Open Source - The Web 2.0 Concepts

How To Automate Optimization and Deployment Of Static Content

2009-11-16T00:14:00.000-08:00

http://www.smashingmagazine.com/2009/07/19/how-to-automate-optimization-and-deployment-of-static-content/

A lot of traffic between users and your site comes from the static content you’re using to set up the user interface, namely layout graphics, Stylesheets and Javascript files.

This article shows a method to improve the providing of static content for a web platform. Further, it will show you a way to automate the deployment of these files, so you can deliver them with least effort but with maximum performance.

This tutorial will take some time to set it up, but it’s going to save you hours of work in the future and will improve your page speed significantly.

Nice and Free CSS Templates

2009-11-15T22:51:00.001-08:00

This site contains free css templates for your website - Just copy and paste and there you have a stunning website !

http://www.mycelly.com/

JavaScript Framework Matrix

2009-11-12T23:24:00.000-08:00

http://matthiasschuetz.com/javascript-framework-matrix/en/

JavaScript Framework Matrix shall give you an overview of popular JavaScript frameworks and their functions. There are various examples for the frameworks and every snippet contains links to the official documentation. The choice of a framework depends on many factors and can't be made of this document only. The matrix shall solely demonstrate the different API styles and functionalities of the JavaScript libraries.

22 Open Source PHP Frameworks To Shorten Your Development Time

2009-11-12T23:23:00.001-08:00

http://www.listelog.com/22-open-source-php-frameworks-to-shorten-your-development-time/

PHP is a widely used programming language for web development. Although there are a lot of alternative programming languages for web development such as ASP and Ruby, but PHP is still the most popular among them.

So, what makes PHP so popular? PHP is so popular because it is relatively easy to learn compare to other language. Furthermore, there are a lot of great tutorials for beginner to get started. Although there are a lot of resources for us, but coding a site from scratch is very tough. Luckily, there are a lot of reliable PHP Framework which can shorten the development time. These frameworks are supported by huge community and they are willing to help if you face any problems.

Google opens up its JavaScript development toolbox to all

2009-11-12T23:12:00.001-08:00

http://arstechnica.com/open-source/news/2009/11/google-opens-up-its-javascript-development-toolbox-to-all.ars

Google has opened the source code of the comprehensive JavaScript library that it uses in some of its popular web applications. The search giant has also opened the source of its JavaScript compression tool.

SVG Web - http://code.google.com/p/svgweb/

2009-11-12T23:03:00.001-08:00

http://code.google.com/p/svgweb/

SVG Web is a JavaScript library which provides SVG support on many browsers, including Internet Explorer, Firefox, and Safari. Using the library plus native SVG support you can instantly target ~95% of the existing installed web base.

Once dropped in you get partial support for SVG 1.1, SVG Animation (SMIL), Fonts, Video and Audio, DOM and style scripting through JavaScript, and more in about a 60K library. Your SVG content can be embedded directly into normal HTML 5 or through the OBJECT tag. If native SVG support is already present in the browser then that is used, though you can override this and have the SVG Web toolkit handle things instead. No downloads or plugins are necessary other than Flash which is used for the actual rendering, so it's very easy to use and incorporate into an existing web site.

Auto Format entered Date onKeyPress event

2009-10-14T03:42:00.000-07:00

function getDate(elem){
var elemVal = elem.value;
var elemId = elem.id;

switch(elemVal.length){
case 2:
elemVal = elemVal+"/";
break;
case 5:
elemVal = elemVal+"/";
break;
}
document.getElementById(elemId).value = elemVal;
}

Widget effects using YUI like scriptaculous does

2009-09-24T23:18:00.000-07:00

http://blog.davglass.com/files/yui/effects/

50+ Amazing Jquery Examples

2009-09-24T23:16:00.000-07:00

Many of us have been using a good deal of jQuery plugins lately. Below I have provided a list of the 50 favorite plugins many developers use. Some of these you may have already seen, others might be new to you. This is just the first series , the second version will be coming soon, stay tuned and Enjoy!

http://www.noupe.com/jquery/50-amazing-jquery-examples-part1.html

BackBase Explorer - A effective Javascript Library

2009-09-24T23:14:00.000-07:00

http://demo.backbase.com/explorer/#|examples/welcome.xml

WebSnapr

2009-09-24T23:11:00.000-07:00

Free document translator

2009-09-24T23:08:00.000-07:00

http://www.worldlingo.com/en/products_services/document_translator.html

How to get radio button value?

2009-09-24T23:07:00.000-07:00

function get_radio_value(obj)
{
for (var i=0; i < obj.length; i++){
if (obj[i].checked){
var rad_val = obj[i].value;
return rad_val;
}
}
}

Looking for AJAX widgets?

2009-09-14T03:10:00.000-07:00

Hey,

r u looking for rich web application Ajax tools?

Here is a link for you to enjoy Ajax gadgets to plug with your webapp.

http://www.miniajax.com/

Enjoy!! :)

AutoCompleteList - Ajax based periodical search updater

2009-09-14T03:06:00.000-07:00

If you used Facebook on a regularly basis, you’ve probably come across their cool autocomplete method of adding multiple recipients to messages. For those that haven’t seen it, here’s a pic:

Reference link:

http://devthought.com/blog/projects-news/2008/01/textboxlist-fancy-facebook-like-dynamic-inputs/
Demo: http://ajaxian.com/archives/facebook-style-input-box

websnapr - Preview Bubble using Javascript

2009-09-14T02:23:00.000-07:00

websnapr lets you capture screenshots of (almost) any web page. Allow your visitors to instantly visualize any web page before clicking. Increase site traffic, click-through rate and site stickiness.

The websnapr Preview Bubble is a simple, unobtrusive script used to display an overlay bubble showing a hyperlink target thumbnail using websnapr. It's a snap to setup and works on (almost) all modern browsers.

This script has been proved to work in IE, Firefox, Opera and Safari. It might work on other browsers as well.

Reference links are:

http://www.frequency-decoder.com/2006/10/25/link-preview-v2/
http://www.websnapr.com/previewbubble/

Enjoy the link preview bubbling

On fly Free GIF loader genereator

2009-09-11T08:14:00.000-07:00

http://www.ajaxload.info/

Getting Started with YUI

2009-09-11T04:30:00.001-07:00

The Yahoo! UI (YUI) - Collection of Javascript gadgets

2009-09-11T04:25:00.000-07:00

The YUI Library is a set of utilities and controls, written in JavaScript, for building richly interactive web applications using techniques such as DOM scripting, DHTML and AJAX. YUI is available under a BSD license and is free for all uses.

It can be downloaded from http://developer.yahoo.com/yui/download/

Documentation is available from http://developer.yahoo.com/yui/docs/

And more interesting YUI example gallery is avail at http://developer.yahoo.com/yui/examples/

Enjoy Yahoo UI... oh sorry! its YUI... :)

How to create a model dialog popup using Yahoo YUI

2009-09-11T04:13:00.000-07:00

Ajax Call using Yahoo YUI

2009-09-11T04:06:00.000-07:00

Transaction id: " + o.tId + "

";
div.innerHTML += "

HTTP status: " + o.status + "

";
div.innerHTML += "

Status code message: " + o.statusText + "

";

div.style.backgroundColor='red';
}
};

var handleSuccessLogin = function(o){
if(o.responseText !== undefined){
}
}

var callbackLogin =
{
success:handleSuccessLogin,
failure: handleFailure,
customevents:{
onStart:transactionObjectLoginStatus.start,
onComplete:transactionObjectLoginStatus.complete
},
argument: ['foo','bar']
};

var postData = "username="+usrName+"&password="+passWd;
var request = YAHOO.util.Connect.asyncRequest('POST', loginAuthUrl, callbackLogin, postData);

JavaScript to validate US SSN numbers

2009-09-11T04:05:00.000-07:00

JavaScript to convert phone numbers in US phone format

2009-09-11T04:04:00.000-07:00

var n;
var p;
var p1;
function ValidatePhone(){
p=p1.value
if(p.length==3){
//d10=p.indexOf('(')
pp=p;
d4=p.indexOf('(')
d5=p.indexOf(')')
if(d4==-1){
pp="("+pp;
}
if(d5==-1){
pp=pp+")";
}
//pp="("+pp+")";
document.getElementById(p1.name).value="";
document.getElementById(p1.name).value=pp;
}
if(p.length>3){
d1=p.indexOf('(')
d2=p.indexOf(')')
if (d2==-1){
l30=p.length;
p30=p.substring(0,4);
//alert(p30);
p30=p30+")"
p31=p.substring(4,l30);
pp=p30+p31;
//alert(p31);
document.getElementById(p1.name).value="";
document.getElementById(p1.name).value=pp;
}
}
if(p.length>5){
p11=p.substring(d1+1,d2);
if(p11.length>3){
p12=p11;
l12=p12.length;
l15=p.length
//l12=l12-3
p13=p11.substring(0,3);
p14=p11.substring(3,l12);
p15=p.substring(d2+1,l15);
document.getElementById(p1.name).value="";
pp="("+p13+")"+p14+p15;
document.getElementById(p1.name).value=pp;
//obj1.value="";
//obj1.value=pp;
}
l16=p.length;
p16=p.substring(d2+1,l16);
l17=p16.length;
if(l17>3&&p16.indexOf('-')==-1){
p17=p.substring(d2+1,d2+4);
p18=p.substring(d2+4,l16);
p19=p.substring(0,d2+1);
//alert(p19);
pp=p19+p17+"-"+p18;
document.getElementById(p1.name).value="";
document.getElementById(p1.name).value=pp;
//obj1.value="";
//obj1.value=pp;
}
}
//}
setTimeout(ValidatePhone,100)
}

function getIt(m){
n=m.name;
//p1=document.forms[0].elements[n]
p1=m
ValidatePhone()
}

Date difference in days using JavaScript

2009-09-11T03:59:00.000-07:00

function calcDays(startDate, endDate){
var date1 = startDate;
var date2 = endDate;
date1 = date1.split("-");
date2 = date2.split("-");
var sDate = new Date(date1[0]+"/"+date1[1]+"/"+date1[2]);
var eDate = new Date(date2[0]+"/"+date2[1]+"/"+date2[2]);
var daysApart = Math.abs(Math.round((sDate-eDate)/86400000));
return daysApart;
}

How to use xml2json

2009-09-11T03:35:00.000-07:00

To use xml2json you simply embed it in the head section of your web pages, before any other scripts that uses it.

<head>
<script type="text/javascript" src="xml2json.js"></script>
...
</head>

Then you use the method xml2json.parser() to convert your XML:

// A simple call - myXML is a string containing your XML:

myJsonObject=xml2json.parser(myXML);

// A 2:nd, optional, parameter is "tags not to convert" - for example <b> and <i>:

myJsonObject=xml2json.parser(myXML,'b,i');

// A 3:rd, optional, parameter gives us a string showing us the JSON structure
// instead of the actual JSON object:

myString=xml2json.parser(myXML,'','html');

// - use "compact" for output without linebreaks or tabbing
// - use "normal" for output with linebreaks and tabbing
// - use "html" for a html representation

XML to JSON – a converter

2009-09-11T03:33:00.000-07:00

There are probably tons of XML to JSON converters floating around out there by now, some written in JavaScript and some in different server side languages. Anyway I wrote this one, xml2json.js, about a year ago – it's small (5 kB) and rather fast. You can download and use it for free. You can also try it out here:

http://www.thomasfrank.se/downloadableJS/xml2json.js

Google Map API

2009-09-11T03:29:00.000-07:00

< script src="http://maps.google.com/maps?file=api&v=2.x&key=ABQIAAAAzr2EBOXUKnm_jVnk0OJI7xSosDVG8KKPE1-m51RBrvYughuyMxQ-i1QfUnH94QxWIa6N4U6MouMmBA" type="text/javascript" ></script<

var map = null;
var geocoder = null;

function initialize() {
if (GBrowserIsCompatible()) {
map = new GMap2(document.getElementById("map_canvas"));
map.setCenter(new GLatLng(37.4419, -122.1419), 13);
geocoder = new GClientGeocoder();
}
}

function showAddress(address) {
if (geocoder) {
geocoder.getLatLng(
address,
function(point) {
if (!point) {
alert(address + " not found");
} else {
map.setCenter(point, 13);
var marker = new GMarker(point);
map.addOverlay(marker);
marker.openInfoWindowHtml(address);
}
}
);
}
}

initialize();

jQuery based inline form validation engine

2009-09-11T03:02:00.000-07:00

When it comes to form validation, it’s hard to have a versatile solution that works with every form. Figuring out how to display errors is not a simple task. This is something I tried to remedy with this script. When an error needs to be displayed, the script creates a div and positions it in the top right corner of the input. This way you don’t have to worry about your HTML form structure. The rounded corner and shadow are done with CSS3 and degrade well in non compliant browsers. There is no images needed.

When you submit a form, it will look for inputs with predefined class selectors, and validate them accordingly to their type. It also does on the fly validation when you click outside of the input. When validating on submit , every errors will appear in absolute position above the input in question, and slide the scroll bar to this first error (diminish your browser window if you don’t see the effect).

for demo visit the link http://www.position-relative.net/creation/formValidator/

To enjoy it with your application download it from http://www.position-relative.net/creation/formValidator/formValidator.zip

Pure CSS Animated Progress Bar

2009-09-11T02:57:00.000-07:00

http://cssglobe.com/lab/progress_bar/progress_bar.zip

Here's a simple demonstration of how you can create animated progress bar using pure css. The trick is very simple. We need 3 elements, one container and 2 nested elements.

MySQL: TimeZone support

2009-09-11T02:10:00.000-07:00

http://dev.mysql.com/doc/refman/5.0/en/time-zone-support.html

MySQL timezone support is very powerful feature to work with multiple timezones. This includes the values displayed by functions such as NOW() or CURTIME(), and values stored in and retrieved from TIMESTAMP columns. Values for TIMESTAMP columns are converted from the current time zone to UTC for storage, and from UTC to the current time zone for retrieval.

Flex with PHP

2009-09-11T02:09:00.000-07:00

Flex Builder & PHP

Download Flex Builder:https://www.adobe.com/cfusion/tdrc/index.cfm?loc=en%5Fus&product=flex

Flex documentation:http://labs.adobe.com/wiki/index.php/Flex_Builder

Online Adobe Flex development center:http://www.adobe.com/devnet/flex/?tab:samples=1

Flex is next foot step for PHP programmers. Its a emerging enhancement and concepts introduce via “Adobe” to developed a PHP application with flexible support of Flash and XML. Its makes your application attractive in presentation and very good as user experience to view your application on the web.

