ISAPI Overview

ISAPI defines two distinct classes of functionality. The first is the ISAPI filter. This is a DLL that is registered with IIS. From that point on, IIS will call an entry point in the DLL whenever certain actions take place. The actions that will trigger the filter are configurable by the filter's developer. The filter is never called directly. I'll cover ISAPI filters in detail in the next chapter.

The other class of functionality that ISAPI allows is the ISAPI extension. An ISAPI extension is a DLL that exports a couple of functions with a predetermined name and argument signature. In general, this is all that is required to make a DLL an ISAPI extension, though as usual, the devil is in the details. The first step is to create a DLL exactly the same way you would create any DLL. In the examples that follow, we will create the DLL using the application wizard in Visual C++ 6. Note that for this first example, we will not be using the ISAPI Extension wizard, but rather the standard Win32 Dynamic-Link Library wizard. Figure 10-4 shows the New application dialog with the wizard selected and the name of the project (ISAPI1) filled in.

Figure 10-4 The New application dialog with selections to create the first example ISAPI extension.

Click on OK, and the single dialog of the DLL wizard appears. Select A Simple DLL Project (as shown in Figure 10-5), and click on Finish. Click on OK, and the project's initial files will be created. These include ISAPI1.cpp, StdAfx.cpp, and StdAfx.h. The StdAfx files are used to include standard header files and declare any variables needed. The only modification to these files for this project is the addition to StdAfx.h of an include statement for httpext .h, a header that declares structure definitions and prototypes needed for ISAPI extensions.

Figure 10-5 The Visual C++ 6 Win32 Dynamic-Link Library wizard.

NOTE

---

To run an ISAPI extension, IIS must be set to allow execution of scripts and executables from the directory in question. Without this permission, when the DLL is included on a URL, the user might be offered the option of downloading the DLL ” certainly not something you would want the user to do.

Benefits of ISAPI over CGI

What makes ISAPI a better option than CGI? Several issues differentiate ISAPI from CGI. The first is that ISAPI results in a compiled solution, while many CGI solutions use scripting tools. This can also be a disadvantage , as even minor changes require an edit-compile-test cycle. However, for many applications ” especially applications that need to be sold and thus have their source protected ”a compiled application can be an advantage.

Another difference between ISAPI and CGI is increased speed. Even if a CGI application is written using a compiled language, it is unlikely to perform as well as an ISAPI application. Why is this? CGI applications create a separate process for each client request. This creation and destruction of processes can be a huge drain on a Web server. ISAPI applications are commonly loaded into the server's memory space once when first called and are virtually never removed until IIS is stopped . Creating individual threads costs much less than creating processes does.

Another advantage for Windows 2000 developers is that the tools used to develop these ISAPI applications can be the exact same tools used to create client applications. I can't overstate how convenient it is to use a single tool set across the spectrum from client to server applications.

Benefits of ISAPI over ASP

ASP applications are a reasonable alternative for a first Web application, and for many situations, ASP might even be acceptable for the entire life cycle of a Web application. However, ASP applications do have a couple of potential problems:

• ASP scripts can be read by anyone with the proper authority. For a commercial application, this can be a big problem. Even for applications designed for internal use, there is always the risk that the source could be exposed, possibly revealing information that should remain secret.
• ASP scripts might not be fast enough for extremely high volume applications. This can be mitigated by the use of compiled ActiveX components for areas of code that are bottlenecks, as in the Chapter 9 example in which string handling was the bottleneck.

Given the potential problems with the alternatives, ISAPI provides the kind of flexibility required for high-performance or commercial applications. ISAPI also provides useful alternatives for access to data that is not easily accessed using ODBC. ASP applications essentially require ODBC access to data, unless you are prepared to create ActiveX components on your own to handle data access.