Quote

How IE identify the encoding of html document

I just summary the priority of IE identify the encoding of html document.

Note: bulleting number represents the priority by which IE identify the encoding.

1. IE use the character set by the server code, like the following asp.net code snap:   Response.Charset = "x-IA5-German"; 

2. IE use the characeter set in META element in the document like:<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=gb2312"> if this element sepcificed, use this element and neglect the IE en-coding set by the user.

3. If 1 and 2 are not set, IE use the default lanuage setting, frequently it is UTF-8

4. After user open the page, user can change the encoding of IE, this time IE will use the user's encoding setting.

I use user scenario to explain:

User open IE and request one web site like www.microsoft.com, the encoding setting of IE is Simplified Chinese, auto-select is unchecked.

When the page is loaded to the user IE, IE will first detect the server code and then the META element and finally the default UTF-8. So even if user's setting is simplified Chinese, the encoding of IE will become UTF-8 after the web site is fully loaded.

•     Work item name: short description of the work item. The work item need to be splited if it takes long time(normal more than 1 week's workload).
•     Priority: the priority of this work item, 0,1,2,3. 0 means the first priority and need to be done as the first priority.

          0,1,2 priority's work item need to be done in this sprint, 3 and 4 priority's work item is best to be done.

•      Owner: the owner of this work item. Can be more than 1 owner.
•      Workload: the assumed total hours of this work item. Normally the workload is 4 hours one day. So for example, if one work item need 3 days, the workload will be 12

•         List all the work items.
•         Prioritize all the work items.
•         Define the work items which should be delivered in the upcoming sprint.
•         Spilt each work item to make sure each sub-work item's workload do not more than 20 hours.

  9. The atom work unit is on daily basis.

          How?

•              4 hour represent one day's workload.
•             Why we just use 4 hours to represents one day's is because that we should exclude the time of meeting, communication and training.
•              4 hour is the workload of work item and not inlcude the meeting, communcition or training time.

 10. The ownership of a work item

      Unlike the waterfall method, in agile method the ownership of each work item is dev and tester.

      That means in the end of one sprint, the work item is shipped by dev and tester, so dev and tester should make sure the quality of the shipped work item.

•            Function works with normal scenario, eg. expected output with good input data.

•            Function works with abnormal scenario,

•            Is the function easy for use?
•            Is the error message friendly engouh and easy to be understood?
•            For the error message, I have the following points;

•     Need detailed review of dev spec to figure out the secuirty issue duing the design stage.
•     Need DTD diagram to analysis the secruity issue according to the scenario.
•     Need to think about the security issue not only on the software architecture pointview but the phyiscal architecture pointview.
•     Need to use both client and server side validation for user input.

In testing stage( web seurity )

Each can-input area needs to have security test cases.

Each url which has query needs to have security test cases.

   a. XSS test cases.

   b. SQL injection test cases.

          Does each transact-SQL use paramaters as input?

          Does each transact-SQL which make up of string like @sql = 'select * from '+ str1 + 'where a='+str2 use EXECSQL() to execute?

   c. Dirty data test cases. To see whether dirty data can be inserted into database.

   d. DOS test cases. If user can generate a great deal of exception, DOS may occur.

   e. Exception message expsure test cases. To test whether exception message will be exposed to user.

 Secuirty bug has its priority according to its impact on the application,

•            Lightweight XSS bugs: those bugs which only affect the attackers. Eg. XSS bug breaks the page style but only attacker can view these broken pages.
•            Heavyweight XSS bugs: those bugs which can affect all users or can steal user's privacy. Eg.  XSS bug breaks the page style and all user can view these broken pages. XSS bug can steal user cookie.
•           Lightweight DOS bugs: those bugs which can casue deny of service but DOS will disappear after the stop of attack.
•           Heavyweight DOS bugs: those bugs which can casue deny of serivce and DOS will still exist after the stop of attack.
•           All SQL injection bugs are heavyweight.

•         Need a test plan which is based on the performance goal of the application

                       For web application, we need to test the perf :

                            a. on the web level

                            b. on the database level

•         Test cases can be those scenarios which need high performance and may exist performance issues.
•         Need a PPE environment to do perf testing. Testing on single-box or dev machine cannot reflect the real performace of the application.
•         Analysis of the test results are more important than the generation of test results.