PHP Code Optimization: Do's and Don'ts

2009-07-30T01:59:00.000-07:00

I am listing tips to improve your PHP code performance. There are few whom you can call as debatable but overall the code performance will surely increase.

Following tips are written to save time and development cost (includes memory too)

* If a method can be static, declare it static. Speed improvement is by a factor of 4.
* echo is faster than print.
* Unset your variables to free memory, especially large arrays.
* Avoid magic like __get, __set, __autoload
* require_once() is expensive
* Use full paths in includes and requires, less time spent on resolving the OS paths.
* str_replace is faster than preg_replace, but strtr is faster than str_replace by a factor of 4
* It's better to use switch statements than multi if, else if, statements.
* Error suppression with @ is very slow.
* Turn on apache's mod_deflate
* Close your database connections when you're done with them
* A PHP script will be served at least 2-10 times slower than a static HTML page by Apache. Try to use more static HTML pages and fewer scripts.
* Cache as much as possible. Use memcached - memcached is a high-performance memory object caching system intended to speed up dynamic web applications by alleviating database load. OP code caches are useful so that your script does not have to be compiled on every request
* Do not implement every data structure as a class, arrays are useful, too
* mod_gzip which is available as an Apache module compresses your data on the fly and can reduce the data to transfer up to 80%

All the above can be used to reduce the processing time and you can make your client happy.

What is SQL Injection?

2009-07-30T01:25:00.000-07:00

What is SQL Injection

SQL injection refers to the act of someone inserting a MySQL statement to be run on your database without your knowledge. Injection usually occurs when you ask a user for input, like their name, and instead of a name they give you a MySQL statement that you will unknowingly run on your database.
SQL Injection Example

Below is a sample string that has been gathered from a normal user and a bad user trying to use SQL Injection. We asked the users for their login, which will be used to run a SELECT statement to get their information.
MySQL & PHP Code:

// a good user's name
$name = "timmy";
$query = "SELECT * FROM customers WHERE username = '$name'";
echo "Normal: " . $query . "
";

// user input that uses SQL Injection
$name_bad = "' OR 1'";

// our MySQL query builder, however, not a very safe one
$query_bad = "SELECT * FROM customers WHERE username = '$name_bad'";

// display what the new query will look like, with injection
echo "Injection: " . $query_bad;

Display:
Normal: SELECT * FROM customers WHERE username = 'timmy'
Injection: SELECT * FROM customers WHERE username = '' OR 1''

The normal query is no problem, as our MySQL statement will just select everything from customers that has a username equal to timmy.

However, the injection attack has actually made our query behave differently than we intended. By using a single quote (') they have ended the string part of our MySQL query

* username = ' '

and then added on to our WHERE statement with an OR clause of 1 (always true).

* username = ' ' OR 1

This OR clause of 1 will always be true and so every single entry in the "customers" table would be selected by this statement!
More Serious SQL Injection Attacks

Although the above example displayed a situation where an attacker could possibly get access to a lot of information they shouldn't have, the attacks can be a lot worse. For example an attacker could empty out a table by executing a DELETE statement.
MySQL & PHP Code:

$name_evil = "'; DELETE FROM customers WHERE 1 or username = '";

// our MySQL query builder really should check for injection
$query_evil = "SELECT * FROM customers WHERE username = '$name_evil'";

// the new evil injection query would include a DELETE statement
echo "Injection: " . $query_evil;

Display:
SELECT * FROM customers WHERE username = ' '; DELETE FROM customers WHERE 1 or username = ' '

If you were run this query, then the injected DELETE statement would completely empty your "customers" table. Now that you know this is a problem, how can you prevent it?

Injection Prevention - mysql_real_escape_string()

Lucky for you, this problem has been known for a while and PHP has a specially-made function to prevent these attacks. All you need to do is use the mouthful of a function mysql_real_escape_string.

What mysql_real_escape_string does is take a string that is going to be used in a MySQL query and return the same string with all SQL Injection attempts safely escaped. Basically, it will replace those troublesome quotes(') a user might enter with a MySQL-safe substitute, an escaped quote \'.

Lets try out this function on our two previous injection attacks and see how it works.
MySQL & PHP Code:

//NOTE: you must be connected to the database to use this function!
// connect to MySQL

$name_bad = "' OR 1'";

$name_bad = mysql_real_escape_string($name_bad);

$query_bad = "SELECT * FROM customers WHERE username = '$name_bad'";
echo "Escaped Bad Injection:
" . $query_bad . "
";

$name_evil = "'; DELETE FROM customers WHERE 1 or username = '";

$name_evil = mysql_real_escape_string($name_evil);

$query_evil = "SELECT * FROM customers WHERE username = '$name_evil'";
echo "Escaped Evil Injection:
" . $query_evil;

Display:
Escaped Bad Injection:
SELECT * FROM customers WHERE username = '\' OR 1\''
Escaped Evil Injection:
SELECT * FROM customers WHERE username = '\'; DELETE FROM customers WHERE 1 or username = \''

Notice that those evil quotes have been escaped with a backslash \, preventing the injection attack. Now all these queries will do is try to find a username that is just completely ridiculous:

* Bad: \' OR 1\'
* Evil: \'; DELETE FROM customers WHERE 1 or username = \'

And I don't think we have to worry about those silly usernames getting access to our MySQL database. So please do use the handy mysql_real_escape_string() function to help prevent SQL Injection attacks on your websites. You have no excuse not to use it after reading this lesson!

how to get KeyCode using Dojo?

2009-04-09T04:36:00.000-07:00

var key;
function echo(event) {
key = event.keyCode;
}

dojo.addOnLoad(function() {
interactiveNode = dojo.byId("sendResponse");
dojo.connect(interactiveNode, 'onkeydown', echo);
});

IBM WebSphere sMash - How to handle sessions?

2009-04-01T00:30:00.000-07:00

To handle the session, there we need to use User Zone to specify session variables. There are some important function needs to specify to implement the sessions:

1: zput("/user#save", true); => To save the session

2: zput("/user#invalidate", true); => To invalidate the session

3: zput("/user/varName", ""); => To set the session variable

4: zput("/user/varName", ""); => To unset the session variable

To Set the error message during the session, can be used:

Zput("/user/login/error","Error Message");

IBM WebSphere sMash - global 404 error handling

2009-04-01T00:25:00.000-07:00

If you like to handle 404 error at common point of sMash application, please follows the below steps:

1: Create a error404.html file under /app/errors/
2: Now specify your 404 handling code or HTML snippet.

This method is similar to follow any type of error in sMash, if you like to handle 503 error. you need to create error503.html file only.

IBM WebSphere sMash - Caching Machanism

2009-04-01T00:24:00.001-07:00

There are three types of caching support available in sMash:-

- Resource caching mechanism

sMash doesn't provide a simple cache API for anything. You could easily store the data in the storage or app zone depending on the lifetime. You can also just manage a disk cache yourself or take one of the off the shelf cache libraries to help you.

- File caching mechanism

By default, files are served with an Etag header that can be used to validate the next request on the server. If you want to turn this behavior off set /config/fileserver/setEtag to false.

Files are also served by default with a Cache-Control header with a max-age of 0. This behavior can be overridden by file extension. For example, to cache all .js files for 300 seconds, set /config/fileserver/expires/.js to 300. This will result in a Cache-Control header being served with a max-age of 300 for all .js files.

Example:

/config/fileserver/setEtag = true

/config/fileserver/expires/.js = 300
/config/fileserver/expires/.css = 300
/config/fileserver/expires/.gif = 300
/config/fileserver/expires/.png = 300

- Script caching mechanism

For script caching in PHP we changed the following settings in

persistent_code_cache=true
persistent_code_cache_dir="./.zero/private/p8codecach

How to package and deploy project zero application to Production box?

2009-04-01T00:22:00.000-07:00

Prerequisite for Production box:

1: Please make sure that JDK is installed.

2: set the Bin path into the JAVA_HOME.

Steps for deployment:

1: First need to run following command from within application directory to create the package of zero application:

zero package -standalone

It will create a zip file inside the export directory of the zero application.

2: Copy the zip file to the production box and unzip into the file system.

3: Go to the unzip application directory and run the following commands:

a) for Linux box:

sh zero resolve

sh zero start

B) for Windows box:
zero resolve
zero start

4: Now test your application using specified URL on browser.

IBM WebSphere sMash - Usefull CLI Commands

2009-04-01T00:09:00.001-07:00

a) zero create : To create new sMash Application

b) zero start: To start sMash server to run the application on 8080 port

c) zero resolve: To add/update the dependencies mentioned in the project's ivy.xml

d) zero stop: To stop the sMash server

e) zero runsql : To execute the SQL scripts on DB server

f) zero model sync: To Syncronized your model with DB tables.

g) appbuilder open/start/stop/status: To handle the Appbuilder environment for application development.

h) zero compile: To compile the Java files zero application.

i) Zero create from : To create a demo application from repository.

IBM WebSphere sMash - ivy.xml

2009-04-01T00:07:00.000-07:00

WebSphere sMash uses a technology from Apache Ivy. The ivy.xml file stored in the config directory is where your dependencies are maintained. You can hand edit the file yourself, but the following example uses the dependencies page of the AppBuilder.

WebSphere sMash, through Ivy, uses the notion of repositories. There is a local one and remote one. WebSphere sMash applications will declare a set of dependencies. The run time, through the Ivy technology, will look in the local repository to see if the dependency is present. If not, it will download it from a remote repository. By default, the remote repository is located in projectzero.org. However, you can configure different remote repositories. For example, when you ran the AppBuilder for the first time, the sMash run time downloaded the dependencies needed. Ivy also supports downloading based on version. For example, by specifying 1.0.0.0, 2.0.0.0 you are telling WebSphere sMash to obtain the latest version between 1.0.0.0 and 2.0.0.0 (not inclusive).

IBM WebSphere sMash configuration file: zero.config

2009-04-01T00:06:00.001-07:00

The configuration of a WebSphere sMash application is set in the config zone of the global context. Values are set to the configzone by way of configuration files. Configuration files for the application, and its dependencies, are processed when the application is started. Configuration files are essentially scripts that set and append values into theconfig zone. The syntax is based upon a simple grammar of global context URIs and JSON data structures. While processing configuration files, entries in the config zone are handled with a "first one wins" strategy:

* Set values once. Subsequent attempts to set a value at an existent global context URI are denied.
* Append values to arrays.
* Append key/value pairs to objects, provided that the key is not already set in that object.

After processing the configuration files, the configzone is read-only. Although you can change the values by application code, not all changes affect the running application. For example, you must restart the application to apply changes in /config/http/port.

Multiple DB connection strings for sMash Application

2009-03-31T23:56:00.000-07:00

Mysql:

Add following dependency in ivy.xml:
<dependency name="mysql-connector-java" org="mysql" rev="5.0.5"/>

then add following string on zero.config:

/config/db/my-db2 = {
"class" : "com.mysql.jdbc.jdbc2.optional.MysqlDataSource",
"serverName" : "localhost",
"portNumber" : 3306,
"databaseName" : "db_name",
"user" : "username",
"password" : "pwd"
}

SQL Server:
Prerequisites: Install JDBC adapter driver on local machine.

then add following string on zero.config:

/config/db/mydb = {
"class" : "com.microsoft.sqlserver.jdbc.SQLServerDataSource",
"serverName" : "host_name",
"portNumber" : port_number,
"instanceName" : "instance_name",
"databaseName" : "db_name",
"user" : "username",
"password" : "pwd"
}

How to Export sMash Application?

2009-03-31T23:53:00.001-07:00

To export your application, complete the following steps:

1. Right-click the project and click Export....

2. Expand the WebSphere sMash category.

3. Select WebSphere sMash Export Wizard and click Next.

4. Click Browse... to select a directory and store the exported zip file.

5. Check Include Source to include the source project.

6. Click Finish to export the project.

Note: you must include source if you plan to import the project back into Eclipse.

IBM WebSphere sMash - Adding PHP support

2009-03-31T23:51:00.000-07:00

If you want to add PHP support for your application, complete the following steps:

1. Stop the application.
zero stop

2. Add the PHP dependency to the application. Within your application's directory, edit config/ivy.xml. Add the entry to the dependencies element.

3. Find the new dependency and associate it with your application. This step is called resolving the dependency.
zero resolve

4. Add PHP scripts to the application's public directory.

5. Optionally, modify the settings in the PHP configuration file config/php.ini.

6. Start the application.

7. From the browser, type "http://localhost:8080/.php" to run the script.

IBM WebSphere sMash - Create a sample application

2009-03-31T23:48:00.001-07:00

The instructions below show you how to create a simple application using the command line interface.

1. Open a command prompt.

2. Type the following:

zero create demo

This creates a new WebSphere sMash application, which is created in a new subdirectory name demo.

3. Change directory into demo.

4. Type zero start to start the application. Log messages are printed showing that the HTTP adapter has started.

5. Open a browser and type http://localhost:8080/.

DOWNLOAD AND INSTALLATION OF THE sMash

2009-03-31T03:30:00.000-07:00

- Download the zero.zip file from http://www.projectzero.org/sMash/1.1.x/download/

- Unzip zero-.zip into any directory. The root directory after unzipping is called zero. Refer to this directory as .

- WebSphere sMash does not support double-byte character sets on the installation path.

- Configure the Java command by setting the environment variable JAVA_HOME.

The zero scripts determine the Java command to use by first using the environment variable JAVA_HOME. JAVA_HOME should be set to the directory where the JDK is installed. The scripts append bin/java to JAVA_HOME and verify whether the file exists. If JAVA_HOME is not set, or if $[JAVA_HOME]/bin/java does not exist, then the script uses the Java command found using the configured path. The recommendation is to set JAVA_HOME.

- (Optional) Add to the PATH environment variable.

IBM WebSphere sMash - References

2009-03-31T03:29:00.000-07:00

IBM WebSphere Online Handbook:

http://publib.boulder.ibm.com/infocenter/wsmashin/v1r0/index.jsp?topic=/com.ibm.websphere.sMash.doc/core/zero.cli.tasks/docs/en/CliTasks.html

Project Zero IBM WebSphere sMash Developer's Guide:

http://www.projectzero.org/zero/sebring/latest/docs/zero.gettingstarted.doc/

Project Zero Samples and Tutorials:

http://www.projectzero.org/sMash/1.1.x/docs/zero.devguide.doc/samples.doc/SamplesOverview.html

Dojo Toolkit Handbook:

http://api.dojotoolkit.org

Video Tutorials:

http://www.viddler.com/explore/projectzero/

IBM WebSphere sMash benefits for Developers

2009-03-31T03:27:00.000-07:00

Unleash Content as REST Services
Representational State Transfer (REST) is an architectural style that allows services to be exposed and consumed over the Web using only a simple URL. Leveraging REST technology, WebSphere sMash extends SOA to the web -- effectively using the Web as the SOA platform.

