cf.Objective Afterthoughts

First off, it was an awesome conference for no other reason than I got to meet a whole bunch of people I know only by their blog, or blog comments. Second, I now get the allure of a Twitter back channel. (Even if it annoys some of the people on my Twitter list who aren’t ColdFusion geeks.) Third, I haven’t been this mentally stimulated by a work related conference, like ever.

This conference was awesome for the sheer access it gives attendees to the people who are leading our niche of web development. There’s something very convincing about Mark Mandel advocating Transfer, or Joe Rinehart showing off Model-Glue:Flex. And there’s something really entertaining about watching Mark Drew curse and compile his way through preparation for a CfEclipse demo.

But the biggest thought going through my head now is “What do I do, now that I know everything I do is wrong?” Granted that’s an exaggeration of the truth, but it’s certainly the feeling I have. But a more productive version of this question is “How do I introduce all of these great techniques into my regular work?”

Here’s my list:

  • Start using Coldspring
  • Start using an ORM
  • Start using a real framework
  • Stop thinking about objects in terms of data
  • Start doing development on my local machine
  • Stop spreading rumors that the man saying he is Sean Corfield has the real Sean Corfield tied up in his hotel room.

That’s a pretty tall order. Of course the smart thing to do would be to accept that there is no way that I can do all of this and therefore not try any of it. (Hold off that on that comment… I’m not just done yet.) So that’s not a good attitude, but it isn’t an uncommon one either.

I think the actually smart thing to do would be to accept that it’s possible that I wouldn’t implement all of these any time soon. However, I’m going to try and implement some of these things in bits and pieces where they make these most sense over the next few months.

I’ve already got a virtual server running a complete development environment, and I maintain that I never saw the real Sean Corfield this weekend…

Oh well, at least I managed to cross one of those off my list.

cf.Objective Day 3

Paul Kenney: Test driven Development with ColdFusion

Paul Kenney from Adobe took us through test driven development. Testing is one of those things that people (okay I) always nod their head and say “We totally should be doing that” and then do nothing about implementing. I was hoping to get some good incentives or strategies out of this session.

Paul started with the problems of testing. They basically boil down to:

  • Too little
  • Too late
  • Too difficult to run (not automated)

Tips

  • Programmer Tests (Unit Test)
    • Written by developer that writes the code
    • Written before the code that they test
    • Tests external behavior of components
    • Acts as a contact
    • No code without testing
    • Allow freedom to refactor
  • Refactoring
    • Changing internal action of code without altering external behavior
    • Do so when principles of good object oriented design aren’t being upheld
      • Duplication
      • Hard to understand
      • High Coupling
      • Low Cohesion
      • Too many switch statements
  • cfcUnit
    • Errors versus Failures
      • Errors you know
      • Failures occur when code does not act as expected

Charlie Arehart: Understanding, Improving and Resolving Issues With Database Procedure Caches

Charlie Arehart is a really polished speaker. I’m not knocking anyone else, but he’s just really smooth.

The main thrust of the talk was about getting optimized query plans through ColdFusion.

Points:

  • Remember that there is a Database Management System between you and the database
    • Database driver
    • Connection Pool
    • DB Page buffers
    • Query Plans – Prepared Statement plan
  • Use SQL Profiler
    • You can see Execution plans
  • DB Plan caching
    • Reduces the amount of processing DBMS does
    • Instead of computing new plan, it reuses old one.
  • Some of this data is available in perf monitor.
  • Use the DBCC stuff in SQL 2005
  • Performance Implications
    • Cache requires memory on CF
    • Not using it requires processor on SQL
  • MySQL can do some of this now
    • Couple Gotchas
  • SQL 2005 might not work if you are using compatibility mode
  • Prepared Statements can hurt sometimes
    • When selecting by NULLS

Ben Forta: Keynote Top Secret Scorpio

Ben went over the Adobe buy out and customer worries to start with. He then went into the marketing over view:

  • Developer Productivity
  • Integration
  • Management and Administration

Ben talked about three things to do with Developers and Eclipse

First was the ColdFusion Ajax Application Wizard. Much like the Flex application wizard it creates a simple application using Ajax. He also pointed out the ColdFusion Ajaz Debugging tool. You know how PHP programmers will grudgingly admit that ColdFusion does debugging much better than anything else out there. They’re going to have to say it some more; because this thing is awesome.

