You can store source code in the App_Code folder, and it will be automatically compiled at run time. The resulting assembly is accessible to any other code in the Web application. The App_Code folder therefore works much like the Bin folder, except that you can store source code in it instead of compiled code. The App_Code folder and its special status in an ASP.NET Web application makes it possible to create custom classes and other source-code-only files and use them in your Web application without having to compile them independently.
The App_Code folder can contain source code files written as traditional class files — that is, files with a .vb extension, .cs extension, and so on. However, it can also include files that are not explicitly in a specific programming language. Examples include .wsdl (Web service description language) files and XML schema (.xsd) files. ASP.NET can compile these files into assemblies.
The App_Code folder can contain as many files and subfolders as you need. You can organize your source code in any way that you find convenient, and ASP.NET will still compile all of the code into a single assembly that is accessible to other code anywhere in the Web application.
.gif) Note: |
|---|
User controls are not allowed in the App_Code folder. This includes both single-file user controls and user controls that use the code-behind model. Putting a user control .in the App_Code directory causes the user control's code to be compiled out of its required sequence and therefore is not allowed. Note that user controls do not need to be in the App_Code folder; they are already available to pages anywhere in the application.
|
Inferring the Programming Language of the App_Code Folder
The App_Code folder is not explicitly marked as containing files written in any one programming language. Instead, the ASP.NET infers which compiler to invoke for the App_Code folder based on the files it contains. If the App_Code folder contains .vb files, ASP.NET uses the Visual Basic compiler; if it contains .cs files, ASP.NET uses the C# compiler, and so on.
If the App_Code folder contains only files where the programming language is ambiguous, such as a .wsdl file, ASP.NET uses the default compiler for Web applications, as established in the compilation element of the Web application or machine configuration file.
Multiple Programming Languages in the App_Code Folder
Because the source code in the App_Code folder is compiled into a single assembly, all the files in the App_Code folder must be in the same programming language. For example, the App_Code folder cannot include source code in both Visual Basic and C#.
However, you can configure your Web application to treat subfolders of the App_Code folder as separate compilable units. Each folder can then contain source code in a different programming language. The configuration is specified by creating a codeSubDirectories element in the compilation element of the Web.config file and adding a reference to the subfolder. The following example illustrates how you would configure subfolders named VBCode and CSCode to compile into separate assemblies:
<compilation debug="false">
<codeSubDirectories>
<add directoryName="VBCode" />
<add directoryName="CSCode" />
</codeSubDirectories>
</compilation>
The references to the VBCode and CSCode subfolders do not need to include any information about what programming language is contained in the subfolder. As with the App_Code folder itself, ASP.NET infers the compiler to use based on the files in the subfolder.
Security with the App_Code Folder
Security issues with code in the App_Code folder are essentially the same as those with code in the Bin folder—the code is compiled into an assembly at runtime. A mitigating factor is that you can read the source code for files in the App_Code folder. However, if you do not fully understand the code, it can still represent a security risk. Therefore, treat source code in the App_Code folder as you would treat compiled code from the same source.