Every Web application;whether a shopping site, a portal, an online customer service system, a wireless site, or anything in between;has a key piece of software in common: an application server.

Simply put, application servers are the brains behind a Web site. Any Internet-based application that generates personalized or dynamic content relies on them. These servers provide a way to add intelligence to Web sites. They let sites take data entered into a browser and run custom business logic on that input (looking up customer information in a database, for example). The application server can then output HTML and send it back through the Web server to the end user.

In the early days of the Web;the mid-nineties;Web applications were typically designed with custom programs written in C and using the Web server's Common Gateway Interface (CGI) API. CGI is still common on the Web, but because it requires spawning a new instance of a program each time it processes a request, and in the interest of better security, it's giving way to two other types of application servers;page-based and component-based. We evaluate both of them here.

Page-based Web application servers;ColdFusion, Java Server Pages (JSP), Microsoft's Active Server Pages (ASP), and PHP, among others;tend to be used on sites that need interactivity but don't have the budget or programmer resources for bulletproof, component-based systems such as those based on BEA's WebLogic or IBM's WebSphere.

Although it's easier to develop for and deploy dynamic sites with page-based scripting, these systems combine the code used to display the page (the presentation logic) with the code that performs the business logic (which usually gets or sets the appropriate database information). This can result in convoluted, unmaintainable code and can open the door to security problems.

Higher-end application servers use a component-based development model, which separates business logic from presentation logic. This compartmentalization lets programmers retool large Web sites quickly: New code modules can be dropped in as needed, which means you can avoid rebuilding an entire system or searching through the spaghetti-code of scripts to find what has to be updated. Because of that, these products are the right choices for complex, often team-written Web applications such as high-volume e-commerce sites.

By far the most common component object framework supported is Enterprise JavaBeans (EJBs). These come in three flavors: session beans, which perform business logic for an individual client during its browsing session; entity beans, which represent persistent data stored in one row of a database table, and message-driven beans, which use JMS (Java Message Service). Microsoft's Component Object Model (COM+) and the Object Management Group's Common Object Request Broker Architecture (CORBA) component standards are also supported by some products. The Java 2 Enterprise Edition (J2EE) specification (encompassing EJBs, servlets, JDBC and several other technologies) has been astonishingly successful at dominating the application server market, and only a handful of vendors;Microsoft being the most notable one;support anything else.

Java is an excellent language for developing server-side code, but other languages such as C and Visual Basic are important as well, particularly to people who use Microsoft's development tools. Those who want to code in languages other than Java should investigate servers from companies committed to supporting multiple languages, such as Sybase.

High-end application servers also tend to be more reliable and scalable. One way to get reliability is through support for application server clusters. If one machine goes down, processing is automatically redirected to other systems without end-user interruption or data loss. Clustering can also help a site scale to handle increasing requests, but some products achieve scalability with multiple CPUs on large symmetric multiprocessing systems.

These servers also need mechanisms that maintain state for each client machine. An example of state is keeping track of what items are in a particular Web surfer's shopping cart. This is usually achieved by using cookies or URL variables.

Application servers are quickly gobbling up two other market niches: transaction monitors and enterprise application integration (EAI) products. Transaction monitors such as BEA's Tuxedo or IBM's CICS have traditionally provided connection pooling and state management. These features now appear in application servers. Application servers are also nudging EAI products to the sidelines by providing connectivity to back-end systems such as databases, enterprise resource planning systems, mainframes, and message queuing systems.

Application servers are taking over other tangential markets, too, such as portals, wireless development servers, storefronts, and B2B integration products based on the foundation of their application server technology.

XML will become more important to application servers over the next year, possibly deescalating the standards battle between EJB and COM+. Microsoft and Sun both pledge to support Simple Object Access Protocol (SOAP), an XML-based remote-procedure-call technology that should ease EJB and COM component interoperability. With more XML features (such as automatic XML-to-database rowset conversion) coming later this year in both Microsoft's .NET framework and Sun's Java 1.4, cross-platform Web-based services will also become easier to write, no matter which standard you use.

We review high-end component-based application servers from Borland, IBM, iPlanet, Microsoft, and Sybase. We conducted performance tests using a Web bookstore application built in EJBs. We could not include iPlanet Application Server, because it doesn't yet support Windows 2000, our test-bed operating system. Microsoft's solution was tested with a feature-equivalent application built on COM+ and ASP, since its solution doesn't support EJBs.

We invited makers of other major application servers— JRun, BEA WebLogic, Hewlett-Packard Total- e-Server (formerly Bluestone Sapphire), and Oracle Application Server—to be included in this roundup, but they declined, citing lack of resources to support our review process or an unwillingness to undergo performance testing.

IBM's WebSphere Application Server, Advanced Edition 3.5 has an array of speed-enhancing caching techniques, rock-solid load balancing and failover handling, and a complete complement of developer tools for creating Web applications. Its management console offers minute control over settings; support for a multitude of operating systems and Web servers sets WebSphere apart. Excellent performance in our testing is the icing on the cake.

