Xml string or Class definition

[John Lee]

Hi,

When we define a web method, if the parameter is actually an xml, we can
either define the parameter as xml string like following:

public void webmethod(string xmldoc) { ... }

or we can create a class or set of classes that can be serialized to the
same xml like:

public void webmethod(class1 param) { ... }

what's the pros and cons of each way? what is the best practice? wsdl first
seems the way to go in .net 2.0 but for now what's the best way of doing
this?

Thanks!
John

[Steven Cheng[MSFT]]

Hi John,

Welcome to MSDN newsgroup.
I think your question is a good one since I've also seen many others
discussing such problem over internet. As for pass/return xml data through
xml webservice, I think we should always avoid passing or return xml
directly trough string parameter or return value. This is becaues the
Webservice'S SOAP message itself is xml based , if we directdly inject
arbitrary xml data in SOAP message(pass xml as string parameter or return
value), the SOAP message is possible to be corrupted.

So I'd strongly recommend that we pass xml data through the .net's buildin
classes such as
XmlElement, XmlDocument like:
[WebMethod]
public XmlElement GetXmlElement()
{
XmlDocument doc = new XmlDocument();
XmlElement elm = doc.CreateElement("MyElement");
elm.InnerXml = "<elm><items><item id=\"1\">item1</item><item
id=\"2\">item1</item></items></elm>";

return elm;
}

In addition, for non- .NET client (when doing platform interop), we may
consider using our custom wrapper class which contains the xml data as
property and can be properly serizalized.

And here is a certain blog article which has mentioned this problem:

#Rant: Don't return XML in string variables!
http://blogs.msdn.com/mpowell/archiv...12/130637.aspx

HTH. Thanks,

Steven Cheng
Microsoft Online Support

Get Secure! www.microsoft.com/security
(This posting is provided "AS IS", with no warranties, and confers no
rights.)