web design articles February 19, 2009
Posted by chris in : rant , add a commentWhats new in the web design world? Here are few articles that will help you maximize and improve your web sites design.
Are you focusing to much on your home page?
http://www.smileycat.com/miaow/archives/001514.php
Google support for canonical links
http://googlewebmastercentral.blogspot.com/2009/02/specify-your-canonical.html
50 tips to a user-friendly website
http://www.htmlist.com/cool-stuff/50-tips-to-a-user-friendly-website/
is the relational database doomed? February 14, 2009
Posted by chris in : rant , add a commentInteresting read posted here http://www.readwriteweb.com/archives/is_the_relational_database_doomed.php regarding a new breed of non-relational database. A non-relational database sounds a lot like MySQL running MyISAM with the rows containing serialized objects or json strings….
ms sql show all tables in a database February 11, 2009
Posted by chris in : rant , add a commentIn MS SQL use the following SQL to show all tables in the selected database.
SELECT * FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_TYPE = 'BASE TABLE';
Hmmm… I think I like the MySQL way:
SHOW ALL TABLES;
preventing sql injection attacks on mysql, php, lamp servers February 3, 2009
Posted by chris in : SQL , add a commentI was recently auditing a clients website and was astounded when I was able to access any customers account by disabling JavaScript, using a wild card ‘%’ operator as the username, and guessing passwords. Unfortunately the developer of the customer login used a query that looked like this and did not clean any of the data once received by the server:
SELECT * FROM the_customer_table WHERE the_username LIKE "'.$_POST['the_username_field'].'" AND password="'.$_POST['the_password_field'].'"
Using the wild card operator it would return any username where the password matched whatever I passed in such as “password”, “happiness”, and some dirty words that I threw in for fun. The exploit could have been very bad actually as certain accounts have gift certificates associated with them. A hacker could have written a simple brute force script in any language and went to town compiling a list of valid accounts and then ordered hundreds to thousands of dollars worth of product. The exploit was patched by altering the query and additional adding an add_slashes() to all POST data for the login.
A proper login query should look like this:
$valid=false;
$sql = "SELECT the_username,the_password FROM the_customer_table WHERE the_username ="'.$_POST['the_username_field'].'" LIMIT 1";
$result = mysql_query($sql);
$row = mysql_fetch_assoc($result);
if($row['the password']==$_POST['the_password_field']){
$valid=true;
}
return $valid;
This will verify first that a valid customer account exists, then it will test the actual password against what was supplied by the end-user. This of course should occur after the POST data has been cleansed against SQL injection hacks and JavaScript hacks. Never use LIKE when you are searching for an exact match either and always use a LIMIT 1 when you are only expecting 1 record to be returned or 1 record to be affected.
using firephp to debug php web applications February 3, 2009
Posted by chris in : php , add a commentFirePHP enables you to log to your Firebug Console using a simple PHP method call. All data is sent via response headers and will not interfere with the content on your page. FirePHP is ideally suited for AJAX development where clean JSON and XML responses are required. Using FirePHP on a production server is a safe and easy way to debug an application without inconveniencing end-users. FirePHP requires PHP 5 on the server, firebug on the client with all three options settings including Net enabled for the site. It can be installed via PEAR or by uploading two classes to your server and referencing them via the include_once() method.
Once the files are uploaded to the server, include them in your script, instantiate the FirePHP class as an object, and call the log() method by passing in two parameters the variable and a title.
include_once('FirePHPCore/FirePHP.class.php');
$firephp = new FirePHP();
$firephp->log($variable,'Enter an optional title for the second parameter');
When you pass an array as a variable to firebug it will display it in a human readable format similar to placing print_r() in between the pre html tags. The most notable security risk to using FirePHP is that anyone with the firephp extension enabled can you use it to see any information you are dumping to the client. My advice is to immediately comment out firebug logging calls once you are finished debugging the application, especially if you are dumping out raw SQL syntax to the client.