Programming the Slideshow Picker Page

You have two tasks to accomplish in code in the  SlideshowPicker.aspx page. The first task is to display records from the Slideshows table in the ListBox control. To display the records, you need to invoke data binding for the ListBox control, just as you did for the DataList control in Chapter 11.

The second task is to run a slideshow. When users click the Run Slideshow button, you need to determine which slideshow they ve selected. After the user has selected a slideshow, you want to display a slideshow page (which you ll create momentarily) and pass the user s slideshow selection to it. You ll need a way to pass the slideshow information from one page to another. In the slideshow picker page, you ll use a query string, which you ll add to the URL of the page you are navigating to.

Understanding Query Strings

When you display a page in your browser, you type or select its URL, which might have a format like this:

http://www.contoso.com/mypage.aspx

The Web server recognizes mypage.aspx as a file name and processes it accordingly. However, you ve probably also seen URLs that look like the following:

http://www.contoso.com/ mypage.aspx?name=mike&status=active

Compared with the URL in the first example, the second URL has extra information. The text from the question mark to the end of the URL is known as the query string. The query string consists of one or more variable/value pairs. If the query string contains more than one variable/ value pair, the variable/value pairs are separated with an ampersand (&). The URL in the second example contains two variable/value pairs, name=mike and status=active.

When the Web server gets a request with a URL containing a query string, the server strips off the query string and passes the contents of the query string to the page being processed. You can therefore use query strings to pass data to another page by tacking it as a query string onto the URL of the page being called. Query strings are a great way to pass information between pages if the information is short and if you don t need to keep the information around for some other reason. Query strings are not secure, however, so you don t want to use a query string to pass any sensitive information, because users will be able to read it. Query strings are also easy to spoof, or fake. Users can easily type in a URL with a bogus or malicious query string. In the page that reads the query string, therefore, you need to use HTML encoding to check for potentially malicious input. Refer to Chapter 10 to see how to use HTML encoding to convert user input.

Let s start programming. Switch to Code view in the  SlideshowPicker.aspx file, and create a Page_Load event handler. In the event handler, call the ListBox1 control s DataBind property. You need to bind the control only the first time the page runs, so put the data binding call into a test for IsPostback. The code will look like the following:

Sub Page_Load(     If Not Page.IsPostBack The         listSlideshows.DataBind(     End I End Sub 

Now switch to Design view, and then double-click the Run Slideshow button to create a Click handler for the button. In the Click handler, enter the boldfaced code shown in the following listing:

Sub buttonRunSlideshow_Click(sender As Object,  e As EventArgs     Dim slideShowTitle as String     Dim slideShowName as String     slideShowTitle = listSlideShows.SelectedItem.Text     slideShowName = listSlideShows.SelectedItem.Value     Dim queryString as String     queryString = "slideShowName=" & slideShowName     queryString &= "&slideShowTitle=" & slideShowTitle     Response.Redirect("SlideshowViewer.aspx?" & queryS tring) End Sub