•     Test cases are based on specific scenarios, only those scenarios which can cause heavy load of application( eg. tons of e-mail sent, mostly viewed pages) need to be tested.
•     Each scenario in test case need to be tested on different benchmark.
•     Analysis of the test results are more important than the generation of test results.
•     Need a PPE environment to do testing. Testing on single-box or dev machine cannot reflect the real stress-handling ability of the application.

    4.Disabled Filtering Mode:
This mode blocks all traffic to a port to provide a firewall against unwanted network access to your cluster.

   5.启用“网络负载平衡管理器”日志。您可以配置“网络负载平衡”管理器以记录每个“网络负载平衡管理器”事件。使用“网络负载平衡管理器”时，这种日志对于问题或错误的故障诊断十分有用。通过单击“网络负载平衡管理器选项”菜单中的“日志设置”，可以启用“网络负载平衡管理器”日志功能。选中“启用”日志框，并指定日志文件的名称和位置。

  6.所有群集主机上的群集参数和端口规则设置均完全相同。

  7.对负载平衡应用程序使用的所有端口设置端口规则。例如，FTP 使用端口 20、端口 21 及端口 102465535。

  8.每设置一个端口规则后，单击“添加”。否则端口规则将不会出现在规则列表中，且规则也不会起作用。

  9.除虚拟专用网络 (VPN) 外，在“网络负载平衡属性”对话框和“Internet 协议 (TCP/IP) 属性”对话框中进行设置时必须输入专用 IP 地址和群集 IP 地址。确保这两处的地址相同。

 10.确保专用 IP 地址始终列在“Internet 协议 (TCP/IP) 属性”对话框中的第一位，即在群集 IP 地址之前。这可以确保将来自主机的连接响应返回给相同的主机。

11.确保群集中所有主机均属于同一子网，且群集客户端能够访问此子网。

12.Windows Server 2003

  16.

When attempting to use Network Load Balancing Manager to connect to a host in your cluster, you receive the error "Host unreachable".

Best practice of NLB: http://technet2.microsoft.com/WindowsServer/en/Library/357a83b5-670d-4eef-96c4-0d69519e5cbc1033.mspx

NLB troubleshooting:

http://technet2.microsoft.com/WindowsServer/en/Library/8d2e0b4f-4dfd-4893-9505-124ddf4fc2f01033.mspx

NLB parameters: http://technet2.microsoft.com/WindowsServer/en/Library/57c24429-0268-4ed8-afdf-fd4b0b6539b71033.mspx

http://support.microsoft.com/kb/198496/EN-US/ 

http://www.microsoft.com/china/technet/prodtechnol/windowsserver2003/technologies/clustering/nlbbp.mspx 

http://msdn2.microsoft.com/en-us/library/ms151247.aspx

Understanding components and their roles in replication:

Publisher

Snapshot replication distributes data exactly as it appears at a specific moment in time and does not monitor for updates to the data. When synchronization occurs, the entire snapshot is generated and sent to Subscribers.

Note:
Snapshot replication can be used by itself, but the snapshot process (which creates a copy of all of the objects and data specified by a publication) is also commonly used to provide the initial set of data and database objects for transactional and merge publications. For more information, see Initializing a Subscription with a Snapshot.

Using snapshot replication by itself is most appropriate when one or more of the following is true:

• Data changes infrequently.
  
• It is acceptable to have copies of data that are out of date with respect to the Publisher for a period of time.
  
• Replicating small volumes of data.
  
• A large volume of changes occurs over a short period of time.
  

Snapshot replication is most appropriate when data changes are substantial but infrequent. For example, if a sales organization maintains a product price list and the prices are all updated at the same time once or twice each year, replicating the entire snapshot of data after it has changed is recommended. Given certain types of data, more frequent snapshots may also be appropriate. For example, if a relatively small table is updated at the Publisher during the day, but some latency is acceptable, changes can be delivered nightly as a snapshot.

Snapshot replication has a lower continuous overhead on the Publisher than transactional replication, because incremental changes are not tracked. However, if the dataset set being replicated is very large, it will require substantial resources to generate and apply the snapshot. Consider the size of the entire data set and the frequency of changes to the data when evaluating whether to utilize snapshot replication.

http://www.microsoft.com/china/msdn/library/langtool/vsts/dnvsentvstsdev.mspx

Tips:

1.FxCop 是一个静态分析工具，它分析托管代码程序集并报告有关程序集的信息,开发人员可以在项目的 Property Pages 上选择 Run FxCop

2.