Using WebSphere sMash, companies can enable new models of revenue by unleashing their content to the world as REST services, take advantage of the huge array of REST services available on the Web to build new applications, and easily reuse these assets in future projects.

Leverage the Power of Scripting for Agile Development
Because WebSphere sMash applications are based on dynamic scripting, they can be run without any compilation -- a feature which eases the overhead of application development and makes modification and customization easy.

WebSphere sMash supports two dynamic scripting languages, PHP Hypertext Preprocessor (commonly known as PHP), and Groovy, a dynamic scripting language which leverages existing Java skills.

Furthermore, because WebSphere sMash only uses the modules it needs, the storage and memory footprints are exceptionally small (You can even run it from a USB key!) and the server can restart in seconds!

Quickly Combine Services and Feeds with Visual Tools
WebSphere sMash offers visual assembly-style development for designing server-side business logic as well as visual design editors for designing rich user interfaces.

WebSphere sMash -- In Three Words

2009-03-31T03:26:00.000-07:00

Speed:

Dynamic scripting languages
Fewer lines of code
Browser-based tooling

Simplicity:

Leverage pre-existing content
Use the web as your SOA platform
Visual Assembly-style development

Agility:

Small footprint
Easily modify your applications
Restart the server in seconds

What is IBM WebSphere sMash?

2009-03-31T03:25:00.000-07:00

A development and execution platform for quickly building agile, web-based applications.

WebSphere sMash v1.1 enables developers to quickly build and execute agile, Web 2.0-based applications that help businesses be more responsive, flexible and cost-effective. As a fast and simple application foundation, WebSphere sMash advances Smart SOA and accelerates business and IT alignment.

Supports some of today's hottest dynamic scripting languages - PHP and Groovy - and provides an agile development environment that has a small footprint, is easy to modify and is fast to re-start
Allows you to unleash and reuse enterprise content, including SOA services, as RESTful services. It extends the reach of SOA - effectively using the web as your SOA platform
Enables the rapid aggregation of disparate services and feeds and supports a broad array of Microsoft environments, bringing you the information you need quickly.
Is based on the highly-acclaimed public incubator and developer community, Project Zero. Visit www.projectzero.org to learn more and get involved.
The IBM Reliable Transport Extension for WebSphere sMash provides the additional capability for WebSphere sMash Version 1.1 applications to interact, using an asynchronous, reliable transport based on queues.
WebSphere sMash Developers Edition v1.1 is available for free download and limited deployment. It represents the stable version of WebSphere sMash plus browser-based tooling and an Eclipse plug-in, while the latest iterations of the tooling are available on www.projectzero.org. WebSphere sMash licenses are purchased when deploying it into production.

IBM WebSphere sMash Architecture for Web 2.0 application

2009-03-31T03:21:00.001-07:00

How to block IP addresses using .htaccess or .php

2009-03-31T03:14:00.000-07:00

1. Using .htaccess

If you want to block IP address using .htaccess file than just copy the below code and paste it in to your .htaccess file. You just need to change the IP address that you want to block. Replace 120.120.120.120 with the IP address that you want to block.

order deny,allow
allow from all
deny from 120.120.120.120

If you want to block series of IP address than just copy the below code and paste it in to your .htaccess file. And replace your IP address series. As per example given deny from 120.120.120 means it blocks 120.120.120.0 , 120.120.120.1 , .. , 120.120.120.255 IP addresses (means total 256 IP addresses).

order deny,allow
allow from all
deny from 120.120.120.

In some cases if you want to block bunch of IP address than just copy the below code and paste it in to your .htaccess file. And replace your IP address bunch as per yours . As per example given deny from 120.120.*. means it blocks 120.120.*.0 , 120.120.*.1 , .. , 120.120.255.255 IP addresses (means total 256 * 256 = 65536 IP addresses).

order deny,allow
allow from all
deny from 120.120.*.

2 . Using php file

If you don’t have .htaccess file access and want to block IP address using .php file than just copy the below code and paste it in to your .php file. You just need to change the IP address that you want to block. Replace 120.120.120.120 , 120.120.120.121 , 120.120.120.122 with the IP addresses that you want to block. You can define as many IP address as you want to block in an array declared below.

$block = array(”120.120.120.120″, “120.120.120.121″, “120.120.120.122″);
if (in_array ($_SERVER['REMOTE_ADDR'], $block))
{
header(”location: http://www.yoursite.com/404.php?error=notallow”);
exit();
}
?>

SubVersion setup on Linux

2009-03-30T10:55:00.000-07:00

Introduction
This howto is based on the Readme at/usr/share/doc/packages/subversion/README.SuSE, but extends it. The steps have been tested on Subversion 1.4.0, running on openSUSE 10.2.

Subversion is a versioning system, which allows you to store a development filetree in a "repository", keeps track of edits made to the files, and allows those edits to be rolled back if necessary.

The "SVN book" (Version Control with Subversion, Ben Collins-Sussman, Brian W. Fitzpatrick, C. Michael Pilato) is essential reading. The copy in /usr/share/doc/packages/subversion/html/book/svn-book.html is for Subversion 1.2. For 1.4 it is better to download the book from the website - substantial changes have been made, with a lot more information added. The book is rebuilt nightly.

[edit]
Subversion flavours
The simplest way to run Subversion on an individual PC is by using the file:// protocol to access the PC's filesystem. In most cases, however, you will want to allow access to the repository over the network. There are two options here - the svnserve protocol, or http://, using a webserver like Apache and the web-dav module.

svnserve should not run as root user. On openSUSE, the startup script rcsvnserve expects a user/group named svn, configureable via /etc/sysconfig/svnserve. But this user/group must be created first:

(su) groupadd -r svn; useradd -r -g svn -d /srv/svn -s /bin/false svn
However, since Apache is more flexible, the rest of this howto deals with that.

[edit]
Software installation
Ensure these packages are installed: apache2, apache2-doc, apache2-prefork, libapr1, libapr-util1, neon, subversion, subversion-server.

Update /etc/sysconfig/apache2 by adding dav and dav_svn to $APACHE_MODULES:

(su) a2enmod dav
(su) a2enmod dav_svn
[edit]
Configuration
The configuration suggested in /usr/share/doc/packages/subversion/README.SuSE sets up individual repositories for each filetree. But since each one requires its own section in the Apache configuration file (/etc/apache2/conf.d/subversion.conf), the edits can be tiresome if you have a significant number of repositories, or are adding or deleting them regularly. Instead, the approach here sets up one parent repository which will hold all the project repositories. (Note that this may raise security issues if you don't want people to know what project repositories you are hosting, so consider that.)

[edit]
Configure the parent repository
Using a text editor (nano in this case), run:

(su) nano /etc/apache2/conf.d/subversion.conf
and edit it to read as follows:

# Example configuration for a subversion repository
# see /usr/share/doc/packages/subversion for the full documentation

# Set up single repository directory 'kdrepos'
# This has open read access, but limited write (commit) access

DAV svn
SVNParentPath /srv/svn/kdrepos
# Allow the 'kdrepos' index page to list all the repositories it contains
SVNListParentPath On
# Limit write permission to list of valid users.

# Require SSL connection for password protection.
# SSLRequireSSL
AuthType Basic
# Message to give to the committer
AuthName "Write access requires a password"
# File listing users with write (commit) access
AuthUserFile /srv/svn/user_access/svn_passwdfile
Require valid-user

# Set up stricter conditions for one directory within the 'kdrepos' dir:
# 'secret_repo' has limited write access, and also limited read access.

Require valid-user

Without the SVNListParentPath directive, you cannot go to the repositories' index page - you will get the response:

Access forbidden!
You don't have permission to access the requested directory. There is either no index document or the directory is read-protected.
If you think this is a server error, please contact the webmaster.
Error 403
Thanks to this page for the secret_repo tip - this subdir will inherit the properties from the kderepos block, so we just need to tell Apache to require a valid user for anything, rather than for write access only.

Create the repository directory:

(su) mkdir -p /srv/svn/kdrepos
[edit]
Configure user access to the parent repository
Note that only one user password file is being used here. However, this could be adjusted by writing clauses on a per-directory basis, as with secret_repo above.

Set up the password file:

(su) mkdir /srv/svn/user_access
(su) touch /srv/svn/user_access/svn_passwdfile
Change the group so that Apache can access it:

(su) chown root:www /srv/svn/user_access/svn_passwdfile
Tighten the permissions:

(su) chmod 640 /srv/svn/user_access/svn_passwdfile
Add the users:

(su) htpasswd2 /srv/svn/user_access/svn_passwdfile your_user
and enter the password twice.

Restart Apache2:

(su) rcapache2 restart
You should now be able to access the parent repository by opening a browser and going to http://localhost/kdrepos, but of course nothing will be listed there.

[edit]
Set up a project repository
Create an svn dir for each project you want to import, and change its permissions:

(su) svnadmin create /srv/svn/kdrepos/meddaliadur
The next step depends on your subversion version, perform one or the other.

Subversion >=1.5 Subversion <1.5
chown -R wwwrun:www /srv/svn/kdrepos/meddaliadur/{db,locks}
chown wwwrun:www /srv/svn/kdrepos/meddaliadur/
chown -R wwwrun:www /srv/svn/kdrepos/meddaliadur/{dav,db,locks}
Here we are setting up a repository for a project called Meddaliadur

[edit]
First import
Import the new project:

svn import /path/to/meddaliadur/files http://localhost/kdrepos/meddaliadur -m "initial import"
and give your password when prompted.

Note that if you try to import before you have created the project repository directory, you will get the following error message:

svn: PROPFIND request failed on '/kdrepos/meddaliadur'
svn: Could not open the requested SVN filesystem
If you browse back to your parent repository, http://localhost/kdrepos, you should now see a link to the meddaliadur project repository, and clicking on it will give a new page with the files in the project.

[edit]
Check out a working copy
Move into the directory where you will be keeping a local working copy (maybe /public_html if you are doing web development), and checkout the versioned filetree:

cd ~/public_html
svn checkout http://localhost/kdrepos/meddaliadur
This will create the directory /public_html/meddaliadur, with a fresh version of the files from the Subversion repository.

Move into the new working copy, and run a few commands:

cd /meddaliadur
svn list --verbose # Review what files were checked out
svn info # Get summary information on this working copy
cat > info.txt # Try adding a new file to the working copy
This is a new file # Press Return, and then Ctrl-D to write this text to info.txt
cat info.txt # Review the new file
svn add info.txt # Let Subversion know that a new file has been created
You should get a response like:

A info.txt
svn commit info.txt # Commit the new file to the project repository
You should be asked for a commit message (see below), and then your password, and you should get a response like:

Adding info.txt
Transmitting file data .
Committed revision 2.

The above svn commit command does not include a commit message, which will inform other developers (and remind yourself) of what this new file or edit was intended to do. By default, Subversion opens an editor so that you can add a message. The default editor is the rather forbidding vi - if this opens and you don't have a clue how to use it, just type in:

:wq!
This will close the editor. You may find it easier to change the default editor for one you are more familiar with. To do this, open /home/your_user/.subversion/config and adjust the editor-cmd line. For instance, to use nano, the line should read:

editor-cmd = nano
To commit and add a message in one go, use:

svn commit info.txt -m "My first commit"
If other developers have added or edited files (or if you have done this on another PC on the LAN and want to update your working copy on this PC), run:

svn update

Top 10 Free PHP Captcha scripts

2009-03-30T10:39:00.000-07:00

1. reCAPTCHA
reCAPTCHA is a free service which helps prevent automated abuse of your site (such as comment spam or bogus registrations) by using a CAPTCHA to ensure that only humans perform certain actions.

2. Securimage
Securimage is an open-source free PHP CAPTCHA script for generating complex images and CAPTCHA codes to protect forms from spam and abuse. It can be easily added into existing forms on your website to provide protection from spam bots. It can run on most any webserver as long as you have PHP installed, and GD support within PHP. Securimage does everything from generate complicated CAPTCHA images to making sure the code the user entered was correct.

3. WebSpamProtect
WebSpamProtect allows you to instantly add verification image (CAPTCHA) to your web site and protect your forms against spam robots. In order to protect your web form, this system requires that you install a small piece of code onto your web page. The code requires that your web site support PHP, Perl, ASP or ASP.NET. Basic plan is free but you can buy a Premium, Advanced or Professional paln with a little expense.

4. Cryptographp
Cryptographp is a PHP script for generate captchas. Cryptographp limit the robots bombarding spams and automating the forms: spaces members subscriptions, guestbooks, forums... This script is free and does not use any database. It is compatible with PHP >= 4.3.0. Cryptographp also exists into plugins for WordPress, wpMu for WordPress, Symfony and Guppy.

5. CAPTCHA-Service
captchas.net provides CAPTCHA images and audio files you can use in html-forms. To use this technology, your web pages have to be generated dynamically in any programming language PHP, ASP, Perl, Python, JSP, Ruby.

6. WP Captcha-Free
WP Captcha-Free blocks comment spam by using a combination of time-based hash (a.k.a. Time Based Tokens, TBT) and JavaScript (AJAX). When a comment is posted the plugin validates a hash based on time (and some other parameters). Comments posted via automated means will not have a hash or will have an expired hash and will be rejected. Unlike using a captcha, this does not place any burden on the commenter.

7. ProtectWebForm
ProtectWebForm is a service to add CAPTCHA images and audio files on your website. You have to create an account, generate your CAPTCHA type with all the desired parameters and include it on your web pages.You can also use it on your Wordpress template with this plugin.

8. ProtectWebForm
OpenCaptcha is a simple web service which requires no special configurations or modules. Basic installation is cut-and-paste, and requires no ability to program image manipuation scripts. New fonts, image algorithms, and distortions applied weekly.

9. Form-to-email script protected by Captcha
This form-to-email script is intended to collect data from an HTML form and send it to a specified email address using a CAPTCHA script to stop spam. It works with any kind of HTML form and you can use it multiple times on your pages.

