Apparently it’s embrace the developer community day at Facebook. In addition to the news that they are making activity stream data available to third party developers, they’ll also be making an announcement around OpenID, we’ve heard. And importantly, the announcement is that they’ll become what’s called a relying party, meaning anyone with an OpenID (Yahoo, Google, AOL, MySpace are all issuers, and Microsoft is in beta) can create and log into a Facebook account using those credentials.
Let me take a step back. OpenID is a distributed single sign on solution that allows people to sign into different services with the same login credentials. There are two ways companies/websites can participate in the OpenID framework - as “issuing parties” or as “relying parties.” Issuing parties make their user accounts OpenID compatible. Relying parties are websites that allow users to sign into their sites with credentials from Issuing parties. Of course, sites can also be both. In fact, if they aren’t both it can be confusing and isn’t a good user experience.
All the big guys are now Issuing Parties, which allow their users logging in all over the Internet with those credentials. But none of them accept IDs from anywhere else, so anyone that uses their services has to create new credentials with them. It’s all gain, no pain. There are two exceptions - AOL Mapquest and Google’s Blogger - but for the most part the big guys are issuers, not relying parties. And that has led us in the past to accuse them of exploiting OpenID for their own benefit without giving back to the community. See our post Is OpenID Being Exploited By The Big Internet Companies?
Showing posts with label web. Show all posts
Showing posts with label web. Show all posts
Monday, April 27, 2009
Friday, April 24, 2009
Google Continues To Center On Location. Adds It To Its Toolbar.
Location-based services haven’t yet caught fire, but location itself is increasingly finding its way to web services as a complimentary feature. The latest to use it is the Google Toolbar. If you have it installed, and open Google Maps, it will now auto-center on your location.
That’s a small, but useful feature, but the ramifications of this move are potentially much large. This adds location capabilities to the millions of people who have Google Toolbar installed. You may be thinking that a lot of those users with the latest version of Firefox already had it — but this feature is for Internet Explorer only right now. That, combined with Mozilla’s use of its Geode location plug-in (which again, is built into the latest version of Firefox), puts location on a good percentage of browsers in the world.
And while it doesn’t mention it, that’s important for Google’s own larger purposes. Its recently launched Latitude location-based network is only useful if it can automatically update your location, or make it really easy to do. Up until now, it has been a pain on a computer.
But there are other big things Google could do with location information — such as serve you location-based ads. There are other companies working in that field, but you can bet Google wants to get out in front of them and lead the charge. And with its own toolbar to get your location, it could potentially do that. It also promises the ability to serve up location-based search results with feature.
Google has been been working on location for a little while in the mobile space, but most users are still experiencing the web first and foremost through regular computer browsers. Google’s toolbar pulls location data from both IP addresses and nearby Wi-Fi access points — since most computers don’t have GPS built-in.
That’s a small, but useful feature, but the ramifications of this move are potentially much large. This adds location capabilities to the millions of people who have Google Toolbar installed. You may be thinking that a lot of those users with the latest version of Firefox already had it — but this feature is for Internet Explorer only right now. That, combined with Mozilla’s use of its Geode location plug-in (which again, is built into the latest version of Firefox), puts location on a good percentage of browsers in the world.
And while it doesn’t mention it, that’s important for Google’s own larger purposes. Its recently launched Latitude location-based network is only useful if it can automatically update your location, or make it really easy to do. Up until now, it has been a pain on a computer.
But there are other big things Google could do with location information — such as serve you location-based ads. There are other companies working in that field, but you can bet Google wants to get out in front of them and lead the charge. And with its own toolbar to get your location, it could potentially do that. It also promises the ability to serve up location-based search results with feature.
Google has been been working on location for a little while in the mobile space, but most users are still experiencing the web first and foremost through regular computer browsers. Google’s toolbar pulls location data from both IP addresses and nearby Wi-Fi access points — since most computers don’t have GPS built-in.
