses a BoundField for some read-only fields mentioned earlier, and uses TemplateFields for the editable fields. We don't use DataBound fields for the editable properties because that wouldn't support the use of validators. Many of the fields are edited by means of a textbox for text properties, a checkbox for Boolean properties (e.g., OnlyForMembers, Listed, Approved), or a DropDownList for lists of values (Country and Category). The following code shows some representative fields:

<asp:DetailsView ID="dvwArticle" runat="server" AutoGenerateDeleteButton="True"
   AutoGenerateEditButton="True" AutoGenerateInsertButton="True"
   AutoGenerateRows="False" DataKeyNames="ID" DataSourceID="objCurrArticle"
   DefaultMode="Insert" HeaderText="Article Details"
   OnItemCreated="dvwArticle_ItemCreated" OnDataBound="dvwArticle_DataBound"
   OnModeChanged="dvwArticle_ModeChanged">
   <FieldHeaderStyle Width="100px" />
   <Fields>
      <asp:BoundField DataField="ID" HeaderText="ID" InsertVisible="False"
         ReadOnly="True" />
      <asp:BoundField DataField="AddedDate" HeaderText="AddedDate"
         InsertVisible="False" ReadOnly="True" DataFormatString="{0:f}" />
      <!-- other read-only BoundFields... -->
      <asp:TemplateField HeaderText="CategoryID">
         <ItemTemplate>
            <asp:Label ID="lblCategory" runat="server"
               Text='<%# Eval("CategoryTitle") %>'></asp:Label>
         </ItemTemplate>
         <EditItemTemplate>
            <asp:DropDownList ID="ddlCategories" runat="server"
               DataSourceID="objAllCategories" DataTextField="Title"
               DataValueField="ID"
               SelectedValue='<%# Bind("CategoryID") %>' Width="100%" />
         </EditItemTemplate>
      </asp:TemplateField>
      <asp:TemplateField HeaderText="Title">
         <ItemTemplate>
            <asp:Label ID="lblTitle" runat="server"
               Text='<%# Eval("Title") %>'></asp:Label>
         </ItemTemplate>
         <EditItemTemplate>
            <asp:TextBox ID="txtTitle" runat="server" Text='<%# Bind("Title") %>'
               Width="100%" MaxLength="256"></asp:TextBox>
            <asp:RequiredFieldValidator ID="valRequireTitle" runat="server"
               ControlToValidate="txtTitle" SetFocusOnError="true"
               Text="The Title field is required."
               ToolTip="The Title field is required."
               Display="Dynamic"></asp:RequiredFieldValidator>
         </EditItemTemplate>
      </asp:TemplateField>
      <asp:TemplateField HeaderText="Abstract" SortExpression="Abstract">
         <ItemTemplate>
            <asp:Label ID="lblAbstract" runat="server"
               Text='<%# Eval("Abstract") %>'></asp:Label>
         </ItemTemplate>
         <EditItemTemplate>
            <asp:TextBox ID="txtAbstract" runat="server"
               Text='<%# Bind("Abstract") %>' Rows="5" TextMode="MultiLine"
               Width="100%" MaxLength="4000"></asp:TextBox>
         </EditItemTemplate>
      </asp:TemplateField>
      <asp:TemplateField HeaderText="Body" SortExpression="Body">
         <ItemTemplate>
            <asp:Label ID="lblBody" runat="server"

               Text='<%# Eval("Body") %>'></asp:Label>
         </ItemTemplate>
         <EditItemTemplate>
            <fckeditorv2:fckeditor id="txtBody" runat="server"
               Value='<%# Bind("Body") %>'
               ToolbarSet="TheBeerHouse" Height="400px" Width="100%" />
         </EditItemTemplate>
      </asp:TemplateField>
      <asp:TemplateField HeaderText="Approved" SortExpression="Approved">
         <ItemTemplate>
            <asp:CheckBox ID="chkApproved" runat="server"
               Checked='<%# Eval("Approved") %>' Enabled="False" />
         </ItemTemplate>
         <EditItemTemplate>
            <asp:CheckBox ID="chkApproved" runat="server"
               Checked='<%# Bind("Approved") %>' />
         </EditItemTemplate>
      </asp:TemplateField>
      <!-- other editable TemplateFields... -->
   </Fields>
</asp:DetailsView>
<p></p>
<mb:FileUploader id="FileUploader1" runat="server">
</mb:FileUploader>

