Chapter 13

Deploying Your Control on the Web

• Hosting a Web Site
• For the Net-Impaired
• Obtaining the ActiveX Control Pad
• Crash Course on HTML and VBScript
  • About HTML
  • About VBScript
• Using the ActiveX Control Pad
• Testing Your Control in a Web Browser
  • Adding VBScript Code to the Web Page
  • Extra Credit
• Making It Work with Netscape
• Using the Setup Wizard in an Internet Context
• CAB Files and CODEBASE Tags
  • Using the CODEBASE Tag
  • GUIDs
• Safety Considerations
  • Script-safe
  • Initialization-Safe
• Licensing Issues on the Web
  • Using the Lpk_tool Utility
• Signing Your Code
  • Obtaining a Software Publisher's Certificate
• Using Signcode to Sign Your.CAB File
  • Testing the Signed .CAB File
• Summary

This chapter will discuss methods of getting your control on the World Wide Web. We'll cover not only the method of distributing your controls to Web users, but also the basics of the VBScript, the scripting language that enables you to program ActiveX controls that you've embedded in your Web pages.

Hosting a Web Site

In order to have a place where users can view your Web pages (and download ActiveX controls), you need access to a Web server, a computer connected to the Internet that runs software designed to send Web pages to other users' computers.

For individuals, the easiest way to locate a Web page on a Web server is to obtain an Internet Service Provider (ISP) that offers space on their Web server as part of their basic service package. With this kind of setup, you don't have to worry about maintaining the technical details of the Internet connection; the ISP does it all for you. However, you may have to pay the ISP extra if your site is very large or very popular; check with your service provider for details on that.

If you have more sophisticated requirements, you may wish to set up your own Web server. Microsoft gives its Web server software away free as a part of the Windows NT Server operating system; there are a number of other Web server packages available from a variety of vendors.

Note that your Web server need not be hooked up to the Internet-at-large to be effective. Web servers designed to serve the needs of individuals within a department or organization are gaining popularity as a way to distribute information within corporations.

This chapter assumes that you have access to some kind of Web server and that you have the ability to place files on it.

For the Net-Impaired

If you're not hooked up to the Internet already, this chapter still has relevance to you. Much of what is discussed in this chapter has relevance both to the Internet and to intranets (defined as private networks using technology standards developed on the Internet).

Even if you're totally Net-impaired, you should be able to use and test most of the demonstrations in this chapter using a stand-alone machine. If you use Windows NT Server 3.51 or 4.0, you can use the free Internet Information Server (IIS) software; if you're on Windows 95, you'll want to investigate the Personal Web Server that comes with Microsoft FrontPage 97.

Obtaining the ActiveX Control Pad

You start your ActiveX Web odyssey by obtaining a copy of ActiveX Control Pad. This is a tool you can use to put together Web pages; it's specifically geared toward building pages that contain ActiveX controls controlled with the VBScript language. I use this tool to test ActiveX controls in Web pages because it's free, it's fast, and it's no-nonsense. It also has some nice features for automatically inserting VBScript code into your HTML Web pages.

You can, of course, use other tools (including Microsoft FrontPage and plain old Windows Notepad) to build Web pages containing ActiveX controls, if you like. And while the Web page examples in this chapter were created with the ActiveX Control Pad, you shouldn't have too much trouble tailoring the discussion to your development tool of choice, since the underlying HTML code is the same.

Crash Course on HTML and VBScript

Once you've obtained and set up the ActiveX control pad, you're ready to get started sticking your control into a Web page and writing code to make it do its magic.

In this demonstration, you'll use a combination of two Web technologies-HTML and VBScript-in order to embed a SoundButton control in a Web page.

About HTML

Hypertext Markup Language (HTML) is the language that defines the appearance of World Wide Web pages. You don't have to know much of anything about HTML to get through this chapter, but you will need to know something about it to set up and maintain a Web site. Fortunately, it's not hard to learn.