Second was the Eclipsed based ColdFusion Debugger. This feature has never really excited me. But seeing it in action, I can really see it being useful.

Third was the new integration of Flex Data Service into ColdFusion. It’s now being called LiveCycle Data Services.

  • New gateway for pushing data to LCDS from ColdFusion
  • LCDS is now part of the ColdFusion Install.
  • Data Services can be consumed by technologies other than Flex.

Lunch

Hal Helms: Object Oriented Modeling

I went to the wrong room, and wandered into this, but didn’t want to move because I had access to an outlet. Additionally, I’ve always wanted to hear Hal Helms talk.

This was a theoretical/philosophical discussion on the way to architect object oriented code around your data model. It was a very cool introduction about talking about this stuff better. The whole getter and setter model isn’t enough. Don’t think about objects in terms of data you can get out of them… Think objects in terms of what they do.

Hal starts at the UI and works down to the database. I guess, but I’m not sure, is that you have to shift your mind to thinking of the database as just a persistence layer to save object state. You have to ask yourself “What does it mean to be a <blank>?”

Hal’s Tiers of OO Applications

  • Data
  • Domain Model
  • Service Layer
  • Application Layer

A lot of this went over my through my fractured attention span. My brain is full.

But cool notes:

  • Favor composition over inheritance
  • Feel free to make mistakes
  • Separation of Concerns
  • High cohesion
    • Well defined purpose
    • It should do only what it should do
  • Low Coupling
    • Through API’s instead of hard coded knowledge
  • Design Patterns
    • They arose over time
    • Collected wisdom of the development world.

He finished up with a good example of why Inheritance is not the best pattern to use in many, many cases.

Chris Scott: Introduction to Aspect Oriented Programming with ColdSpring

Aspect Oriented programming is a relatively new comer to the programming world. It complements OO and controls wide reaching concerns. Chris Scott started talking about why we do it, before talking about how.

  • Cross Cutting Concerns
    • Security
    • Transactions
    • Caching
    • Logging (Poster Child)
  • Two central themes
    • Interception
      • Grabbing method calls (Join Points)
    • Introduction
      • Add functionality before, after, and around methods
      • Doing so is called Advising

This was another one that blew my mind.

He showed us an example of caching that was so robust, he took the database of a database application down, and it still worked. He also showed a great example of a use of custom metadata in CFC’s.

After this I was done. Chris Scott hurt my brain. This stuff was so cool and so powerful, I want to use it. I just don’t know where yet.

cf.Objective Day 2

The beds at the Sofitel almost made me miss my first session.

Matt Woodward: OO Architecture Back to Front

The focus of this session was developing OO architectures starting at the database and moving forward. Matt Woodward started with a quick overview of OO. One of the best things he explained was that all of the layers of an OO application serve to increase the coupling and decrease the cohesion of your application. He went over a few basic patterns like DAO, Gateways, Beans, etc, and a few layers like service, business, controller etc.

Interesting tips and pointers

  • You want to do multiple layers of validation.
  • Server side validation should probably live in the bean.

This was a really good presentation about the whys and wherefores of the multiple layer development style. He’s going to post it up on his site. Definitely check it out if you get a chance. It would be a good tool to explain this stuff to others.

Steve Rittler: Using the Adobe Flex Toolkit for Apex

Steve Rittler’s session wasn’t announced. Being a fellow Philly ColdFusion guy, I figured I would give him some support. But it was so far outside my bailiwick that I figured I would be better served going to another session.

So I wandered into Adam Lehman’s session.