Tuesday, November 4, 2008
PHP Source Code »Using Large Objects in OCI8
In PHP
, LOBs are manipulated using a descriptor. To show this, in SQL*Plus create a table
that has a BLOB column:
SQL> create table mybtab (blobid number, blobdata blob);
PHP code
to insert data into this table is:
navioo_blobinsert.php
$c = oci_connect('hr', 'hrpwd', '//localhost/XE');
$myblobid = 123;
$myv = 'a very large amount of binary data';
$lob = oci_new_descriptor($c, OCI_B_LOB);
$s = oci_parse($c,
'INSERT INTO mybtab (blobid, blobdata) '
. 'VALUES(:myblobid, EMPTY_BLOB()) '
. 'RETURNING blobdata INTO :blobdata');
oci_bind_by_name($s, ':MYBLOBID', $myblobid);
oci_bind_by_name($s, ':BLOBDATA', $lob, -1, OCI_B_BLOB);
oci_execute($s, OCI_DEFAULT);
$lob->save($myv);
oci_commit($c);
?>
Read all..
Monday, October 27, 2008
Hiding PHP as another language
In general, security by obscurity is one of the weakest forms of security.
But in some cases, every little bit of extra security is desirable.
A few simple techniques can help to hide PHP, possibly slowing
down an attacker who is attempting to discover weaknesses in your
system. By setting expose_php = off in your php.ini file, you
reduce the amount of information available to them.
Another tactic is to configure web servers such as apache to
parse different filetypes through PHP, either with an .htaccess
directive, or in the apache configuration file itself. You can
then use misleading file extensions:
Hiding PHP as another language
# Make PHP code look like other code types
AddType application/x-httpd-php .asp .py .plRead more about Hiding PHP
Friday, October 17, 2008
JAVASCRIPT DHTML TUTORIALS » Event onMethod
Wednesday, October 8, 2008
DHTML GUI Components
Colection of GUI Components
Try It online :
http://www.navioo.com/javascript/dhtml/GUI_Components_227.dhtml
.
Animation (39)
Banner (1)
Calendar International (2)
Calendar (39)
Chart (1)
Clock (10)
Code Formatter (1)
Color Chooser (5)
ComboBox (4)
Cursor (2)
Desktop (2)
Documentation (1)
Drag Drop (22)
Dual List (1)
Editor (9)
Events Calendar (1)
Grid Layout (17)
IFrame (1)
Key Event (1)
Log Panel (1)
Menu (32)
Navigation Bar (3)
Outlook Bar (1)
Popup Menu (2)
RadioButton (2)
Scroll (9)
ScrollBar (4)
Slider (6)
Sortable Listbox (1)
Syntax HighLighter (1)
Tab (13)
Table Grid (45)
TextArea (1)
TextBox (1)
Ticker (7)
Time Picker (2)
Toggle (5)
ToolBar (3)
Tree Table (1)
Tree (26)
Try It online :
http://www.navioo.com/javascript/dhtml/GUI_Components_227.dhtml
Monday, October 6, 2008
A TCP stack design vulnerability could put Internet services everywhere at major DoS risk
Researchers from the Swedish security company Outpost24 have discovered a major flaw in the design of TCP stacks which could put TCP-enabled devices at risk. According to their findings, which they kept secret for three years, performing DoS attacks through this vulnerability would require little bandwidth and the attacked devices would need rebooting in order for proper functionality to be restored.
The researchers discovered this vulnerability back in 2005 and they claim it affects most, if not all, TCP stack implementations out there. With every TCP-enabled device being at risk, this affects everyone on the Internet, ranging from billions of home users to ISPs, hosting and other companies. Due to the deep implications of this vulnerability, the researchers decided to keep it secret and try to find applicable solutions. Because they did not succeed in coming up with an answer for mitigation, they decided to go public and search for input and feedback from the security community.
They did not disclose full details to the general public, but they teamed up with the Finnish CERT and started providing information to various vendors world-wide, which include major OS developers and router/firewall manufacturers. Along with information regarding several different attack types, the researchers provided the vendors with a stress test kit which they developed and named Sockstress. “They're still trying to do triage and understand the individual attack types that we've identified for them. We're still trying to get them to back up a step. It's a class of attack, not necessarily individual things that the vendors need to be focusing on," said Robert E. Lee, Chief Security Officer at Outpost24.
The researchers tested their attacks on 15 different TCP stacks and all proved vulnerable. "We haven't found anybody who has a TCP stack that runs TCP based services that isn't vulnerable. If they make a TCP stack then it's probably still going to be vulnerable to one or all of these attacks because this is something fundamental in how TCP works," commented Mr. Lee for The Register.