About VBScript

VBScript is a Microsoft extension to HTML. You can use VBScript to program ActiveX controls inside a Web page, among other things.

VBScript is a subset of Visual Basic. It lacks many of the features of the Visual Basic language, because it is optimized for speed and safety over the public Internet. (See the section titled "Safety Considerations" later in this chapter for more about safety on the Internet.)

Using the ActiveX Control Pad

Now that you have the two-bit backgrounder on HTML and VBScript, here's a brief demonstration of how to use an ActiveX control in a Web page. This demonstration assumes that you have Microsoft Internet Explorer 3.01, the ActiveX Control Pad, and the SoundButton control installed on your machine. (If you didn't compile and install the SoundButton control back in Chapter 12, there is an installable version of the control on your CD-ROM.)

In this demonstration, you'll create an HTML Web page that will contain an embedded SoundButton control. The point of this demonstration is not to have a fully functional Web page right off the bat, but just to make the control appear in the browser. To do this:

1. Launch the ActiveX Control Pad. (By default, the ActiveX Control Pad is installed to c:\program files\ActiveX Control Pad\ped.exe on your computer.) The application displays an untitled page, as illustrated in Figure 13.1.
   Figure 13.1 : ActiveX Control Pad.
   
   What you're looking at is a skeletal HTML page. It contains the minimal elements of a Web page, comprised mostly of tags denoting page structure and formatting elements. (For example, <BODY> is a tag that exists in most HTML pages; it denotes the start of the main body of text in a Web page.)
   
   The text that appears between the <TITLE> and </TITLE> tags will appear in the browser's title bar when the page is viewed. To customize this default page, begin by changing this text:

2. Click-drag across the text New Page to select it. Overtype it with the words SoundButton Example.
3. Next, insert some text in the body of the Web page. To do this, click between the <BODY> and </BODY> tags. Type the text:

<p>This page demonstrates the SoundButton control. 
Not only does the SoundButton control emit a pleasant sound, 
but it can perform useful actions in a web page.</p>

Be sure to remember to type the <p> tag at the beginning and the </p> at the end of the sentence. This tag pair indicates that this is a paragraph, so that a paragraph break will be inserted after the text. The HTML should look like Figure 13.2.

Figure 13.2 : Web page with text.

Next you'll insert the SoundButton control in the page you're editing. To do this:

1. At the end of the document, press Enter a few times to open up some space.
2. From the ActiveX Control Pad menu, select Edit, Insert ActiveX Control.
3. Scroll through the list until you find MySoundButton.SoundButton. Click on it, then click on OK.
4. A visual design form (similar in appearance to a Visual Basic form) and a property sheet appear.
5. In the Properties sheet, change the SoundButton's Caption property to Click Me!, then click on Apply (or press Enter). The screen should look like Figure 13.3.
6. Click on the Properties window's close button in its upper right corner, then close the Edit ActiveX Control window the same way.
7. Save the page using the menu command File, Save. Give the page the file name SoundButton.htm.

The ActiveX Control Panel has inserted the following code in your document:

<OBJECT ID="SoundButton1" WIDTH=84 HEIGHT=36
 CLASSID="CLSID:7E0B5DF2-576C-11D0-9A3B-204C4F4F5020">
    <PARAM NAME="_ExtentX" VALUE="2223">
    <PARAM NAME="_ExtentY" VALUE="953">
    <PARAM NAME="Caption" VALUE="Click Me!">
</OBJECT>

This is the code that makes the ActiveX control show up on the Web page. Here's a brief description of the lines of code that were inserted:

• The <OBJECT> tag is an HTML tag that directs the Web browser to embed a software component into the page.
• The ID parameter is similar to the Name property of a Visual Basic control.
• The WIDTH and HEIGHT parameters dictate the dimensions of the control.
• The CLASSID tag is the GUID of the control. (The concept of the GUID was introduced in Chapter 12.)
• The PARAM tags set initial values for the control's properties; they are the equivalent of design-time properties. (The only settable property of the SoundButton control is Caption; the _ExtentX and _ExtentY properties are internal to the ActiveX Control Pad.)