The declaration of the FCKeditor shows the use of the ToolbarSet property, which references the TheBeerHouse toolbar defined earlier in the JavaScript configuration file.

protected void Page_Load(object sender, EventArgs e)
{
   if (!this.IsPostBack)
   {
      if (!string.IsNullOrEmpty(this.Request.QueryString["ID"]))
      {
         if (this.User.Identity.IsAuthenticated &&
            (this.User.IsInRole("Administrators") ||
             this.User.IsInRole("Editors")))
         {
            dvwArticle.ChangeMode(DetailsViewMode.Edit);
         }
         else
            throw new SecurityException(
               "You are not allowed to edit existent articles!");
      }
   }
}

protected void dvwArticle_ItemCreated(object sender, EventArgs e)
{
   Control ctl = dvwArticle.FindControl("txtBody");
   if (ctl != null)
   {
      FCKeditor txtBody = ctl as FCKeditor;
      txtBody.BasePath = this.BaseUrl + "FCKeditor/";
   }
}

protected void dvwArticle_DataBound(object sender, EventArgs e)
{
   if (dvwArticle.CurrentMode == DetailsViewMode.Insert)
   {
      CheckBox chkApproved = dvwArticle.FindControl("chkApproved") as CheckBox;
      CheckBox chkListed = dvwArticle.FindControl("chkListed") as CheckBox;
      CheckBox chkCommentsEnabled = dvwArticle.FindControl("chkCommentsEnabled")
         as CheckBox;

      chkListed.Checked = true;
      chkCommentsEnabled.Checked = true;

      bool canApprove = (this.User.IsInRole("Administrators") ||
         this.User.IsInRole("Editors"));
      chkApproved.Enabled = canApprove;
      chkApproved.Checked = canApprove;
   }
}

The ManageComments.aspx Page

This page is located under the ~/Admin/ folder and it displays all comments of all articles, from the newest to the oldest, and allows an administrator or an editor to moderate the feedback by editing or deleting comments that may not be considered suitable. The page uses a paginable GridView for displaying the comments and a separate DetailsView on the bottom of the page to edit the comment selected in the grid. Figure 5-9 shows a screenshot of this page.

Figure 5-9

I won't cover the code for this page in detail because it's similar to other code that's already been discussed. The pagination for the GridView is implemented the same way as the pagination in the ArticleListing user control, and the editable DetailsView connected to the GridView's selected row is like the DetailsView in the page ManageCategories.aspx. You can refer to the downloadable code for the complete implementation.

The ShowCategories.aspx Page

This is the first end-user page of this module, located in the site's root folder. Its only purpose is to display the article categories in a nice format, so that the reader can easily and clearly understand what the various categories are about and quickly jump to their content by clicking on the category's title. Figure 5-10 shows this page.

Figure 5-10

The list of categories is implemented as a DataList with two columns (with repeatColumns set to 2). We don't need pagination, sorting, or editing features here, so a simple DataList with support for repeated columns is adequate. Following is the code for the DataList and its companion ObjectDataSource:

<asp:ObjectDataSource ID="objAllCategories" runat="server" SelectMethod="GetCategories"
   TypeName="MB.TheBeerHouse.BLL.Articles.Category">
</asp:ObjectDataSource>

