Web Development Technology
Over the last decade, we have seen major advancements in the Web-based programming technology. From static HTML to dynamic Web page, and then to Web Services, these developments have changed the Internet into a computing platform, creating a “programmable Web”. XML has enabled heterogeneous computing environments to share information over the World Wide Web. It now offers a simplified means by which to share process as well. From a technical prospective, it is now possible to build an application from individual web services distributed over the Internet by simply describing the behaviours of the web services that the application required, using web service technology (SOAP, WSDL, and UDDI). This report will briefly review and discuss some of the Web development platforms – namely ASP.NET, JSP and PHP, and provide some comparison on what these technologies can offer for developers.
This article will only focus on three of the most commonly used server-side development platforms: Microsoft ASP (now ASP.NET), Sun Microsystem JSP, and PHP. Other platforms such as Python, ColdFusion will not be considered here. These three platforms are chosen because they represent three distinctive groups of approaches to the Web development.
ASP.NET (formerly referred to as ASP+) is a unified Web development platform provided by Microsoft. It is an integral part of Microsoft.NET product that provides the services necessary for developers to build enterprise-class Web applications. Although it is syntactically similar to ASP 3.0, it is not compatible with ASP. It provides a new programming model and infrastructure that enables developers to create interoperable, scalable and reliable applications more easily than ever before. While it can run side by side with old ASP, ASP.NET pages can not share the same state information with ASP pages. ASP.NET provides many improvements over ASP. As an alternative to scripting, dynamic content can be generated by browser-aware XML-like elements. For improved performance, ASP.NET pages are compiled instead of interpreted, and compiled languages such as C++ with managed extension, C#, and VisualBasic.NET can be embedded in a page. ASP.NET pages run at the server require Microsoft .NET Framework installed on the server to provide the Common Language Runtime (CLR) and Class Library for the application. An integrated development environment (IDE) – VisualStudio.NET (officially released on the 13th February 2002) – is now available for developers to program using .NET Services. ASP.NET is also designed to support web services technology (SOAP, WSDL, UDDI etc), and allow customers of the web services to easily develop browser-based platform-independent user interfaces for any application.
ASP.NET is primarily bundled with Microsoft’s IIS 5.0. Although it was designed to be platform independent through the common language runtime environment, any inclusion of native COM components will make it primarily a solution for the Windows platform. Currently there is little information on its support for other platforms. It is anticipated in the future, however, some third-part product may provide limited support for other platforms like for old ASP. It should be noted that Microsoft.NET does not support the Java Programming Language.
JSP is an open standard technology from Sun Microsystem for developing web pages that include dynamic content. It is an integral part of the Java 2 Platform Enterprise Edition (J2EE), that provides the services necessary for developers to build enterprise-class Web applications. It is a more mature technology than ASP.NET and supported by many industrial players. JSP promotes the separation of program coding from page authoring through action elements, Java Servlets and JavaBeans components, and this will significantly simplify web site development and maintenance. JSP supports both scripting and element-based dynamic content, and allows programmers to develop custom tag libraries to satisfy application-specific needs. JSP is Java-centric and JSP pages are precompiled for efficient server processing. JSP pages run at the server require Java 2 Platform to be installed on the server to provide the Java Runtime Environment (JRE) and APIs. Because JSP is built on top of the Java Servlets, JSP also has access to all of the powerful Enterprise Java APIs, including JDBC, RMI and CORBA support, JNDI, EJB, JMS, and JTA. Recently Java has extended its capability to support web services in Java XML Pack.
JSP technology is platform independent in its dynamic web pages, its web servers, and its underlying server components. JSP pages may be authored on any platform, run on any web server or web enabled application server, and accessed from any web browser. Server components can be built on any platform and run on any server.
PHP is an Open Source general-purpose scripting language that is designed to provide a server-side scripting for developing dynamic Web-based sites and applications, and for embedding code within HTML. PHP has a C-like syntax with some features borrowed from Perl, C++, and Java. Complex code can be encapsulated in both functions and classes. A large number of predefined functions are available as part of PHP, such as accessing databases, encrypting and decrypting data, etc. The new version PHP 4.0 has provided major architecture changes to improve performance. The PHP 4.0 scripting engine - Zend Engine - uses a much more efficient "compile-then-execute" paradigm, instead of the "execute-while parsing" model employed in PHP 3.0. PHP 4.0 also provides expanded functionality and new features for object-oriented programming and building classes and objects.