分析应用程序(Analize the performance of application and generate relevant reports)

分析应用程序的首选使用模式是首先开始采样，然后根据采样所产生的结果检测应用程序的特定方面。

分析应用程序的过程相当简单。首先创建一个新的性能会话。在 Visual Studio 2005 Team System 中，可以使用 Performance Session Wizard 创建一个新的性能会话。

Performance Session Wizard

Performance Session Wizard 设置分析应用程序的必要环境。在 Visual Studio 2005 Team System 中，该向导为 EXE、DLL 和 ASP.NET 应用程序提供内置支持。

一旦应用程序执行完毕，系统就会将一个性能会话报告自动添加到 Reports 节点。

From: http://www.588188.com/netbook/sqlserver2000/acdata/ac_8_con_04_9uek.htm

使用 sp_executesql

建议使用 sp_executesql 而不要使用 EXECUTE 语句执行字符串。支持参数替换不仅使 sp_executesql 比 EXECUTE 更通用，而且还使 sp_executesql 更有效，因为它生成的执行计划更有可能被 SQL Server 重新使用。

自包含批处理

sp_executesql 或 EXECUTE 语句执行字符串时，字符串被作为其自包含批处理执行。SQL Server 将Transact-SQL 语句或字符串中的语句编译进一个执行计划，该执行计划独立于包含 sp_executesql 或 EXECUTE 语句的批处理的执行计划。下列规则适用于自含的批处理：

• 直到执行 sp_executesql 或EXECUTE 语句时才将sp_executesql 或 EXECUTE 字符串中的 Transact-SQL 语句编译进执行计划。执行字符串时才开始分析或检查其错误。执行时才对字符串中引用的名称进行解析。
  
  
• 执行的字符串中的 Transact-SQL 语句，不能访问 sp_executesql 或 EXECUTE 语句所在批处理中声明的任何变量。包含 sp_executesql 或 EXECUTE 语句的批处理不能访问执行的字符串中定义的变量或局部游标。
  
  
• 如果执行字符串有更改数据库上下文的 USE 语句，则对数据库上下文的更改仅持续到 sp_executesql 或 EXECUTE 语句完成。

通过执行下列两个批处理来举例说明：

/* Show not having access to variables from the calling batch. */
DECLARE @CharVariable CHAR(3)
SET @CharVariable = 'abc'
/* sp_executesql fails because @CharVariable has gone out of scope. */
sp_executesql N'PRINT @CharVariable'
GO

/* Show database context resetting after sp_executesql completes. */
USE pubs
GO
sp_executesql N'USE Northwind'
GO
/* This statement fails because the database context
   has now returned to pubs. */
SELECT * FROM Shippers
GO

替换参数值

sp_executesql 支持对 Transact-SQL 字符串中指定的任何参数的参数值进行替换，但是 EXECUTE 语句不支持。因此，由 sp_executesql 生成的 Transact-SQL 字符串比由 EXECUTE 语句所生成的更相似。SQL Server 查询优化器可能将来自 sp_executesql 的 Transact-SQL 语句与以前所执行的语句的执行计划相匹配，以节约编译新的执行计划的开销。

使用 EXECUTE 语句时，必须将所有参数值转换为字符或 Unicode 并使其成为 Transact-SQL 字符串的一部分：

DECLARE @IntVariable INT
DECLARE @SQLString NVARCHAR(500)
/* Build and execute a string with one parameter value. */
SET @IntVariable = 35
SET @SQLString = N'SELECT * FROM pubs.dbo.employee WHERE job_lvl = ' +
                 CAST(@IntVariable AS NVARCHAR(10))
EXEC(@SQLString)
/* Build and execute a string with a second parameter value. */
SET @IntVariable = 201
SET @SQLString = N'SELECT * FROM pubs.dbo.employee WHERE job_lvl = ' +
                 CAST(@IntVariable AS NVARCHAR(10))
EXEC(@SQLString)

如果语句重复执行，则即使仅有的区别是为参数所提供的值不同，每次执行时也必须生成全新的 Transact-SQL 字符串。从而在下面几个方面产生额外的开销：

• SQL Server 查询优化器具有将新的 Transact-SQL 字符串与现有的执行计划匹配的能力，此能力被字符串文本中不断更改的参数值妨碍，特别是在复杂的 Transact-SQL 语句中。
  