That's it. At this point your control is ready for testing (even though it doesn't really do anything yet). Leave the ActiveX Control Pad open for now; in the next section you'll bring up Microsoft Internet Explorer and try out your HTML page.

Testing Your Control in a Web Browser

Now that you have a minimal HTML test page with a copy of your ActiveX control embedded into it, you can see how it looks in a Web browser. To test the Web page you're developing:

1. Leave the ActiveX Control Pad open and launch Microsoft Internet Explorer.
2. In Internet Explorer, choose the menu command File, Open.
3. The Open dialog box appears. Click on Browse and locate the file SoundButton.htm you saved in the first step, then click on Open.
4. In the Open dialog box, click on OK. The Web page opens, displaying the Potential Safety Violation dialog box illustrated in Figure 13.4.

5. If you were opening a page on the Internet, this would be a problem, but because you're opening your own control, it's no big deal. (We'll deal with this warning, what it means, and how to resolve it later in the chapter.) For now, click on Yes to All to proceed.
6. The Web page opens, as Figure 13.5 illustrates.

This page doesn't do much of anything, but if you click on the Click Me! button, you will be treated to the pleasant clicking sound you've grown so accustomed to.

Figure 13.4 : Potential safety violation dialog box.

Figure 13.5 : SoundButton Control in the browser window.

In the next demonstration, you'll return to the ActiveX Control Pad to make the page do something more useful.

Adding VBScript Code to the Web Page

Now that you have a rudimentary Web page, it's time to make it more functional. To do this, you'll add a VBScript procedure to it using the ActiveX Control Pad. To do this:

1. Leave Microsoft Internet Explorer running. Switch back to the ActiveX Control Pad. You should still have the file Soundbutton.htm open in the ActiveX Control Pad.
2. From the ActiveX Control Pad Tools menu, select Script Wizard.
3. The Script Wizard appears, as illustrated in Figure 13.6.

   Figure 13.6 : ActiveX Control Pad Script Wizard.

4. You'll use the Script Wizard to create an event procedure in the SoundButton control's Click event. This code will execute whenever a user clicks on this SoundButton. To do this, double-click on SoundButton1 in the Select an Event panel of the Script Wizard, then select Click.
5. In the Insert Actions panel on the right side of the Script Wizard, double-click on Go To Page...
6. The Enter A Page dialog box appears. Type the following URL:

http://www.mcp.com/

7. Click on OK. The Script Wizard looks like Figure 13.7.
8. Click on OK to close the Script Wizard. The following code is added to your document:

   Figure 13.7 : Script Wizard with event procedure.

    <SCRIPT LANGUAGE="VBScript">
<!-
Sub SoundButton1_Click()
Window.location.href = "http://www.mcp.com/zdpress/"
end sub
->

You can see that with the exception of the <SCRIPT> tag and HTML comment tags (the <!- and -> tags), the code is quite similar to a Visual Basic event procedure.

To test this procedure, do the following:

1. In the ActiveX Control Pad, re-save the Web page by choosing the File, Save command (or by using the keystroke shortcut Ctrl+S).
2. Leave the ActiveX Control Pad open. Switch to Internet Explorer.
3. In Internet Explorer, reload the page by selecting the menu command View, Refresh.
4. When the Potential Safety Violation dialog appears, ignore it by clicking Yes to All. The Web page refreshes.
5. Click on the Click Me! button. It looks the same as before, but this time when you click it, you not only hear the pleasant clicking sound, but the Web browser also loads the stylish and engaging Ziff-Davis Press home page.

Well, that's it. You've created a test page that successfully tests the two elements of the SoundButton control's interface (its Click event and its Caption property) as well as its feature-set enhancement (the pleasant clicking sound).