If you want a quick and dirty solution to dynamic Web serving, look no farther than page script-based ColdFusion 4.5. Its rich development environment, out-of-the box interoperability, and powerful Web-based server administration tool are without peer in other page-based systems.

We liked iPlanet's excellent load balancing, failure handling, and growth path as a platform for e-commerce, but it needs a better suite of development tools, compatibility with more Web servers and operating systems, and stronger monitoring.

Borland AppServer 4.5 gets top marks for development environment and compatibilities. But difficulties during testing concerned us about its ability to scale for enterprise applications.

Sybase EAServer offers simple setup; interoperability with CORBA, C++, and Java; and a powerful administration interface. But it can't match WebSphere's performance and scalability.

Microsoft's "application server" (IIS, COM+, and ASP) shows a lot of promise. It currently needs better load balancing and state handling. If .NET can address these issues, Microsoft will be a strong contender next time around.

Easy setup and support for the latest CORBA and J2EE standards help make Borland AppServer 4.5 suitable for any smaller to midsize Web initiative. Though AppServer lagged in our performance testing, it offers several strengths, including excellent interoperability with other systems and the industry-leading developer tool, JBuilder.

Installing the application server was a simple matter of running a setup program and configuring our test machines using the Java-based AppServer Console—no tweaking of text files. Administrators can use this same management console (similar to IBM's WebSphere) on multiple platforms. The console can import the J2EE JAR, WAR (Web archive), and EAR (enterprise archive) files necessary to deploy a site as well as view and edit EJB descriptors. As with most of the products here, when EJB deployers import an archive, its integrity is checked. AppServer's interface and the quality of its verifier's feedback are outstanding. It checks for missing bean interfaces and classes, as well as incompatible XML descriptor settings (such as transaction and security options).

Wizards make generating client-side EJB JARs (which programmers need in order to create clients) a far less painful task than it might otherwise be. We also liked the clear and comprehensible online help and tutorials, which walked us through basic administration tasks and introduced the big picture of creating and using EJBs in Web applications.

Using the AppServer Console, administrators can manage multiple server nodes easily. We liked that it lets you view server activity for all of the EJBs on each server, and finding log and error files was easy. When it comes to load balancing, AppServer is capable, though perhaps not as powerful as some of the others we tested. Borland offers a separate product, AppCenter ($4,000 per CPU list), which provides better control of load balancing and improves availability.

Though the console isn't Web-based, you can perform all administrative tasks remotely via the command line. In testing, we used the command line to generate text-based reports on bean and memory usage to help tweak configuration settings. Alternatively, the Java-based console provides several precanned simple graphical reports.

Because it is based on the underlying Visigenic ORB 4.5 and CORBA standards, Borland's strengths (like Sybase's) include excellent interoperability with legacy systems, including those written in C++ and Borland Delphi. Through its partner Tibco Software, Borland offers a variety of separately priced connector solutions, which can get your system to interoperate with more than 100 legacy APIs and systems (such as PeopleSoft and SAP). AppServer's CORBA support makes it easy to integrate new and old systems. The product is also J2EE branded, with full support for today's Java standards and APIs.

JBuilder 4 Enterprise Java IDE has first-rate EJB development features and a powerful modeling wizard that can generate components based on database tables. We liked its ability to join EJB components. Besides targeting Borland AppServer EJBs, JBuilder can also target JAR files for BEA's WebLogic 5.1 (with support for IBM's WebSphere and other app servers in the works).

There's excellent support for end-to-end debugging, including a nifty feature that generates code for testing all your EJBs before integrating them into a Web application. One missing item, however, is a visual interface for creating JSPs. Though they can target other application servers with JBuilder, developers will appreciate the integration between this Java IDE and AppServer.

When it comes to raw performance, Borland's AppServer suffered from a lack of scalability on our tests. According to Borland, our tests exposed a problem with the integrated Tomcat JSP container. Calls between the EJB container and Tomcat were not located in the same process, and this slowed the server down. Borland say this limitation will be fixed in a maintenance release.

AppServer also had trouble performing effective load balancing on our tests. Borland claimed the product would scale better with a single, multiprocessor box rather than with clustered servers. Administrators of large server farms will want the separate AppCenter product for more capable load balancing and failover.

Recently acquired in a merger with Macromedia, ColdFusion is an old standby in the world of application servers. It's easy to see why ColdFusion remains so popular. It combines a full-featured server engine with a language that's powerful, extensible, and easy to learn; it also has some of the best development tools around. The war for application servers may look like a battle between Microsoft and Java, but developers who want an independent alternative have an excellent one in ColdFusion.

Site builders can write ColdFusion Markup Language (CFML), the product's scripting language, in any text editor, but they're much better off using ColdFusion Studio. Conveniences such as right-clicking any CFML tag to display all tag options make this tool a pleasure. Studio works with HTML, too, and even includes a decent style-sheet builder. Studio also lets programmers develop in ASP, CSS, Java, JSP, Perl, PHP, SQL, vScript, and WML.