<asp:DataList ID="dlstCategories" EnableTheming="false" runat="server"
   DataSourceID="objAllCategories" DataKeyField="ID"
   GridLines="None" Width="100%" RepeatColumns="2">
   <ItemTemplate>
      <table cellpadding="6" style="width: 100%;">
         <tr>
            <td style="width: 1px;">
            <asp:HyperLink runat="server" ID="lnkCatImage"
                  NavigateUrl='<%# "BrowseArticles.aspx?CatID="+ Eval("ID") %>' >
               <asp:Image runat="server" ID="imgCategory" BorderWidth="0px"
                  AlternateText='<%# Eval("Title") %>'
                  ImageUrl='<%# Eval("ImageUrl") %>' />
            </asp:HyperLink>
            </td>
            <td>
               <div class="sectionsubtitle">
               <asp:HyperLink runat="server" ID="lnkCatRss"
                  NavigateUrl='<%# "GetArticlesRss.aspx?CatID="+ Eval("ID") %>'>
                  <img style="border-width: 0px;" src="Images/rss.gif"
                     alt="Get the RSS for this category" /></asp:HyperLink>
               <asp:HyperLink runat="server" ID="lnkCatTitle"
                  Text='<%# Eval("Title") %>'
                  NavigateUrl='<%# "BrowseArticles.aspx?CatID="+ Eval("ID") %>' />
               </div>
               <br />
               <asp:Literal runat="server" ID="lblDescription"
                  Text='<%# Eval("Description") %>' />
            </td>
         </tr>
      </table>
   </ItemTemplate>
</asp:DataList>

The category's image and the title both link to the BrowseArticle.aspx page, with a CatID parameter on the querystring equal to the ID of the clicked row. This is the page we'll cover next. The Show Categories.aspx has no code in the code-behind file because its data values are generated by the DataList and ObjectDataSource pair, and there are no actions or events we need to handle.

The ShowArticle.aspx Page

This end-user page outputs the whole article's text, and all its other information (author, release date, average rating, number of views, etc.). At the bottom of the page it has input controls to let the user rate the article (from one to five glasses of beer) and to submit comments. All comments are listed in chronological order, on a single page, so that it's easy to follow the discussion. When the page is loaded by an editor or an administrator, some additional buttons to delete, approve, and edit the article are also visible, and this also applies to the comments. Figure 5-12 shows a screenshot of the page as seen by an end user.

Figure 5-12

The code that renders the title, rating, and other information in the upper box is very similar to the code used in the ArticleListing user control, so I won't list it here again. The article's content is displayed in a simple Literal control. Let's consider the controls that allow the user to rate the article and provide feedback. The possible rating values are listed in a DropDownList, and below that there's a Label that tells the user what rating she selected. The Label will be made visible only after the user rates the article, of course, and once that happens the DropDownList will be hidden. This will be true also for future loads of the same article by the same user, because the vote will be remembered in a cookie, as you'll see shortly in the code-behind file:

<div class="sectiontitle">How would you rate this article?</div>
<asp:DropDownList runat="server" ID="ddlRatings">
   <asp:ListItem Value="1" Text="1 beer" />
   <asp:ListItem Value="2" Text="2 beers" />
   <asp:ListItem Value="3" Text="3 beers" />
   <asp:ListItem Value="4" Text="4 beers" />
   <asp:ListItem Value="5" Text="5 beers" Selected="true" />
</asp:DropDownList>
<asp:Button runat="server" ID="btnRate" Text="Rate"
   OnClick="btnRate_Click" CausesValidation="false" />
<asp:Literal runat="server" ID="lblUserRating" Visible="False"
   Text="Your rated this article {0} beer(s). Thank you for your feedback." />

The rest of the page defines a DataList and an accompanying ObjectDataSource for listing the current comments. I won't show this piece because there's nothing new here. Instead, note the DetailsView at the bottom of the page, which is used to post a new comment and edit existing ones (when a comment in the DataList just shown is selected by an editor or administrator):