10. freeCap
freeCap is a GPL CAPTCHA script to stop spam. It has been used on any form on any kind of website. It does require some knowledge of PHP to install, though there are several captcha plugins for forum and blog software listed below.

Top 6 PHP Application security tips

2009-03-30T10:30:00.000-07:00

1. Never include, require, or otherwise open a file with a filename based on user input, without thoroughly checking it first.

Take the following example:

if(isset($page))
{
include($page);
}

Since there is no validation being done on $page, a malicious user could hypothetically call your script like this (assuming register_globals is set to ON):

script.php?page=/etc/passwd

Therefore causing your script to include the servers /etc/passwd file. When a non PHP file is include()'d or require()'d, it's displayed as HTML/Text, not parsed as PHP code.

On many PHP installations, the include() and require() functions can include remote files. If the malicious user were to call your script like this:

script.php?page=http://mysite.com/evilscript.php

He would be able to have evilscript.php output any PHP code that he or she wanted your script to execute. Imagine if the user sent code to delete content from your database or even send sensitive information directly to the browser.

Solution: validate the input. One method of validation would be to create a list of acceptable pages. If the input did not match any of those pages, an error could be displayed.

$pages = array('index.html', 'page2.html', 'page3.html');
if( in_array($page, $pages) )
{
include($page);
{
else
{
die("Nice Try.");
}

2. Be careful with eval()

Placing user-inputted values into the eval() function can be extremely dangerous. You essentially give the malicious user the ability to execute any command he or she wishes! You may envision the input coming from a drop-down menu of options you specify, but you user may decide to send input like this:

script.php?input=;passthru("cat /etc/paswd");

By putting his own code in that statement, the user could cause your program to output your server's complete /etc/passwd file.

Use eval() sparingly, and by all means, validate the input. It should only be used when absolutely necessary -- when there is dynamically generated PHP code. If you are using it to substitute template variables into a string or substitute user-inputted values, then you are using it for the wrong reason. Try sprintf() or a template system instead.

3. Be careful when using register_globals = ON

This has been a major issue since this feature was invented. It was originally designed to make programming in PHP easier (and that it did), but misuse of it often led to security holes. As of PHP 4.2.0, register_globals is set to OFF by default. It is recommended that you use the superglobals to deal with input ($_GET, $_POST, $_COOKIE, $_SESSION, etc).

For example, let us say that you had a variable that specified what page to include:

include($page);

but you intended $page to be defined in a config file or somewhere else in the script, and not to come as user input. In one instance you forgot to pre-define $page. If register_globals is set to ON, the malicious user can take over and define $page for you, by calling your script like this:

script.php?page=http://www.example.com/evilscript.php

I recommend you develop with register_globals set to OFF, and use the superglobals when accessing user input. In addition, you should always develop with full error reporting, which can be specified like this (at the top of your script):

error_reporting(E_ALL);

This way, you will receive a notice for every variable you try to call that was not previously defined. Yes, PHP does not require you to define variables so there may be notices that you can ignore, but this will help you to catch undefined variables that you did expect to come from input or other sources. In the previous example, when $page was referenced in the include() statement, PHP would issue a notice that $page was not defined.

Whether or not you want to use register_globals is up to you, but make sure you are aware of the advantages and disadvantages of it and how to remedy the possible security holes.

4. Never run unescaped queries

PHP has a feature, enabled by default, that automatically escapes (adds a backslash in front of) certain characters that come in from a GET, POST, or COOKIE. The single quote (') is one example of a character that is escaped automatically. This is done so that if you include input variables in your SQL queries, it will not treat single quotes as part of the query. Say your user entered $name from a form and you performed this query:

UPDATE users SET Name='$name' WHERE ID=1;

Normally, if they had entered $name with single quotes in them, they would be escaped, so MySQL would see this:

UPDATE users SET Name='Joe\'s' WHERE ID=1

so that the single quote entered into "Joe's" would not interfere with the query syntax.

In some situations, you may use stripslashes() on an input variable. If you put the variable into a query, make sure to use addslashes() or mysql_escape_string() to escape the single quotes before your run the query. Imagine if an unslashed query went in, and a malicious user had entered part of a query as their name!

UPDATE users SET Name='Joe',Admin='1' WHERE ID=1

On the input form, the user would have entered:

Joe',Admin='1

As their name, and since the single quotes were not escaped, he or she would be able to actually end the name definition, place in a comma, and set another variable called Admin!

The final query with input in blue would look like this:

UPDATE users SET Name='Joe',Admin='1' WHERE ID=1

In some configurations, magic_quotes_gpc (the feature that automatically adds slashes to all input) is actually set to OFF. You can use the function get_magic_quotes_gpc() to see if it's on or not (it returns true or false). If it returns false, simply use addslashes() to add slashes to all of the input (it is easiest if you use $_POST, $_GET, and $_COOKIE or $HTTP_POST_VARS, $HTTP_GET_VARS, and $HTTP_COOKIE_VARS, instead of globals because you could step through those arrays using a foreach() loop and add slashes to each one).

5. For protected areas, use sessions or validate the login every time.

There are some cases where programmers will only use some sort of login.php script to first validate their username and password (entered through a form), test if they're an administrative or valid user, and actually set a variable through a cookie, or even hide it as a hidden variable. Then in the code, they check to see if they have access like this:

if($admin)
{
// let them in
}
else
{
// kick them out
}

The above a code makes the fatal assumption that the $admin variable can only come from a cookie or input form that the malicious user has no control over. However, that is simply not the case. With register_globals enabled, injecting designed input into the $admin variable is as easy as calling the script like so:

script.php?admin=1

Furthermore, even if you use the superglobals $_COOKIE or $_POST, a malicious user can easily forge a cookie or create his own HTML form to post any information to your script.

There are two good solutions to this problem. One is on the same track as setting an $admin variable, but this time set $admin as a session variable. In this case, it is stored on the server and is much less likely to be forged. On subsequent calls to the same script, your user's previous session information will be available on the server, and you will be able to verify if the user is an administrator like so:

if( $_SESSION['admin'] )

The second solution is to only store their username and password in a cookie, and with every call to the script, validate the username and password and verify if the user is an administrator. You could have two functions -- one called validate_login($username,$password) that verified the user's login information, and one called is_admin($username) that queried the database to see if that username is an administrator. The code would be placed at the top of any protected script:

if( !validate_login( $_COOKIE['username'], $_COOKIE['password'] ) )
{
echo "Sorry, invalid login";
exit;
}

// the login is ok if we made it down here
if( !is_admin( $_COOKIE['username'] ) )
{
echo "Sorry, you do not have access to this section";
exit;
}

Personally I recommend using sessions, as the latter solution is not scalable.

6. If you don't want the file contents to be seen, give the file a .php extension.

It was common practice for awhile to name include files or library files with a .inc extension. Here's the problem: if a malicious user simply enter the .inc file into his browser, it will be displayed as plain text, not parsed as PHP. Even if the browser did not like the file type, an option to download it would most likely be given. Imagine if this file had your database login and password, or even more sensitive information.

This goes for any other extension other than .php (and a few others), so even a .conf or a .cfg file would not be safe.

The solution is to put a .php extension on the end of it. Since your include files or config files usually just define variables and/or functions and not really output anything, if your user were to load this, for example, into their browser:

http://yoursite.com/lib.inc.php

they would most likely be shown nothing at all, unless of your lib.inc.php outputs something. Either way, the file would be parsed as PHP instead of just displaying your code.

There are also some reports of people adding Apache directives that will deny access to .inc files; however, I do not recommend this because of the lack of portability. If you rely on .inc files and that Apache directive to deny access to them and one day you move your scripts to another server and forget to place the Apache directive in, you are wide open.

PHP Application security links

2009-03-30T10:27:00.001-07:00

Sending emails in PHP & email injection attacks:

- http://phpcamp.net/toolbar/sending-emails-in-php-email-injection-attacks

HTTP Authentication With PHP & htpasswd

- http://phpcamp.net/toolbar/http-authentication-with-php-htpasswd

Speed comparison of PHP functions

- http://phpcamp.net/toolbar/php-benchmark-comparision-of-functions-which-is-faster

PHPIDS - Web Application security Tool

2009-03-30T10:23:00.000-07:00

What kinds of attacks are detected by the PHPIDS

Currently the PHPIDS detects all sorts of XSS, SQL Injection, header injection, directory traversal, RFE/LFI, DoS and LDAP attacks. Through special conversion algorithms the PHPIDS is even able to detect heavily obfuscated attacks - this covers several charsets like UTF-7, entities of all forms - such as JavaScript Unicode, decimal- and hex-entities as well as comment obfuscation, obfuscation through concatenation, shell code and many other variants.

Furthermore the PHPIDS is able to detect yet unknown attack patterns with the PHPIDS Centrifuge component. This component does in depth string analysis and measurement and detects about 85% to 90% of all tested vectors given a minimum length of 25 characters.

What’s required to run the PHPIDS

You need at least PHP 5.1.2 to use all features of the PHPIDS. Depending on which kind of logging and caching you chose you might need a database that is able to work together with PDO. SimpleXML is required if you wish to use the XML based filter rules - if your system doesn’t provide SimpleXML you can use the fallback JSON based rules. A nice to have for the generic attack detection is Unicode support for the PCRE engine. The PHP packages shipped with current distributions should fulfill all requirements out-of-the-box.

How to install the PHPIDS?

Just download the package - unpack it in your application or include folder. For productive usage you only need the phpids-0.x/lib folder - it includes the filter rules and the PHPIDS core. By watching the examples in the phpids-0.x/docs/examples folder you should get good information on how to install the PHPIDS, perform logging and special configuring etc. You can also open this file directly in your browser when having the PHPIDS running inside a webroot. It’s configured to run out of the box.

How to use it in my application?

You can use the following code to include the PHPIDS and have access to the result object:

set_include_path(
get_include_path()
. PATH_SEPARATOR
. 'path/to/phpids/lib'
);

require_once 'IDS/Init.php';
$request = array(
'REQUEST' => $_REQUEST,
'GET' => $_GET,
'POST' => $_POST,
'COOKIE' => $_COOKIE
);
$init = IDS_Init::init('IDS/Config/Config.ini');
$ids = new IDS_Monitor($request, $init);
$result = $ids->run();

if (!$result->isEmpty()) {
// Take a look at the result object
echo $result;
}
Keep in mind that you might want to change the order of the arrays to merge if you don’t use the default variables_order EGPCS.

How to configure the PHPIDS

You can configure all important values in the Config/Config.ini. The settings should work out of the box most times but then and when you might want to tweak the paths or change the way of how the PHPIDS uses caching.

As mentioned before the example.php gives great advise in hard-configuring the PHPIDS if the Config.ini won’t work for you for whatever reasons. Just check the sources.

Filter/Storage/Abstract.php wasn’t found?

That’s a typical error when the PHPIDS is not located in the root of an include folder. You can just solve that problem with using the set_include_path() function. Point it to the folder the IDS folder is located in and everything should work fine.

How to work with the impact?

The impact indicates the severity of the attack. The PHPIDS brings around 50 filter rules to detect attacks and each one of them has an impact - the more rules match on the incoming data, the more likely it’s an attack and the higher ranks the resulting impact.

The impact can be received by using the $result->getImpact() on the result object.

You can store the impact as session value, if you want to track an attackers activity for some time and wish to react later - when session impact has risen to 50 or 100. A usual very first attack impact is around 5 - 10 - sometimes 15 -20. A typical XSS probing monitored by session based impact usually results in an impact of 50 - 150. So it’s pretty easy to separate the false alerts from the real attacks using session based impact.

What can be done in case the impact is very high?

There are several ways to react on high (around 15) or very high (around 25-50) impact - first and easiest would be a hard redirect - the suspicious user could be redirected to a warning page which tells him that the application considered his input malicious and asks him to stop. Meanwhile all important parameters of the user can be logged and used for forensics. Another effective way would be to destroy the users session.

Basically the PHPIDS leaves the choice on what to do up to you. If you found a smart way of defending your application in case of very high impact feel free to let other users know via our forum.

What about performance issues?

The PHPIDS is being developed under constant profiling with xdebug and performance measurements to make sure that your application will not become noticeably slower. Only request parameters are checked whose values inhabits characters besides a-Z, 0-9, @ and _.

Furthermore modules like the HTML parser are only included and used in case there is input coming in with a key matching the ones given in the Config.ini / via $monitor->setHtml() for content with HTML allowed. So the performance hungry components normally won’t be loaded during about 95% of all requests.

Why should use the MyISAM table?

2009-03-30T10:17:00.001-07:00

MyISAM is an ideal choice if you are new to MySQL, your web application is simple, has to be fast, or use full-text searches. However, it should not be used when data integrity is a priority. Possible applications could include content management systems, online bookmarking tools, RSS readers, or simple search engines.

Note that you can mix table types within the same database. In practice, it may cause less developer confusion if you stick with a single table type.

Pros and Cons of MySQL MyISAM Tables

2009-03-30T10:14:00.000-07:00

Pros:

1. Simplicity
MyISAM tables are simple. If you are new to MySQL or databases in general, I would recommend you start with MyISAM tables.

2. Speed
MySQL is fast. Really fast. Under normal conditions, benchmarks show that MyISAM tables beat every other general-purpose database and uses fewer system resources.

3. Full-text searching
Consider our table above. What if we need to search for keywords in both the title and the body? An easy solution is to add a fulltext index:

ALTER TABLE mysqltest.articles ADD FULLTEXT alltext (title, body);
We can now find all articles that feature the words “database” and/or “article” using:

SELECT * FROM mysqltest.articles
WHERE MATCH(title, body) AGAINST ('database article');

We can even order articles by the most relevant first to create a simple search engine:

SELECT *, MATCH(title, body) AGAINST ('database article') AS rel
FROM mysqltest.articles
ORDER BY rel DESC;

Cons:

1. Poor data integrity
MyISAM tables do not support transactions or foreign key constraints.

Consider a banking application where you are transferring money. This would typically involve two SQL UPDATE statements; a debit from one account and a credit to another. If MySQL or the server failed at the wrong point, you could end up with money in both accounts or neither.

2. Poor crash recovery
MySQL is reliable, but MyISAM tables can become corrupt following a crash. The problem can usually be fixed using REPAIR TABLE but it is an additional administrative overhead.

3. Table locking
MyISAM uses table-level locking. When a row is inserted or updated, all other changes to that table are held up until that request has been completed.

It is not always easy to prove whether this will cause problems for your web application but, in general, if you are performing more inserts/updates than selects, MyISAM may not be the best table type to choose.