Even if, at this point, there is some skepticism coming from the security community regarding the seriousness of the vulnerability, this is explainable through the lack of detailed technical information or confirmation from other parties. “My immediate reaction is skepticism: things like this tend to be hype. However, after listening to their audio interview, I believe they are probably right. They have been working deep within TCP stacks. If such problems exist, then they would have certainly come across them,” wrote on his blog Robert Graham, the CEO of Errata Security.
A new DoS attack technique
From what little information is available in an interview with Robert E. Lee, Chief Security Officer at Outpost24, the exploitation of this flaw consists of essentially tricking the TCP stack into not closing the TCP connections. By opening numerous such connections that are never dropped, the max limit of simultaneous connections that the stack can handle is eventually reached. This uses up all the available resources and causes a denial of service situation.
This actually works backwards compared to the classic distributed DoS (DDoS) attacks where, by using the combined bandwidth of multiple compromised machines (botnets), the attacker opens numerous connections and sends numerous packets in order to force the device into using up all its resources by attempting to process them. With such classic DoS attacks, there is a direct proportionality between the resources available to the attacked device and the bandwidth required to crash it successfully. However, in one of the new attacks described by the Mr. Lee, the concept is to trick the device into thinking that your connection is getting slower. In fact, the slower, the better.
A TCP stack will attempt to determine the maximum speed of a connection and adjust the speed at which it sends the packets in order to prevent packets from being dropped. So, if successfully tricked into thinking that your speed is getting so slow that it will take, for example years for the transfer to complete, the stack will keep the connection open for a very long period of time. Then, it's just a matter of opening enough such connections up to the point where the stack can't handle any more and becomes unresponsive. But, while a device can recover on its own within minutes from a classic DDoS attack, with this new technique, the only solution is to reboot the device. "It basically self thrashes, and the only recovery after about two to four minutes worth of attack flow, even after the attack stops, is to reboot the machine," explains Mr. Lee.
Another Internet architecture design flaw
This TCP resource leak vulnerability is the second major Internet architecture design flaw made public in 2008. A few months ago, security researcher Dan Kaminsky discovered a critical flaw in the design of DNS (domain name system). That vulnerability allowed for an attacker to poison the cache of DNS servers with fake entries. Just like this flaw is supposed to affect all TCP stack implementations, the DNS one affected all DNS server platforms. That posed a great mitigation problem, but Mr. Kaminsky silently worked with several major affected vendors and companies that offer Internet-based services and eventually a patch was developed.
Facing pressure from the security community, Dan Kaminsky decided to make the technical details public after the patch was deployed on most of the DNS servers world-wide. He revealed at the time that the flaw also affects services like e-mail. Not long after, Russian physicist Evgeniy Polyakov presented a proof of concept exploit demonstrating that the patch only increases the time required to compromise a DNS server and that it doesn't really block attacks.
Miscreants like phishers and malware developers have already adopted the DNS vulnerability and complex attacks have been carried out. While a permanent solution is still being devised, the U.S. government announced plans to implement DNSSEC, an encryption-based DNS service, on their network by December 2009. All this puts into perspective what could happen if the TCP stack flaw issue is not properly addressed.
The researchers discovered this vulnerability back in 2005 and they claim it affects most, if not all, TCP stack implementations out there. With every TCP-enabled device being at risk, this affects everyone on the Internet, ranging from billions of home users to ISPs, hosting and other companies. Due to the deep implications of this vulnerability, the researchers decided to keep it secret and try to find applicable solutions. Because they did not succeed in coming up with an answer for mitigation, they decided to go public and search for input and feedback from the security community.
They did not disclose full details to the general public, but they teamed up with the Finnish CERT and started providing information to various vendors world-wide, which include major OS developers and router/firewall manufacturers. Along with information regarding several different attack types, the researchers provided the vendors with a stress test kit which they developed and named Sockstress. “They're still trying to do triage and understand the individual attack types that we've identified for them. We're still trying to get them to back up a step. It's a class of attack, not necessarily individual things that the vendors need to be focusing on," said Robert E. Lee, Chief Security Officer at Outpost24.
The researchers tested their attacks on 15 different TCP stacks and all proved vulnerable. "We haven't found anybody who has a TCP stack that runs TCP based services that isn't vulnerable. If they make a TCP stack then it's probably still going to be vulnerable to one or all of these attacks because this is something fundamental in how TCP works," commented Mr. Lee for The Register.