Adam Lehman: Scorpio: Diagnostic Server Monitoring and Realtime Performance Alerts

Adam went over the server monitor, showing off what it could do.

He started with an overview of how this tool could be used in development. Since the server monitor shows how much memory all of your scopes are taking up, you can figure out the capacity of your application on your server. Very cool.

Cool Bites:

  • The server monitor has a force garbage collection button
  • Reports show the effectiveness of the query cache
  • You can see how the database connection pool is being used and queued
  • Configurable alerts so you can be notified if there are speed or responsiveness problems
  • Alerts can take snapshot dumps of the environment for troubleshooting after the fact
  • Configurable actions you can map to alert items. Like killing threads, or stop accepting requests
  • Multiserver monitoring panel will allow you to see status of all your ColdFusion servers at once

Sean Corfield: Real World SOA: Building Services With ColdSpring and Transfer

Despite persistent rumors that he was an impostor, Sean Corfield took the stage to talk about Real World SOA’s. SOA’s = API’s is a good way to think about this stuff. Things have to be done differently. Sean went over these difference.

SOA is about more than services. You need to have clearly defined data. Basically you need to agree on the same semantics when you talk about data, and the same components. For the most part you really have to document these applications, and then actually make this information available.

Software as a Service (SaaS) is growing as a market at 20 per year. SOA’s are the backbone of SaaS.

Separation of concerns is very important to be doing this type of application. The future of this space will be light application that call SOA’s that don’t have their own view or controller. These SOA’s are all Model.

Tips:

  • Don’t rely on client scopes
    • Session
    • Cookie
    • Client
  • In fact turn the session scope off in your application
  • Create some sort of token handling using a persistent store (database)
  • Remember that ColdFusion makes data easy to manage
    • Other technologies don’t handle Queries
    • Keep data types simple
    • Typed structs are good
    • XML
  • You actually might need to use the This scope and <cfproperty>
  • Sean has made a Rest adapter, you can download at his site.
  • You don’t want to just set access=Remote on your entire business layer.
    • Build a remote api instead
    • Might need to build API’s for multiple technology
  • Unit Testing is necessary
  • Exceptions need to be handled differently
    • Fail gracefully
    • Return structured error message with fault indicator
    • Make sure that you throw codes along with text (because of internationalization.)
  • Clustering and Caching is a challenge
  • Tools to use:
    • ColdSpring
      • Manages the CFC’s
      • Manages Transfer
    • Transfer
      • Manages the database
      • Handles all of the persistence of the application.
    • cfcUnit
      • Write tests
      • Automate tests
  • What worked well
    • Unit Testing
    • Managing the CFC’s and database with ColdSpring and Transfer
    • Automated builds
    • Cruise Control
  • What went not so good
    • Using an old model for new work
    • Too many endpoints in the exposed API
    • Not enough unit testing

Lunch

Simeon Bateman: Fusebox the Original ColdFusion Framework

Simeon Bateman thinks that you should be using a framework, even your own. But he thinks that Fusebox is the best. I decided to go to this because some bad Fusebox code was what originally made me dislike Frameworks. Now that I’ve come around I figured I would give it another look.

Simeon took us from the beginning of Fusebox to the current day.

It was basically a good introduction to Fusebox. I had no interest in using Fusebox before this session; I now want to give it a try.

Break

I had a lull between sessions I wanted to attend. Evidently Jason Delmore’s wife told him that I said I was annoyed with him yesterday. Poop. I didn’t want to do that. I was mostly happy with what he had to say. There was much more positive than negative.

Additionally, Jason also helped saved someone’s life yesterday, He was a total hero! He has that going for him.

Kelly Brown: JVM Server Tuning

I finished up the day with the very geeky JVM session with Kelly Brown. It was altered into a ColdFusion Performance Tuning session. I guess he extended it beyond where he initially intended it.