Studio has a first-rate debugger that lets developers inspect not only variables but also database record sets. There's also extensive printed documentation, a rather quaint feature these days. For team development, Studio plugs into any SCCI-compliant revision control system.

Wizards make building typical pages a snap; for example, we built a simple data entry form for a database, without writing a single tag. Still, it is a code-based editor, so those who want a more WYSIWYG tool may prefer Macromedia Dreamweaver UltraDev, which also can generate CFML. There's a large third-party market for CFML-based solutions, such as connectors to PeopleSoft and SAP. Check the Allaire Developer Exchange (http://devex.allaire.com/developer/gallery/).

Installing ColdFusion Server on Windows 2000 is a simple matter of an InstallShield wizard, which you've done a hundred times. Deployment is a forte: Studio can deploy an application using FTP or the RDS (remote development server) protocol, which tunnels within HTTP. You can also create deployment scripts in VBScript or JScript that send the application to its server. By modifying the scripts, you can add custom behaviors, such as e-mail notification.

ColdFusion's server engine falls short of JSP performance for most applications because it's interpreted, rather than compiled, but the Enterprise version of ColdFusion Server contains software-based clustering, improving both the performance and the reliability of ColdFusion sites. Another weak spot is ColdFusion's simple text logging in place of detailed performance monitoring.

ColdFusion Administrator is one of the server's great strengths. The interface is completely Web-based, so you can administer using a browser from any system that can reach the server. You can also delegate some of the administrative duties, such as those for an individual site on the server—one reason ColdFusion is popular in hosted environments.

Version 5.0 of ColdFusion Server should be available shortly. Its most significant features are support for user- defined functions and a "query of queries." In addition, a graph generator in the server lets you create images and Macromedia Flash graphics dynamically. (The recent merger should result in even more integration with Macromedia products.) According to the company, there are also plans for future versions to embrace J2EE standards.

In as new an area of technology as application servers, it's refreshing to see a product that can already be described as mature. Over six years of development (and two changes of ownership of the product), iPlanet Application Server 6.0 has become the flagship Java application server of iPlanet E-Commerce Solutions, a Sun-Netscape Alliance.

iPlanet's development team has emphasized fault tolerance and scalability since the beginning of the product's life. Banks, brokers, and other organizations that need to be extremely cautious with data should give this platform strong consideration.

iPlanet provides very flexible session handling, load balancing and clustering. Load-balancing strategies include round-robin, server response time, and component response time; or you can configure them yourself. There's also automatic server-to-server replication of user state and session information.

When we used a browser with cookies disabled, we were impressed to see iPlanet automatically switch to using URL variables for storing the session ID instead of using a cookie. Building a site that works well even without cookies is hard to do if the application server does not provide this option.

We were able to define two state-server masters in a test cluster, and iPlanet kept them in sync automatically. When we hit the reset switch on one master server, the Web server plug-in switched to serving our application from the backup system with no loss of functionality or state information.

Unfortunately, we had to start iPlanet after we installed new EJBs or Java classes–a limitation requiring multiple servers and careful handling to avoid downtime on production sites. Hot deployment of EJBs will come in Service Pack 3, coming out later this year, according to the company.

The product is heavily geared toward Java. Though iPlanet's current version still allows logic to be written in C using an API, this support will disappear in Version 7.0. C developers should look to a platform such as Sybase EAServer, which is still committed to supporting C. iPlanet can call out to CORBA servers, which can run logic written in C, but the product doesn't support Microsoft's COM objects and can't authenticate users against a Windows domain list or any directory standard other than LDAP.

The LDAP-based iPlanet Directory Server is included with the product, as well as the iPlanet Web server. iPlanet can also be used with Microsoft IIS; Apache support is also planned for Service Pack 3. It runs on Solaris, Windows NT, HP-UX, and AIX (a Linux version is not planned). Windows 2000 support will be another added feature in Service Pack 3.

Because Apache and Windows 2000 support were not available at testing time, we could not include iPlanet on our performance tests.

The iPlanet administration tool offers real-time performance monitoring and includes a Simple Network Management Protocol agent. The administration tool is Java-based rather than HTML-based, making it less accessible.

For performance enhancement, iPlanet includes a Web page cache for HTML and XML output from JSP pages and servlets, and the server also provides EJB, JMS, and database connection pools.

iPlanet's weakest link is its tools strategy: A series of half-baked development tools over the years has been abandoned. There are new plans to shift developers to Sun's Forte for Java IDE, but Forte for Java won't gain EJB authoring ability until this summer, when Enterprise Edition 3.0 ships. As an interim measure, developers can use an iPlanet plug-in for WebGain's VisualCafé. iPlanet says a plug-in for Forte for Java Internet Edition 2.0 should be available by the time you read this. We tested a beta version of the plug-in.

iPlanet's enterprise version includes a built-in transaction monitor (IBM's TXSeries)–a significant value-add, since it lets the server safely drive distributed transactions between different databases.