PHP is supported on a wide range of platforms, including all major web servers, on almost all operating systems, and with interfaces to a large number of database engines. More information about PHP is available at http://www.php.net.
Despite these improvements, PHP is still lack behind ASP.NET and JSP in web programming technology. Its architecture is still not as good as ASP.NET and JSP. As it stands today PHP does not support the Web Service Technology. Therefore, in the following sections PHP will not be discussed any more.
.NET is Microsoft’s new platform for XML Web services. XML Web Services allow applications to communicate and share data and process over the Internet, regardless of operating system or programming language. It is a development platform, runtime, and set of class libraries (collectively known as the "Framework") designed from the ground up (in C#) to support Internet and other open standards. The European Computer Manufacturers Association (ECMA) has ratified the core services of .NET as an open standard, and work is under way to port these specifications to other operating systems (see http://msdn.microsoft.com/net/ecma/). (For more information about this, visit the Mono project site at http://www.go-mono.com/ and Southern Storm Software site at http://www.southern-storm.com/.)
.NET is similar to J2EE in many ways. In order to start building Web applications in .NET, you need the .NET Framework Software Development Kit (SDK), which is a free download at http://msdn.microsoft.com/downloads/default.asp?url=/downloads/sample.asp?url=/msdn-files/027/000/976/msdncompositedoc.xml&frame=true. The SDK includes the Common Language Runtime (CLR), class libraries, and the compilers and tools necessary to begin building .NET applications - the Visual Studio.NET integrated development environment (IDE) for its developer productivity enhancements.
To build Web applications in J2EE, you need the Java 2 Software Development Kit (SDK), which is a free download at http://java.sun.com/. Java 2 SDK also includes the Java Runtime Environment (JRE), class libraries, and the Java compiler and tools necessary to develop application – Forte provides integrated development environment for the developer.
Both J2EE and .NET was designed to simplify complex problems with the development, deployment, and management of multi-tier enterprise solutions. The important difference is that .NET is a product suite, J2EE is an industry standard, not a product. Customers of J2EE have the choice of vendor products and tools to best suit their requirements, and the development of J2EE is an open Java Community Process (JCP), while .NET is under the control of Microsoft alone.
The .NET Framework
One of the most important developments in the .NET framework is the creation of the Common Language Runtime (CLR) which offers language-independence and language-interoperability to developers. A single .NET component can be written, for example, partially in VisualBasic.NET, C#, and managed C++. This is possible because all languages are compiled to an Intermediate Language (IL), like Java ByteCode, not to machine code. The IL is a low-level language, like assembly language, that is not configured to any one operating system or CPU, unlike assembly language. At runtime the IL code is then interpreted and translated into a native executable when it is first run using IL to native compilers provided by CRL runtime library, similar to Java’s JIT compiler, but differs in one key area: once IL code has been compiled to native machine code, it need never be compiled on that machine again. The CLR runtime library ensures that all programming languages work under the same object model when requesting operating system services or even dealing with each other. CRL also imposes a common data typeset on languages and enforces that parameters passed to objects are type safe.
This CLR provides many exciting features provided in JRE, which are not available in earlier versions of Windows DNA, such as automatic garbage collection, exception handling, cross-language inheritance, debugging, and "side-by-side" execution of different versions of the same .NET component.
The CLR also enforces security in a way that enables users to trust that although an executable attached to an e-mail can play an animation on screen or sing a song, it cannot access their personal data, file system, or network.
Similar to Java APIs available in J2EE, the .NET Framework class library provides a comprehensive, object-oriented collection of reusable classes that you can use to develop applications ranging from traditional command-line or graphical user interface (GUI) applications to applications based on the latest innovations provided by ASP.NET and Web Services. It tightly integrates with the common language runtime. The class library builds on the object-oriented nature of the runtime, providing types from which your own managed code can derive functionality. This not only makes the .NET Framework types easy to use, but also reduces the learning curve associated with using a new piece of code. In addition, third-party components can integrate seamlessly with the classes in the .NET Framework.
