Reza Alirezaei , SharePoint MVP /MCTS Development Horizon, Corp. http://blogs.devhorizon.com/reza Twitter: @ rezaal

1. Reza Alirezaei , SharePoint MVP /MCTS Development Horizon, Corp. http://blogs.devhorizon.com/reza Twitter: @rezaal Turning Chaos into Order: Best Practices for Developing SharePoint Applications

2. Who am I? Microsoft MVP SharePoint (2007, 2008) SQL Server Reporting Services (2006) Microsoft Certified Technology Specialist MOSS 2007 Configuration MOSS 2007 Application Development Top 20 Contributor to MSDN Wiki 2006, 2007,2008 International SharePoint Professional Association Regional Evangelist (Canada) Architect/Instructor/Speaker Enterprise level SharePoint application Large scale Integration Projects

3. Agenda Dev Tooling Experience Configuration Performance Security Some Architectural Decisions

4. Prerequisites • Good Understandings of SharePoint Dev • Definitely Not a 101 session

5. Why do I care? Anti best practices: “I suppose it is tempting, if the only tool you have is a hammer, to treat everything as if it were a nail.” Abraham Maslow

6. SharePoint Uber Dev Tools • Most Popular Tools • WSPBuilder (Community) http://www.devhorizon.com/go/100 • STSDEV (Community) http://www.devhorizon.com/go/101 • VSeWSS (Microsoft) http://www.devhorizon.com/go/102 • Old School way • Microsoft endorsement on VSeWSS • Cleanup code is your responsibility

7. A Survey by Todd Bleeker (MVP)

8. DEMO • Quick Overview of all three tools • VSeWSS Solution Generator • VSeWSS WCF endpoint

9. Configuration Management Strategy • Four most common solutions: • Settings in Solution Manifiest • SPWebConfigModification class • SharePoint List • Configuration From Web Services • Property bags (SPWebApplication.Properties) • SPWebConfigModification’s Top 6 Issues http://www.devhorizon.com/go/103 • Scope at Web Application, not Site collection • Note: Persisted attributes in SPPresistedObject class as BLOB XML

10. DEMO

11. “Execution in Parallel” is King! • ONLY one slow Web Part… ONLY one slow Process…. • No ASP.NET Async Luxury • No Async Page Directive • How many Web Parts on one page • How many instances of your Web Part on one page • So, what are my *pure SharePoint* options? • Create a Worker Class to handle Async code • SPLongOperation Class • Use Built-in Functionalities • -ed Event handlers • Workflows • CQWP • DFWP

12. Workflow or Event Handler? Yes Event Receiver Cancel? Human Interference? Workflow Yes Running > 5 min Yes High Volume Yes

13. DEMO Asynchronous Dev

14. Memory Leaks • MSDN Paper http://www.devhorizon.com/go/104 • Roger Lamb’s Blog http://www.devhorizon.com/go/105 • . Net Rule for Disposing Objects • Edge –Cases!! • SPDisposeCheck http://www.devhorizon.com/go/106

15. Edge Case -1 public class MyFeatureRec : SPFeatureReceiver{ public override void FeatureActivated(SPFeatureReceiverProperties properties) { //Does the following reference to SPSiteleak? SPSitesite = properties.Feature.Parent as SPSite; } }

16. Edge Case -2 public class MyClass: SPItemEventReceiver{ public override void ItemUpdated(SPItemEventProperties properties) { //Does the following reference to SPWeb leak? SPWebweb = properties.OpenWeb(); } }

17. Edge Case -3 public class MyClass: SPWebProvisioningProvider{ public override void Provision (SPWebProvisioningPropertiesprops) { //Does the following reference to SPWebleak? SPWebweb = props.Web; } }

18. My $0.02 • Don’t Dispose in Edge Cases

19. DEMO • SPDisposeCheck • Edge Cases

20. How about this one? SPWeboWeb = SPContext.Current.Web; //Does the following reference to SPSite leak? SPSiteoSite = oWeb.Site; Say No To Disposing Of objects hanging off SPContext

21. MOSS is a Ecological System IIS Custom WPs/Procs MOSS All of these technologies must fit in a single 32-bit process Search Profiles Audience BDC Forms ExcelSrv Analytics CMS WSS CRL/Native APIs MDAC LDAP

22. x64 Issues x86 Issues • Last slide + A lot more issues! Go hybrid & Build “ Any CPU” • Artifact/WP development - don’t matter • Protocol handlers/iFilters/ Document Convertors • Many of the current dev tools run in WOW • Some tools don’t support x64 bit (STSDEV) • Infrastructure Cost • Not ISV friendly • VS 2008 WF Templates (Seq and State) not supported, but who cares?!