Upload files in MySQL Table

2009-03-30T10:12:00.000-07:00

Using PHP to upload files into MySQL database sometimes needed by some web application. For instance for storing pdf documents or images to make som kind of online briefcase (like Yahoo briefcase).

For the first step, let's make the table for the upload files. The table will consist of.

id : Unique id for each file
name : File name
type : File content type
size : File size
content : The file itself

For column content we'll use BLOB data type. BLOB is a binary large object that can hold a variable amount of data. MySQL have four BLOB data types, they are :

TINYBLOB
BLOB
MEDIUMBLOB
LONGBLOB
Since BLOB is limited to store up to 64 kilobytes of data we will use MEDIUMBLOB so we can store larger files ( up to 16 megabytes ).

CREATE TABLE upload (
id INT NOT NULL AUTO_INCREMENT,
name VARCHAR(30) NOT NULL,
type VARCHAR(30) NOT NULL,
size INT NOT NULL,
content MEDIUMBLOB NOT NULL,
PRIMARY KEY(id)
);
Uploading a file to MySQL is a two step process. First you need to upload the file to the server then read the file and insert it to MySQL.

For uploading a file we need a form for the user to enter the file name or browse their computer and select a file. The input type="file" is used for that purpose.

<?php
if(isset($_POST['upload']) && $_FILES['userfile']['size'] > 0)
{
$fileName = $_FILES['userfile']['name'];
$tmpName = $_FILES['userfile']['tmp_name'];
$fileSize = $_FILES['userfile']['size'];
$fileType = $_FILES['userfile']['type'];

$fp = fopen($tmpName, 'r');
$content = fread($fp, filesize($tmpName));
$content = addslashes($content);
fclose($fp);

if(!get_magic_quotes_gpc())
{
$fileName = addslashes($fileName);
}
include 'library/config.php';
include 'library/opendb.php';

$query = "INSERT INTO upload (name, size, type, content ) ".
"VALUES ('$fileName', '$fileSize', '$fileType', '$content')";

mysql_query($query) or die('Error, query failed');
include 'library/closedb.php';

echo "
File $fileName uploaded
";
}
?>

Regular Expressions with Javascript

2009-03-30T10:03:00.000-07:00

A while ago, when I was just getting used to this insanely complicated stuff, I posted a brief introduction to the world of regular expressions. I’m glad to say that, since then, I have learnt a bunch more about them and how you can make use of them within JavaScript. So, here goes:

In JavaScript, there are four string operations that will accept a regular expression as an argument:

String.match(), - this method only accepts a regexp as the first argument. It’s usually used to extract specific parts of a string or to test whether a string matches a regular expression.

String.replace(), - this method accepts either a string or a regular expression as its first argument, and accepts either another string or a function as its second argument. It’s usually used to find and replace certain parts of a string.

String.split(), - this method accepts either a string or a regular expression as its first arguments, the second argument is used (rarely) to signify a limit for the split operation. It’s used to split a string into an array based on the regular expression and/or string passed as the first parameter.

String.search(), - this method accepts a regular expression as its first and only argument. It’s used to find the index of a regex match within a string.
The RegExp object has its own methods:

RegExp.exec(), - this method is exactly the same as the String.match() method, the only difference being that you pass the string as the argument and the method is run as a member of the regular expression that you’re using to search the string.

RegExp.test(), - this method is similar to the above exec, but instead of returning the match found it will return either true or false dependent on whether or not its found a match.

Correction: Luke pointed out in the comments that String.match and RegExp.exec are slightly different in that the latter will return capture groups plus the first match if a global flag is used, while the former (match) method won’t return any capture groups; only the full matches.

Because I know no better way to begin, let’s start with a basic example:

Validating user input
One of the most common uses for regular expressions on the client-side is validating user input. Let’s say we need to validate a product ID… We’ve had to leave it up to the user to type it in because there are over 5000 products. All product ID’s start with either the letter ‘M’ or ‘D’ followed by 4 or 5 digits and then an additional trailing letter to signify upgrades and variations. Validating such an input would be perfectly possible without using a single regular expression, as shown here:

JAVASCRIPT:HIDE CODE
var usersProductID = 'M5060i';

function isLetter(character) {
return ('abcdefghijklmnopqrstuvwxyz').indexOf(character.toLowerCase()) > -1;
}

function isValidKey(character) {
return ('md').indexOf(character.toLowerCase()) > -1;
}

var isValidProductID = (
isValidKey(usersProductID.substr(0,1))
&& (!isNaN(usersProductID.substr(1,4)) || !isNaN(usersProductID.substr(1,5)))
&& isLetter(usersProductID.substr(usersProductID.length-1))
);

alert (isValidProductID); // Boolean, true or false...

Now, with a regular expression:

JAVASCRIPT:HIDE CODE
var usersProductID = 'M5060i';

var isValidProductID = /^[md][0-9]{4,5}[a-z]$/i.test(usersProductID);
Hopefully the above example has demonstrated the necessity and importance of regular expressions in JavaScript (if you weren’t already convinced). Here’s a commented version of our regular expression:

JAVASCRIPT:HIDE CODE
^ - Matches the start of a string
[md] - Character class that matches 'm' or 'd'
[0-9] - Character class that matches any digit
{4,5} - Repeat last character ([0-9]) 4 OR 5 times
[a-z] - Character class that matches any letter
$ - Matches the end of a string
In JavaScript there are two ways of defining a regular expression, using its constructor, or literally:

JAVASCRIPT:HIDE CODE
// Constructor:
var myRegexp = new RegExp('^[md][0-9]{4,5}[a-z]$', 'i');
// Literal:
var myRegexp = /^[md][0-9]{4,5}[a-z]$/i;

The only situation in which you’d want to use the constructor would be when you need to add varying data to the regular expression. If it’s constant and does not change then stick with the RegExp literal (/regex goes here/)

The ‘i’ that you see is a flag. Flags are either passed as the second argument to the constructor or, if you’re using the literal syntax, they’re specified beyond the right-hand delimiter (forward slash) of the expression. The ‘i’ flag in particular means ‘ignore case’, so an ‘a’ in the regular expression will match both ‘a’ and ‘A’ in the string that’s being tested. The available flags include:

i, - “ignore case” - the case (uppercase/lowercase) of all letters within the string will be ignored during testing.
g, - “global search” - the search is carried out across the entire string, regardless of whether a match has already been found.
m, - “multiline search” - the regular expression will match over multiple lines.
String extraction

I couldn’t come up with a good name; “string extraction” seems suitable, although it sounds a bit dodgy if not in the context of programming. Anyway, back to the point: regular expressions are not only useful in validation; you can extract very precise pieces of information from string data. Let’s say, for example, we have to extract all numbers from a massive string and produce an array from them:

Since the String.match() method returns an array of all the matches this is incredibly easy:

JAVASCRIPT:HIDE CODE
var theString = 'Dr. Average has 78 patients, and only 12 of them think he\'s a good doctor!';
var allNumbers = theString.match(/\d+/g); // \d is just a shortcut to [0-9]

// allNumbers = [ 78, 12 ]
Notice that we’ve used the g (global) flag, without it we’d only get one match. The only problem with this is that it matches numbers in the middle of other words, like “foo299bar” - even though this might be a rare occurance it’s still important to take it into account. We can eliminate this problem by specifying, in our regular expression, that the digit characters should come straight after a word boundery, i.e. the position between a space and the start of a word (in regular expressions a word is anything that contains letters and/or digits):

JAVASCRIPT:HIDE CODE
var theString = 'Dr. Aver3age has 78 pa555tients, and only 12 of them thi6nk he\'s a good doctor!';
var allNumbers = theString.match(/\b\d+\b/g); // \b stands for boundary

// allNumbers = [ 78, 12 ]
Even though the string is full of words interspersed with numbers the resulting array still only has ‘78′ and ‘12′ in it; exactly what we’re after!
Extracting URLs from a string:

A more realistic application of this technique might be when searching for URLs within a string. URLs can contain a whole variety of characters and checking the validity of a URL is a huge task; our regular expression is going to be a “dumb” one because we haven’t got the time to study the intricacies of the URI specification. Here’s the string we’ve got to work with:

JAVASCRIPT:HIDE CODE
var theString = 'Hey! Please visit http://google.com and http://www.sitepoint.com';
The first thing we want to look for is ‘http://’ so that can be the start of our regular expression:

JAVASCRIPT:HIDE CODE
var urlRegex = /http:\/\//g;
Since forward slashes are used to delimit an expression we need to escape those which are to be taken literally (as actual characters). We can improve this by adding support for some other protocols:

JAVASCRIPT:HIDE CODE
var urlRegex = /(f|ht)tps?:\/\//g;
Now it supports http://, https://, ftp:// and ftps://. I think that’s enough to get us started…
Now, like I said, this is going to be a dumb regular expression and so it won’t be suitable for many situations. A more “intelligent” one would specify all valid characters in order. Next we want to look for a space, i.e. where the URL probably ends:

JAVASCRIPT:HIDE CODE
var urlRegex = /(f|ht)tps?:\/\/.+?\s/g;
I’ve just added .+?\s which translates to: “One or more of any character but as soon as a space is encountered, stop!”
If we try it as it currently stands here’s the result we could get:

JAVASCRIPT:HIDE CODE
theString.match(urlRegex); // [ "http://google.com " ]
So we’ve only matched the first URL. The second URL isn’t being matched because it’s at the end of the string and so there is no space (\s), we can test for this with the dollar symbol ($ will match if at the end of a string):
JAVASCRIPT:HIDE CODE
var urlRegex = /(f|ht)tps?:\/\/.+?(\s|$)/g; // matches \s OR $ at the end...

If we try it now, here’s what we get:

JAVASCRIPT:HIDE CODE
theString.match(urlRegex); // [ "http://google.com ", "http://sitepoint.com" ]

We can get rid of any trailing spaces using the ‘replace’ method:

JAVASCRIPT:HIDE CODE
var matches = theString.match(urlRegex);
for (var i = 0, len = matches.length; i < len; i++) {
matches[i].replace(/^\s+|\s+$/g, '');
}

// The above code will find and replace all spaces near
// the beginning and/or end of the string. (i.e. trimming)
Find & replace with style…
The most basic application of the ‘replace’ String operation is passing two strings, one will replace the other:

JAVASCRIPT:HIDE CODE
"I'm tired".replace('tired', 'sleeping'); // "I'm sleeping"
What’s cool about it is that you can also use regular expressions to search for the item you want to replace:

JAVASCRIPT:HIDE CODE
"I wonder how I can remove (these brackets)...".replace(/$(.+?)$/, '$1');
// Removes the brackets
You can reference groups using ‘$1′, ‘$2′, ‘$3′ etc. in the replacement string. Groups are specified in regular expressions using brackets. The above regular expression is easier to understand when laid out:

JAVASCRIPT:HIDE CODE
$ - Literal left bracket
(.+?) - Group containing any character
- '?' makes it non-greedy, so it will stop when
the next character is encounted...
$ - Literal right bracket
So, ‘$1′ in the replacement string is referencing all characters found between the brackets. In some circles these replacement keys ($1, $2 etc.) are known as “backreferences”.
Another incredibly useful thing about the ‘replace’ method is that you can pass a function as its second parameter; this function will be run each time a match is found within the string:

JAVASCRIPT:HIDE CODE
"-moz-border-radius".replace(/-\w/g, function(match){
return match.replace('-','').toUpperCase();
});
// Returns MozBorderRadius

// Made into a function:

function camelCaseCSS(property) {
return property.replace(/-\w/g, function(match){
// return match.replace('-','').toUpperCase(); // Old way
return match.charAt(1).toUpperCase(); // New way, suggested by Luke
});
}

What we’ve got is actually a pretty useful function that converts CSS property names to their DOM counterparts. E.g:

JAVASCRIPT:HIDE CODE
camelCaseCSS('background-color'); // => backgroundColor
camelCaseCSS('font-family'); // => fontFamily
camelCaseCSS('line-height'); // => lineHeight

Query Cacing machanism in mysqlnd

2009-03-30T10:00:00.000-07:00

I hope you know what mysqlnd is. If not, then.... mysqlnd is the replacement for libmysql in the PHP world. Starting from PHP 5.3 you might use mysqlnd to connect to your MySQL Server(s) without installing libmysql on your web servers/client hosts. mysqlnd also promises reduced memory usage compared to the scenario when libmysql is used and should be at least as quick as libmysql. To be able to beat libmysql and create incentives to let you migrate to mysqlnd we had brainstorming sessions. We came with a list of possible features.

Here is a short list
PS handle cache
Asynchronous mysql_query calls
Background fetching
Query caching

How to enable mod_rewrite module in apache?

2009-03-30T09:51:00.000-07:00

How to check weather mod_rewrite module is enabled or not?

Well there are lots of technique to check this but I’ll show you a very simple technique to check weather mod_rewrite module is enabled or not in you web server.
1) Type in a php file and save it and run that file in the server.
2) And now you can the list of information, just search the word “mod_rewrite” from the browser’s search menu
3) If it is found under the “Loaded Modules” section then this module is already loaded as you see in the picture below, otherwise you need to go to the next step for enabling mod_rewrite module.

How to enable mod_rewrite module in apache in xampp, wamp?
Now, I’ll show you how to enable how to mod_rewrite module in apache installed under windows environment.
1) Find the “httpd.conf” file under the “conf” folder inside the Apache’s installation folder.
2) Find the following line “#LoadModule rewrite_module modules/mod_rewrite.so” in the “httpd.conf” file.You can do this easily by searching the keyword “mod_rewrite” from find menu.
3) Remove the “#” at the starting of the line, “#” represents that line is commented.
4) Now restart the apache server.
5) You can see now “mod_rewrite” in the Loaded Module section while doing “phpinfo()”.

YAHOO Interview - Level 1

2009-03-30T09:48:00.000-07:00

Are you going to appear in YAHOO Interview? Here are something useful to you:

PHP
----
1. Differences between sessions and cookies
2. Disadvantage of sessions
3. How to upload file using Get method
4. What is the max size of post method
5. How to store sessions in database
6. "a_b_2_3__5_ 6_8_a_b_2_ 4" given as a string Explode it
using Underscrore and find out unique alphanumeric existences and
their no.of occurences
7. Explain DB.ini file configuration in PHP
8. Registar_globals
9. connect,pconnet differences
10. setting php configurations dynamically
11. Soap Vs Rest
12. Error handling when an object calls an function which is not
existing in class
13. Implementation of Destructors in PHP4
14. In php5, in a class
__construct( ) is one method and another method name same as class name
Which will be called when object is intialized
15. Writing Code snippet for Stack implementation using OOPs.