The Enterprise Pro Edition adds Web-based process-management software. It also includes connectors to IBM's CICS and BEA Systems' Tuxedo transaction monitors as well as SAP AG's and PeopleSoft's ERP packages.

Rounding out version choices, a new Standard Edition–without EJB support–will ship this summer for $2,995 (direct) per CPU.

Tomcat 3.2, an open-source application server, puts servlet and JSP Web applications within anyone's reach. For organizations that have onboard expertise with open-source software and want to save on licensing costs, it's a worthy option. But Tomcat is not very easy to use, and its lack of enterprise-level features (in particular, support for EJBs and scalability) will probably discourage larger companies from adopting it.

Both Apache and Sun Microsystems back Tomcat, which easily hooks into Apache, Microsoft IIS, and Netscape Enterprise Web servers, as the reference platform for current servlet and JavaServer Pages (JSP) standards. We tested the latest shipping version of Tomcat, Version 3.2. which supports the Servlet 2.2 and JSP 1.1 APIs on Windows 2000. Like any open-source software, the best starting place for support is its support newsgroup.

System administrators tackling Tomcat will need to know a good deal about today's Java Virtual Machine (JVM), because, unlike the commercial application servers we tested, there is no command console or browser-based administration module. Instead, Webmasters edit XML-based configuration files.

In our testing, we got the server running easily, but, as the documentation suggests, obtaining any kind of scalability and performance requires modifying properties and the configuration files. Through these files, administrators can also add support for SSL and other security settings (like setting up access lists for individual servlets).

Tomcat has no built-in development tools: Programmers can use their favorite IDE or rely on the command line Java compiler from Sun. As with all page-based scripting languages, separating presentation code from business logic requires care in JSP development. But with the proper planning and expertise, it can be done. Reusable tag libraries that keep Java out of sight for less technical Web designers within an organization are one step toward accomplishing this. Tomcat developers can also make use of simple database beans (rather than EJBs) that work as separate components on the middle tier. Integrating these with databases usually requires writing plenty of code using JDBC.

Applications can be deployed by creating a single Web Archive (WAR) compressed file—the same file type supported by the high-end products—that specifies the location of files (Web pages, servlets, JSP, and bean component files). After deploying for production systems, administrators will need to fine-tune Tomcat's use of thread pools for each servlet to get acceptable performance.

For most shops, scaling a system built on Tomcat will mean using one powerful box with multiple CPUs and plenty of memory; there's no load balancing built-in. It is possible to redirect servlets to different servers (and JVMs) for basic clustering support, but this is primitive compared with solutions such as Sybase EAServer, which provides dynamic load balancing and a console to manage clusters.

The Tomcat FAQ suggests that administrators profile their code with different JVMs to find which is fastest. It's just such a "roll-up-your-sleeves" ethic that will make Tomcat appealing—or not—to an organization.

Microsoft doesn't actually sell an application server, so what the heck is it doing in this roundup? Well, a great many sites are using Microsoft technologies to do the very things that application servers do. One advantage to this approach is that if you're using Microsoft Windows 2000 Advanced Server, you've already got the engine for application server functions.

Other pieces of Microsoft's solution are Visual Studio, Internet Security and Acceleration Server (ISA), and Application Center. The Microsoft equivalent to J2EE's EJB components is COM+ objects, and instead of JSP (Java Server Pages), we have ASP (Active Server Pages). One advantage of COM+ objects is that they can be built in several languages, and multilanguage programming is common in COM+ systems.

ISA can improve the performance of a Web site by caching frequently accessed static content. It handles requests directly, without having to contact an upstream Web server. ISA servers can also be configured in arrays, for fault tolerance and load balancing. Application Center helps administrators work with clusters, letting them, for example, change configuration settings on all servers or perform rolling upgrades of applications.

At the heart of COM+ is a simple premise: Write the code and declare what services it requires. Developers can write code using RAD (rapid applications development) tools such as Visual Basic (VB) or Delphi and package it into COM+ components, or they can get more control over components by coding in C++.

One of the key innovations in COM+ is the concept of attributes. An attribute is data that declares what services a component needs at runtime. In practice, different people decide on a component's attributes. In one case, a developer declares that one component must have a transaction. In another case, an administrator declares which groups of users are allowed to access a given component.

Attributes are the key to extending COM+; developers can add future services by defining new attributes. Alas, only Microsoft can add new attributes today. This limitation is removed in the .NET Framework, where developers can define their own attributes. Visual Studio.NET is currently in beta, and Microsoft says it will ship this year.

Another important service that COM+ provides is its thread and database connection pools. New requests are executed on the next available thread from the pool. Code that uses the Active Data Objects (ADO) API to talk to databases gets connections from the pool.

COM+ also provides a simple, transparent security model. A component can request that COM+ perform access checks prior to having its methods invoked. Developers define the roles that are allowed access to the component. Administrators define which Windows user groups (or users) belong to which roles.