Extra Credit

If you want, you can insert a few more lines of HTML code in your page to enhance it. To do this, replace the <BODY> tag with the following HTML code:

<BODY bgcolor=CCFFCC>
<FONT FACE="Trebuchet MS, Ariel, Helvetica">
<h1>SoundButton Control Test</h1>

Here's a brief explanation of what the new HTML code does:

• The new BODY tag now has a bgcolor component that instructs the browser to render this page with a soothing green background color. (The CCFFCC value is a hexadecimal triplet that works similar to Visual Basic's RGB function; it provides a color by specifying red, green, and blue values. For example, pure red is FF0000, blue is 0000FF, and white is FFFFFF.)
• The FONT FACE tag tells the browser to display the page's text in one of the fonts indicated. (The reason why it lists three fonts is because not everyone has the same fonts installed on their computers. So the browser tries Trebuchet MS first, then Ariel, then Helvetica. If none of these three fonts are available on the client machine, or if the browser is not capable of displaying fonts, the browser will display a default font.)
• Finally, the <H1> tag indicates that the following text is a header and should accordingly appear larger and more emphasized on the page. The </H1> tag shuts off the display of the header font.

To test this, save the HTML file, switch to MS Internet Explorer, and refresh the page. It should look something like Figure 13.8 (although the exact color and font you see will depend on what you have installed on your system).

Figure 13.8 : Greatly enhanced SoundButton test page.

From here, you could go on to build a complete Web site based on SoundButton controls, clicking yourself silly in short order. But there are a few enhancements you need to make to the distribution of the SoundButton control-specifically, addressing the issue of the Potential Safety Violation warning, but also handling the actual installation of the control over the Net. I'll address those issues later in this chapter.

Making It Work with Netscape

I know what you're saying. You're saying, "Well, Jeffrey, this may be all well and good, but the minute a Netscape user hits my page, the whole thing is going to go kablooey." Am I right? Well, friends, gather 'round, because I'm going to show you a way to display an ActiveX control that will look like an ActiveX control to a Microsoft Internet Explorer user and like a hyperlink to a Netscape Navigator user (or a user of any one of a number of other fine browsers).

The home page for this book (http://www.well.com/user/jeffreyp/activex/) contains a list of links to ActiveX-related resources. Originally, this list was a conventional list of hypertext links. But the more I worked with the pleasant-sounding SoundButton control, the more I liked the idea of a clicky hypertext button. So I decided to replace the hyperlinks with SoundButtons. Here's how I did it.

Originally, the HTML code that produced hypertext links on the book's home page looked like this:

<a href="author.html">About the Author</a><br>
<a href="errata.html">Errata</a><br>
<a href="xlinks.html">ActiveX Resources</a><br>
<a href="vblinks.html">Visual Basic Resources</a><br>
<a href="../vbscript/index.html">VBScript Links</a><br>

<a href="http://www.mcp.com/zdpress">Ziff-Davis Press</a>

But that was boring, and I'm a novelty freak, so I started replacing the hyperlinks with buttons. Here's what this looks like for the first hyperlink:

<OBJECT ID="sbnAuthor" WIDTH=83 HEIGHT=24
CLASSID="CLSID:7E0B5DF2-576C-11D0-9A3B-204C4F4F5020">
        <PARAM NAME="Caption" VALUE="Author">
<a href="author.html">About the Author</a>
</OBJECT><br>

Although most of this could have been done with the ActiveX Control Pad, there is one extra twist that makes the page compatible with non-Microsoft browsers: the hyperlink tag embedded inside the OBJECT tag. This works because whenever a browser can't figure out what to do with a particular tag, it generally tosses the tag out, ignoring it completely. In the case of the OBJECT tag, non-Microsoft browsers can't figure out what to do with the SoundButton control, so it displays the part of the OBJECT tag it does understand: the hyperlink. Microsoft browsers get the ActiveX control interface, other browsers get the conventional hyperlink interface, and your Web page is, once again, safe for democracy.