Javascript
-----------
1. OOPs(inheritence and polymorphism) implementation in Javascript
2. Implement Trim functionality in javascript
3. Explain different types of objects(Native ,Host and user Defined) in
javascript
4. Try to extend Trim() method on String object
5. Explain all parameters of Window.open( )
6. How to avoid Permission denied error when child window accesses
parent window's elements.
7. Enabling and disabling Client's cookie settings using javascript
8. Write code snippet for managing the size of text area so that it will
not get scrollbar
(with DOM and without DOM)

HTML
----
1. Span vs Div
2. InnerHTML explanation
3. Form tag properties while uploading file
4. Frames vs Iframes
5. W3standards
6. How do you implement Search engine optimization Using HTML

CSS
----
1. #txt and .txt diffences
2. Order of preference for differnt types of CSS(inline,external etc.)
3. How to avoid scrollbar for textarea

Database
---------
1. Explain SQL Query processing
2. Explain Analyze option
3. Getting 10 to 20 records in mysql
4. Query to alter the data type of a field
5. Backup and Restore of Mysql database
6. Mysql 4 vs Mysql 5
7. Normal Forms
8. Employee table(empid, name,deptid, sal)
Query to retrive the details of employees who are having sal more
than the average of their dept sal
9. Inner join Vs Outer Join
10. Unique key vs. Primary key
11. Triggers in Mysql

Linux
------
1. How to monitor currently running processes in linux/unix
2. How to send a process to background[Atleast Three commands]
3. How to change the priority of processes
4. How to see the lists of services running currently
5. How to stop an user to connection to linux with ssh
6. How to reset root password
7. Installing PHP,apache and Database
8. How do you add modules to php(like gdlibrary) in windows and linux
9. How to see the ip address of linux system as normal user
10. what are the tools you use for file upload and ssh connection for linux

Apache
------
1. Virtual hosting
2. How to run apache on 2 or more ports at a time
3. What is directory index
4. How do you control no.of connections to webserver through apache settings
5. What is the default port of apache

Cascading Style Sheets (CSS) Made Easy for Freshers

2009-03-30T09:44:00.000-07:00

Cascading Style Sheets (CSS for short) is a hot topic. However some people have been putting it off because of its wired name. Don't be fooled by the name, it's rather easy eventually. In this article, you'll see the simplicity of CSS and realize that making style changes to your web pages is not only quick and easy, but also fun.

Create a file named style.css, or whatever you want to name it with .css as extension. Upload the style.css file to your server.

Now, in the source HTML code of your web pages, put this line in the HEAD area:

< LINK REL="stylesheet" TYPE="text/css" HREF="style.css" >

That's all there is to it. Every page with the above line in the HEAD area will have it's style converted to what you specify in the style.css file. To change the style on all your web pages, simply edit the style.css file.

(You can also add the style sheet directly in the HEAD area of each page the style will be applied to.)

Now lets look at the style sheet code in the style.css file.

First, add in these three lines in style.css file:

BODY, TD, P, LI, {
font-family: arial;
}

Now, every page with the above style.css link in HEAD area will have it's font magically converted to "Arial". Is it fast;-)?

Okay, there may be just a bit more to it than that. If you currently have FONT tags specified in the source code of your web pages, you need to remove those so the CSS style can do its job.

The "font-family: arial;" line is a style element. Styles can have other elements like size and color, and some of those are addressed below. Each style element has two parts. The first part is called the "property" and the second part, the "value." The property is followed by a colon and the value is followed by a semi-colon. The property must be specified before the value, and they must appear together.

Like in standard HTML FONT tags, to control the exact font name to be used, with backups in case the one you specify isn't available on the user's computer, you can list the font names in order of preference, separated with a comma:

font-family: arial,helvetica,sans-serif;

Lets also specify the text size and color:

BODY, TD, P, LI, {
font-family: arial,helvetica,sans-serif;
font-size: 12px;
color: #000000;
}

The above specifies a font size of 12 pixels and text color of black. The color can be specified either as a hexadecimal number proceeded with a "#" character (like the example) or by a color name such as "black".

Once you upload the above style sheet, your pages will have black, 12 pixel sized text, Arial font. Change the color to

color: blue;

and suddenly all your text is blue. Change the size to

font-size: 55px;

and your text is huge.

Just one simple change in style.css changes every page that has the one-line tag in the HEAD area.

By now, you've probably been wondering about the

BODY, TD, P, LI, {

line in file style.css. That is a list of tags that the style will effect. In this case, it effects the BODY tag (which is everything in the page BODY that doesn't otherwise have a style), the TD tag (table data cell), and the P tag (paragraph).

Let's add another style for the H1 tag. Your style.css file should now have these lines:

BODY, TD, P, LI, {
font-family: arial,helvetica,sans-serif;
font-size: 14px;
color: #000000;
}

H1 {
font-size: 36px;
font-weight: bold;
text-align: center;
color: red;
}

The above will cause the H1 text to be 36 pixels in size, bold, centered, and colored red. The font face will be Arial because that's what's specified for BODY, and H1 didn't specify any different.

Once you upload style.css, all your web page's H1 text will be the specified style.

Your style.css file can contain specifications for any HTML tag. Yes, there is a lot more to be learned. Even with just this small amount of knowledge, however, you have the ability to specify the font attributes for any and all HTML tags that contain visible text - throughout your site. Except one.

The one exception is the anchor tag, often referred to as the "A" link tag. The A tag can have three different styles, one for each of it's states: link, active, and visited. To see how it works, change your style.css style sheet file so it has these thirty lines:

BODY, TD, P, LI, {
font-family: arial,helvetica,sans-serif;
font-size: 12px;
color: #000000;
}

H1 {
font-size: 36px;
font-weight: bold;
text-align: center;
color: red;
}

A:link {
color: blue;
font-weight: bold;
}

A:active {
text-decoration: underline;
}

A:visited {
color: purple;
font-style: italic;
text-decoration: line-through;
}

With the above, your linked text will be bold, colored blue. When the link is active (while it's being clicked on), it will be underlined. Once the linked page has been visited, the text will be italic and have a line through it, and the text color will be purple.

Another A tag style you may wish to utilize is "hover" style. This style becomes effective when the mouse cursor hovers above the linked text. The "hover" style works in IE 5+ and in Netscape 6+. The style has no effect for browsers that don't support "hover". Here is an example "hover" style:

A:hover {
text-decoration: none;
color: red;
font-size: 22px;
font-weight: bold;
}

The above causes any underlines or line-throughs to disappear, turns the linked text red, changes the text size to 22 pixels, and makes the text bold.

Some of the styles demonstrated in the examples cause dramatic effects. They serve to demonstrate possibilities. Your actual implementation will probably be more pleasant to the eyes.

Alternate PHP exec() function tp bypass the cmd.exe

2009-03-30T09:41:00.000-07:00

I had a problem running executables (like identify.exe and convert.exe from ImageMagick) from php under windows using the exec() funciton. The solution provided by others was kind off stupid... Give full permisions on cmd.exe to IURS... Like you wanna do that.....
I wrote a exec() replacement function using the bypass_shell option proc_open has. It works great for me. Do your favour with it.

<?php

function executeCommand($cmd) {

if(DEBUG === true) {
echo "Command: ".$cmd;
echo "
";
echo "Tempdir: ".TEMP_DIR;
echo "
";
}

$descriptorspec = array(
0 => array("pipe", "r"),
1 => array("pipe", "w"),
2 => array("pipe", "w")
);

$process = proc_open(
$cmd,
$descriptorspec,
$pipes,
TEMP_DIR,
NULL,
array('bypass_shell' => TRUE)
);

if(!is_resource($process)) {
return false;
}

if(!$pipes[1]) {
if(DEBUG === true) {
echo "No STDOUT
";
}
return false;
}
$output = stream_get_contents($pipes[1]);
fclose($pipes[1]);
$err = stream_get_contents($pipes[2]);
fclose($pipes[2]);

$x = proc_get_status($process);

$return_value = proc_close($process);

if($return_value == 0) {
if(DEBUG === true) {
echo "Return value {$return_value}
";
print_r($x);
echo "

";
}
return explode("\n", str_replace("\r", '', $output));
} else {
if(DEBUG === true) {
echo "Return value {$return_value}
";
print_r($x);
echo "Output: ".$output;
echo "Error: ".$err;
echo "

";
}
return false;
}

}
?>

Top 10 PHP Frameworks

2009-03-30T09:39:00.000-07:00

This is the top ten PHP frameworks that based on MVC design pattern.

1. Yii

Yii is a component-based high-performance PHP framework for developing large-scale Web applications. Yii is written in strict OOP and comes with thorough class reference and comprehensive tutorials. From MVC, DAO/ActiveRecord, widgets, caching, hierarchical RBAC, Web services, to theming, I18N and L10N, Yii provides nearly every feature needed by today’s Web 2.0 application development. And all these come without incurring much overhead. As a matter of fact, Yii is one of the most efficient PHP frameworks around.

2. CodeIgniter

CodeIgniter is an Application Development Framework - a toolkit - for people who build web sites using PHP. Its goal is to enable you to develop projects much faster than you could if you were writing code from scratch, by providing a rich set of libraries for commonly needed tasks, as well as a simple interface and logical structure to access these libraries. CodeIgniter lets you creatively focus on your project by minimizing the amount of code needed for a given task.

3. CakePHP

CakePHP is a rapid development framework for PHP which uses commonly known design patterns like ActiveRecord, Association Data Mapping, Front Controller and MVC. Our primary goal is to provide a structured framework that enables PHP users at all levels to rapidly develop robust web applications, without any loss to flexibility.

4. PHPDevShell

PHPDevShell is an Open Source (GNU/LGPL) Rapid Application Development framework written using only PHP with no Javascript and comes with a complete GUI admin interface. It is aimed at developing admin based applications as plugins, where speed, security, stability and flexibility are essentials. It is designed to have a very easy learning curve without complicated new terms to learn. The need for a light, fully functional GUI with limitless configuration brought forward PHPDevShell. We strive to keep direction and focus in our development according to our moto.

5. Akelos

The Akelos PHP Framework is a web application development platform based on the MVC (Model View Controller) design pattern. Based on good practices, it allows you to:

Write views using Ajax easily
Control requests and responses through a controller
Manage internationalized applications
Communicate models and the database using simple conventions.
Your Akelos based applications can run on most shared hosting service providers since Akelos only requires that PHP be available at the server. This means that the Akelos PHP Framework is the ideal candidate for distributing standalone web applications as it does not require any non-standard PHP configuration to run.

6. Symfony

Symfony is a web application framework for PHP5 projects.

It aims to speed up the creation and maintenance of web applications, and to replace the repetitive coding tasks by power, control and pleasure.

The very small number of prerequisites make symfony easy to install on any configuration; you just need Unix or Windows with a web server and PHP 5 installed. It is compatible with almost every database system. In addition, it has a very small overhead, so the benefits of the framework don’t come at the cost of an increase of hosting costs.

Using symfony is so natural and easy for people used to PHP and the design patterns of Internet applications that the learning curve is reduced to less than a day. The clean design and code readability will keep your delays short. Developers can apply agile development principles (such as DRY, KISS or the XP philosophy) and focus on applicative logic without losing time to write endless XML configuration files.

Symfony is aimed at building robust applications in an enterprise context. This means that you have full control over the configuration: from the directory structure to the foreign libraries, almost everything can be customized. To match your enterprise’s development guidelines, symfony is bundled with additional tools helping you to test, debug and document your project.

7. Prado

The PRADO group is a team of PRADO enthusiasts who develop and promote the PRADO framework and the related projects.

Team Members

Qiang Xue - founder of PRADO framework, core development
Xiang Wei Zhuo - core development (javascripts, active controls, DB controls, tests)
Jason Ragsdale - site and forum administration
Knut Urdalen - test, marketing
Carl G. Mathisen - design and document comment system
Christophe Boulain - component development, test
Michael Hartl - component development, test
Eirik Hoem - core development
Yves Berkholz - core development
Past Team Members

Alex Flint, Brian Luft, John Teague, Todd Patrick, Pim van der Zwet, Tim Evans, Alban Hanry, Marcus Nyeholt

History of PRADO

The very original inspiration of PRADO came from Apache Tapestry. During the design and implementation, I borrowed many ideas from Borland Delphi and Microsoft ASP.NET. The first version of PRADO came out in June 2004 and was written in PHP 4. Driven by the Zend PHP 5 coding contest, I rewrote PRADO in PHP 5, which proved to be a wise move, thanks to the new object model provided by PHP 5. PRADO won the grand prize in the Zend contest, earning high votes both from the public and from the judges’ panel.

In August 2004, PRADO was hosted on SourceForge as an open source project. Soon after, the project site xisc.com was announced to public. With the fantastic support of PRADO developer team and PRADO users, PRADO evolved to version 2.0 in mid 2005. In this version, Wei Zhuo contributed to PRADO with the excellent I18 and L10N support.

In May 2005, we decided to completely rewrite the PRADO framework to resolve a few fundamental issues found in version 2.0 and to catch up with some cool features available in Microsoft ASP.NET 2.0. After nearly a year’s hard work with over 50,000 lines of new code, version 3.0 was finally made available in April 2006.

Starting from version 3.0, significant efforts are allocated to ensure the quality and stability of PRADO. If we say PRADO v2.x and v1.x are proof-of-concept work, we can say PRADO 3.x has grown up to a serious project that is suitable for business application development.

8. Zend

Extending the art & spirit of PHP, Zend Framework is based on simplicity, object-oriented best practices, corporate friendly licensing, and a rigorously tested agile codebase. Zend Framework is focused on building more secure, reliable, and modern Web 2.0 applications & web services, and consuming widely available APIs from leading vendors like Google, Amazon, Yahoo!, Flickr, as well as API providers and cataloguers like StrikeIron and ProgrammableWeb.
Expanding on these core themes, we have implemented Zend Framework to embody extreme simplicity & productivity, the latest Web 2.0 features, simple corporate-friendly licensing, and an agile well-tested code base that your enterprise can depend upon.

9. ZooP

The Zoop Object Oriented Php Framework (The Zoop PHP Framework for short). A framework written in and for php.