IIS can broker incoming HTTP requests and hand them off to COM+ components for processing. COM+ applications bypass an extra network round-trip to a separate application server, resulting in increased throughput. This is why logical three-tier, physical two-tier designs are popular in COM+ systems.

ASP exposes an object model to developers working in scripting languages such as JScript, PerlScript, or VBScript. This object model lets applications interact with three key sub-systems: the current HTTP request, the current COM+ transaction (if any), and external COM+ components. Each ASP first receives and pre-processes an incoming HTTP request. Next, it instantiates a COM+ component in the business tier and invokes methods using DCOM (Distributed Component Object Model). Finally, it generates the HTTP response and releases its reference to the COM+ component.

We set up our test bookstore site using the same machine configuration as the J2EE products. The two front-end Web servers were load-balanced using a simple round-robin DNS scheme. They delegated the real work to the three application servers running our business logic.

Our testing of Microsoft, though not directly comparable, because it used a different code base than that used for testing the J2EE products, showed COM+ performing on a par with the fastest J2EE products when using Oracle and even faster with Microsoft SQL Server.

You don't have to surf the Web very long before running into pages written in PHP (which officially stands for PHP: Hypertext Preprocessor), an open-source Web scripting language. According to Netcraft's February 2001 survey of Web servers (www.netcraft.com), PHP is running on over five and a half million domains. Shop for Web-hosting services and you'll find they almost all offer PHP.

But though PHP thrives on hosted servers, it's too immature for a high-traffic business environment. As much as we were rooting for it to succeed in our testing, it failed;especially when we attempted to evaluate on Windows.

PHP is a scripting language with an engine for running the scripts. It comes with no tools at all. Setting it up on Linux or another Unix OS is a breeze if you're a Unix/ Apache expert. The PHP language is a bit of a mishmash of other languages; mostly Perl. Version 4 of PHP (we tested 4.04 patch level 1) significantly improved the power of the language, including adding easy access to Java code.

But PHP has some strange features. The normal way to do database programming is through an abstraction layer such as ADO or JDBC. But the PHP way is to use a database-specific API. There's support for over a dozen databases, including Oracle and Sybase, and the open-source MySQL and PostgreSQL. PHP proponents argue that abstraction layers dumb down and slow down access to databases, but we think they can increase developer productivity, facilitate application migration, and cut training costs.

PHP grew up joined at the hip with the Linux operating system, Apache Web server, and MySQL database. This combination is the most common configuration for PHP, and the language is optimized for it.

The Windows version of PHP, unfortunately, cannot be taken seriously for production environments. We were unable to get the ISAPI version working and had to test with the CGI version. We scanned the comments on the official PHP support forums and found that the ISAPI code frequently fails and that, even when it works, PHP extensions tend to fail because they aren't thread-safe. PHP on Windows should be used only for development. Developers seeking to use the Windows version should check out http://php4win.de/.

Zend Technologies (www.zend.com) sells a number of ancillary PHP products, including an integrated development environment and several performance-enhancing products.

The Zend IDE has very little going for it, the most important being that it supports server-based debugging;though only for Unix. The IDE has none of the better features found in other tools, such as syntax assistance. And there's no integrated help at all; all Zend documentation is in PDF files. If we have to make a trade-off between IDE and debugging, we'd rather use a better editor, such as Allaire's HomeSite, and deal with debugging the hard way.

Zend also sells Zend Cache, which can improve PHP performance up to twentyfold, according to the company, and the free Zend Optimizer statically analyzes and optimizes PHP source code. Applications can be distributed in tokenized form rather than showing source code using Zend Encoder.

A J2EE-branded and CORBA-based platform, Sybase EAServer 3.6 Enterprise distinguishes itself with excellent administration tools for clustering and load balancing. Though it lagged behind WebSphere on our tests, EAServer offers a good matrix of abilities for powering any Web application where speed is not the paramount factor.

Installing EAServer was appealingly simple. Though the product has you install the older 3.5 version first and then upgrade to 3.6, all that's required is that you run setup programs. Currently, EAServer runs on Microsoft Windows (NT/2000) and Solaris. As a CORBA-based solution (such as Borland's AppServer), the product offers a flexible infrastructure for getting to components of all persuasions, whether built on CORBA, C++, or Java. In testing, we had no trouble using Apache Web Server and an Oracle database.

Setting up our e-commerce bookstore application on EAServer also went smoothly. System administrators will appreciate the powerful Sybase Central Java Edition, which offers one-stop control over virtually every aspect of enterprise servers. The console makes life easier with wizards to import the JAR, WAR and EAR archive files necessary to set up a site. There's good support for viewing and editing the contents of EJB XML descriptors, too. Don't look for a Web browser-based version of this administration tool; EAServer's functions can be scripted to control servers remotely through telnet.

A major strength of this console (which has more options than Borland AppServer's and is easier to use than WebSphere's) is the full control of all the network nodes that are running Sybase's Jaguar Server, the application server process. Administrators can tweak EJB descriptors and performance settings (such as memory use and connection pooling) and then push these settings to all the other nodes in a network. Most settings can be published and refreshed while the site is live, without bringing down servers.

