We all know that it is bad bad bad to trust user input. I don’t care if your users are all ascetic monks in a remote monastery, do not trust their input. However, user input often likes to put on sheep’s clothing and disguise itself as something else entirely, such as the case with ViewState.

Yesterday, I wrote a quick and dirty ASP.NET HttpModule for displaying the time that a request takes to process. Note that by turning on trace output for a page, you can get timing information for that page. But as far as I understand, and I need to double check this, this only applies to the page lifecycle, which might not have all the information you want in the context of ASP.NET MVC.

I credit Google AdSense for really opening up the possibility for small blogs to become sources of passive income. Look around the web and you’ll see nearly every blog sport an AdSense ad or two…or three.

…and the feeling’s right.

When you create a new ASP.NET MVC project using our default templates, one of the things you might notice is that there is a web.config file within the Views directory. This file is there specifically to block direct access to a view.

UPDATE: Updated the registry settings per James Curran’s comment. Thanks James!

I used to find the smart tag really annoying in Visual Studio because it is such a small target to hit with the mouse. Silly me, trying to expand a smart tag with a mouse.

When approaching an extensibility model, I often find cases in which I want to merely tweak the existing behavior of the default implementation and wish I didn’t have to create a whole new specific type to do so.

Or, as my recent inbox tells me, you’re not afraid to ask. ;)

Yesterday, I wrote a post that contained the phrase “BFFs Forever” in the title. Commenters were quick to point out the redundancy of “Forever” in the title.

Today’s Dilbert described one of the most challenging problems small consulting companies face. I’m sure Jon, Micah, and I remember experiencing this many times when trying to build and expand Veloc-IT (though Micah probably still gets the pleasure of dealing with this as he’s still chugging along).

UPDATE: I just posted the working demo here.

My compadre Scott Hunter, another PM on the ASP.NET team, who happens to work on the Dynamic Data feature, recently put together an example of using ASP.NET MVC and Dynamic Data Web Forms together in the same application. Look for the link to MvcDynamicData.zip on this Code Gallery page.

The design is never right the first time. Nor is it usually right the second time. This is one of those key lessons you learn over time building real software, and is the source of one of the chief complaints leveled at the Waterfall methodology for building software, which puts heavy emphasis on getting the design right up front.

I updated the template to have the correct assembly references so it should work now out of the box. Sorry about that.

A while back I wrote a sample that demonstrated how to use Routing with WebForms.

The news is out, the beta for the Visual Studio 2008 and the .NET Framework 3.5 Service Pack has been released. As it relates to ASP.NET MVC, there are two important points to notice about the SP1 release:

In my last post, I walked through a simple example of an ActionResult that you can use to transmit a file to the user’s browser along with a download prompt.

NEW UPDATE: There is no longer need for this custom ActionResult because ASP.NET MVC now includes one in the box.

A while back I wrote a routing debugger which is useful for testing your routes and seeing which routes would match a given URL. Rob suggested we have something like this for unit tests, so I whipped something simple up.