<asp:DetailsView id="dvwComment" runat="server" AutoGenerateInsertButton="True"
   AutoGenerateEditButton="true" AutoGenerateRows="False"
   DataSourceID="objCurrComment" DefaultMode="Insert"
   OnItemInserted="dvwComment_ItemInserted" OnItemCommand="dvwComment_ItemCommand"
   DataKeyNames="ID" OnItemUpdated="dvwComment_ItemUpdated"
   OnItemCreated="dvwComment_ItemCreated">
   <FieldHeaderStyle Width="80px" />
   <Fields>
      <asp:BoundField DataField="ID" HeaderText="ID:" ReadOnly="True"
         InsertVisible="False" />
      <asp:BoundField DataField="AddedDate" HeaderText="AddedDate:"
         InsertVisible="False" ReadOnly="True"/>
      <asp:BoundField DataField="AddedByIP" HeaderText="UserIP:" ReadOnly="True"
         InsertVisible="False" />
      <asp:TemplateField HeaderText="Name:">
         <ItemTemplate>
            <asp:Label ID="lblAddedBy" runat="server"
               Text='<%# Eval("AddedBy") %>' />
         </ItemTemplate>
         <InsertItemTemplate>
            <asp:TextBox ID="txtAddedBy" runat="server"
               Text='<%# Bind("AddedBy") %>' MaxLength="256" Width="100%" />
            <asp:RequiredFieldValidator ID="valRequireAddedBy" runat="server"
               ControlToValidate="txtAddedBy" SetFocusOnError="true"
               Text="Your name is required." Display="Dynamic" />
      </InsertItemTemplate>
      </asp:TemplateField>
      <asp:TemplateField HeaderText="E-mail:">
         <ItemTemplate>
            <asp:HyperLink ID="lnkAddedByEmail" runat="server"
               Text='<%# Eval("AddedByEmail") %>'
               NavigateUrl='<%# "mailto:" + Eval("AddedByEmail") %>' />
         </ItemTemplate>
         <InsertItemTemplate>
            <asp:TextBox ID="txtAddedByEmail" runat="server"
               Text='<%# Bind("AddedByEmail") %>' MaxLength="256" Width="100%" />
            <asp:RequiredFieldValidator ID="valRequireAddedByEmail" runat="server"
               ControlToValidate="txtAddedByEmail" SetFocusOnError="true"
               Text="Your e-mail is required." Display="Dynamic" />
            <asp:RegularExpressionValidator runat="server" ID="valEmailPattern"
               Display="Dynamic" SetFocusOnError="true"
               ControlToValidate="txtAddedByEmail"
               ValidationExpression="\w+([-+.']\w+)*@\w+([-.]\w+)*\.\w+([-.]\w+)*"
               Text="The e-mail is not well-formed." />
         </InsertItemTemplate>
      </asp:TemplateField>
      <asp:TemplateField HeaderText="Comment:">
         <ItemTemplate>
            <asp:Label ID="lblBody" runat="server" Text='<%# Eval("Body") %>' />
         </ItemTemplate>

         <EditItemTemplate>
            <asp:TextBox ID="txtBody" runat="server" Text='<%# Bind("Body") %>'
               TextMode="MultiLine" Rows="5" Width="100%"></asp:TextBox>
            <asp:RequiredFieldValidator ID="valRequireBody" runat="server"
               ControlToValidate="txtBody" SetFocusOnError="true"
               Text="The comment text is required." Display="Dynamic" />
         </EditItemTemplate>
      </asp:TemplateField>
   </Fields>
</asp:DetailsView>

One unique aspect of the preceding code is that the AddedBy and AddedByEmail fields use the TemplateField's InsertItemTemplate instead of the EditItemTemplate that we used in the other DetailsView controls. This is because these fields must be editable only when adding new comments, whereas they are read-only when a comment is being edited. If we had used the EditItemTemplate, as we did for the Body field, that template would have been used for insert mode (unless you specify an InsertItemTemplate that's like the ItemTemplate, but that means replicating code without any advantage). The InsertItemTemplate is not used while the control is in edit mode instead; in that case the ItemTemplate is used, with the result that those fields cannot be changed.

