The US Department of Homeland Security, under the Common Weakness Enumeration initiative put out the 2010 CWE/SANS Top 25 Most Dangerous Programming Errors. Most of the errors noted related to web application security programming errors.

• Failure to Preserve Web Page Structure (‘Cross-site Scripting’)
• Improper Sanitization of Special Elements used in an SQL Command (‘SQL Injection’)
• Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’)
• Cross-Site Request Forgery (CSRF)
• Improper Access Control (Authorization)
• Reliance on Untrusted Inputs in a Security Decision
• Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’)
• Unrestricted Upload of File with Dangerous Type
• Improper Sanitization of Special Elements used in an OS Command (‘OS Command Injection’)
• Missing Encryption of Sensitive Data
• Use of Hard-coded Credentials
• Buffer Access with Incorrect Length Value
• Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP File Inclusion’)
• Improper Validation of Array Index
• Improper Check for Unusual or Exceptional Conditions
• Information Exposure Through an Error Message
• Integer Overflow or Wraparound
• Incorrect Calculation of Buffer Size
• Missing Authentication for Critical Function
• Download of Code Without Integrity Check
• Incorrect Permission Assignment for Critical Resource
• Allocation of Resources Without Limits or Throttling
• URL Redirection to Untrusted Site (‘Open Redirect’)
• Use of a Broken or Risky Cryptographic Algorithm
• Race Condition

As an aid for myself, and maybe other Open Social developers, I have organized the pertinent Open Social presentations as follows…

Meet the OpenSocial Containers
Representatives from current OpenSocial containers give an overview of their implementations, policies, and what’s unique about their container. They also share some of the fruits of their labors including high level stats. Team members from upcoming containers review their planned launches, policies, and timelines.

Apache Shindig: Make your Social Site an OpenSocial Container
Shindig is a new project in the Apache Software Foundation incubator and is an open source implementation of the OpenSocial specification and gadgets specification in multiple programming languages. The goal of Shindig is to make it easy for social sites to extend their functionality using the OpenSocial API, which makes it easier for developers to write to write those extensions.

Building on the Promise of OpenSocial
The goal of OpenSocial is to provide a framework for developers to build their applications once and run them in multiple social networks. To do this effectively, you need to architect your system to properly segment data and accommodate differences in networks, all while still maintaining a common code base. How do you scale this architecture out to multiple applications? Jeremiah Robison, CTO of Slide, will outline best practices for delivering multiple applications on multiple OpenSocial containers.

OpenSocial – Scaling and Analytics, Nuts & Bolts
iLike uses Ruby on Rails and a core “user”, “fan” and “music” metadata infrastructure to drive iLike services on it’s own site and on Facebook, OpenSocial, the iLike Sidebar for iTunes and Windows Media Player, and other UI projections across the web. Nat will give an overview of iLike’s infrastructure and the places they have invested to make the syndication and projection that are central to Web 2.5/3.0 world quick and easy, with a focus on social gadgets. He’ll also discuss the role of analytics and A/B testing on user acquisition and customer satisfaction.

OpenSocial Across Containers
OpenSocial provides a common set of APIs that developers can learn in order to create applications that run on multiple social sites. However, since social sites vary widely in functionality, OpenSocial provides ways to extend the core APIs so containers can implement site-specific functionality.

OpenSocial, OpenID, and OAuth: Oh, My!
A number of emerging technologies will soon collectively enable an open social web in which users control their information and it can flow between multiple sites and services. OpenID, OAuth, microformats, OpenSocial, the Social Graph API, friends-list portability, and more will be discussed, as well as a coherent vision for how the pieces fit together and how developers can start taking advantage of them now.

OpenSocial: A Standard for the Social Web
OpenSocial is an open specification defining a common API that works on many different social websites, including MySpace, Plaxo, Hi5, Ning, orkut, Salesforce.com and LinkedIn, among others. This allows developers to learn one API, then write a social application for any of those sites: Learn once, write anywhere.

URLs are People Too – Using the Social Graph API to Build a Social Web
Using email addresses to identify people has a problem – email addresses can be used to send, not receive. With the rise of blogs and social networks, millions of people are using URLs to refer to themselves and others. The Social Graph API indexes these sites and their connections, enabling this web-wide distributed social network to be used to make your sites better. Learn how XFN and FOAF express connections, how we index them, and how OpenID combines with The Social Graph API to help connect people on the web to your applications, and save your users from re-entering their friends over and over again.

Technorati Tags: google, open social, social, io, java

Even though the scans are not the best, there are some features that just work well. Just like Google Maps, where you can send a link to a map (with a set size, address, etc), with Google Books you can send a link to a specific page in a certain book with specific words highlighted. Google also has handy links such as the table of contents, popular passages, and where to buy the book (perhaps in a better quality PDF format).

All the books listed here have a ‘limited preview’, meaning that some pages are not available for viewing but for the most part you can browse through most the the book. Google Books does indicate the pages that are not available.