The Zoop PHP Framework is stable, scalable and portable. It has been in production use for the last 5 years and has been used in many production environments. The Zoop PHP Framework is designed to be fast, efficient and clean. It is easily extendable and you choose to include only the functionality you use.

With Zoop an inexperienced coder can make secure web applications quickly. A more experienced coder will really appreciate how flexible The Zoop PHP Framework is. Both experienced and inexperienced coders alike will appreciate the automations that are at his/her disposal to handle mundane tasks.

The Zoop PHP Framework encourages separation of display, logic and data layers(MVC).

The Zoop PHP Framework is made up of many components and integrates many different projects including smarty (http://smarty.php.net) and the prototype AJAX framework. It also makes use of PEAR modules (http://pear.php.net). The efficient core components handle many of the functions you would have to code yourselves. Zoop’s integrated error handling can be configured to log errors for production environments, and is highly informative and readable which makes bugs easy to find and squash.

Zoop has been designed to make the developers life easier by providing tools to make efficient use of his/her time. On of our more unique and notable features is our implementation of GuiControls, a revolutionary idea in PHP that provides many form widgets with validation completely integrated, as well as a framework to develop your own guiControls extremely easily.

10. QPHP

QPHP stands for Quick PHP and is a MVC framework similar as architecture to ASP.NET.
I, as the author of the project, have spent the last 8 years working on web projects using various Java frameworks, ASP.NET and PHP. This framework tries to get the best of the above platforms as well as to avoid the problematic parts. Basically it:

Brings the elegance of Java and C#
Drops all Perl like bizzare statements that other PHP frameworks use
Relies extensively on OOP concepts
Code-behind approach is used, so every webpage consists of 2 files:

.PHP - presentation logic
.PHP.SCRIPT - business/programming logic

FACTS ABOUT QPHP

Less than 70 classes
Less than 300K in size
3 years of internal use
Works with PHP4/PHP5
Easy database access
Fast and stable
Event driven, component based
AJAX compatible
I18N support
View/Session/Application states
Simple input validation
5 menu controls

10 Web Analytics Tools For Tracking Your Visitors

2009-03-30T09:37:00.000-07:00

1. AWStats

AWStats comes pre-installed by many web hosting companies. Additionally, if you’re setting up your own servers, you can download it for your personal use. AWStats goes deeper into the referring sites’ information than most analytics packages, and is a perfect tool for monitoring whether someone is hotlinking files from your site. Besides being a great detective tool for bandwidth thieves, it offers all of the usual useful tools that you might expect from a statistics package.

2. eLogic

eLogic provides three levels of service based on your exact needs. If you need to track only one or two pages, they offer a stat counter that just offers you the most basic of reports. Their Webstats BASIC package is also free, but gives you more the usual tools you expect like referring sites, a history, demographics, and more. Finally if you’re a business or a larger site, you may sign up for their subscription program, Webstats PRO, that will give you a full history and more extensive tools.

3. Google Analytics

Google Analytics is arguably the most popular analytics package available for individual site owners. Google Analytics (or plain old “GA”) allows you to dig down deep into your stats to see breakdowns of individual regions, states/provinces, cities and numerous other items to better identify your site visitors. The wealth of data available is admirably balanced by a well-executed user interface, but it can still be overwhelming. The package integrates with AdWords and has ecommerce-specific tools to track sales.

4. ShinyStat

ShinyStat was initially designed to monitor visits to Italian web sites. Now it is available to sites all over the world, and offers software packages for the individual user, the professional user who needs to track marketing, and a business owner who needs to monitor sales and ROI. There is also a level of service for ISPs to install and include with their hosting accounts.

5. SiteMeter

SiteMeter has a free version for smaller bloggers with up to 100,000 monthly visitors that offers all of the usual tools a webmaster can expect such as tracking referrals, visit durations and so on. If you are launching a larger site and need more tools, there is a paid version based on your volume of visitors.

6. StatCounter

StatCounter might have a rather plain interface, but it deftly handles multi-author blogs, allowing you to easily assign unique codes to each author. While it is free and does work, you have to click on a link to see each analytic result on a separate page. Despite its unpolished looks, the site does offer you clearly readable stats on things such as keywords, traffic sources, and other useful information.

7. W3Counter

W3Counter comes in a free and paid version. With a free W3Counter account, you can track up to 5,000 page views a day across 10 websites and see all of the usual stats. In addition, you get a bonus that you can share your stats with anyone you like via widgets for your blog or an API that lets you build new tools. For sites with higher traffic, you can go for the Pro account that allows you to track up to 1 million views a month.

8. W3Perl

W3Perl differs from other analytics packages in that it doesn’t just measure web traffic, but also can parse the log files of email and RSS to measure just about anything you choose. You can set up the administration interface for web access and gain real-time stats from there.

9. Webalizer

Webalizer is written in C, which means that it is extremely fast and portable, and is a favorite choice of people who host their own servers. Many web hosts have this analytics package pre-installed for your use inside of their control panel. Webalizer doesn’t allow you to dive terribly in-depth into your data like some other packages, but it provides an excellent overview.

10. Woopra

Woopra is currently in a closed beta test, but it offers you a wealth of data for those who can get in. Real-time data are streamed from your site that appear on a map letting you graphically see where readers are coming from, what keywords brought them in, and referring sites. Woopra offers you a unique ability to open up a chat window with visitors of your choice as they browse your site. An unusual feature of this service is that the data is presented to you in a desktop application. WordPress users can install a plugin that lets them see this data in the dashboard of their blog.

There are no doubt other excellent site analytic packages out there. Which is your favorite? Let us know in the comments.

How to become a ZCE (Zend Certified Engineer)

2009-03-30T09:25:00.000-07:00

Three Steps to become ZCE:

Prepare for the Exam

Zend Framework Certification Study Guide
Zend Framework Certification Training Course
Zend PHP 5 Certification Training Course
Zend PHP 5 Certification Study Materials

Take the Exam
Purchasing the Exam
Scheduling an Exam

After the Exam
Zend PHP Yellow Pages
Zend Certfication Logos
Join the Linked in Group

If anybody interested, post a comment with your email address to get ZCE preparation kit.

Benefits for Zend Certification

2009-03-30T09:24:00.001-07:00

Career Rewards
Differentiate yourself from competitors when looking for a new job
Boost your value at your annual salary review
Get your resume/CV noticed
Gain recognition from your employer
Have your profile displayed in Zend's Yellow Pages for PHP Professionals
Join the Linkedin Group Exclusively for ZCE's

Personal Rewards
Be recognized as a proud and dedicated supporter of PHP
Show your commitment to the spread and growth of PHP
Help the community prove that PHP is reliable, stable and dependable

Rewards from Zend
Be listed in Zend's PHP Yellow Pages
Used by employers and recruiters to find top PHP developers worldwide
Personalize your listing by uploading your photo, inputting your company information, CV details
Get special discounts on Zend PHP conferences worldwide

PHP - Zend Certification

2009-03-30T09:22:00.000-07:00

Zend Certifications set the industry standard for PHP certifications, recognizing outstanding expertise and delivering a measure of distinction for PHP 5 and Zend Framework developers. Utilizing exam topics specified by a neutral board of top PHP experts and community members worldwide, the Zend PHP 5 Certification and Zend Framework Certification ensure Zend Certified Engineers a clear advantage.

Certifications that employers value
Because the exam is created with specific skills, knowledge and competencies that are matched to real-world job functions, Zend Certifications provide a measure of technical distinction that employers use to evaluate prospective employees.

“Becoming a certified expert brings many benefits to the engineer, to the company, and its clients,” “The ZCE Certification demonstrates that the development team keeps in step with the latest PHP technology. And it helps to show our customers and prospects that we have highly qualified PHP developers where it matters most of all - their critical projects.” Dmitry Karpovich, Oxagile CEO.

Certifications that meet the standards of accreditation
Sponsored by Zend and developed according to American National Standards Institute (ANSI) standards, Zend Certification programs are designed to test a candidate’s level of knowledge without prejudice to other technologies. The tests use a set of testing questions that reflect real-world scenarios, including knowledge in many areas ranging from basics to the more complex topics.

Exams
Zend Framework Certification
PHP 5 Certification

How to start Linux cron daemon?

2009-03-30T03:36:00.000-07:00

These are the following steps to start a cron daemon on Linux environment:

1: shell> cd /etc/init.d
2: shell> ./cron

How to schedule a Cron job in Linux enviornment?

2009-03-30T03:34:00.000-07:00

cron is a Linux system process that will execute a program at a preset time. To use cron you must prepare a text file that describes the program that you want executed and the times that cron should execute them. Then you use the crontab program to load the text file that describes the cron jobs into cron.

Here is the format of a cron job file:

[min] [hour] [day of month] [month] [day of week] [program to be run]

where each field is defined as
[min] Minutes that program should be executed on. 0-59. Do not set as * or the program will be run once a minute.
[hour] Hour that program should be executed on. 0-23. * for every hour.
[day of month] Day of the month that process should be executed on. 1-31. * for every day.
[month] Month that program whould be executed on. 1-12 * for every month.
[day of week] Day of the week. 0-6 where Sunday = 0, Monday = 1, ...., Saturday = 6. * for every day of the week.
[program] Program to be executed. Include full path information.

Here are some examples:

0,15,30,45 * * * * /usr/bin/foo

Will run /usr/bin/foo every 15 minutes on every hour, day-of-month, month, and day-of-week. In other words, it will run every 15 minutes for as long as the machine it running.

10 3 * * * /usr/bin/foo

Will run /usr/bin/foo at 3:10am on every day.

10 * 1 * * /usr/bin/foo

Will run /usr/bin/foo at 12:10am on the first day of the month.

10 * * 1 * /usr/bin/foo

Will run /usr/bin/foo at 12:10am on the first month of the year.

10 14 * * 1 /usr/bin/foo

Will run /usr/bin/foo at 2:10pm on every Monday.

There are more options for these. See man man crontab -S 5.

You must use crontab to load cron jobs into cron. First create a text file that uses the above rule to describe the cron job that you want to load into cron. But before you load it, type crontab -l to list any jobs that are currently loaded in crontab.

If none are listed, then it is safe to load your job. Example. If you wanted to run /usr/local/bin/foo once a day at 3:10am, then create a text file

10 3 * * * /usr/bin/foo

Save it as foo.cron. Then type crontab foo.cron. Check to see if it was loaded by typing crontab -l. It should display something like this:

# DO NOT EDIT THIS FILE - edit the master and reinstall.
# (ipwatch.cron installed on Thu Nov 18 11:48:02 1999)
# (Cron version -- $Id: crontab.c,v 2.13 1994/01/17 03:20:37 vixie Exp $)
10 3 * * * /usr/bin/foo

If you want to edit the cron job, then edit foo.cron and then remove the existing cron job (crontab -r) and load it again (crontab foo.cron). You can have multiple jobs. Just put each different one on a seperate line in foo.cron.

contab jobs will run under the user that was in effect when you loaded the job in crontab.

See man cron, man crontab and man crontab -S 5 for more information.

How to Zip/Unzip files in Linux CLI?

2009-03-30T03:31:00.001-07:00

To zip a file or folder:

tar -cvf filename.tar directory/file

To Unzip a file or folder:

tar -xvf filename.tar

How to execute SQL file from MySQL CLI?

2009-03-30T03:26:00.000-07:00

mysql -h <hostname> -u <usernam> -p <password> <dbname> < "<sql_file_path>"

Symfony - A Sample Application

2009-03-30T02:58:00.000-07:00

By following the steps below, a developer will be able to create the “Hello World” PHI Component. For this example, the “Hello World” component will be an Application Component so its base directory will be $APP_BASE .

1. Create the “Hello World” Controller file in the $APP_BASE/templates/helloWorldComponent.class.php which contains the following code:

class helloWorldComponent extends sfComponents

{

/**

* Executes contacts component

* @param sfRequest $request A request object

public function execute( $request )

{

/***

* Set the data for the component by defining the $componentLoc->componentData

* as shown below

$componentLoc = $this->pgModel->getComponentLocation("helloWorld");

$componentLoc->componentData = 'Hello World';

}

2. Create the default Component View file in the $APP_BASE/actions/_helloWorld.php with the following code.

componentData ?>

3. Define the “Hello World” component Module Mapping. Add the following line to the $COMPONENT_MODULE_MAP array in the $PHI_HOME/main/lib/componentModuleMap.class.php file.

‘helloWorld’ => ‘app’

4. Create the “helloworld.php” Web Page in the $PHI_HOME/web directory. Add the following code to create a “2Col” Layout which has the “Hello World” component in the second column.

$pgModel->layout= ‘1Col’;

$pgModel->addComponentLocation('helloWorld','body',2,1);

Open a browser and goto http://localhost/web/helloworld.html to view your component.

Symfony - An Introduction

2009-03-30T02:41:00.000-07:00

There are two types of component in the PHI Framework:

· Application Components - Component which will be used to build the application. Some examples are My Files, Contacts, Send File, Account Usage, etc.

· Framework Components - the set of components which are used to build the web site. This includes such components as the Banner, Header, Footer, LeftNav, TopNav, etc.

Symfony directory structure:

$SYMFONY_HOME/apps/main/modules/app - base directory for Application Components. This directory will be referred to as the $APP_BASE directory.

$SYMFONY_HOME/apps/main/modules/framework – base directory for Framework Components. This directory will be referred to as the $FRAMEWORK_BASE directory.

Symfony Components:

A Symfony Component (both Application and Framework) consist of a Controller file, one or more View files, and one or more optional Action files. The Application Components View Files are located in the $APP_BASE/templates directory, while it Controller and Action files are located in $APP_BASE/actions. Similarly, the Framework Component View files are stored in $FRAMEWORK_BASE/templates, and The Controller and Action Files are in the $APP_BASE/actions directory.

1. Component View

A Component View contains the HTML markup and JavaScript to create the user interface. Each component has a main view called _{componentName}.php . Additional views can be defined by creating a file called _{componentName}{viewName}.php.

2. Component Controller

The Component’s Controller file contains the business logic (interactions with the SU2 web services) for the component. This file has the following naming convension _{componentName}Component.class.php (Note the “_” must be the first character).