Even if, at this point, there is some skepticism coming from the security community regarding the seriousness of the vulnerability, this is explainable through the lack of detailed technical information or confirmation from other parties. “My immediate reaction is skepticism: things like this tend to be hype. However, after listening to their audio interview, I believe they are probably right. They have been working deep within TCP stacks. If such problems exist, then they would have certainly come across them,” wrote on his blog Robert Graham, the CEO of Errata Security.
A new DoS attack technique
From what little information is available in an interview with Robert E. Lee, Chief Security Officer at Outpost24, the exploitation of this flaw consists of essentially tricking the TCP stack into not closing the TCP connections. By opening numerous such connections that are never dropped, the max limit of simultaneous connections that the stack can handle is eventually reached. This uses up all the available resources and causes a denial of service situation.
This actually works backwards compared to the classic distributed DoS (DDoS) attacks where, by using the combined bandwidth of multiple compromised machines (botnets), the attacker opens numerous connections and sends numerous packets in order to force the device into using up all its resources by attempting to process them. With such classic DoS attacks, there is a direct proportionality between the resources available to the attacked device and the bandwidth required to crash it successfully. However, in one of the new attacks described by the Mr. Lee, the concept is to trick the device into thinking that your connection is getting slower. In fact, the slower, the better.
A TCP stack will attempt to determine the maximum speed of a connection and adjust the speed at which it sends the packets in order to prevent packets from being dropped. So, if successfully tricked into thinking that your speed is getting so slow that it will take, for example years for the transfer to complete, the stack will keep the connection open for a very long period of time. Then, it's just a matter of opening enough such connections up to the point where the stack can't handle any more and becomes unresponsive. But, while a device can recover on its own within minutes from a classic DDoS attack, with this new technique, the only solution is to reboot the device. "It basically self thrashes, and the only recovery after about two to four minutes worth of attack flow, even after the attack stops, is to reboot the machine," explains Mr. Lee.
Another Internet architecture design flaw
This TCP resource leak vulnerability is the second major Internet architecture design flaw made public in 2008. A few months ago, security researcher Dan Kaminsky discovered a critical flaw in the design of DNS (domain name system). That vulnerability allowed for an attacker to poison the cache of DNS servers with fake entries. Just like this flaw is supposed to affect all TCP stack implementations, the DNS one affected all DNS server platforms. That posed a great mitigation problem, but Mr. Kaminsky silently worked with several major affected vendors and companies that offer Internet-based services and eventually a patch was developed.
Facing pressure from the security community, Dan Kaminsky decided to make the technical details public after the patch was deployed on most of the DNS servers world-wide. He revealed at the time that the flaw also affects services like e-mail. Not long after, Russian physicist Evgeniy Polyakov presented a proof of concept exploit demonstrating that the patch only increases the time required to compromise a DNS server and that it doesn't really block attacks.
Miscreants like phishers and malware developers have already adopted the DNS vulnerability and complex attacks have been carried out. While a permanent solution is still being devised, the U.S. government announced plans to implement DNSSEC, an encryption-based DNS service, on their network by December 2009. All this puts into perspective what could happen if the TCP stack flaw issue is not properly addressed.
Friday, October 3, 2008
Wednesday, October 1, 2008
How to animate an element's position using the Motion subclass
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
<html>
<head>
<title>Motion Example - Basic</title>
<style type="text/css">
/*
Copyright (c) 2006, Yahoo! Inc. All rights reserved.