Using the Setup Wizard in an Internet Context

In order to distribute your control over the Internet, you must create a special type of compressed installable file. The Setup Wizard (introduced in Chapter 12) has an option that enables you to build such files. To see how this works:

1. Launch the application Setup Wizard the same way you did in Chapter 12 (by closing VB5 and selecting the Setup Wizard from the Windows Taskbar's VB5 program group).
2. The Introduction screen appears. Click on Next.
3. Click on Browse to locate the project file for the SoundButton project, Ctrl_SoundButton.vbp.
4. In the Options panel, click on Create Internet Download Setup. The What's New icon appears, providing you with a hypertext jump to information on downloadable software from Microsoft. (This hypertext jump is actually just a link to http://www.microsoft.com/vbasic/.)
5. Click on Next. A disturbing momentary delay takes place, after which the Internet Distribution Location screen appears. If you have direct access to a Web server from your LAN (or if your local machine is itself a Web server), then select a public directory you have access to. If you don't have access to a Web server at this point, don't worry. Select a directory that's convenient, and you can move the downloadable file into place later.
6. Click on Next. The Internet Package screen appears, as illustrated in Figure 13.9. In this screen, you do two important things. You designate the server from which users will download support files (such as the dreaded Visual Basic Virtual Machine). And you mark your components as safe for initialization and scripting.

Figure 13.9 : Internet Package screen.

7. For now, leave the Download from Microsoft Web Site option button selected. This will enable users to download support files (such as the Visual Basic Virtual Machine) from Microsoft's Web site rather than yours, thereby conserving bandwidth and disk space on your Web server. (The down side to this is that every user of your control must be connected to the Internet; in a corporate intranet situation, you might instead choose to distribute these support files from an intranet Web server.)

8. To mark your components as safe for initialization and scripting, click on the Safety button.
9. The Safety dialog box appears. Select the Safe for initialization and Safe for scripting checkboxes, as illustrated in Figure 13.10.
10. Click on OK. You are returned to the Internet Package screen. Click on Next.
11. The ActiveX Components screen appears. Since your control does not make use of any constituent controls, there is nothing to do here. Click on Next.
12. The File Summary screen appears, displaying a list of files that will be distributed with your control. Click on Next, then click on Finish.
13. The Setup Wizard compresses the files and displays a dialog box indicating that it has finished.

Figure 13.10: Safety dialog box.

In the directory you selected to serve as the repository for your controls, you should have a .CAB file, as well as a few other files I'll describe in the next section.

CAB Files and CODEBASE Tags

You should now be able to see that the directory you selected back in step 5 of the Setup Wizard process has been filled with files-specifically, a .CAB file and an .HTM file, as well as a subdirectory called Support that contains the original, uncompressed version of the control along with a few other files.

The .CAB file is the important one. This is a compressed file that contains your .OCX file and any other files required for your control to run. (Absent from this file are support files, such as the Visual Basic Virtual machine, for reasons discussed in the demonstration.) Because they're compressed and they don't include Visual Basic and Windows support files, .CAB files tend to be fairly small.They're perfect for placing on a Web page without slowing the download process too much, although the exact size of your control's .CAB file will obviously depend on the size and complexity of your control.

The .HTM file is important, too, because it shows you exactly what HTML code needs to be written in order to embed your control in a Web page. This is going to be old hat to you, assuming you followed the ActiveX Control Pad demonstration earlier in this chapter. But just for your edification, here are the contents of SNDBTN.HTM:

<HTML>
<!-   If any of the controls on this page require licensing, 
you must create a license package file.
       Run LPK_TOOL.EXE in the tools directory to create the 
required LPK file.