The follow table is abstracted from Vawter and Roman (2001) which shows the similarities between the two development platforms.
Type of technology
Dynamic Web Pages
.NET Managed Components
SOAP, WSDL, UDDI
To fully explore capabilities of ASP.NET, you must install ASP.NET on a machine with IIS 5.0 or higher, limiting your choices on the server end to Windows 2000 or later. This is because that currently Windows is the only platform that runs .NET, but plans exist for other operating system. The .NET architecture in theory at this point allows .NET applications portable to any platform that has CLR installed.
With the exception of using Web Services, ASP.NET is also supported on Windows NT 4 with Service Pack 6a. Using Web Services is supported on all platforms supported by the Microsoft .NET Framework SDK, except Windows 95.
JSP is supported by any platform that has Java 2 SDK installed. JSP pages can run with many server engines. Tomcat is currently the favourite server engine to be used as the server container.
.NET and J2EE provide a multi-tier
ASP.NET is a Microsoft product providing the hosting environment that enables developers to use the .NET Framework to target Web Services applications. ASP.NET also creates an application domain for each Web application that will run on a Web server.
In contrast, JSP is not a product but a specification for vendors to implement. The goal of the JSP specification is to simplify the creation and management of dynamic web pages by separating program coding from content presentation.
By comparison, JSP architecture may be better than ASP.NET architecture in promoting design pattern MVC with its component separated into Servlets, JSP pages, and JavaBeans.
In ASP.NET, you can use server-side Web Controls and even create your own. The intrinsic Web Controls appear in the ASP.NET page (*.aspx) as XML tags in the ASP namespace, as in <asp:button></asp:button>. These Web Controls exist in compiled dynamic link libraries (DLLs) and operate in similar fashion to JSP custom tags in that, when the tag is rendered, compiled code is executed to produce the output stream. This allows the compiled code to check the browser type and version to produce the correct output for that particular browser, or to perform any other operation that the control is designed for. (To learn more about JSP custom tags, read this article on Java's Web site.)
Both ASP.NET and JSP allow user defined controls or tags.
Both ASP.NET and JSP allow you to separate your functionality from the design and layout of the page by supporting the notion of "code-behind". In code-behind development, you deal with at least two separate files for each Web page. The layout and design of the page is written in the URL-accessible *.aspx or *.jsp page, while all of the page functionality exists in a "class" file as Assemblies and JavaBeans in .NET and J2EE respectively. Assemblies are compiled class files in Intermediate Language and you can write them in any supported .NET language. You can also associate resource files (*.resx) with the class so your pages can be easily localised in multiple languages without changing the layout or design.
Like JSP which uses compiled Java programming language, ASP.NET now also uses compiled languages for scripting and “Code-behind”. The idea of interpreting script on the server seems to be thrown out the window in ASP.NET. Code-behind files and even script blocks within the page are written in compiled languages like Visual Basic.NET (not VBScript) and C# and in third-party languages like Perl.NET and COBOL.NET. Script blocks written in the *.aspx page are compiled on demand when the page is first accessed and then kept in memory for future use, while code-behind files must be pre-compiled into a DLL known as an "assembly". In fact, JScript.NET is now a compiled language and can produce DLLs and other executables.
Like Java ByteCode, programming codes in ASP.NET pages and associated resources are only compiled to the Microsoft Intermediate Language – a language-neutral, platform-independent, low-level language. Compilation to machine codes only take place at runtime when the page first run.
JSP only uses Java programming language for scripting and developing components such as JavaBeans and custom tags. J2EE promotes Java-centric computing.
ASP.NET is language-independent due to the new CLR. ASP.NET supports development in any language that implements the Microsoft’s common language specification, so you can choose a language that best applies to your application, or partition your application across many languages. Currently ASP.NET supports VisualBasic.NET, Managed C++, and C#, a Microsoft new object-oriented programming language. C# is equivalent and similar to Java with the exception of portability. It should be noted: ASP.NET does not support Java. .NET promotes language-independent computing (except for Java) and provides language interoperability through CLR.