  
• 每次执行时均必须重新生成整个字符串。
  
  
• 每次执行时必须将参数值（不是字符或 Unicode 值）投影到字符或 Unicode 格式。

sp_executesql 支持与 Transact-SQL 字符串相独立的参数值的设置：

DECLARE @IntVariable INT
DECLARE @SQLString NVARCHAR(500)
DECLARE @ParmDefinition NVARCHAR(500)

/* Build the SQL string once. */
SET @SQLString =
     N'SELECT * FROM pubs.dbo.employee WHERE job_lvl = @level'
/* Specify the parameter format once. */
SET @ParmDefinition = N'@level tinyint'

/* Execute the string with the first parameter value. */
SET @IntVariable = 35
EXECUTE sp_executesql @SQLString, @ParmDefinition,
                      @level = @IntVariable
/* Execute the same string with the second parameter value. */
SET @IntVariable = 32
EXECUTE sp_executesql @SQLString, @ParmDefinition,
                      @level = @IntVariable

此 sp_executesql 示例完成的任务与前面的 EXECUTE 示例所完成的相同，但有下列额外优点：

• 因为 Transact-SQL 语句的实际文本在两次执行之间未改变，所以查询优化器应该能将第二次执行中的 Transact-SQL 语句与第一次执行时生成的执行计划匹配。这样，SQL Server 不必编译第二条语句。
  
  
• Transact-SQL 字符串只生成一次。
  
  
• 整型参数按其本身格式指定。不需要转换为 Unicode。

说明  为了使 SQL Server 重新使用执行计划，语句字符串中的对象名称必须完全符合要求。

重新使用执行计划

在 SQL Server 早期的版本中要重新使用执行计划的唯一方式是，将 Transact-SQL 语句定义为存储过程然后使应用程序执行此存储过程。这就产生了管理应用程序的额外开销。使用 sp_executesql 有助于减少此开销，并使 SQL Server 得以重新使用执行计划。当要多次执行某个 Transact-SQL 语句，且唯一的变化是提供给该 Transact-SQL 语句的参数值时，可以使用 sp_executesql 来代替存储过程。因为 Transact-SQL 语句本身保持不变仅参数值变化，所以 SQL Server 查询优化器可能重复使用首次执行时所生成的执行计划。

下例为服务器上除四个系统数据库之外的每个数据库生成并执行 DBCC CHECKDB 语句：

USE master
GO
SET NOCOUNT ON
GO
DECLARE AllDatabases CURSOR FOR
SELECT name FROM sysdatabases WHERE dbid > 4

OPEN AllDatabases

DECLARE @DBNameVar NVARCHAR(128)
DECLARE @Statement NVARCHAR(300)

FETCH NEXT FROM AllDatabases INTO @DBNameVar
WHILE (@@FETCH_STATUS = 0)
BEGIN
   PRINT N'CHECKING DATABASE ' + @DBNameVar
   SET @Statement = N'USE ' + @DBNameVar + CHAR(13)
      + N'DBCC CHECKDB (' + @DBNameVar + N')'
   EXEC sp_executesql @Statement
   PRINT CHAR(13) + CHAR(13)
   FETCH NEXT FROM AllDatabases INTO @DBNameVar
END

CLOSE AllDatabases
DEALLOCATE AllDatabases
GO
SET NOCOUNT OFF
GO

当目前所执行的 Transact-SQL 语句包含绑定参数标记时，SQL Server ODBC 驱动程序使用 sp_executesql 完成 SQLExecDirect。但例外情况是 sp_executesql 不用于执行中的数据参数。这使得使用标准 ODBC 函数或使用在 ODBC 上定义的 API（如 RDO）的应用程序得以利用 sp_executesql 所提供的优势。定位于 SQL Server 2000 的现有的 ODBC 应用程序不需要重写就可以自动获得性能增益。有关更多信息，请参见使用语句参数。

用于 SQL Server 的 Microsoft OLE DB 提供程序也使用 sp_executesql 直接执行带有绑定参数的语句。使用 OLE DB 或 ADO 的应用程序不必重写就可以获得 sp_executesql 所提供的优势。