Code licensed under the BSD License:
http://developer.yahoo.net/yui/license.txt
Version: 0.10.0
*/
body {
margin:0;
font:small arial;
}
h1 {
color:#666;
margin:0;
font:bold 150% palatino, georgia;
}
#hd img {
vertical-align:middle;
}
#hd h1 {
display:inline;
margin:0 0 0 20px;
vertical-align:middle;
}
ul, li {
margin:0;
padding:0;
list-style:none;
}
#doc {
margin:10px;
}
#examples {
margin:60px 40px;
}
#examples li {
margin-bottom:1em;
}
#examples li a {
color:#666;
font:85% verdana;
}
#demo {
background:#ccc;
font:100%/1.2em arial;
width:10px;
height:10px;
}
#animation-demo-scroll #demo p {
width:600px;
}
#animation-demo-motion #demo {
color:yellow;
font-size:0;
}
#animation-demo-size-plus #demo, #animation-demo-fade #demo, #animation-demo-colors #demo {
background:#ccc;
font:100%/1.2em arial;
width:200px;
height:200px;
}
#animation-demo-colors #demo {
border:3px solid #c3c;
}
#animation-demo-scroll #demo {
width:400px;
height:200px;
overflow:auto;
}
#animation-demo-colors #demo {
}
#target {
background:red;
font-size:0;
position:absolute;
left:300px;top:300px;
width:10px;
height:10px;
}
</style>
<script type="text/javascript" src="./build/yahoo/yahoo.js"></script>
<script type="text/javascript" src="./build/event/event.js"></script>
<script type="text/javascript" src="./build/dom/dom.js"></script>
<script type="text/javascript" src="./build/animation/animation.js"></script>
<script type="text/javascript">
YAHOO.example.init = function() {
var anim = new YAHOO.util.Motion('demo', { points: { to: YAHOO.util.Dom.getXY('target') } });
YAHOO.util.Event.on(document, 'click', anim.animate, anim, true);
};
YAHOO.util.Event.onAvailable('demo', YAHOO.example.init);
</script>
</head>
<body id="animation-demo-motion">
<div id="doc">
<h1>Motion Example - Basic</h1>
<p>This example demonstrates how to animate an element's position using the Motion subclass.</p>
<p>Click anywhere to start animation.</p>
<div id="demo"></div>
<div id="target"></div>
</div>
</body>
</html>
Yui required !!!!
Try it online
<html>
<head>
<title>Motion Example - Basic</title>
<style type="text/css">
/*
Copyright (c) 2006, Yahoo! Inc. All rights reserved.
Code licensed under the BSD License:
http://developer.yahoo.net/yui/license.txt
Version: 0.10.0
*/
body {
margin:0;
font:small arial;
}
h1 {
color:#666;
margin:0;
font:bold 150% palatino, georgia;
}
#hd img {
vertical-align:middle;
}
#hd h1 {
display:inline;
margin:0 0 0 20px;
vertical-align:middle;
}
ul, li {
margin:0;
padding:0;
list-style:none;
}
#doc {
margin:10px;
}
#examples {
margin:60px 40px;
}
#examples li {
margin-bottom:1em;
}
#examples li a {
color:#666;
font:85% verdana;
}
#demo {
background:#ccc;
font:100%/1.2em arial;
width:10px;
height:10px;
}
#animation-demo-scroll #demo p {
width:600px;
}
#animation-demo-motion #demo {
color:yellow;
font-size:0;
}
#animation-demo-size-plus #demo, #animation-demo-fade #demo, #animation-demo-colors #demo {
background:#ccc;
font:100%/1.2em arial;
width:200px;
height:200px;
}
#animation-demo-colors #demo {
border:3px solid #c3c;
}
#animation-demo-scroll #demo {
width:400px;
height:200px;
overflow:auto;
}
#animation-demo-colors #demo {
}
#target {
background:red;
font-size:0;
position:absolute;
left:300px;top:300px;
width:10px;
height:10px;
}
</style>
<script type="text/javascript" src="./build/yahoo/yahoo.js"></script>
<script type="text/javascript" src="./build/event/event.js"></script>
<script type="text/javascript" src="./build/dom/dom.js"></script>
<script type="text/javascript" src="./build/animation/animation.js"></script>
<script type="text/javascript">
YAHOO.example.init = function() {
var anim = new YAHOO.util.Motion('demo', { points: { to: YAHOO.util.Dom.getXY('target') } });
YAHOO.util.Event.on(document, 'click', anim.animate, anim, true);
};
YAHOO.util.Event.onAvailable('demo', YAHOO.example.init);
</script>
</head>
<body id="animation-demo-motion">
<div id="doc">
<h1>Motion Example - Basic</h1>
<p>This example demonstrates how to animate an element's position using the Motion subclass.</p>
<p>Click anywhere to start animation.</p>
<div id="demo"></div>
<div id="target"></div>
</div>
</body>
</html>
Yui required !!!!