We also like that Webmasters can view server health with statistics for component and cluster activity. EAServer has excellent control of load balancing with random, round-robin, and weighted schemes for allocating the workload among servers. For higher availability, administrators can take specific servers off-line for maintenance without jeopardizing production systems.

Though EAServer rivals higher-end platforms, this is not a case of David slaying Goliath. The server doesn't cache JSPs and servlets, which caused it to lag behind WebSphere on our performance tests. It also supports far fewer concurrent users than IBM's system. We would still recommend EAServer for its potential to scale up.

An unanticipated plus in this package is Sybase PowerJ 3.6, a Java tool that bundles with the application server. PowerJ is a very capable IDE with most everything that today's programmers would expect. Benefiting from the legacy of the once hugely popular RAD tool PowerBuilder, this IDE offers a polished Java development environment.

PowerJ has good support for a variety of component types as well as for JSPs. The IDE lets developers use a drag-and-drop function to connect front-end code to back-end EJBs easily. We also liked the Sybase Reference Card wizard, which makes filling in arguments for common Java APIs easy.

Unlike other Java IDEs (such as Borland's JBuilder), PowerJ doesn't have a wizard for defining EJB relationships visually, but it has plenty of other advanced features for common development and deployment tasks. For example, the wizard for generating new EJBs walks programmers through all the steps for creating both entity and session beans, including precise control of transaction options for each component.

On the higher end, Sybase supports OTS/XA transactions out of the box for interaction with object-oriented, distributed, transaction-processing systems in this Enterprise version of the product. The company also offers separate B2B solutions, such as an enterprise portal and a wireless server, that rely on XML.

With these recent offerings, Sybase is no longer just a tools vendor. The company that brought us PowerBuilder, a legendarily successful thick-client solution, has clearly reinvented itself with products such as EAServer. Despite somewhat lackluster test scores, it's a package that can power any small to medium-size organization effectively with a well-rounded set of features and a surprisingly powerful administration tool.

If your business is looking for a complete, scalable, and high-performance environment for Web applications, WebSphere Application Server is ready. WebSphere's wizards can make creating, testing, installing, and operating Java-based e-business applications easy, but its tools also offer minute control over advanced server settings for experts.

Foremost, WebSphere is a software platform: The application server is just a single part of the whole. A host of e- commerce offerings, such as personalization and wireless servers, that sit on top of WebSphere are available from IBM and third parties. WebSphere Studio Advanced ($1,999 list), a complete development environment, lets programmers create and maintain a Web application's logic and look. The studio contains VisualAge for Java and a base version of IBM HTTP Server (IHS), powered by Apache.

VisualAge for Java (VAJ) Professional Edition ($149) is a complete visual IDE for developing servlets, JSP, JavaBean components, and HTML. The Enterprise Edition ($2,999) adds a test client generator, EJB support, connections to IBM Enterprise Access Builder tools, and a toolkit for OMG's XMI (XML Metadata Interchange) and UML (Unified Modeling Language) standards for modeling distributed software architectures.

Today's VAJ offers better integration with WebSphere Studio and WebSphere itself than earlier versions but could still stand improvement. New wizards make creating session and entity beans a snap. After creating EJBs, you'll need to package them as JAR files for transfer and import them into the application server. VAJ uses a repository for code management with role-based security and privileges.

WebSphere Studio lets site builders integrate Web assets such as graphic files, HTML, Java Server Pages, and page templates with Enterprise JavaBean e-business logic. It supports team development using check-in and check-out security at the file level or an external source code manager such as Merant PVCS or Rational's ClearCase.

To get our test bookstore site up, we installed the included version of the IHS Web Server on the two server machines, which also installs the WebSphere connectivity plug-in automatically. This is a software mechanism that directs end-user page requests across application servers, providing load balancing and failover. We then installed the Oracle JDBC drivers and the application server software.

After creating a single instance of our bookstore application using WebSphere's GUI administration console, we created a model of our production configuration. We then cloned the model to three physical servers, which become a management group. Any changes to the model, including updates to Java components, are automatically replicated across the clones. This process makes running a cluster much easier than trying to keep each machine in sync individually.

During testing we tuned Web server, application server, and database server parameters for optimal performance. The aggressive use of caching contributed to the fastest search results we saw. Adjustable caches exist at many levels in WebSphere, including those for database queries, Java objects, pages, and graphics. During the login/logout test, WebSphere's creation of sessions within the database caused it to trail behind other products that offer more distributed but less available session management.

Earlier versions of WebSphere's application server could not provide reliable load balancing and failover. Release 3.5 provides these necessary features for implementing bet-your-business Web sites. During testing, we killed a server process and watched the other two application servers pick up the extra workload while the watchdog process reinvoked the failed server process.

Though its developer tools simplify creating Web applications, optimizing WebSphere implementations requires deep knowledge of Web servers, app servers, database servers, and the operating environment. Companies will need a highly qualified support staff to deploy applications, but the reward for that investment will be a highly scalable, robust, enterprise-class e-business delivery platform.