Concepts he went over:

  • Disk Based
    • Trusted Cache
    • Deleting saved class files
      • Finding them can be slower than compiling
      • Dependent on hardware and size of site
  • Memory based
    • A lot of these are tough because you control the number of items not size of memory footprint.
    • Maximum Number of cached template
      • Sweet spot
        • Too high – runn out of memory
        • Too low – performance issues
    • Maximun number of cached queries
    • Session and application scope
      • Session’s can be wrecked by search engines so watch OnSessionStart
    • Mail and Charting can be cached too.
    • JVM tuning
      • You can change the memory footprint of the JVM
      • Jvm.config is where you can set a whole bunch of settings.
      • Change the JVM’s JDK to improve performance.
        • Certified to 1.4.2_11.
        • Rumors of 1.4.2_13
      • Max Heap Size:
        • 512mb default to low number of Gb depending on platform.
        • If you are seeing memory errors set this higher.
      • A lot of JVM settings will never need to be touched. Especially in CF 7.
      • You can check JVM through the java.lang.Runtime
    • Sun Virtual Garbage Collector tool.
      • Free download from SUN
      • Part of jvmstat
  • Processor Based
    • Simultaneous requests
      • His experience 15-20 per processor
      • Optimal depends on application.
      • Too high you spend more time switching out threads then processor
      • Too low, you don’t get anything done.
    • Request Timeouts
    • Report and Charting threads
  • Jrun.xml
    • Edit away
    • But make a backup first.
  • Jrun Proxy Service
    • Connects Jrun to Webserver
  • Scheduler Service
    • Also allows thread manipulation
  • Load Testing
  • Final thoughts
    • Don’t turn on debug in production
    • Update database drivers
    • Don’t put client variables in registry.

All in all, today was another day that hurt my brain.

cf.Objective Day 1

Keynote

Jason Delmore delivered the keynote the really gave a good overview of the philosophy around Scorpio. Adam Lehman was evidently worried about Jason’s lack of “marketingese” but I really liked him admitting that the use cases for things like <cfpresentation> and <cfreport> were hard to find.

New confirmed developments include <cfthread> and <cffeed>.

I was a little annoyed with Jason’s response to my question. I asked “Is the Beta feature complete?” He gave me a hard time and cited the NDA. I could have just asked. “If I’m on the beta will you say anything new?” But I was trying to be nice.

Mark Mandel: Developing Applications with Transfer ORM

This was basically a good introduction to using Transfer. Mark Mandel did a really good job speaking. What I can’t figure out is the main difference between Transfer and Reactor. I’m not saying there isn’t one. I just wonder if there is anything that one does that the other doesn’t do or vice versa.

If only I had access to Mark Mandel and ask him without being an ass about it. (Remember to ask before any receptions or parties tonight.)

Dean Saxe: Application Security and Compliance

Dean Saxe‘s presentation on security looked really promising. This is why I signed up for it. What I heard of it was good. However Sean’s twitters about David Keith’s session lured me out.

David Keith: Adobe.com

This was a great opportunity to find out how Adobe runs their site. They use a heavily tiered environment on both the hardware and application side. It validated what we do at Wharton a lot, which I was happy about.

They were also upfont about their weaknesses which was also very helpful. They talked about their single point of failure at the database level, and problems with colliding scheduled tasks.

Lunch

Sean Corfield: AJAX Integration With Scorpio!

Sean Corfield gave this talk despite the fact that he not an Adobe employee (and despite rumors that he was not in fact the real Sean Corfield.)

Interesting little trivia bit – AJAX came out of advancements cause by Outlook Web Access.

Cool features:

  • CFC Proxies in JavaScript, automatically
  • Yahoo UI controls
  • Databinding across controls
  • Rich Text textarea’s
  • Auto Suggests

New Tags:

  • <cflayout>
  • <cftooltip>

At this point in the presentation Mark Drew started showing me his Project Unity stuff. Since I’ve seen a lot of what Sean was doing in the Beta, I paid attention to Mark Drew instead.

Adam Lehman: Scorpio: Working with .NET and Microsoft Exchange

Called the audible twice and decided to stay with what brought me to CF in the first place: Microsoft Exchange.