<OBJECT CLASSID="clsid:5220cb21-c88d-11cf-b347-00aa00a28331">
      <PARAM NAME="LPKPath" VALUE="LPKfilename.LPK">
</OBJECT>
->

<OBJECT
       classid="clsid:7E0B5DF2-576C-11D0-9A3B-204C4F4F5020"
       id=SoundButton
       codebase="sndbtn.CAB#version=1,0,0,0">
</OBJECT>
</HTML>

Since SoundButton isn't a commercial file, you don't need to worry about the licensing part (see the section later in this chapter about distributing licensed controls). The other code should be familiar to you, except for the CODEBASE tag, which I'll explain next.

Using the CODEBASE Tag

When you deploy your ActiveX control on the Internet, you need to provide a way for the Web browser to find the binary .OCX file in situations where the user's machine doesn't already have it.

You use a <CODEBASE> tag to do this. A <CODEBASE> tag is part of the <OBJECT> tag; it tells the Web browser where to download the software component. The value of a CODEBASE tag can be an .OCX file, but it's more commonly a .CAB file. The location of a file in a CODEBASE tag can be on a disk drive on your LAN, or it can be a URL.

You can see that at the end of the CODEBASE tag, the VERSION parameter was added. This is important because it directs the Web browser to download the latest version of the ActiveX control if it needs to.

For example, let's say you make enhancements to the SoundButton control, releasing version 2.0. You update all the HTML files on your Web site so the CODEBASE tag refers to version 2.0 of the control. Later, a user who has version 1.0 of the SoundButton control on her computer hits one of your Web pages. Because the CODEBASE tag indicates that the HTML page requires SoundButton 2.0, her browser knows to download the new version before rendering the Web page.

Note that when a browser downloads and installs a new version of a control, it overwrites any previous version the end user has installed on his or her computer. This is one reason why it's important that your control maintain a consistent, backward-compatible interface across versions, so that upgrading to a newer version of the control doesn't break existing applications.

GUIDs

The GUID used as an argument to the CODEBASE tag is generated at the time the control is compiled. The GUID of a particular control should never change after the control is released, even if you release a new version of the control. (To enforce this, you turn binary compatibility on when compiling the control; for more information on this, see Chapter 12.)

It goes without saying that to avoid transcription errors, you should avoid typing a GUID directly into the OBJECT tag. Use the ActiveX Control Wizard, or copy and paste the OBJECT tag in from the sample HTML file generated by the Setup Wizard.

Safety Considerations

Safety refers to a control's ability to cause harm to an end-user's computer. A control is said to be safe if it is incapable of performing such actions as filling the user's hard drive, shutting down the user's computer, and filling memory.

It is your responsibility as the control's author to devote mental resources to determining if your control is safe. This is particularly the case if your control is signed, because signed controls include your or your company's name. If you certify a control as safe and it's really not, end users can figure out who you are through your code signature, find you, hunt you down, and gnaw on your limbs.

Script-safe

Script-safe controls are certified by the control author (you) to be incapable of damaging a machine no matter what the script does. Put another way, when you certify a control as script-safe, you're saying that no scripting command can possibly cause your control to harm someone's computer.

Initialization-Safe

Controls that are initialization-safe are certified to not cause problems on an end user's machine no matter what wacky values the control's initial properties (in its PARAM tags) are set to.

For example, consider a control that has a Picture property. If you permit a user to assign the Picture property of your control to a 9GB picture file, it's going to download that file and hang the user's machine. If your control has the ability to save to a file (something that isn't possible to do using scripting, but is possible to do using Visual Basic and is therefore possible to do using an ActiveX control), you need to make sure that the control can't overwrite a file (such as a vital operating system file) or fill the end user's hard drive with files.

Does safety mean you can't build ActiveX controls with properties that can be freely set? No, it just means you can't distribute such controls on the Net and mark them as safe. Does safety mean that you can't use unsafe constituent controls in your ActiveX control? Again, no. The degree of safety provided by your control is a function of the elements its interface provides.