We pushed the Java application servers to their limits and found significant differences in how they handle heavy loads. Our tests used a custom EJB-based application that mimics a typical e-commerce site. We then used the Empirix e-TEST suite 5.0 (www.empirix.com) to scale the load up to thousands of virtual users trying to access the site. The e-TEST module we used was e-Load, which measures real-time system performance in terms of throughput and response time.

We ran six modular tests including browse, which measures how fast the application server can get data from the database and rebuild pages in a list; title search, which looks at how quickly the server can retrieve results sets of various sizes from the database and parse them; login/logout, which measures the server's ability to maintain session and state; create account, which evaluates the server's ability to handle large amounts of data being added throughout the system; add to cart, which measures the system's ability to handle log-on, search, and add items to the shopping cart; and checkout, which tests a complete transaction from search to purchase and exercises all the critical components of the system. We ran these tests with little wait time between transactions, placing an extremely demanding load on the server. The graphical results for the title search, login/logout, and checkout tests appear below—both in peak performance (pages served per second) and in average response time, or A.R.T. (the time required for one test iteration).

We then ran the scenario test, which runs all of the above modules together using a reasonable distribution of tasks (for example, many more searches than account creations) and greater wait time between iterations to simulate a real-world situation.

We don't include Microsoft's results in our charts, because its different architecture makes direct comparison against the Java-based servers inappropriate. When viewed independently, however, the Microsoft results are impressive.

The Results

IBM's WebSphere Application Server, Advanced Edition 3.5 was by far the fastest and most scal-able server on the scenario test. At its peak, it maintained 4,000 virtual users at 177 pages per second. Because of its sophisticated dynamic page-caching algorithms, WebSphere was also the clear winner on the title search test. It also had the best A.R.T. at peak performance on nearly all of the tests.

The tests exposed a weakness in Borland AppServer. Our run rules called for the EJB and servlet containers to be placed in separate processes, and AppServer's performance degrades significantly when the containers are not collocated. But AppServer did extremely well on the login/logout test, with almost twice the throughput of its nearest rival. This shows AppServer's ability to maintain its session state and streamline database connection pooling efficiently.

Sybase EAServer lacks dynamic caching for Web container dynamic content (JSPs and servlets). The server lagged behind IBM's WebSphere in performance and could support far fewer concurrent users.

How We Tested

Our client platform consisted of eight machines (Pentium III/550, with 256MB of RAM) on a 100-Mbps private switched network, as well as a ninth machine dedicated to controlling the actions of the clients. Using e-Load, these machines could emulate close to 9,000 concurrent virtual users.

The server environment consisted of six servers: two dedicat-ed Web servers running Apache (Pentium III/866, 256MB of RAM), three application servers (Pentium III/1-Ghz, 512MB of RAM), and one database server running Oracle 8i (Pentium III/1-GHz, 512MB of RAM). Windows 2000 Server was installed on all server machines, and Windows 2000 Workstation was on the client machines.

Each company used the same application and same database schema, deployed to its environment. Company representatives were on hand to tune the environments for optimal performance. Every company had the opportunity to configure caching parameters, connection pooling, session management, and the Oracle database—as long as it did not infringe on the EJB code.

Not every dynamic Web site requires the high-power Java and COM+ based application servers reviewed in the first section of this article. There are many ways to design Web applications, and a free or low-cost Web scripting language is often the best method for smaller, simpler, or less critical applications that need to be developed quickly.

There are a number of Web scripting languages worth considering. The key players are ColdFusion, Microsoft's Active Server Pages (ASP), and in the open-source world, Java server pages (JSP) and PHP. Also important (though not specifically designed for Web scripting) are Perl and Python.

All scripting languages are simple to learn and use compared with pure Java or C code. Developers used to Visual Basic will find ASP code easy. HTML coders will find ColdFusion familiar. C and Perl developers will see similarities to these languages in PHP.

Another way scripting languages make Web application development simpler is by mixing logic with HTML. But this is a double-edged sword: A collection of complex pages can easily turn into a jumbled mess. Both Microsoft (with ASP.NET) and Sun (with JSP tag libraries) are working on ways to let script developers separate presentation code from application logic.

The biggest downside to scripting languages is that upgrading a site to the level of reliability and performance of high-end application servers can be a major undertaking. JavaServer Pages and ColdFusion provide the best transition paths to higher-end site designs, and ASP is improving in this regard with the February, 2001 release of Microsoft's Application Center 2000 clustering product.

Each of these languages has an associated engine that runs the scripts on the Web server system. ColdFusion's markup language runs on servers ranging from the free ColdFusion Express Edition to the $4,995 cluster-capable Enterprise Edition.

Microsoft's ASP engine is included with the company's IIS Web server.

PHP runs on the PHP script engine, which can be downloaded at no cost from www.php.net.

JSP runs on many different servers. In fact, all Java 2 Enterprise Edition application servers (including those reviewed in the first section of this article) run JSP code. Here we test Tomcat, the open-source reference implementation of a JSP and servlet server.