Adam spelled out the different ways that you can currently interact with .Net. Things like webservices, and various other types of wrappers. ColdFusion 8 will allow you to call .Net assemblies like CFC’s or Java classes. Additionally it will perform better than all the other wrapper methods. On the backend ColdFusion creates proxies, much like webservices use skeleton objects on the backend.

He then went on to the Exchange technologies. Claim: ColdFusion Exchange tags can do anything that the Outlook Client can. Eh, not really, but it can do everything that you would want to build an application around. You can manipulate contacts, appointments, mail items, and tasks. You can’t interact with say the Out Of Office message. “You can do anything to the objects CF exposes that you can do in Outlook” would be more accurate.

Interesting Ideas:

  • .Net interaction will allow CF to extend Sharepoint.
  • .Net interaction will allow CF to interact with IIS

Mark Drew: The CFEclipse Project

Mark Drew confirmed that he was never on the show 24. He then took as on an overview of the CFEclipse project.

Most of the people here are using CFEclipse, so he powered through the existing features. He spent a fair amount of time showing off Snippets which definitely are powerful.

Then he revealed Project Unity. Which I’m pretty sure is the killer application for CFEclpise. It’s a CFFramework inspector that allows developers to basically interact with Frameworks through a variety of methods. One method looks a lot like the Component Explorer, but it also allows snippet like inserts of calls to Framework components.

What’s really cool about it is that it understands the frameworks. So if you inspect a Fusebox project you can inspect individual circuits. If you inspect a Reactor project you can wire together relationships. In addition to viewing them, you can also edit them through a wizrd view that writes the code for you.

Finally it’s full extensible, so if you have a framework, you can write your own XML to make it work with the CFframework explorer.

The key question is: When will it be released?

I figure I’ll blog about the Birds of a Feather session after than tonight.

Squidhead Update 5/2007

Squidhead is swimming along nicely. I’ve gotten some good suggestions, over the last few weeks, and figured I would post what’s going on.

Dave Konopka, who works with me here at Wharton, has a pretty good complaint about Squidhead. Basically his complaint is that there needs to be another layer between the DAO and UI. We’ve taken to calling it the Business layer. Basically, many times his basic interaction with the database requires more than just one DAO operation, and often other operations not related to the database (logging, email, etc.) So to achieve perfect encapsulation and reusability through the application, he requires the business layer.

He provided me with a good bit of code for it, which will create Business beans for any of the DAO operations. Additionally it abstracts the whole “Is it an add or is it an update” logic, making the UI have to do less work.

I’ve added the business CFC creation routine to Squidhead and am working on rewiring the UI to use it. It will be optional, so that existing applications don’t break, but it will be set to the default way of doing stuff.

Finally, I did get some requests for Fusebox integration, and MySQL compatibility. I’m working on those, but Dave’s in my office, so he gets to sell me this stuff right to my face.

My cf.Objective Schedule

All the cool kids are doing it, so I figured I would share my cf.Objective schedule with the world. The twist is that I extracted it from my Outlook calendar using the new Exchange tags in Scorpio. I’ve included the code below.