The ShowArticle.aspx.cs Code-Behind File

When the page loads, it reads the ID parameter from the querystring. The ID parameter must be specified; otherwise, the page will throw an exception because it doesn't know which article to load. After an Article object has been loaded for the specified article, you must also confirm that the article is currently published (it is not a future or retired article) and that the current user can read it (if the OnlyForMembers property is true, they have to be logged in). You must check these conditions because a cheating user might try to enter an ID in the URL manually, even if the article isn't listed in the BrowseArticles.aspx page. If everything is OK, the article's view count is incremented, and Labels and other controls on the page are filled with the article's data. Finally, you check whether the current user has already rated the article, in which case you show her rating and hide the ratings DropDownList to prevent her from recording a new vote. Here's the code for the Page_Load event handler where all this is done:

protected void Page_Load(object sender, EventArgs e)
{
   if (string.IsNullOrEmpty(this.Request.QueryString["ID"]))
      throw new ApplicationException("Missing parameter on the querystring.");
   else
      _articleID = int.Parse(this.Request.QueryString["ID"]);

   if (!this.IsPostBack)
   {
      // try to load the article with the specified ID, and raise an exception
      // if it doesn't exist
      Article article = Article.GetArticleByID(_articleID);
      if (article == null)
         throw new ApplicationException("No article found for the specified ID.");

      // Check if the article is published (approved + released + not yet expired).
      // If not, continue only if the current user is an Administrator or an Editor
      if (!article.Published)
      {
         if (!this.UserCanEdit)

         {
            throw new SecurityException(@" What are you trying to do???
               You're not allowed to do view this article!");
         }
      }

      // if the article has the OnlyForMembers = true, and the current user
      // is anonymous, redirect to the login page
      if (article.OnlyForMembers && !this.User.Identity.IsAuthenticated)
         this.RequestLogin();

      article.IncrementViewCount();

      // if we get here, display all article's data on the page
      this.Title += article.Title;
      lblTitle.Text = article.Title;
      lblNotApproved.Visible = !article.Approved;
      lblAddedBy.Text = article.AddedBy;
      lblReleaseDate.Text = article.ReleaseDate.ToShortDateString();
      lblCategory.Text = article.CategoryTitle;
      lblLocation.Visible = (article.Location.Length > 0);
      if (lblLocation.Visible)
         lblLocation.Text = string.Format(lblLocation.Text, article.Location);
      lblRating.Text = string.Format(lblRating.Text, article.Votes);
      ratDisplay.Value = article.AverageRating;
      ratDisplay.Visible = (article.Votes > 0);
      lblViews.Text = string.Format(lblViews.Text, article.ViewCount);
      lblAbstract.Text = article.Abstract;
      lblBody.Text = article.Body;
      panComments.Visible = article.CommentsEnabled;
      panEditArticle.Visible = this.UserCanEdit;
      btnApprove.Visible = !article.Approved;
      lnkEditArticle.NavigateUrl = string.Format(
         lnkEditArticle.NavigateUrl, _articleID);

      // hide the rating box controls if the current user
      // has already voted for this article
      int userRating = GetUserRating();
      if (userRating > 0)
         ShowUserRating(userRating);
   }
}

The code for retrieving and displaying the user's vote will be shown in a moment, but first let's examine how the vote is remembered. When the Rate button is clicked, you retrieve the selected value from the Rating DropDownList and use it to call Article.RateArticle. Then you save the rating into a cookie named Rating_Article_{ArticleID}, and later you can retrieve it from the cookie:

protected void btnRate_Click(object sender, EventArgs e)
{
   // check whether the user has already rated this article
   int userRating = GetUserRating();
   if (userRating > 0)
   {

      ShowUserRating(userRating);
   }
   else
   {
      // rate the article, then create a cookie to remember this user's rating
      userRating = ddlRatings.SelectedIndex + 1;
      Article.RateArticle(_articleID, userRating);
      ShowUserRating(userRating);

      HttpCookie cookie = new HttpCookie(
         "Rating_Article" + _articleID.ToString(), userRating.ToString());
      cookie.Expires = DateTime.Now.AddDays(
         Globals.Settings.Articles.RatingLockInterval);
      this.Response.Cookies.Add(cookie);
   }
}

Notice that the cookie is set to have a lifetime of the number of days specified by the RatingLockInterval configuration setting. The default value is 15, but you can change it to a more suitable value according to a number of factors: For example, if your articles are not changed very often you will likely want to specify a much longer cookie lifetime. To determine whether a user has already voted, you simply need to check whether a cookie with that particular name exists. If it does, you read its value to get the rating:

protected int GetUserRating()
{
   int rating = 0;
   HttpCookie cookie = this.Request.Cookies[
      "Rating_Article" + _articleID.ToString()];
   if (cookie != null)
      rating = int.Parse(cookie.Value);
   return rating;
}