With the exception of the processor-file association still defined in MMC of IIS, Microsoft has dropped its Matabase in IIS, and preferred to use XML-based configuration. ASP.NET configuration settings are now stored in XML-based files, called config.web, which are human readable and writable. Each of your applications can have a distinct configuration file and you can extend the configuration scheme to suit your requirements.
The ASP.NET configuration system handles both ends, and provides a hierarchical configuration set-up that enables extensible configuration data to be defined and used throughout an application, a Web site, and/or an entire domain. No server restart is required, even to deploy or replace running compiled code! The configuration file config.web should be stored under the application directory and would apply to all the files in the directory it resides and all of its sub-directory unless it is overridden by config.web file in the sub-directories.
JSP always uses XML-based files: Server.xml and web.xml, to set up the server and web application configurations. Server.xml file in TOMCAT_HOME\conf director is used to configure the Tomcat server and set up new web applications for the server. The web.xml file in web-inf\ directory provides the configuration for the web application in this directory and its sub-directories.
Apart from the easy-to-use Application and
Session state facilities that are familiar to ASP developers, ASP.NET offers
new methods of state management, which enables automatic process recovery
through error and memory overload detection. Session state can now be
maintained in a number of ways. Session data can be passed in a hidden field
within the pages (
JSP offers a better state management services that enable developers to write less code and not worry about managing. Apart from the implicit session and application objects, state management services enable you to build components that hold state. Persistence services (entity beans) enable developers to write applications without coding data access logic, resulting in leaner, database-independent applications that are easier to build and maintain.
ASP.NET works in concert with the Microsoft .NET Framework and IIS to provide Web application security. Application security in ASP.NET is defined in config.web in the <security> element and its sub-element <authentication> with sub-element <authorisation>. ASP.NET, in conjunction with Internet Information Services (IIS), can authenticate user credentials such as names and passwords, using any of the following authentication methods:
· Windows: Basic, digest, or Integrated Windows Authentication (NTLM or Kerberos). (Limiting to Windows platform.)
· Microsoft Passport Authentication (centralised network-based single entry)
· Form Authentication (i.e. cookies)
· Client Certificates (centralised, public/private key encryption)
ASP.NET controls access to site information by comparing authenticated credentials, or representations of them, to NTFS file system permissions or to an XML file that lists authorised users, authorised roles (groups), or authorised HTTP verbs.
Since ASP.NET is built on the Microsoft .NET Framework, the ASP.NET application developer also has access to all of the built-in security features of the .NET Framework, such as code access security and role-based user-access security. Using code access security, you can specify the set of operations your code should be allowed to perform as well as the operations your code should never be allowed to perform. CLR also enforces security check at runtime.
For more information, see ASP.NET Web Application Security.
Since JSP is built on the J2EE, JSP allows application developers to implement security by programming. An example of this is given in the book “Java Server programming” using login servlet and admin servlet pair. JSP can also use another approach provided by J2EE to enforce security, called declarative security. In this method, developers use deployment descriptor <web-app> to specify security constraints and authentication scheme in web.xml configuration file for the application let the web container to implement the mechanism for authentication. JSP, in conjunction with web container, can authenticate user credentials using any of the following authentication methods:
· Web server-based authentication: basic, digest, HTTPS client (PKC), Form-based authentication (provided by Servlet Container)
· LDAP authentication (centralised network-based single entry)
· Certificate-based authentication
In addition Tomcat provides an implementation of the Servlet 2.2 specification that allows developers to replace a default security handler with a custom security handler, so further strengthen Tomcat security mechanism (a runtime security).
ASP.NET includes data access tools that make it easier than ever for you to design sites that allow your users to interact with databases through Web pages.
The .NET Framework includes two data providers for accessing enterprise databases: the OLE DB .NET data provider and the SQL Server .NET data provider. It also provides a set of ActiveX Data Objects (ADO.NET) that expose data access services to the .NET programmer, (and it may also limit to Windows application? as ActiveX is not a standard Internet protocol). ADO.NET provides a rich set of components for creating distributed, data-sharing applications. It is an integral part of the .NET Framework, providing access to relational data, XML, and application data. For more information, see Accessing Data with ASP.NET.