Time Session Speaker
Thu 9:00 PM Reception
Fri 8:00 AM Breakfast
Fri 9:00 AM Keynote -Top Secret Scorpio! Jason Delmore
Fri 10:15 AM Developing Applications with Transfer ORM Mark Mandel
Fri 11:25 AM Application Security and Compliance Dean Saxe
Fri 12:30 PM Lunch
Fri 1:30 PM AJAX Integration With Scorpio! Sean Corfield
Fri 2:40 PM ColdFusion Flex Integration Kevin Schmidt
Fri 4:10 PM The CFEclipse Project Mark Drew
Fri 7:00 PM Birds of a Feather Sessions
Sat 8:00 AM Breakfast
Sat 9:00 AM OO Architecture Back to Front Matt Woodward
Sat 10:15 AM Using the Adobe Flex toolkit for Apex Steve Rittler
Sat 11:25 AM Object Think Simon Horwith
Sat 12:30 PM Lunch
Sat 1:30 PM Fusebox – The original CF Framework Simeon Bateman
Sat 4:10 PM JVM Server Tuning Nick Tunney
Sat 7:00 PM Birds of a Feather Sessions
Sun 8:00 AM Breakfast
Sun 9:00 AM Keynote -Top Secret Scorpio! Ben Forta
Sun 10:15 AM Test-Driven Development with ColdFusion Paul Kenney
Sun 11:25 AM Understanding, Improving and Resolving Issues With Database Procedure Caches Charlie Arehart
Sun 12:30 PM Lunch
Sun 1:30 PM Introduction to Cairngorm Rob Gonda
Sun 2:40 PM Introduction to Aspect Oriented Programing with ColdSpring Chris Scott
Sun 4:10 PM Leveraging ColdSpring to Build a Robust and Maintainable Architecture for Flex Chris Scott
Sun 5:10 PM Close of Conference

Exchange Code

I’ve only omitted my server details.

<cfexchangeconnection
action
=
“open”
connection
=
“exchangeConnection”


protocol
=
“https”
server
=
“#homeServer#”


username
=
“#exchange_user#”
password
=
“#exchange_password#”

mailboxName
=
“#mailbox#”
/>



<cfexchangecalendar
action
=
“get”


name
=“appointments”


connection
=“exchangeConnection”>

<cfexchangefilter
name
=
“starttime”


from
=
“5/3/2007 15:00”
to=“5/7/2007”
/>

</cfexchangecalendar>



<cfexchangeconnection
action
=
“close”
connection
=
“exchangeConnection”
/>

<cfquery
dbtype=“query”
name=“appointments”>

SELECT AllDayEvent, starttime, endtime, location, message, subject

FROM appointments

WHERE AllDayEvent = 0

ORDER
BY starttime



</cfquery>

<table>

<tr>

<th>Time</th>

<th>Session</th>

<th>Speaker</th>

</tr>

<cfoutput
query=“appointments”>

<tr>

<td>#DateFormat(startTime,”ddd”)#

<!— Lazy way of dealing with time difference —>

#timeformat(DateAdd(“h”,-1,startTime ) ,”h:mm tt”)#

</td>

<td>#subject#</td>

<td>#message#</td>

</tr>

</cfoutput>

</table>

Adobe Made me Obsolete

It looks like with the Scorpio tour in full swing, the NDA is up on certain aspects of ColdFusion 8. (I’m still going to tread lightly though.) But according to this article from the downloadsquad, Adobe finally revealed that they went and added Exchange Integration to ColdFusion.

Up until now, the only game in town was using Webdav to communicate with Exchange. I’ve been pushing the little bit I know about it for the last year.

I’ve never been happier to be out of a line of work ever. This stuff is tough to write and fickle to maintain. Microsoft doesn’t make it any easier by breaking stuff when they push out updates.

I’ve been working with it in the Beta tests and I can categorically say: Adobe has made it truly easy to interact with Exchange. Short of working in .Net, there is no easier way to programmatically interact with Exchange than with what the ColdFusion team achieved here. This is to say, having worked with .Net, there is no easier way to programmatically interact with Exchange than with ColdFusion 8.

I have some ideas for best practices of working with Exchange from ColdFusion when we can all talk more freely about it. In the meantime if you get a chance to get on the Beta trial give it a chance; it will knock your socks off.

Top Code Review Issues

I figured I would blog about what I’ve been seeing during code reviews lately. Maybe someone else has been seeing too, or seeing other issues. I’ve omitted problems that deal with our shop’s internal best practices, and tried to stick with things that would apply more globally. If I over applied something let me know. It’s a long one, so more after the jump.

5. Improper implementation of Application.cfc inheritance

Application Inheritnace is very useful for application and sub applications development. However there is a gotcha to remember here. If you are going to override application variables that you set in onApplicationStart, they you need to give the application.cfc its own this.name. Why?

