Is your Web application secure?

“No language can prevent insecure code, although there are language features which could aid or hinder a security-conscious developer.”

An interesting article on Security Focus illustrates examples on PHP coding and vulnerabilities.
The attacks explained in the article are:
1. Remote code execution
2. SQL injection
3. Format string vulnerabilities
4. Cross Site Scripting (XSS)
5. Username enumeration
http://www.securityfocus.com/infocus/1864

Backup your batabases w/o phpmyadmin

I often read threads about export/import data from MySQL and it’s always mentioned phpmyadmin as the only way to do that (with PHP indeed).
But that’s not true, and it’s indeed the slower way to do that, expecially when importing large database files (because phpmyadmin has problems with large db)…
This would be just a reminder 🙂
Use an SSH client, like putty (if your database is on a remote server), to connect to your server and export the databse you want simply with:

mysqldump –user=username –password=1234 –databases your_database –opt –quote-names –allow-keywords –complete-insert | bzip2 -c > your_database.sql.bz2

download the .bz2 file created, unzip it using 7-zip (if you dont have any other uncompress utility), and backup your database in mysql using:

mysql –user=username –password your_database < your_database.sql

that’s faster than using “import” from phpmyadmin
http://dev.mysql.com/doc/refman/5.0/en/mysqldump.html

IE’s ActiveX D-Day

As Microsoft announced time ago, the next generation of Internet Explorer will change the way the browser handles ActiveX controls with a significant impact on how online advertising and streaming media content is delivered over the Internet.
The software maker plans to give Web developers an extra 60 days to continue making preparations.
The big push now is for developers to recode Web sites and Web applications to cater for the browser update. If not, users won’t be able to directly interact with Microsoft ActiveX controls loaded by the APPLET, EMBED or OBJECT elements without first activating the user interface with an extra mouse click.
Get the Internet Explorer 7 beta preview


http://www.eweek.com/article2/0,1895,1943847,00.asp

MySQL Workbench 1.0.5

MySQL has released some days ago a new tool for Database Design.
It can handle tables, stored procedures, functions, triggers and views of your existing databases (using the reverse engineering command).
Some features:
– Reverse engineering of existing MySQL databases
– Import DBDesigner4 models
– Synchronize edited model with MySQL database
– Generate SQL create script file
– Printing (Windows)
– Powrefull scripting and plugin interface. Plugins can be written in several languages, such as Lua, PHP, Java and
Python.
– Fast, OpenGL based graphical canvas
It is available for Windows, Linux and MacOSX too.
There’s also the source code free for download.
I found also a very nice Database tool, with tons of features, even if the GUI is not really usable (in my opinion): Aqua Data Studio 4.5
In these days I worked a lot with MySQL 5 and it’s new features and I found those tools very comfortable for my needs.
I hope my hosting provider (mediatemple) will upgrade mysql server too, which is still the 3.23.58!
http://forums.mysql.com/read.php?98,73820,73820#msg-73820

Gtalkr

Anybody using Gmail? How about Google Talk?
If so, 2Entwine has created a truely awsome Flash App called Gtalkr!! Right now it is Beta 2.0.0.67, but in my opinion a very promising RIA (Rich Internet Application).

  • Google Talk contact information
  • Contact presence changes
  • Gtalkr Notifier integration
  • Drag and drop support

It lists friends, your Gmail Account, a Flickr slideshow, a YouTube component, and much more…
Still not enough? Well Gtalkr also has a blog, Everything Gtalkr that will keep you up to date!!
Still want more? Well it even supports extensions!! A combination of XML and Flash…”you’ll need to create the Flash file that Gtalkr will load.”
I see a lot of potential in this application and fresh view on customization that other portal technologies lack….
https://gtalkr.com/

PHP5: a big failure ?

What’s happening ?
PHP 5 has been presented as a revolution, a lot of new features have been added and a lot of projects have been made. But only a small group of hosters seem interested in supporting PHP 5 on their web servers. It is not so useful to have a beautiful programming language to use if we can’t apply it to production environments.
But what about the causes ? Maybe they are related to the fact that Zend decided to support both PHP 4 and 5 separately, allowing hoster to choose which version to compile on their webservers, or maybe to the fact that PHP 5 is not fully compatible with the older versions, and there are some security-related bugs that increase our doubts.
I’m using a lot PHP 5 in production environments, without any problem. It is quite fast and reliable, and has got a lot of useful features that adapt perfectly to enterprise development. We MUST use PHP 5 to help it growing until it become the standard …
To conclude I’d like to inform the ones who don’t know it, that PHP team is working on the sixth version (yes … PHP 6 … and it is available for download at snaps.php.net) that will add to the language a lot of interesting features, such as native support to Unicode.
I hope there will be only one (working) version of PHP in the future …

Microsoft Internet Explorer 7 to public

Microsoft has just released Internet Explorer 7 beta for the public.
For Firefox and Opera users its new features are very familiar, such as the tabbed browsing, quick tabs (a very handly plugin I use in Firefox and which lets to see thumbinails of all the opened borwser pages), zoom and the quick search box…
For the full feature list please read more on Microsoft site: http://www.microsoft.com/windows/ie/ie7/featuretable.mspx
http://www.microsoft.com/windows/ie/ie7/default.mspx