If the user has already voted on the article, you show their rating with the following method, which both hides the DropDownList and shows the Label with the message:

protected void ShowUserRating(int rating)
{
   lblUserRating.Text = string.Format(lblUserRating.Text, rating);
   ddlRatings.Visible = false;
   btnRate.Visible = false;
   lblUserRating.Visible = true;
}

One last detail: When the DetailsView is created in insert mode, you can prefill the AddedBy and AddedByEmail fields with the value retrieved from the user's membership account, if the user is authenticated:

protected void dvwComment_ItemCreated(object sender, EventArgs e)
{
   if (dvwComment.CurrentMode == DetailsViewMode.Insert &&
      this.User.Identity.IsAuthenticated)
   {

      MembershipUser user = Membership.GetUser();
      (dvwComment.FindControl("txtAddedBy") as TextBox).Text = user.UserName;
      (dvwComment.FindControl("txtAddedByEmail") as TextBox).Text = user.Email;
   }
}

Figure 5-13 shows the DataList with all comments, and the DetailsView while editing one.

Figure 5-13

Note

Security warning: Never store a user's account number, or any sensitive data, in a cookie. In this application the article rating is not sensitive in any way — you have already tallied the rating in the database and the cookie is only used to display the rating made by that user. Using the cookie frees you from having to store each user's rating for each article in the database. You only need to store the total rating in the database, which is far more efficient.

The GetArticlesRss.aspx Page

This page returns the RSS feed for the "n" most recent articles (where "n" is specified in web.config) of a specific category, or for any category, according to the CatID parameter on the querystring. In the "Design" section of this chapter you saw the schema of a valid RSS 2.0 document. Here we apply that structure to output a set of Article entries retrieved from the DB using a Repeater control. We don't need a more advanced data control because the structure is simple and is completely format-free. Let's examine the markup code of this page, and then I'll point out a few interesting details:

<%@ Page Language="C#" AutoEventWireup="true" ContentType="text/xml"
   EnableTheming="false"
   CodeFile="GetArticlesRss.aspx.cs" Inherits="GetArticlesRss" %>
<head runat="server" visible="false"></head>

<asp:Repeater id="rptRss" runat="server">
   <HeaderTemplate>
      <rss version="2.0">
         <channel>
            <title><![CDATA[The Beer House: <%# RssTitle %>]]></title>
            <link><%# FullBaseUrl %></link>
            <description>The Beer House: the site for beer fanatics</description>
            <copyright>Copyright 2005 by Marco Bellinaso</copyright>
   </HeaderTemplate>
   <ItemTemplate>
      <item>
         <title><![CDATA[<%# Eval("Title") %>]]></title>
         <author><![CDATA[<%# Eval("AddedBy") %>]]></author>
         <description><![CDATA[<%# Eval("Abstract") %>]]></description>
         <link><![CDATA[<%# FullBaseUrl + "ShowArticle.aspx?ID="+
            Eval("ID") %>]]></link>
         <pubDate><%# string.Format("{0:R}", Eval("ReleaseDate")) %></pubDate>
      </item>
   </ItemTemplate>
   <FooterTemplate>
         </channel>
      </rss>
   </FooterTemplate>
</asp:Repeater>

Here are the interesting points about this code:

• The page's ContentType property is not set to "text/html" as usual, but to "text/xml". This is necessary for the browser to correctly recognize the output as an XML document.

• There is a server-side <head> tag that has its Visible property set to false. The head tag is required if you've specified a theme in the web.config file, and even if you've explicitly disabled themes for this specific page, as we have done here (the page's EnabledTheming property is set to false). This is because ASP.NET has to dynamically create <link> tags for the CSS stylesheet files it finds under the theme folder when themes are enabled for the site. If the parent <head> tag is not found, it throws an exception. Having specified a <head> you can't leave it enabled because the output would not be a valid RSS document. Therefore, we specify a <head> but we make it invisible.