Try it online
Monday, September 29, 2008
Ajax Layer Ajax Library Examples
Large examples collection of Ajax Library : Ajax Layer JAVASCRIPT DHTML TUTORIALS
See at work :demo online Ajax Library : Ajax Layer
See at work :demo online Ajax Library : Ajax Layer
Friday, September 26, 2008
Tips to Improve Joomla Performance = Fast page loading and error-free Joomla Website
When you are using the Joomla content management system, the overall site performance could be affected by various factors. Moreover, if you have many site users, the page loading speed could be influenced by the simultaneous number of MySQL database queries. In order to obtain the best results for the page loading speed (which is a key factor for the search engines rankings) and to maintain the best performance of your Joomla website, there are a few tips that could help you.
The recent studies show that Joomla is twice as fast when used with PHP 5.2.3 in comparison with PHP 4.4, as a consequence the use of the last PHP version (which is definitely improved) will always offer you the optimal Joomla performance.
If you turn on caching on the Cache tab from Joomla Global Configuration in Administration Panel, then static files or a cache of your website will be created. The file caching allows the system to find a certain page directly from hard disk and removes the delay induced by a MySQL query to retrieve the same page in the database. The speed of page loading will also be increased by enabling caching.
On the Cache tab, when enabling caching, you must not modify the default cache folder, but you can set a lower value for the cache time if you update the site contents often and a higher value if the content is changed rarely. There are also many modules from Joomla structure that support caching. It is recommended to enable caching for those modules. There are also components that improve the page caching process, such as Ircmaxell's Page Cache.This component will have visible effects on page load speed in case of website with high traffic.
Another important aspect that could affect Joomla performance is the template structure. For the best performance, you should use CSS templates and remove the unused CSS styles. The images should be optimized for web display in order to decrease the page loading time. The unused modules should be unpublished and flash modules should be avoided if they are not really necessary.
Before installing Joomla on a webserver you should test the site performance using benckmarking tools on the local computer. There are more advanced settings to modify in php.ini and .htaccess files, respectively, to increase Joomla performance, but these are specific to every joomla website, depending on its destination. In case you modify them, you should check the apache server documentation to maintain your website free of errors.
The recent studies show that Joomla is twice as fast when used with PHP 5.2.3 in comparison with PHP 4.4, as a consequence the use of the last PHP version (which is definitely improved) will always offer you the optimal Joomla performance.
If you turn on caching on the Cache tab from Joomla Global Configuration in Administration Panel, then static files or a cache of your website will be created. The file caching allows the system to find a certain page directly from hard disk and removes the delay induced by a MySQL query to retrieve the same page in the database. The speed of page loading will also be increased by enabling caching.
On the Cache tab, when enabling caching, you must not modify the default cache folder, but you can set a lower value for the cache time if you update the site contents often and a higher value if the content is changed rarely. There are also many modules from Joomla structure that support caching. It is recommended to enable caching for those modules. There are also components that improve the page caching process, such as Ircmaxell's Page Cache.This component will have visible effects on page load speed in case of website with high traffic.
Another important aspect that could affect Joomla performance is the template structure. For the best performance, you should use CSS templates and remove the unused CSS styles. The images should be optimized for web display in order to decrease the page loading time. The unused modules should be unpublished and flash modules should be avoided if they are not really necessary.
Before installing Joomla on a webserver you should test the site performance using benckmarking tools on the local computer. There are more advanced settings to modify in php.ini and .htaccess files, respectively, to increase Joomla performance, but these are specific to every joomla website, depending on its destination. In case you modify them, you should check the apache server documentation to maintain your website free of errors.
Web Attacks Through SQL Injection - A New Solution to Increase SQL Based Applications Security
The management of relational databases is performed by using SQL (Structured Query Language) that helps
you to manipulate data inside a collection of tables. Practically, at the web level, SQL language represent the bridge of communication between a web application and a database. In the same manner, the user interacts with the database at a certain point in a given database driven application.
SQL injection represents a hacking method that is based on the security vulnerabilities of web applications having a database backend. It has many implementation forms and basically it consists of malicious SQL code (or non-intended to be used in a given application) that, after execution, could determine the complete destruction of a database, the revealing of secret informations from the database records and more.
