Visualforce Markup and Controllers

A Visualforce page is comprised of two key elements:

1. Visualforce Markup

2. A Visualforce Controller

That means the page behaviour is a result of these two components. Visualforce is built on the MVC model. The markup is the VIEW part of the MVC model, whereas the controller is the CONTROLLER part of the MVC model. The MODEL is hidden behind, which is essentially the metadata repository. 

Visualforce Markup comprises of Visualforce tags, HTML, Javascript, Style components, any web-enabled code (for example : widgets), which are embedded within a single <apex:page> tag. The markup drives how the page should look like, when the page renders in a browser.

Visualforce Controllers are basically set of instructions created out of classes that may be standard or custom, that are responsible for driving how a page or rather to be precise, the page components, should behave when an event or action takes place on that page component. For example, if you are wondering what part of Visualforce takes care of the behavior of the application when a button click or a link click takes place, well, this is taken care by the controller.

There are two types of controllers - Standard Controller and Custom Controllers. A Standard Controller is a controller that is provided by the Force.com platform. On the other hand, a Custom Controller is basically a controller class written using the Apex language.

A Standard Controller comprises of logic and rules that are used in native Salesforce.com pages. For example, if we are using a standard Contacts controller and implementing the EDIT functionality, the same behavior is exhibited when EDIT action is being executed in the Salesforce.com Contacts page.  

And as obvious, if a Standard Controller is being used on a page where a user does not have privilege on that controller, a message is displayed that displays that the user does not have sufficient privileges over the controller. And such messages can ofcourse be avoided well in advance, by checking user's privileges on objects.

Whereas Standard Controllers act on single records, Standard List Controllers  act on multiple records. There are some examples of Salesforce.com pages that use Standard List Controllers such as:

1. List Pages

2. Related Lists

3. Mass action pages.

Now talking about Custom Controllers, these are basically classes that implement the entire logic of a page, without using Standard Controllers. However, some functionality of Standard Controllers are reimplemented.

System Mode vs. User Mode

It is interesting to know that Custom Controllers work in System Mode, which means that when Custom Controllers are used to render a Visualforce page, the object level permissions and field level permissions of the current user are ignored. However, it can be specified in the User's profile whether he/she can executed a method in a Custom Controller. This is a very powerful feature of a custom controller. Standard Controllers run in User Mode. This means that pages built on Standard Controllers will inherit the field level security plus the object level security of the user.

Now that we have discussed what are Standard Controllers and Custom Controllers, it is important to mention what Controller Extensions are. Well, Controller Extensions are nothing but classes built on Apex, that add to or override the functionalities of Standard or Custom controllers. This way, developers can make custom and standard controllers even more feature packed. Note that Controller Extensions run in System mode.

The optional modifier with sharing which allows the current user to get permissions even to pages that use Custom Controllers or Controller extensions.