Licensing Issues on the Web

When you distribute licensed controls over the Web, you must contend with additional issues, most of which stem from the fact that on the Web, there is no such thing as design-time.

The solution to this problem is to create a license package file that temporarily checks out a license to the Web browser. This license is held in memory, enabling the Web browser to display the control, but it does not permit the user to then use your control in a development environment such as Visual Basic (unless, of course, the user has purchased a licensed version of your control and installed it on his computer).

You'll recall from the previous section that the Setup Wizard put the following license package-related code in the SoundButton control's sample HTML file:

<!-   If any of the controls on this page require licensing, 
you must create a license package file.
       Run LPK_TOOL.EXE in the tools directory to create the 
required LPK file.

<OBJECT CLASSID="clsid:5220cb21-c88d-11cf-b347-00aa00a28331">
       <PARAM NAME="LPKPath" VALUE="SoundButton.LPK">
</OBJECT>
->

If the SoundButton control were a licensed control, you would be required to include this HTML at the top of any Web page in which a SoundButton control resided. You'd also be required to create and store the file SoundButton.LPK (the SoundButton control's license package file) on the Web server along with the .CAB file for your control. The following section describes how to create a license package file.

Using the Lpk_tool Utility

The Lpk_tool utility enables you to create a license package (.LPK) file. To create an .LPK file for the SoundButton control, do the following:

1. Locate and run the Lpk_tool utility, Lpk_tool.exe. If you have the ActiveX Software Development Kit, you'll find this file in the \inetsdk\bin\i386 directory.

2. The utility runs, displaying a list of all the controls that are registered on your system. Select the SoundButton control, then click on Add. The screen should look like Figure 13.11.
3. The control moves to the Controls in license package list. At this point, you could move additional controls to the list if you wish; this is necessary if you plan to add additional licensed controls to the Web page you wish to design, because you must include all the controls on a given Web page in a single .LPK file.
4. For now, this is the only control you need to add to create this .LPK file, so click on Save & Exit.
5. A file dialog appears, prompting you to save the .LPK file. Name the file SoundButton.lpk and save it into the same directory as you saved sndbtn.cab earlier.
6. After you save the file, a message box appears informing you that the license package file was successfully created and that the utility is terminating. The license package file, SoundButton.lpk, is created on your disk.

Figure 13.11: Lpk_tool utility.

Signing Your Code

So you've got a compiled control, you've marked it as safe for scripting and safe for initialization, you've made it into a .CAB file, you've put it on a Web server, and you've purchased it the cutest little pair of footed jammies with bunny ears. You may think your life is complete, but there's something missing-you still don't have everything you need to put your control on the public Internet.

In order to distribute your controls over the Web, you must digitally sign your control. Signing your control embeds information that connects you, the software developer (or software development company), with the file you're distributing. The theory here is that if your name is associated with the software you write, it's less likely that you'll write controls that will reformat people's hard drives, shut down their computers, or stomp through downtown Tokyo crushing buildings and breathing fire. Digital signing, then, is a way of keeping ActiveX control developers from unleashing destructive control abominations upon the Internet landscape.

The process of digitally signing code is known as Authenticode. In order to digitally sign a control created in Visual Basic, you must go through the following steps:

• Obtain a Software Publisher's Certificate. This is an electronic signature you apply to your binary files that marks you as its author. Microsoft does not issue these certificates; you must go to a third party (known as a certificate authority, or CA) to obtain one. Check out the page http://www.microsoft.com/ intdev/ security/authcode/certs.htm for the latest information on certificate authorities.
• Use the Signcode utility to apply your digital certificate to your downloadable .CAB file.

Obtaining a Software Publisher's Certificate

The first step to getting your signed controls on the Web is to sign up with a certificate authority. As of this writing, there is only one certificate authority, Verisign, although there may be more authorities by the time you read this book. The Verisign page is at http://digitalid.verisign.com/.

