Editing Active Template Library (section)

== History ==
COM objects can also be created with [[Microsoft Foundation Classes]] (MFC), but this leads to larger binaries that require support [[dynamic-link library|DLL]]s.<ref>{{cite book | title = Visual C++ 6 Unleashed | edition = 1st | chapter = Active Documents | page = 733 | last = Williams | first = Mickey | year = 2000 | publisher = Sams | isbn = 978-0-672-31241-0 }}</ref> ATL, on the other hand, is a more lightweight alternative in situations where the graphical user interface parts of MFC are not required.<ref>Microsoft MSDN: [https://msdn.microsoft.com/en-us/library/bk8ytxz5.aspx Recommendations for Choosing Between ATL and MFC]</ref>

Older versions of ATL (ATL prior to version 7.1, [[Visual_Studio#History|pre-Visual Studio 2005]]) are incompatible with [[Data Execution Prevention#Windows|DEP]] because it places executable [[thunk]]s in data heap.<ref>http://web.archive.org/web/20080130115007/http://blogs.msdn.com/michael_howard/archive/2008/01/29/new-nx-apis-added-to-windows-vista-sp1-windows-xp-sp3-and-windows-server-2008.aspx</ref><ref>https://learn.microsoft.com/en-us/archive/blogs/michael_howard/new-nx-apis-added-to-windows-vista-sp1-windows-xp-sp3-and-windows-server-2008</ref><ref>https://msrc.microsoft.com/blog/2009/06/understanding-dep-as-a-mitigation-technology-part-1/</ref> 
This problem can be mitigated with DEP-ATL thunk emulation with performance penalty.<ref>http://web.archive.org/web/20090123222148/http://support.microsoft.com/kb/948468</ref><ref>https://learn.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-updateprocthreadattribute</ref>

In ATL version 7 (Visual Studio 2003), which directly succeeded version 3 (Visual Studio 6.0), a number of MFC classes like CString were made available in ATL, or more precisely moved to an ATLMFC common layer which is shared by both libraries. ATL version 7 also introduced attributes in C++ in an attempt to provide something similar to [[Metadata (CLI)#Attributes|CLI attributes]], however these have not been particularly successful, and have been deemphasized in ATL version 8 (Visual Studio 2005); the various wizards no longer generate them by default. Version 7 also introduced new string conversion classes.

On July 28, 2009, Microsoft released a patch to ATL to fix a bug that could allow [[ActiveX]] controls created using ATL to be vulnerable to a remote code execution security flaw.<ref>{{cite web|url=http://msdn.microsoft.com/en-us/visualc/ee309358.aspx |title=ATL Security Update |publisher= Microsoft|work = MSDN| date=2009-07-28 |access-date=2011-09-19}}</ref>

Since Visual Studio 2013 (ATL version 12), all ATL code is static, eliminating the DLL.<ref>http://web.archive.org/web/20130827013146/http://blogs.msdn.com/b/vcblog/archive/2013/08/20/atl-and-mfc-changes-and-fixes-in-visual-studio-2013.aspx</ref><ref>https://devblogs.microsoft.com/cppblog/atl-and-mfc-changes-and-fixes-in-visual-studio-2013/</ref>

ATL version is defined by ATL_VER macros and can be queried via AtlGetVersion() function.<ref>https://learn.microsoft.com/en-us/cpp/atl/reference/atl-text-encoding-functions?view=msvc-170#atlgetversion</ref>