Quick Links to FusionCharts Resources & Demos

2009-03-30T02:39:00.001-07:00

FusionCharts Website: www.fusioncharts.com
Product Overview: www.fusioncharts.com/Overview.asp
Feature Tour: www.fusioncharts.com/Tour.asp

Online Demos: www.fusioncharts.com/LiveDemos.asp
FusionCharts BluePrint Application: www.fusioncharts.com/Demos/Blueprint/
Chart Gallery: www.fusioncharts.com/Gallery.asp

Online Forums: www.fusioncharts.com/forum
Knowledge Base: www.fusioncharts.com/KB

Fusion Chart - Create your first application

2009-03-30T02:22:00.001-07:00

Creating your First Chart

Here, we'll guide you through the process
of creating your first chart. For a head start, we'll create a simple
3D Column Chart to visually depict Monthly Sales Summary.

To create any chart using FusionCharts, you need to assemble three things:

SWF File for the chart that you want to create. We
want to create a 3D Column Chart, whose SWF file is named
as Column3D.swf. All the chart SWF files
are present in Download Package >
Charts folder.

XML Data File. FusionCharts accepts data only in
a pre-defined XML format. So, you'll need to convert your data to XML
format - either using a server side scripting language or manually.

HTML Wrapper File. This HTML file would contain the
code to embed the chart.

Before we get on to assemble the above items, let's create a new folder
that will serve as our playground for our trials and researches. Create
a new folder named as c:\FusionCharts on
your computer. We'll keep all our examples within this folder.

For our first chart example, we'll create another folder within the above
folder. Name the new folder as MyFirstChart
so that the structure now looks like c:\FusionCharts\MyFirstChart.

All examples discussed in the documentation
are present in Download Package under Code
folder.
Setting the Chart SWF

Now, to build the chart, we need to copy
chart SWF files within this folder. Before that, create another folder
FusionCharts under c:\FusionCharts,
so that the new folder looks like c:\FusionCharts\FusionCharts.
This folder would be our container for all the chart SWF files.

Copy all the chart SWF files (from Download Package > Charts
folder) into this newly created folder (c:\FusionCharts\FusionCharts\).

This folder serves as the central location for charts. All our examples
would use the charts contained in this single folder.

Even when you're using FusionCharts
on your website, it's a good idea to keep all the chart SWF files in a root
level folder named as FusionCharts. This
makes sure that you do not have multiple copies of the same chart SWF. So,
updates of charts become easier, as you just have to copy-paste the new
charts at one location.

Now that the SWF files are set up, we move on to see how to create the
XML data for our chart.

Creating the XML data document

Before we build the chart, we first need
to have the data that we'll represent on the chart. Since we're plotting
monthly sales summary for a given year, our data in tabular form would
look something like below. Each month given below would be represented
on the chart as a 3D column.

Month	Net Revenue
January	$17400
February	$19800
March	$21800
April	$23800
May	$29600
June	$27600
July	$31800
August	$39700
September	$37800
October	$21900
November	$32900
December	$39800

Now, as earlier mentioned, FusionCharts necessarily
needs its data in pre-defined XML format. It cannot read
any other format (including Excel, CSV or text data) apart from XML. So,
we need to convert this data into XML.

You can use the visual XML Generator Utility to convert this tabular data into XML. That is explained in "Guide for General Users" section.

The converted XML data would look
as under:

Punch the above code in a text editor (e.g.,
Notepad) and save it as Data.xml under
c:\FusionCharts\MyFirstChart folder.

And yeah - don't worry about whatever spaghetti stuff you have just written
- we'll soon cover them. Basically, what we've done above can be listed
in the following points:

We've created the root <chart>
element, with a few attributes to define captions, axis names and number
prefix character, to consist everything.

For each data row, we've created a <set>
element. label attribute of this element
represents the month name and value
attribute represents the data that we want to plot.

Just as a measure to check if the XML document is structurally valid,
open the file in your browser. You should be able to see the XML data
document in a formatted way, without any errors.

And now, if you're running out of your patience to see this data in chart
format, let's quickly build the HTML container for this chart.

Creating the HTML container for chartEach chart needs to be embedded in an HTML file
before it can be viewed. So, to view our chart, we'll have to create an
HTML wrapper for this one too. Pull up your text editor again and throw
in the following code:<html>
<head>

<title>My First FusionCharts</title>

</head>
<body bgcolor="#ffffff">

<object classid="clsid:d27cdb6e-ae6d-11cf-96b8-444553540000"
codebase="http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=8,0,0,0"
width="900" height="300" id="Column3D" >

<param name="movie"
value="../FusionCharts/Column3D.swf" />

<param name="FlashVars"
value="&dataURL=Data.xml">

<param name="quality"
value="high" />

<embed src="../FusionCharts/Column3D.swf"
flashVars="&dataURL=Data.xml" quality="high" width="900"
height="300" name="Column3D" type="application/x-shockwave-flash"
pluginspage="http://www.macromedia.com/go/getflashplayer" />

</object>
</body>

</html>Save this file as Chart.html
under MyFirstChart folder.

The code in
bold above is the actual code that you need to place
in your page to embed a FusionCharts chart.

In the above code, we've

used <OBJECT>
and <EMBED> tags to embed the
3D Column Chart (Column3D.swf) within
the HTML page.

used &dataUrl=Data.xml under FlashVars
parameter to indicate the source of data to chart – Data.xml
in this case. This method of indicating data is referred to as dataURL
method of providing data.

specified chart width as 900 and chart height as 300.

To display a Flash movie correctly
in a browser, HTML page should contain specific tags that specify the
Flash movie file to be opened and played. There are two tags which are
intended for it: <OBJECT> and
<EMBED> tags.

These two tags are required to display a Flash movie in different Internet
browsers properly. The <OBJECT>
tag is used by Internet Explorer under Microsoft Windows and the
<EMBED> tag is used by Netscape Navigator under Microsoft
Windows or Mac OS. Each of these two tags acts in the same way, however
using only one tag may cause incompatibility of one of the browsers. To
ensure that most browsers will play your Flash movies, you should place
the <EMBED> tag nested within the
<OBJECT> tag as shown in the example.
ActiveX-enabled browsers will ignore the <EMBED>
tag inside the <OBJECT> tag. Netscape
and old Microsoft browsers will not recognize the <OBJECT>
tag and will use only the <EMBED>
tag to load the Macromedia Flash Player.

And, it's now time to fructify the efforts that
you have put into creating your first chart. Open Chart.html
in your preferred browser. You should now see a chart like this (image below
has been resized - actual chart will be bigger and more crisp):

And we just proved how easy it is to create
a chart using FusionCharts. Next, we'll show you how easy it is to convert
this chart into a pie chart.
Troubleshooting

If for some reasons, you do not see a chart
similar to one shown above, run through the following checks:

If you see an endless loading progress bar in your browser, or if the
right click menu (right click at the place where the chart is supposed
to be) shows "Movie not loaded",
check the following:

Have you pasted the chart SWF files in FusionCharts
folder?

Have you provided the SWF path properly in your Chart.html
page?

Do you have Adobe Flash Player 8 (or above) installed for this
browser?

Have you enabled your browser to show ActiveX controls?
Normally, all browsers are Flash-enabled.

If you get a "Error in Loading Data" message, check the following:

Whether Data.xml is in the same folder
as the Chart.html HTML file?

Whether Data.xml is named as Data.xml
and not Data.xml.txt, as many basic
text editors append .txt after the file name?

If you get an "Invalid XML Data" message, it means that the
XML data document is malformed. Check it again for common errors like:

Difference in case of tags. <chart>
should end with </chart> and not
</Chart> or
</CHART>

Missing opening/closing quotation marks for any attributes. e.g.,
<chart caption=Monthly Sales' should
be <chart caption='Monthly Sales'

Missing closing tag for any element.

To check whether your final XML is ok, open it in your browser and you'll
see the error.

What is Fusion Charts?

2009-03-30T02:02:00.000-07:00

FusionCharts is a flash charting component that can be used to render data-driven animated charts. Made in Adobe Flash 8 (formerly Macromedia Flash), FusionCharts can be used with any web scripting language like HTML, .NET, ASP, JSP, PHP, ColdFusion etc., to deliver interactive and powerful charts. Using XML as its data interface, FusionCharts makes full use of fluid beauty of Flash to create compact, interactive and visually-arresting charts.

Advantages of using FusionCharts

Animated and interactive Charts
Using FusionCharts, you can quickly and easily render animated charts that have a lot of interactive options for the end users. Different chart types support different forms of animation and interactivity, thereby providing a different experience to the end users.

Easy yet powerful AJAX/JavaScript integration
FusionCharts offers advanced options to integrate charts with AJAX applications or JavaScript modules. You can update charts on client side, invoke JavaScript functions as hotspot links, or make dynamic calls for XML data to server without involving any page refreshes.

No installation hassles
To use FusionCharts, you do not have to install anything on your server. All you need to do is copy paste the SWF files (the core files of FusionCharts) to your server, just like you would do to any image files - and you're ready to go! So, even on those servers which do not allow installation of ActiveX or any other form of components, FusionCharts can run without any hassles.

Easy to use
FusionCharts makes the chart creation process a painless experience for you. Since it uses XML as its data, all you need to do is convert your data into XML using a programming language or using the visual GUI provided in FusionCharts - and that's all what is required to create interactive and animated charts.

Runs on a variety of platforms
Irrespective of what server side scripting language you're using, FusionCharts can be used to create charts in that. Since FusionCharts uses XML as the data interface, you can run it on any server and against any scripting language. Also, to view the charts, your users just need to have Adobe Flash Player 8, which is one of the most used browser plugins on the planet.

Reduces load on your servers

In traditional image based charting systems, the charts are generated as image at the server side. So, for each chart that you need to serve to a user, you'll have to build complex images on the server and then stream it to the client. When the need of hour is high, this can be an expensive resource on the server, as image creation takes a lot of toll on the server.

FusionCharts brings you great relief - all the charts are rendered at client side using the widely installed Adobe Flash Platform. The server is just responsible for streaming the pre-built SWF files and your XML data files to the end viewers. From there on, Flash Player takes the onus of rendering the charts. Also, the chart SWF Files can be cached so that you can just update the data, and not send chart SWF files every time.

A plethora of chart types
FusionCharts v3 offers you a plethora of chart types. From the basic bar, column, line, pie etc. to the advanced combination and scroll charts, you can build all the charts with the same ease of use.

Clear licensing policies

FusionCharts offers you a clear cut no-nonsense licensing model. We do NOT charge for per-testing server or per-production server. Once you buy a license of FusionCharts, you can host it on multiple servers, if all those servers are hosting the same website. We offer unlimited development servers, unlimited test servers and unlimited CPUs on a given server with each license of FusionCharts.

Moreover, if you're using multiple technologies for the same application - like say, ASP for a few modules and PHP for a few modules, you can use FusionCharts for both of them, without having to pay us anything additional. This saves you a lot on licensing cost and renders a generic look and feel to all the charts of your application.

JS Random number fucntion

2009-03-30T02:01:00.000-07:00

How to get HTML contents using Curl in PHP?

2009-03-30T01:49:00.002-07:00

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL,"http://www.example.com");
curl_setopt($ch, CURLOPT_HEADER, 0);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$css = curl_exec($ch);
curl_close($ch);

How to get Data using Curl in PHP?

2009-03-30T01:49:00.001-07:00

How to reload a IFRAME?

2009-03-30T01:22:00.000-07:00

<iframe src="index.html" width='100%' height='600' scrolling="yes" id='myframe'>
<script>
function rand( min, max ) {
// http://kevin.vanzonneveld.net
// +   original by: Leslie Hoare
// +   bugfixed by: Onno Marsman
// *     example 1: rand(1, 1);
// *     returns 1: 1
var argc = arguments.length;
if (argc == 0) {
 min = 0;
 max = 2147483647;
} else if (argc == 1) {
 throw new Error('Warning: rand() expects exactly 2 parameters, 1 given');
}
return Math.floor(Math.random() * (max - min + 1)) + min;
}

function reload(){
document.getElementById('myframe').src = 'index.html?'+rand(1,100000);
}
var ourInterval = setInterval('reload()', 10000);
script>

An Introduction to Web 2.0

2009-03-30T01:18:00.000-07:00

JSON Vs JavaScript/XML

2009-03-27T02:54:00.000-07:00

JSON Vs JavaScripts

JSON is a subset of the object literal notation of JavaScript
> JSON can be used in the JavaScript language with no muss or fuss
Members can be retrieved using dot or subscript operators
myJSONObject.web[1].name // “css"

JSON Vs XML

They are both 'self-describing' meaning that values are named, and thus 'human readable'
Both are hierarchical. (i.e. You can have values within values.)
Both can be parsed and used by lots of programming languages
In XML you can use any name you want for an element, in JSON you can't use reserved words from javascript.

Why JSON

2009-03-27T02:53:00.000-07:00

Lighter and faster than XML as on-the-wire data format
JSON objects are typed while XML data is typeless
JSON types: string, number, array, boolean, XML data are all string
Native data form for JavaScript code
XML data needed to be parsed and assigned to variables through tedious DOM APIs
Data is readily accessible as JSON objects in your JavaScript code
Retrieving values is as easy as reading from an object property in your JavaScript code

What is JSON?

2009-03-27T02:50:00.000-07:00

Lightweight data-interchange format
> Compared to XML

Simple format
> Easy for humans to read and write
> Easy for machines to parse and generate

JSON is a text format
> Programming language independent
> Uses conventions that are familiar to programmers of the C family of languages, including C, C++, C#, Java, JavaScript, Perl, Python

Anti-REST - Issues With REST

2009-03-27T02:48:00.001-07:00

Single Method to GET and POST to - the 'service' endpoint (http://www.flickr.com/services/rest/).
Similarly, function URLs (e.g. https://api.del.icio.us/v1/posts/add)
Arguments to the 'function call', perhaps 'method' (flickr.groups.pools.getPhotos, flickr.blogs.postPhoto, etc), access key, etc.
Internal ids as arguments (photo_id, etc.)
Use of GET for 'function calls' that cause changes
Use of POST for 'function calls' that only read data
POSTing an entire 'function call' in XML, complete with name and arguments, to the service URL
Thinking in terms of function calls - Once you do that in an HTTP/Resource context its really easy to slip away from the Web's design and start breaking its fundamental properties of being able to cache, index, and bookmark (link to) resources

What is this thing - REST

2009-03-27T02:28:00.000-07:00

Resource based (not service based) - Something intersting on your system
Address ability (name everything that matters)
Statelessness (no stateful messages exchange with a resource)
Resource state is always kept in the server and sent to the client as representations
Statelessness increments scalability (self contained messages)
Relationships (expressed through links)
Resources contain links (or URI templates) to other resources Links act as state transitions
Think of resources as states in a state machine and links as state transitions
Application (conversation) state is captured in terms of these states