  • Imagine this:
  • Application.cfc
    • This.name=parent
    • OnApplicationStart
      • <cfset application.title = “Parent” />
  • Child/application.cfc extends=”../application”
    • OnApplicationStart
      • <cfset application.title = “Child” />

In this case, assuming the application is not started, going to a page under the child will trigger onApplicationStart. But since they have the same application name through inheritance, going to any parent page will not trigger OnApplicationStart, and they will be stuck with the application title of “child.”

The easy fix here is to always give children a different application name, only omitting it when you have a specific reason not to.

4. Improper Access on CFC methods

The four access types of CFC methods tend to cause people some confusion especially when they are learning the whole CFC thing. They each have different implication for application security.

I’ve pasted a more in depth guide below, but for the most part you probably shouldn’t set access=remote. Even if you are writing a webservice, only the exact method you are calling needs to be set to remote, so don’t set all of the methods called from your webservice to remote.

  • Private
    • Only accessible by other functions in CFC
    • Used for sub functions only relevant to CFC
  • Package
    • Only accessible by code in same folder
    • Any sort of organization makes this almost useless
  • Public
    • Accessible by any code on the server
    • Sounds scary, but relatively safe on a dedicate server
    • Use with caution on a hosted box.
  • Remote
    • Used for webservices.
    • If building webservices these should be accompanied by some security or logging.

3. Inappropriate use of a Query of Queries

Query of Queries have many legitimate uses. They include but are not limited to:

  • Performing SQL syntax queries on query objects returned from non-SQL operations. (Ex. <CFLDAP> <CFDIRECTORY>)
  • Joining the results of two queries made from two different sources (Ex. Joining MS SQL and Oracle data, or SQL and LDAP data.)
  • Providing multiple views to the same data on the same page request. (Ex. Showing a chart of data sorted multiple ways on the same page.)

However, where they get deservedly shunned is when they are reproducing functionality that can be completely handled in native SQL. In my experience, this is often (but not always) done by developers who know Cold Fusion very well, but not advanced SQL, therefore when they can’t get the problem solved in SQL they fall back on Cold Fusion to do what they need to get done. (At least that’s what I was doing when I got yelled at for it.)

In many cases, it takes less time to post the SQL request to the database server and get the response back then it does for Cold Fusion to process the request on an in-memory query. It’s counter-intuitive, but such is the power of indexing and SQL-based set operations. Case in point, when I was designing a dictionary check for a password change page, it made sense to load the entire dictionary into an application variable, and then do a query of queries on it. The process took 3000ms, or 3 seconds, which is slower than a request really should take. The same request against the database server took half that. Ultimately through indexing and query tuning, I got the process down to 100ms.

Your mileage may vary, especially depending on the size of the dataset, but the point remains that you should let SQL be SQL and Cold Fusion be Cold Fusion.

And by the way, I’m not being original here, other people have said this:

ColdFusion is Not a DBMS

2. Fake Email addresses in error or reporting pages

If your application sends email, those emails should be sent from a legitimate, addressable email address. (Whether or not the email goes to a list, a mailbox, or some other place is not a factor.) There are a couple of reasons for doing this:

  • It is not inconceivable in the future that your organization, hosting provider, or your user’s email host will start rejecting messages from invalid addresses due to spam considerations.
  • Any bounces generated from these messages will never get back to you.
  • Users responding to these messages will get ungraceful bounce responses.

Of these reasons, 1 is probably the most important as spam or virus concerns have forced mailing hosts to make quick decisions like this without consulting others, due to the severity of the issue. But this is one of those easy to fix low hanging fruit issue.

1. Lack of Var scoping in CFC methods

This is a pretty familiar issue to everyone. I don’t want to belabor it. As a matter of fact I’ll just link to a bunch of posts about it:

Additionally there is a tool you can use to help programmatically attack this problem:

VarScoper