Perl is most commonly run through the free mod_perl Apache Web server extension. Python also has a free Apache module available. Another choice is Zope, an open-source Python application server from Digital Creations.

These languages vary widely in developer tools support. For ASP, Microsoft offers Visual InterDev; for ColdFusion, there's the powerful ColdFusion Studio; for JSP, you can use one of many Java IDEs; Macromedia's Dreamweaver will create both JSP and ColdFusion code.

Integrated editors and debuggers for PHP, Perl, and Python are just starting to appear on the market. We used Zend Technologies' few-month-old Zend IDE 1.0 in our PHP testing, and Active State Corp. is close to releasing its Komodo, Visual Perl, and Visual Python IDEs for easier Perl and Python development.

Half.com, the company that convinced a small Oregon town to change its name, recently went through a few changes of its own. For over a year, the online marketplace, which bills itself as a cross between Amazon.com and its parent company eBay, used little other than ColdFusion, Macromedia's page-scripting—based application server, to construct its Web site. This past winter, however, Half.com's chief technology officer, Sunny Balijepalli, and his staff rebuilt a few of the site's critical components, basing them on Resin, an open-source Java application server sold by a small Silicon Valley company called Caucho technology. The two application servers now work in tandem, each handling the tasks that suit its strengths.

Many businesses use multiple application servers on their Web sites. Roughly 20 percent of respondents to a recent Forrester Research survey said that their companies use at least two different application servers.

Often this is merely a result of company dynamics. "You may have various departments that have their own budgets and make their own decisions about the technologies they use," says Chris Dial, the analyst who conducted Forrester's survey. "Or you may start out with one application server and then purchase a business that uses a different app server." And for some companies, such as Half.com, which lets people buy used books, music, movies, and games from individuals and businesses at a fixed price, it's more a matter of the right tool for the right job.

When Half.com was founded in 1999—the company is actually based in Philadelphia but made Halfway, Oregon, an offer it couldn't refuse to take the name Half.com—Balijepalli was told to get the site up and running as quickly as possible. Without hesitation, he turned to ColdFusion.

"Because it's template-driven, ColdFusion is perfect when you have to put together an application quickly," he says. "And it has a low learning curve." Indeed, two of Half.com's original three developers had no previous experience with the product and needed little more than a day to master it.

After only six months of work and expenditures of roughly 1 million dollars, the site was complete. Hosted at a Level 3 Communications facility in Philadelphia, it used roughly 20 Linux servers running ColdFusion and Apache Web Server, two Sun Enterprise servers running Oracle8i databases, and a load balancer.

ColdFusion served the site well, and Half.com has no plans to stop using it for the site's visual layout. But as traffic increased, the company decided to improve the site's performance and stability in two important places: the shopping cart and the user account management area. Half.com turned to Resin, a JSP and servlet application server built by Caucho's president and cofounder Scott Ferguson.

Even officials at Macromedia, which also makes the Java-based application server, JRun, agree that ColdFusion isn't ideal for high-end business applications. "You can build complex sets of operations in ColdFusion, but the more complex they get, the less useful it becomes," explains Philip Costa, senior product marketing manager for ColdFusion. "When you're integrating with a back-end system and want really high performance, you're going to use Java or C or some other systems programming language."

Before choosing Resin, Half.com looked at several other Java-based application servers, including similar engines such as Tomcat and high-end EJB products such as BEA's WebLogic and IBM's WebSphere. When it came to running JSPs and servlets, Bajijepalli felt that Resin was "the fastest and the most stable." And though the company wasn't necessarily looking to save money, the Caucho product proved much more affordable than WebLogic and WebSphere. Resin sells for only $500 per license, and support for five physical servers is available for $5,000 per year. "We spend about $20,000 a year with Caucho," says Balijepalli. "If we were using BEA, we'd be spending half a million dollars more."

Of course, as Forrester's Dial points out, there's something to be said for purchasing from a longstanding company: "[Application servers like Resin] are certainly going to find some ground in this market, but the larger firms are going to feel more confident with a relationship with IBM, for example, than with a small service provider offering an open-source platform."

Vadim Geshel, director of application development at Half.com and one of its leading programmers, doesn't necessarily agree. "I think we actually get better support on Resin than on a piece of software like ColdFusion," he says. "Since it's open-source, we could make our own bug fixes, but there's great turnaround on fixes from Caucho."

Resin and ColdFusion are working independently of each other, although they do access the same database and actually reside together on some of Half.com's servers. If the company eventually sees a need to upgrade the Resin part of the site to use EJBs, it may make use of Caucho's J2EE product, which is now in beta and should be available later in the year.

Half.com was in the top ten of sites visited during the last Christmas season, and the e-tailer hopes that its approach to Web applications building will let it upgrade the performance of the storefront to keep pace with growth. It will be little wonder if it succeeds. After all, it's hard to bet against a company that can talk a town 3,000 miles away into changing its name.