Java
The Java Language Specification
Effective Java Programming language
Java: The complete Reference
Java In A Nutshell
Head First Java

C/C++
Practical C++ Programming
C++ The Core Language
The Concurrent C Programming Language
C++ Primer Plus

.Net/C#
The C# Programming Language
The Visual Basic .NET Programming Language
Pro C# 2005 and the .NET 2.0 Platform
Learning Visual Basic .NET
VB.NET Language in a Nutshell

Python
Python in a Nutshell
Learning Python
Visual Quickstart Guide: Python
Python Pocket Reference
Python Cookbook

JavaScript/DOM
JavaScript: The Definitive Guide
Beginning JavaScript with DOM Scripting and AJAX
The Book of JavaScript
The Complete Reference JavaScript
JavaScript Bible
DOM Scripting

Ruby/Rails
Ruby in a Nutshell
The Ruby Way
Beginning Ruby
Ruby on Rails: Up and Running
Rails Solutions: Ruby on Rails Made Easy
Beginning Ruby on Rails E-Commerce

PHP
PHP in a Nutshell
Programming PHP
PHP Cookbook
Learning PHP and MySQL
Learning PHP 5

Database
Visual Quickstart Guide: MySQL
MySQL Cookbook
MySQL in a Nutshell
MySQL Tutorial
Programming SQL Server 2005
SQL Server 2005: Developer’s Guide
SQL Server 2005: A Beginner’s Guide
Beginning SQL Server 2005 Express

Technorati Tags: java, php, database, programming, language, .net, ruby, rails, google, book search, dom, javascript, python, vb

Quercus is available with the latest Resin but it is also available for download as a WAR file which can be deployed on Resin or other application Servers such as GlassFish.

Getting Started

Get the latest version of Resin server, as of this writing the latest version is Resin 3.1.3. To start the server just run the <INSTALL DIRECTORY>\bin\httpd script from the command prompt. If you look around the Resin install directory you will find a php folder where the Quercus WAR file is already configured to handle any PHP file. To give the Quercus PHP engine a try, lets create a simple test. First lets create phptest directory in <INSTALL DIRECTORY>\webapps. In the phptest directory create a new file, index.php, and add the following text to it.

<html>
<body>
<?php phpinfo(); ?>
</body>
</html>

The phpinfo method outputs a large amount of PHP configuration information. I usually print this information out to ensure that PHP is setup correctly. If you have already started the Resin server you can direct your browser to the following URL: http://localhost:8080/phptest/

You should be looking at a screen that looks like the following screen shot.

Mixing PHP with Java

Since Quercus is written in Java there are hooks to import and mix Java classes in your PHP files. Lets import a Java class and manipulate it in PHP. In the next sample piece of code I will import a Java HashMap class and manipulated it PHP. The import functionality is obviously not part of PHP but an extension made possible by Quercus. .

<html>
<body>
<?php
import java.util.HashMap;

$map = new HashMap();

// Add some name-value pairs
$map->put(‘california’, 1000);
$map->put(‘oregon’, 1200);

$total = 0;
// Iterate over keys and sum values
for($itr = $map->keySet()->iterator(); $itr->hasNext(); ) {
$key = $itr->next();
$total += $map->get($key);
}
print “Total $total”;

?>
</body>
</html>

Once a Java class has been loaded it can be handled just like any other object in PHP. In addition having access to JDK classes, you can import your own Java code. You can import any class that is available in your web applications class loader.

Run PHP Applications

Using Quercus and Resin you can deploy full fledge PHP web applications such as WordPress or Joomla! To get a PHP application running on Resin with Quercus you just need to unzip the application into the <INSTALL DIRECTORY>\webapps directory. Since your PHP application would be running on top of Java you need to have the right JDBC dirver installed in the <INSTALL DIRECTORY>\lib directory. This is usually all you have to do to have a PHP application to run on JSP/Servlet container like Resin.

There is a list of PHP applications that are known to be running on Java via Quercus.

Quercus opens a lot of opportunities for PHP web development. Now you don’t really have to choose between languages or frameworks, develop in what you know is best for the task and resources at hand and interoperate between PHP, Java, Ruby, Groovy whatever not at the XML level but at the bytecode.

Technorati Tags: php, java, jvm, quercus, jdk, jruby, ruby, rails, rubyonrails, resin

This session dealt with performance and profiling considerations spanning the whole stack from using DTrace on Solaris to using caching in your application. Dtrace is dynamic tracing utility made available in Solaris that will help you discover bottlenecks in your application by analyzing the whole process.

Another session dealt with GlassFish. GlassFish is an enterprise ready Java EE 5 Application Server with easy management tools and clustering support. GlassFish supports RIFE, Rails, Struts, Wicket and just about every other Java web application framework under the sun, no pun intended.

Tim Bray of Sun moved up the stack and talked about web technologies such as PHP and Rails. Tim stated that PHP is easy to learn and quick to develop with. PHP has a share nothing architecture that is great for scaling but is historically known for the tons of security holes, SQL injection, and cross-site scripting attacks. Tim noted that some developers would trade the security of JEE for the speed of development of PHP to get first to market. Tim also mentioned that Don’t Repeat Yourself, Convention Over Configuration and the expressiveness of Ruby while talking about Rails. The Ruby programming language allows for Rapid Agile Development. The big knock against Rails is its lack luster performance and it’s multi-headed mongrel deployment story. PHP or Rails are a good solution for many of the CRUD applications that babysit a database.