• All data retrieved from the DB is wrapped within an XML CDATA section so that it won't be considered to be XML text. As mentioned earlier, CDATA is a way of quoting literal data so that it will not be considered XML data. This is necessary in our case because we can't assume that all text stored in the DB will contain only characters that won't conflict with XML special characters (such as < and >).

• Our RSS feed will be consumed by desktop-based aggregators, or by other sites, so all the links you put into the feed (the link to the site's home page, and all the articles' links) must be complete links, and not relative to the site's root folder or to the current page. In other words, it must be something like www.contoso.com/GetArticlesRss.aspx instead of just /GetArticlesRss.aspx. For this reason, all links are prefixed by the value returned by FullBaseUrl, a custom property of the BasePage class that returns the site's base URL (e.g., http://www.contoso.com/).

public partial class GetArticlesRss : BasePage
{
   private string _rssTitle = "Recent Articles";
   public string RssTitle
   {
      get { return _rssTitle; }
      set { _rssTitle = value; }
   }

   protected void Page_Load(object sender, EventArgs e)
   {
      int categoryID = 0;
      if (!string.IsNullOrEmpty(this.Request.QueryString["CatID"]))
      {
         categoryID = int.Parse(this.Request.QueryString["CatID"]);
         Category category = Category.GetCategoryByID(categoryID);
         _rssTitle = category.Title;
      }

      List<Article> articles = Article.GetArticles(true, categoryID,
         0, Globals.Settings.Articles.RssItems);
      rptRss.DataSource = articles;
      rptRss.DataBind();
   }
}

Configuring Security Settings

Many security checks have been implemented programmatically from the pages' code-behind. Now you need to edit the Admin folder's web.config file to add the Contributors role to the list of allowed roles for the AddEditArticle.aspx page:

<configuration xmlns="http://schemas.microsoft.com/.NetConfiguration/v2.0">
   <system.web>
      <authorization>
         <allow roles="Administrators,Editors" />
         <deny users="*" />
      </authorization>
   </system.web>

   <location path="AddEditArticle.aspx">
      <system.web>
         <authorization>
            <allow roles="Administrators,Editors,Contributors" />
            <deny users="*" />
         </authorization>
      </system.web>
   </location>

   <!--ManageUsers.aspx and EditUser.aspx pages... -->
</configuration>

Final Touches — Friendly URLs with UrlMappings

The more meaningful and short a URL can be, the better. Those URLs are easier to communicate to people, and easier for them to remember. The current URLs that allow us to browse articles for a specific category are already pretty short, but it's not easy to remember all category IDs by heart … and thus to remember the URL. ASP.NET 2.0 introduces a new section in web.config that allows us to map a virtual URL to a real URL: This section's name is urlMapping, and it's located under <system.web>. When the user types the virtual URL, the page located at the corresponding real URL will be loaded. Here's what you can write in web.config to make your sample categories easier to reach:

<urlMappings>
   <add url="~/articles/beer.aspx" mappedUrl="~/BrowseArticles.aspx?CatID=28" />
   <add url="~/articles/events.aspx" mappedUrl="~/BrowseArticles.aspx?CatID=41" />
   <add url="~/articles/news.aspx" mappedUrl="~/BrowseArticles.aspx?CatID=31" />
   <add url="~/articles/photos.aspx" mappedUrl="~/BrowseArticles.aspx?CatID=40" />
   <add url="~/articles/blog.aspx" mappedUrl="~/BrowseArticles.aspx?CatID=29" />
   <add url="~/articles/faq.aspx" mappedUrl="~/BrowseArticles.aspx?CatID=42" />
</urlMappings>

Note that when the server receives a request for the virtual URL it doesn't make a normal redirect to the real URL. Before the page is loaded, ASP.NET rewrites the URL to the request's context. From that point on, the URL will be read from the context, and thus the correct URL will be retrieved. The bottom line is that the transition is done in memory on the server side, and users do not even see the real URL in their browser. Therefore, if a user maneuvers to ~/articles/beer.aspx she's really going to get ~/BrowseArticles.aspx?CatID=28. Furthermore, there is no physical page named ~/articles/beer.aspx.