SharePoint 2007–Event Handlers

SharePoint isn’t just an application.  It is an extensible application platform.  Easily extended with features that allow you to add custom event handlers to sites, lists, items and content types in your portal. A custom event handler is a .Net assembly that contains the additional business logic you need to run when the event occurs in SharePoint.

Examples of custom event handlers can include things like:

• Retrieve information from a database such as filling in the remaining fields of a list based on a CustomerID (assuming you don’t have an enterprise license for BDC)
• Call a web service
• Start a workflow
• Perform list data validation
• Convert document to PDF and store in alternative library.

Event Types

Microsoft.SharePoint.SPWebEventReceiver : "Site Level"

Microsoft.SharePoint.SPListEventReceiver : "List Level"

Microsoft.SharePoint.SPItemEventReceiver : "List Item Level"

Asynchronous vs Synchronous Events: The "ing" and the "ed"

As you may have noticed above, there are two events raised for each type of event. The "…ing" event occurs before the action starts and the "…ed" occurs after the actions ends. "…ing" events occur synchronously while the "…ed" events occur asynchronously. What does this mean?

Synchronous events:

• Occur before the event.
• Block the flow of code execution until your event handler completes.
• Provide you with the ability to cancel the events resulting in no after event (“…ed") being fired.

Asynchronous events:

• Occur after the event.
• Do not block the flow of code execution in SharePoint.

So what are some of the Best PRactices when building custom event handlers?  Here are a couple of things you want to keep in mind:

1. Security:

The assembly you deploy to the Global Assembly Cache(GAC) is running with full trust. Watch out for the following:

• Denial of Service attack: If a user uploads 10000 items to a list, what is the effect it will have to the systems your assembly uses.
• SQL Injection attack: If a user attempts to insert SQL statements into a column of a list that your assembly uses to update a database, what mechanisms are you using to make sure the input is valid.
• Cross Site scripting attack: What is the effect of adding script to a column that your assembly uses to update another area in SharePoint?

2. Performance:

Watch out for the following:

• Load: What burden are you placing on your web front end servers to run the assembly each time an event occurs? Use performance counters to determine this.
• Long Running Operations: Consider creating a custom SharePoint timer job. Kick off/ Schedule the Timer Job from the event rather than running all the logic inside the event. This will allow you to use the features of SharePoint to view whether the Timer Job ran successfully.
• Sync vs Async Events: Synchronous events have to wait until your code completes before returning the page, whereas Asynchronous events show the page immediately.

3. Error Handling:

When using synchronous events and you decide to cancel an event, let the user know why the event was cancelled. For example, update a Task List with a message why it failed.  Log your errors so that you can determine what issue is occurring when your system is in production environment.

4. Connections: Cater for external systems being down when you are trying to connect to them. Don’t let your code / solution go belly up because you cannot connect to a database.

5. Bulk Operations:

The MSDN documentation mentions that event handlers will not fire when bulk operation is occurring. For example, when a new list is created, the FieldAdding event will not fire.