JSP uses JDBC data access APIs to access databases. JDBC calls can be either directly embedded in a JSP page using scripting or via a custom action, or written in a servlet or JavaBean component dedicated to database access. The JDBC API provides three core services: Connection services, SQL services, and Result processing using ResultSet object.
Today, both ASP.NET and JSP support web services.
JSP supports web services through the Java XML Pack, which includes:
· Java API for XML Messaging (JAXM)
· Java API for XML Processing (JAXP)
· Java API for XML Registries (JAXR)
· Java API for XML-based RPC (JAX-RPC)
These APIs allow developers to perform any web service operation today through manually parsing XML documents, connecting to business registries, transforming XML-to-Java and Java-to-XML, parsing WSDL documents, and performing messaging such as with ebXML.
All these APIs are packaged in an all-in-one download called Java Web Services Developer Pack (Java WSDP), along with other Java key technologies including Servlet, JSP, and JSTL, to simplify building of web services using Java 2 platform. The Java WSDP also includes the:
· Tomcat Servlet and JSP container
· Ant build tool
· Java WSDP Registry Server
to provide a development and deployment environment.
There are also a variety of J2EE-compatible 3rd party tools available today that enable rapid development of web services.
ASP.NET supports web services through the .NET platform, which is built for XML web services.
The preview release of Microsoft.NET also enables organisations to build web services. The tool - Visual Studio.NET - shipped with Microsoft.NET offers rapid application development of web services, with automatic generation of web service wrappers to existing systems. You can perform operations using SOAP, UDDI, and WSDL (formerly SCL). However, .NET does not support for ebXML - a very important standard for eBusiness collaboration. Microsoft is still clinging to its BizTalk proprietary framework that has proprietary SOAP extensions. This evidence makes us question Microsoft's true commitment to open and interoperable web services.
A comparison between the two development platforms: J2EE vs. Microsoft .Net, in terms of building server-side systems as Web services is given by Chad Vawter and Ed Roman (June 2001, see attachments).
Both JSP and ASP.NET deliver a well-factored architecture that allows developers to "plug-in" their code at the appropriate level. In fact, it is possible to extend or replace any sub-component of the JSP runtime and ASP.NET runtime with your own custom-written component. Implementing custom authentication or state services has never been easier.
Both JSP and ASP.NET make it easy to perform common tasks, from simple form submission and client authentication to deployment and site configuration. The Common Language Runtime simplifies development with managed code services like automatic reference counting and garbage collection, however these will not apply to unmanaged code. One advantage of ASP.NET is its Page Framework offers Web Form for you to build user interfaces that cleanly separate application logic from presentation code, and handle events in a simple, VB-like forms processing model.
The Sun J2EE Product Portfolio includes Forte, a modular and extensible Java-based IDE that pre-dates both Sun J2EE and .NET. Developers who prefer other IDEs for Java development, are free to use WebGain’s Visual Café, IBM’s VisualAge for Java, Borland’s JBuilder, and more. Numerous 3rd party tools and open source-code products are available.
Microsoft has always been a strong tool vendor, and that has not changed. Microsoft had launched the Visual Studio.NET integrated development environment on 13 February 2002. Visual Studio.NET supports all languages supported by earlier releases of Visual Studio - with the notable exception of Java. In its place, the IDE supports C#, Microsoft’s new object-oriented programming language, which bears a remarkable resemblance to Java. Visual Studio.NET has some interesting productivity features including Web Forms, a web-based version of Win Forms, .NET’s GUI component set. Visual Studio.NET enables developers to take advantage of .NET’s support for cross-language inheritance.
With Visual Studio.NET, now you can drag-and-drop web controls like you do VB controls, double-click and write the server code for the control. ASP.NET supports XCOPY deployment that requires no registration or stopping of the server, supports dynamic DLL updates and extensible configuration using XML files.
In conclusion, Microsoft has the clear win when it comes to tools. While the functionality of the toolset provided by J2EE community as a whole supercedes the functionality of the tools provided by Microsoft, these tools are not 100% interoperable, because they do not originate from a single vendor.
A problem with Web site’s or Web
application’s performance is with data-access.