The most vulnerable to SQL injection attacks are web forms. For example, if next SQL code is used in a login system, a username could be selected from the usersname table due to the fact that the boolean value of the code 'a'='a' is true in any situation:
CODE
SELECT * FROM usersname WHERE name = 'John' OR 'a'='a';
In the case presented earlier, a hacker could bypass the authentication system or even more, to compromise the database with a DROP TABLE statement. Fortunately, solutions to increase the general security of web applications back-ended with relational databases exist.
Martin Bravenboer presents a new methods to avoid the security leaks in database driven applications in his Ph.D. Thesis entitled "Exercises in Free Syntax-Syntax Definition, Parsing, and Assimilation of Language Conglomerates". The techniques of totally removal of the SQL insecurities is based on the usage of an API (application programming interface) in combination with easy strings manipulation.
The method of embedding the syntax of SQL language into a host language like Java or PHP is generalized for many pairs host-guest type programming languages. The content of the Ph.D thesis is available on-line as PDF document and can help you to better understand the mechanisms of SQL injection and respectively the recommended coding procedures.
you to manipulate data inside a collection of tables. Practically, at the web level, SQL language represent the bridge of communication between a web application and a database. In the same manner, the user interacts with the database at a certain point in a given database driven application.
SQL injection represents a hacking method that is based on the security vulnerabilities of web applications having a database backend. It has many implementation forms and basically it consists of malicious SQL code (or non-intended to be used in a given application) that, after execution, could determine the complete destruction of a database, the revealing of secret informations from the database records and more.
The most vulnerable to SQL injection attacks are web forms. For example, if next SQL code is used in a login system, a username could be selected from the usersname table due to the fact that the boolean value of the code 'a'='a' is true in any situation:
CODE
SELECT * FROM usersname WHERE name = 'John' OR 'a'='a';
In the case presented earlier, a hacker could bypass the authentication system or even more, to compromise the database with a DROP TABLE statement. Fortunately, solutions to increase the general security of web applications back-ended with relational databases exist.
Martin Bravenboer presents a new methods to avoid the security leaks in database driven applications in his Ph.D. Thesis entitled "Exercises in Free Syntax-Syntax Definition, Parsing, and Assimilation of Language Conglomerates". The techniques of totally removal of the SQL insecurities is based on the usage of an API (application programming interface) in combination with easy strings manipulation.
The method of embedding the syntax of SQL language into a host language like Java or PHP is generalized for many pairs host-guest type programming languages. The content of the Ph.D thesis is available on-line as PDF document and can help you to better understand the mechanisms of SQL injection and respectively the recommended coding procedures.
Free Acrobat.com Online Service Suite
The free Acrobat.com online service suite provides web based applications and tools to manage and share documents and files. There are web conferences (communication in real time) and storage solutions available, as well as a word processor and an online PDF converter.
The applications and tools contained in the suite are: Share, Create PDF, Adobe Buzzword, Adobe ConnectNow and My Files. They make the online collaboration with your team a lot easier, at the same time providing flexible access from any Internet connection.
Adobe Buzzword is a web browser based word processor capable of editing and exporting many types of documents like .txt (plain text), .pdf (Adobe PDF), .docx and .doc (Microsoft Word), HTML and more. Images (JPEG, PNG or GIF) can be inserted and easily positioned in documents. Authoring rights can be assigned to users for a certain document. The free online word processor also has many other features besides the ones mentioned in this article, so much so that due its overall capabilities it could compete with commercial desktop software.
Adobe ConnectNow is an online conferencing application that makes work more productive through an efficient web based collaboration system. Among its multiple features Adobe ConnectNow provides: video conferencing opportunity, chat pod, a unique URL for your meeting room and more.
For file sharing and storage there are 5GB of web disk space for any user account. The files can be organized online in a flexible way through a simple to use interface. There are limitations regarding the type of files uploaded and respectively shared: you are not allowed to use various formats of video, audio, executable, fonts, archives or database and raster image files on the Acrobat.com account.
Acrobat.com services are supported on Microsoft Windows XP and Vista as well as on Mac OS X. The online service suite from ADOBE can also be accessed through a Rich Internet Application (the AIR version of Acrobat.com) which provides the possibility to publish, share, edit or browse documents directly from the computer desktop. The AIR version of Acrobat.com can be downloaded from here.
The applications and tools contained in the suite are: Share, Create PDF, Adobe Buzzword, Adobe ConnectNow and My Files. They make the online collaboration with your team a lot easier, at the same time providing flexible access from any Internet connection.
