Microsoft Internet Information Server (IIS) 3.0 provides only minor improvements to IIS 2.0's base Internet server functionality, but IIS 3.0 offers several important new features. The most significant new feature is its rich server-side code scripting that uses Active Server Pages (ASP). With ASP, you can build high-powered, dynamic Web server applications from a development environment that combines HTML, scripts, and ActiveX components on the server. (For a brief description of IIS 3.0's other key features, see the sidebar, "What's New in IIS 3.0.") Let's take a look at what ASP is and the role it plays in IIS 3.0.

Active Server Pages

ASP (formerly code-named Denali) integrates Web scripting and components in IIS 3.0, as Figure 1, illustrates. Just as Internet Explorer (IE) 3.0 hosts Visual Basic Scripting Edition (VBScript) and JScript on the client, ASP hosts those scripting languages on the server. The name Active Server Pages comes from the files: For the most part, the pages are HTML files with embedded scripting code that executes on the server and can reference ActiveX Server Components. An ASP file can contain both server-side scripting and, embedded in standard HTML, client-side script code. When a client requests an ASP file, the server loads the file into memory and passes off any server-side scripting code to the corresponding scripting engine. Everything else in the file (including any client-side script code) ends up in the HTTP response that returns to the client.

Meet IIS 3.0's most significant new feature

Running script code on the server provides several important advantages. First, the code is secure: Each page can use the access control lists (ACLs) in Windows NT's security system. Also, because the code executes on the server, the Web client never sees the code--only the results. This feature prevents users from looking at or otherwise appropriating your code. Furthermore, because you can tightly administer servers, you can keep unauthorized code off the server. The second major advantage is that the server can better manage expensive resources (e.g., database connections) to support a higher volume of client requests. ASP supports apartment model threading, which offers improved scalability and performance on the server. (In apartment model threading, each thread gets a copy of the program and global data, and runs in a protected area or "apartment.") Third, code on the server runs closer to the data and back-end systems. This arrangement eliminates a lot of low-bandwidth network traffic. Finally, because the code executes on the server, you can develop sophisticated Web applications that users can run from any browser.

Probably the only advantage to running code on the client is that the client can validate individual fields without an expensive round-trip to the server. Of course, because users with browsers can change individual pages rendered on their machine, you still must validate all data on the server.

The ASP architecture is a little more complicated than I've described so far. ASP can maintain state information across multiple calls from the same user (called a session in ASP). You can also build a long-lived server application that handles many different clients (called an application in ASP). IIS 3.0 stores each ASP application in a separate virtual directory; a request for any file in the directory starts the application. When a client requests new pages, NT loads them into memory, compiles (and can execute) the code, and returns the output (if any) in the HTTP response. NT then watches the disk for any pages that have changed since loading. If NT finds an updated file, it recompiles the code and replaces the code that was already in memory. The global.asa file defines application startup and shutdown, and initializes global variables.

ASP Intrinsic Objects
To complement and extend the scripting code that ASP files contain, the ASP architecture handles the creation and management of server and application-building objects. Similar to the way Microsoft makes the IE object model available to VBScript hosted on the client, Microsoft gives developers a handful of useful intrinsic server objects to work with. Intrinsic server objects are always available--you do not need to load a corresponding object library. ASP includes the following five intrinsic server objects.

Application. The Application object handles globally scoped variables, which affect all users of a given application. The Application object defines a set of application initialization and termination subroutines and provides a method for temporarily locking an application for administrative purposes or to control access to a global variable.

Session. Session objects store information about user sessions. They control session lifetimes, maintain session-scoped variables, and provide initialization and termination subroutines each time a session is created or destroyed. Sessions have unique SessionIDs, which ASP encrypts and IIS transmits to and from the client via cookies.

Request. The Request object is a meta-object for five different collections: ClientCertificate, Cookies, Form, QueryString, ServerVariables. Request collections generally store information parsed from the HTTP request.

Response. The Response object is the Request object's complement: It contains the information used in the HTTP response, including the body of the response, the Cookies collection, expiration and status data, and client-side redirection.

Server. The Server object provides a limited set of utility functions. These functions include CreateObject, HTMLEncode, MapPath, URLEncode.

Because Microsoft built the ASP architecture on component object model (COM), you can use almost any COM-based server objects. You can develop server objects in-house or purchase them from third-party vendors.

ASP Base Components
There's really no limit to what you can do with ActiveX Server Components, and you can include existing components developed in languages such as C++, VB, and Java into your Web applications on IIS servers. Fortunately, Microsoft decided to include a base set of application component objects with IIS 3.0 that incorporate the most commonly requested Web server functions.