The starting point to obtain a digital ID is http://digitalid.verisign.com/codesign.htm. If you're an individual software developer, you want to get a Class 2 certificate, which as of this writing costs $20 a year. If you're registering a company that produces software, you'll need to obtain a Class 3 certificate, which costs $400 a year. Also, if you are based outside of the U.S. or Canada, you can't get a Class 2 certificate.

The Verisign Web pages tell you exactly what you need to get signed up. The process to receive a digital ID is arranged in a series of steps; each Web page tells you what's required in detail, and it's pretty hard to mess up. The steps are:

1. Choose which kind of digital ID you want. If you're an individual, choose Class 2; if you're representing a business, choose Class 3.
2. Supply some information about yourself. If you're an individual, you just need to give them some information about yourself. If you're registering a company, you'll need to supply information about your organization.
3. Pay the annual fee. You can do this online by supplying your Visa or Mastercard number.
4. Confirm that the information you entered is correct.
5. Read and agree to the Software Publisher's Pledge. (Placing your right hand over your heart at this stage is, I believe, optional.)
6. Submit the information to Verisign.

After you've supplied this information, Verisign will e-mail you a digital ID personal identification number (PIN) that you'll need to activate your digital ID. (Doing it this way verifies that the e-mail address you gave them is valid.) When you receive this PIN, you return to Verisign's Web site, enter the PIN, and your digital ID request is complete.

At this point, the request process generates two files on your machine: a credential file and a private key. Because it can be made to work like a signature, you should store the private key on a disk that is not connected to the Net. (I keep mine on a floppy, with a backup in my safe deposit box at my bank.)

The credential file contains information about who you are, such as whether you're an individual or a business and what your e-mail address is. Both the credential file and the private key are used by the signing utility when you sign your file.

Using Signcode to Sign Your.CAB File

Once you've obtained a software publisher's certificate, you can use the Signcode utility to digitally sign your files. Signcode is a utility that comes with the ActiveX SDK (on my machine, it's installed into the \inetsdk\bin\i386 directory).

When you run Signcode, it launches the Code Signing Wizard, as illustrated in Figure 13.12.

Figure 13.12: Code Signing Wizard.

To sign your code using Code Signing Wizard, do the following:

1. Click on Next to move past the initial screen. The second Code Signing Wizard screen appears.
2. In the field "Which program would you like to sign?" enter the path and filename to your control's .CAB file. Use the Browse button if you don't feel like typing the full path.
3. In the "What would you like to call this program?" field, type the full name of the control.
4. In the "Where can people find more information about it?" field, type the name of the control's URL, if one exists. The screen should look like Figure 13.13.
5. Click on Next. The next screen asks you how you want to sign your control. In this screen, you need to specify the location of your credentials file and your private key. Enter this information. The screen should look like Figure 13.14.
6. Click on Next. The Code Signing Wizard will display a screen verifying the information you supplied. Make sure everything is correct, click on Next, then click on Sign.

Figure 13.13: Code Signing Wizard with the details filled in.

Figure 13.14: Code Signing Wizard screen with credential and private key information.

The wizard will read the files it needs to read, then it will alter your .CAB file to accommodate the digital signature. When it's done, it will display a message saying that it successfully signed the program.

Testing the Signed .CAB File

The easiest way to test a signed ActiveX control is to load it through Microsoft Internet Explorer. If the control hasn't been installed on your computer before and it has been signed properly, your digital certificate will appear after the control is downloaded, as Figure 13.15 illustrates.

When this certificate appears, it confirms your identity to the end users of your control.

Figure 13.15: SoundButton control certificate.

Summary

In this chapter you learned how to embed an ActiveX control into an HTML Web page using the ActiveX Control Pad. You also saw how to create a .CAB file, a compressed file that enables Web users to seamlessly download your ActiveX control with a Web browser.

In the next chapter, you'll take this crazy Internet thing one step further, creating Internet-aware controls that transmit data over the Net and have the ability to remotely download their properties.