Adobe Buzzword is a web browser based word processor capable of editing and exporting many types of documents like .txt (plain text), .pdf (Adobe PDF), .docx and .doc (Microsoft Word), HTML and more. Images (JPEG, PNG or GIF) can be inserted and easily positioned in documents. Authoring rights can be assigned to users for a certain document. The free online word processor also has many other features besides the ones mentioned in this article, so much so that due its overall capabilities it could compete with commercial desktop software.
Adobe ConnectNow is an online conferencing application that makes work more productive through an efficient web based collaboration system. Among its multiple features Adobe ConnectNow provides: video conferencing opportunity, chat pod, a unique URL for your meeting room and more.
For file sharing and storage there are 5GB of web disk space for any user account. The files can be organized online in a flexible way through a simple to use interface. There are limitations regarding the type of files uploaded and respectively shared: you are not allowed to use various formats of video, audio, executable, fonts, archives or database and raster image files on the Acrobat.com account.
Acrobat.com services are supported on Microsoft Windows XP and Vista as well as on Mac OS X. The online service suite from ADOBE can also be accessed through a Rich Internet Application (the AIR version of Acrobat.com) which provides the possibility to publish, share, edit or browse documents directly from the computer desktop. The AIR version of Acrobat.com can be downloaded from here.
Wednesday, September 24, 2008
The Android era begins
Google's Android OS is the driving force behind the new $179 T-Mobile G1 phone and a passel of apps designed to go with it
http://www.cnet.com/google-android/
http://www.cnet.com/google-android/
Monday, September 22, 2008
Javascript bar chart
Javascript bar chart : Chart : GUI Components JAVASCRIPT DHTML TUTORIALS
http://www.navioo.com/javascript/dhtml/Javascript_bar_chart_1774.html
http://www.navioo.com/javascript/dhtml/Javascript_bar_chart_1774.html
Wednesday, September 17, 2008
CHM Reader
CHM Reader is an extension to allow Firefox to read Compiled HTML (.chm) files. After installation, with "File | Open CHM File", you can open a CHM file in Firefox. With "View | Sidebar | CHM Reader" or "Ctrl-E", a sidebar that contains topics and an index of the CHM files will be shown.
Dealing with XForms - PHP
» XForms defines a variation on traditional webforms which allows them to be used on a wider variety of platforms and browsers or even non-traditional media such as PDF documents.
The first key difference in XForms is how the form is sent to the client. » XForms for HTML Authors contains a detailed description of how to create XForms, for the purpose of this tutorial we'll only be looking at a simple example.
Example - A simple XForms search form
Read more >>
The above form displays a text input box (named q), and a submit button. When the submit button is clicked, the form will be sent to the page referred to by action.
The first key difference in XForms is how the form is sent to the client. » XForms for HTML Authors contains a detailed description of how to create XForms, for the purpose of this tutorial we'll only be looking at a simple example.
Example - A simple XForms search form
<h:html xmlns:h="http://www.w3.org/1999/xhtml"
xmlns="http://www.w3.org/2002/xforms">
<h:head>
<h:title>Search</h:title>
<model>
<submission action="http://example.com/search"
method="post" id="s"/>
</model>
</h:head>
<h:body>
<h:p>
<input ref="q"><label>Find</label></input>
<submit submission="s"><label>Go</label></submit>
</h:p>
</h:body>
</h:html>Read more >>
The above form displays a text input box (named q), and a submit button. When the submit button is clicked, the form will be sent to the page referred to by action.
Tuesday, September 16, 2008
CSS background-position
HTML CSS TUTORIALS » CSS Attributes and Javascript Style Properties » background position »
Try it
background-position
Related in same category :
Try it
background-position
Related in same category :
Monday, September 15, 2008
Yahoo! UI Library - Slider Widget
JAVASCRIPT DHTML TUTORIALS » GUI Components » Slider »
Try it here :
Yahoo! UI Library - Slider Widget
Try it here :
Yahoo! UI Library - Slider Widget
Tuesday, September 2, 2008
Open Source Scripts and Programs Ajax Javascript
Thousands of open source Javascript /Ajax projects
XML parsers
Content Editors
Image processing
XML parsers
Content Editors
Image processing
Subscribe to:
Posts (Atom)
Posts