23. App Pool Best Practices • Say No to Web Gardening • Not supported • Breaks Blob Cache (Wrong Header) • Leave App pools in Legacy Mode (a.k.a worker process isolation mode) • Most of the time , leave App Pool settings as it is • Stick to reasonable upper bounds of RAM utilization (850 Mb on x86 or 1.2Gb on x64)

24. List Capacity Planning Working with Large List Paper MSDN http://www.devhorizon.com/go/107 Recap of the MSDN paper on my blog http://www.devhorizon.com/go/108 Bottom Line is : 2000 items per list limit is ….. SPList w/DataTable or SPList w/for/each …….. Escalation of SQL Server Lock on Lists Table is serious Be cautious about using Collections & Avoid Using Indexes on each Call

25. Properly Working With Collections // BAD way SPWeb web = SPContext.Current.Web; string tasksID = web.Lists[“Tasks”].ID; string tasksTitle = web.Lists[“Tasks”].Title; // GOOD way SPWeb web = SPContext.Current.Web; SPListtasksList = web.Lists[“Tasks”]; string tasksID = tasksList.ID; string tasksTitle = tasksList.Title;

26. What is wrong with this code? SPListbigList = web1.Lists[“BigList”]; foreach(SPListItem item in bigList.Items) { if(item[“MyColumn”] == “Foo”) { Console.WriteLine(“Found One!”); } }

27. SPList.Items gets a collection with ALL list items Terrible for big lists Lots of memory needed Lots of SQL I/O Lots of network Lots of CPU Instead use SPList.GetItems Takes a CAML query Working with SPList Say No To

28. Content Query Web Part (QueryOverride Prop) Data Form Web Part with FullTextSqlQueryObject PortalSiteMapProviderClass Primarily used for navigation controls Optimized to query data not only across lists, but across webs Scope limited to the current site collection Limitations : Not good for infrequent queries Not good for frequently changed data Uses the same shared caching facility in your site collection MOSS Only

29. Options for Querying SP Data

30. Avoid Reporting directly off of SharePoint Databases Use OM Web Services RPC Calls (Remote) Use innate capability of your reporting tool Lists or Database?

31. DEMO • Reporting against Lists • Aggregating of Content

32. Security is NOT a Joke • Know your threat model and what security context your code runs on behalf of. http://www.devhorizon.com/go/110 • GAC or BIN? • Event Receivers • Workflows • Provision Handlers • Web Parts if they’re being manipulated programmatically • permcalc -Show <assemblyName> utility in .Net Framework 2.0 http://www.devhorizon.com/go/111 • NEVER raise the trust level in Web.config to FULL – NEVER! • System Account = Application Pool Identity • Elevation of Privilege – do it the right way!

33. DEMO Elevating the security context *Properly*

34. Only WSP deployment , but…. Use timer Jobs to Sync up thing in your entire farm CKS:IEE http://www.devhorizon.com/go/109 Don’t touch file system on a server directly Don’t touch file system by System.IO either Don’t use LOCK in timer jobs if targeting the farm Think Farm, NOT Standalone

35. Per-Customer Customization System Files ALL in WSP Package!

36. DEMO System.IO Love (Well, not really!)

37. References • Professional SharePoint 2007 Web Content Management Development by Andrew Connell • http://www.devhorizon.com/go/112 • Francis Cheung (Microsoft patterns & practices) http://www.devhorizon.com/go/113 • Patterns & Practices SharePoint Guidance • http://www.devhorizon.com/go/114

38. THINK SHAREPOINT Last but certainly not least: http://blogs.devhorizon.com/reza