XML / XSL

<?xml version="1.0" encoding="utf-8"?>
<Benchmark id="MicrosoftSecurityComplianceManagementForWindows2008" resolved="0" xml:lang="en" xmlns="http://checklists.nist.gov/xccdf/1.1" xmlns:cdf="http://checklists.nist.gov/xccdf/1.1" xmlns:cpe="http://cpe.mitre.org/XMLSchema/cpe/1.0" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xhtml="http://www.w3.org/1999/xhtml" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.1 xccdf-1.1.xsd http://cpe.mitre.org/XMLSchema/cpe/1.0 cpe-1.0.xsd">
  <status date="2008-05-16">draft</status>
  <title>Microsoft Security Compliance Management for Windows Server 2008</title>
  <description>Microsoft Security Compliance Management for Windows Server 2008</description>
  <notice id="terms-of-use" xml:lang="en">
  </notice>
  <front-matter>
    <xhtml:p>
    </xhtml:p>
  </front-matter>
  <rear-matter>
  </rear-matter>
  <reference href="http://checklists.nist.gov/repository/1001.html">
    <dc:title>Microsoft Security Compliance Management for Windows Server 2008</dc:title>
    <dc:creator>Microsoft Solution Accelerator for Security and Compliance</dc:creator>
    <dc:publisher>
    </dc:publisher>
    <dc:identifier>
    </dc:identifier>
  </reference>
  ...
  ...

// pass an object to this function
// the attribute of the object tells the function which stored proc to call
// the object itself is serialized to an xml string and passed to the database
// the stored proc on the other side takes care of the behind the scenes details
public static string SaveObjectToDB(object obj)
{
    string sql = "", xml = "", result = "";
    // populate the object from the database using the specified ID
    // loop through the attributes of the object/class
    // Look up the stored procedure attribute on the object to use the appropriate stored proc to save the object
    foreach (Attribute attr in obj.GetType().GetCustomAttributes(true))
    {
        DBStoredProcAttribute dbSPAttr = attr as DBStoredProcAttribute;
        // check if the attribute is a DBStoredProcAttribute
        if (dbSPAttr != null)
        {
            // serialize the object to xml
            xml = SerializeObjectToXML(obj);
            // trim of the xml headers
            // Subject Structures can be longer than 8000 characters so must trim off the prefix in .Net for SubjectStructure objects
            xml = xml.Replace("\\r\\n", "").Replace("\r\n", "").Replace("<?xml version=\"1.0\" encoding=\"utf-16\"?>", "");
            int StartPos=0;
            StartPos = xml.IndexOf("<SubjectStructure>");
            if (StartPos > 0)
            {
                xml = xml.Substring(StartPos);
            }
            // run the sp for this type of object passing the xml for the object
            sql = dbSPAttr.SaveObjectSP + "'" + xml.Trim() + "'";       // stored proc for SaveObject ;

            // execute the stored proc
            result = ExecuteStoredProc(sql);
        }
    }

    return result;
}