ActiveX Data Object. Microsoft developed a new data access solution for ASP: ActiveX Data Object (ADO). In early betas of ASP, ADO closely mirrored VB's Remote Data Objects (RDO). By the time Microsoft released ASP, the company had rearchitected ADO to be the object interface to the new OLE DB data access layer. OLE DB is Microsoft's new Object Linking and Embedding (OLE) access layer for enterprise databases. ADO lets an ASP Web page connect to an Open Database Connectivity (ODBC) database or an OLE DB data source and work with its data. One potentially important feature of ADO is that third- party developers can use a type library to create upwardly compatible implementations of ADO that expose additional back-end database features. For more information about ADO, check http://www.microsoft.com/ado.

Advertisement Rotator. Many Web site designs incorporate banner areas that display constantly changing content. The Advertisement Rotator component--originally created for The Microsoft Network (MSN) News--automates image presentation. It's ideal for displaying constantly changing advertising, news, or entertainment images. Individual ASP files use this object to access a list of images: The site administrator creates the list (a text file) and includes image information such as image size, which image files to use, and the percentage of time to display each file. Another management file maintained on the server records the number of times users click on the returned images.

Browser Capabilities. Another handy component, the Browser Capabilities component, identifies the browser type entered in the HTTP header and creates an object with read-only properties for the browser's capabilities (e.g., forms or scripting) that affect your server-side code. The component examines a table-based feature list of known browsers to get the object's properties. The feature list is a simple text file that you can easily maintain as new browsers are introduced into the marketplace.

Content Linking. Content Linking, another component originally created for MSN News, enables navigation among multiple pages in a long composition, such as online documentation or a lengthy news story. A simple text file stores a table of filename pairs: Navigating forward or backward retrieves the following or previous page, accordingly. The advantage of this technique is that someone other than a developer can maintain the composition. When you add, delete, or reorder pages, this component automatically handles the content linking via the text file, without having to update links in Web pages or scripts.

File Access. For security reasons, VBScript has no native file I/O. Two ASP components, FileSystemObject and TextStream, provide basic text-based file operations. These components let ASP create, read, and write Unicode and ASCII files.

Allocated Memory in Free List
Allocated Memory in Used List
Browser Requests Executing
Communication Failed
Free Script Engines in Cache
Memory Allocated
Request Errors/Sec
Request Execution Time
Request Total Bytes In
Request Total Bytes Out
Requests Current
Requests Executed
Requests Failed
Requests Rejected
Requests Timed Out
Requests Total
Requests/Sec
Session Timed Out Requests Executing
Session Timed Out Requests in Queue
Sessions Current
Sessions Timed Out
Thread Pool Current
Total Queue Length
FIGURE 2:
NT's Performance Counters
Tracked by ASP

What Else Is Needed?
Although these base components are a nice start, Microsoft needs to add more ASP components to IIS. The most glaring omission is the lack of any email support: Microsoft included a Simple Mail Transfer Protocol (SMTP) component in the original specification for the product, but the company pulled the component before the product reached widespread beta.

Microsoft has two other server-side products that offer mail support: the Active Messaging mail server in Exchange 5.0 and an Internet Mail Server (IMS) included with Internet Personalization System (IPS) in Microsoft Commercial Internet System (MCIS, formerly code-named Normandy). Microsoft aims these two products at very different markets: Exchange, for corporations, and MCIS, for large Internet service providers. Neither mail support product is appropriate for the many small Web servers that will run ASP.

Fortunately, developing a server-side mail solution is not very difficult. However, rather than developing something from scratch, many ASP sites now use an inexpensive ($55) third-party component, ASPMail (http://www.genusa.com/asp/aspcomp.stm#aspmail), developed by Stephen Genusa. This utility lets you send SMTP mail directly from a Web page and includes support for multiple file attachments as well as MIME and UUEncoding.

Application Design
One disadvantage of ASP is that it runs in a black box. Services run in separate, noninteractive window stations. IIS runs as a service under NT, and ASP is an Internet Server API (ISAPI) DLL in that server process. However, like any well-architected service, ASP makes good use of NT's performance counters. The list shown in Figure 2 contains all the NT performance counters that ASP tracks.

ASP simplifies building full-featured Web applications that run under IIS 3.0. Because script code in ASP is familiar

VBScript or JScript, corporate VB developers can easily leverage their skills to build new, dynamic Web applications. Although ASP comes with a set of starter objects, you can easily extend ASP with COM components written in any language.

Internet Information Server 3.0
Microsoft * 206-882-8080
Web: http://www.microsoft.com/iis
Price: Download for free from Microsoft's Web site
System Requirements: Windows NT Server 4.0, IIS 2.0