The reason for this is that most enterprise applications are data-driven systems with much more data logic than business logic. JSP, or more precisely J2EE reduces database traffic through two tactics:
· Stateful business processes allow you to maintain business process state in memory, rather than writing that state out to the database on each request.
· Long-term caching (provided by some implementations) allow for database data to be cached for long periods of time, rather than re-reading database data upon each request.
J2EE gives programmers more control over lower-level services such as state management and caching. Well-educated developers can tap into these features to improve the quality of their deployment. However, this may also result in problems if developers are not properly trained on when to (and when not to) use these features.
ASP.NET comes with a data-caching module - the <%@ OutputCache %>. This data-caching module allows you to specify what data on an ASP page to cache and on what conditions to empty the cache and re-query the data-store. ASP.NET also provides Cache API and allow developers to create customised caching mechanism.
In addition, ASP.NET ships with Performance Counters which system administrators can use to gather application metrics. They can be used to measure the performance of either a single instance of an ASP.NET application or all ASP.NET applications combined on a computer.
J2EE architecture allows you choose your service level. For example, with J2EE you can have a high-end, expensive solution (iPlanet running on Sun Solaris in an E-10000 server), or a low-end, inexpensive solution (jBoss running on Linux on a Cobalt RAQ server). Costs are typically in the single-digit thousands of dollars per processor. There's also an assortment of free and/or open source tools and services that support Java and XML. The basic Java APIs may be obtained from Sun Microsystem for free. The cost consideration should cover the followings:
· the price of the server platform,
· the cost to train developers,
· the cost to build and evolve a solution on that platform,
· the cost to maintain the solution, and
· any business opportunity costs from picking the 'wrong' platform.
As a product, Microsoft.NET has a price tag on it. Further work will be needed to find out the actual price, as Microsoft is only officially release the Visual Studio.NET last month. However, more important is how stable this platform will be with Microsoft. Will we be forced to change as with previous Microsoft products?
ASP.NET is different from ASP in two major ways:
· ASP.NET offers several programmatic enhancements over ASP, such as, Compiled ASP.NET Scripts, Caching: Post-Back Forms: Server Controls, and Deployment.
· ASP.NET offers a change in programming fundamentals – object oriented component programming model. ASP followed procedural pattern of creating pages.
For key considerations on migrate from ASP to ASP.NET, which is relevant to CLRC DataWeb, please read the attached summary titled “From ASP to ASP.NET”.
Both JSP and ASP.NET, and their associated platforms J2EE and .NET, are comparable in functionalities. The key difference is that ASP.NET is a proprietary product and JSP is an open standard. As a single vendor product, Microsoft’s ASP.NET may offer a better integration, and it provides a better IDE, and it also offers language-neutrality to developers. In comparison, however, JSP provides a more mature technology, and offers platform-neutrality, and better portability to developers. As a specification, developers will have more controls over what they are doing.
Attachment 1: “From ASP to ASP.NET” – a summary of changes required based on an article by Jim Kieley, Microsoft Corporation, Updated November 2001.
Attachment 2: “J2EE vs. Microsoft.NET – a comparison of building XML-based web services” by Chad Vawter and Ed Roman, June 2001. Prepared for SUN Microsystem, Inc.
Attachment 3: “an Introduction to ASP.NET and .NET Framework” – a note of summary on ASP.NET basics (unfinished).
Attachment 4: “Creating future proof applications” – a summary of some opinions modified from W3School’s Vision.
Other references used:
Microsoft .NET web sites: http://www.microsoft.com/net/default.asp
MSDN Library on .NET Development: http://www.microsoft.com/net/develop/default.asp
ASP.NET home page: http://www.asp.net/
ASP.NET application example: http://www.ibuyspy.com/
.NET Framework download:
Windows .NET Server Home:
Java Web Services Tutorial:
.NET Resources: http://www.dotnetexperts.com/resources/
JSP vs. ASP: http://www.jspinsider.com/articles/jspasp.view
PHP vs. Java: http://www.phpbuilder.com/columns/marknold20001221.php3
PHP vs. ASP: http://php.weblogs.com/php_vs_asp
PHP home site: http://www.php.net/
PHP Resource Index: http://php.resourceindex.com/
.NET site: http://www.dotnet101.com/