The last session of the talked compared Ehcache and memcached. Memchached is said to be used in LiveJournal and Slashdot as well as many Ruby on Rails applications. Ehcache distributed peer-based caching in Java sync/async operations used in Spring and Hibernate.

Technorati Tags: communityone, javaone, javaone2007, dtrace, solaris, glassfish, php, rails, ror, memcached, ehcache

svn://rubyforge.org/var/svn/liquidrail/plugins/ziya/trunk

You typically install a Rails plugin by executing ‘script/plugin install URL’ from the application directory where you replace URL with the one above.

Once ZiYa has been installed you need to include one line into the controller to load the required graphing capabilities. Add the following line in the controller near the top.

include Ziya

To follow along with the code examples, create a bargraph action in the controller so that we can create a bar graph. In the bargraph action we will create a bar chart object with code similar to the following.

def bargraph
chart = Ziya::Charts::Bar.new
render :text => chart
end

The new bar chart will contain default data so that at this point we can quickly move onto the view and see ZiYa and XML/SWF in action. You do not have to create a rhtml view for bargraph since the action will generate the necessary XML required for the chart. You can render the chart in any rhtml view by adding the following view helper code.

<%= gen_chart(“chart_id”,
url_for(:controller => ‘mycontroller’, :action => “bargraph”),
“#ffffff”,
400,
300) %>

The above action and view code will generate a chart with default data that looks like the following.

if you want to create a similar graph with code replace the action with the following code.

def bargraph
chart = Ziya::Charts::Bar.new
chart.add(:axis_category_text, [ "2003", "2004", "2005"])
chart.add(:series, “Region A”, [100, 25, 40], ['Large', 'Low', 'Soso'])
chart.add(:series, “Region A”, [80, 70, 20])
render :text => chart
end

For this graph, the :axis_category_text symbol indicate that the following values are the y-axis labels. To produce x-axis labels you can add data for :axis_value_text. The series symbol indicates your data points. You will also notice that when setting the series data point there is an optional string array. That string array is used as legend or label for the bars in this series. The chart is highly customizable, you can create yml files that describe the theme such as color, border, and even animation effect for each charts.

The other graph types are just as easy to generate. Just as an example below is the action code required to generate a pie chart.

def piegraph
chart = Ziya::Charts::Pie.new
chart.add :axis_category_text, ["2003", "2004", "2005"]
chart.add :series, “Region I”, [200, 100, 50], ['Super', 'Large', 'Medium']
render :text => chart
end

ZiYa is such a large and rich plugin that I obviously can’t do it justice. Please take a look at the Google Groups and official documentation.

Technorati Tags: ruby, rails, rubyonrails, chart, graph, ming, php, plugin, rails plugin, xml/swf, php/swf, flash, ziya, swf

2. If you are using Google Analytics to track your blog’s performance I recommend the Google Analytics plugin by Boakes. It is simple to install and configure, just have your Google Analytics User Account handy.

3. If you are using Google Analytics you might also be using Google Sitemaps. Google Sitemaps helps Google crawl and index the new content available in your site. Yahoo and MSN also use Google Sitemaps. I have been using the Google Sitemap Generator plugin from Arne Brachhold.

4. Tags are sooo web 2.0, that is to say so last year. That said, I use SimpleTags by Broobles. I went through several tagging plugins until finally settling with SimpleTags.

5. Along the lines of web 2.0 WordPress plugins, I recommend Social Bookmarks by Apostolos Dountsis. Social Bookmarks adds a list of icon links at the end of each post to submit the post to your favorite social bookmarking sites such as Digg, Del.icio.us, Reddit, and others.

6. If you are a techie blogger and post a lot of code samples you should use SyntaxHighlighter by Erik Range. SyntaxHighlighter can high light the keywords in programming languages such as C++, C#, CSS, Java, JavaScript, PHP, Python, Ruby, SQL, VB, XML, and HTML. You can also easily customize other display options for this plugin.

7. If you are like me you are often counting your page views via Google Analytics. Ivan Djurdjevac has written a helpful little plugin called Count Posts that will display the hits per post or a list of the top post on you site. This plugin is a bit more difficult to setup because to display the hit counter you need to edit the theme you are using itself to add a bit of PHP code.

8. If you have a del.icio.us account you should install the Del.icio.us Cached++ WordPress plugin by João Craveiro. LIke Count Posts, you will need to edit your theme files to add a bit of snippet of PHP code. I placed the one liner in the sidebar.php of my current theme.

9. Another kick ass WordPress plugin is the Automattic Widget plugin. The Widget plugin is a mini WP framework which WordPress developers can develop sidebar WordPress components, or widgets. For example, the Del.icio.us Cached++ plugin could easily be re-written to be a WordPress widget. There are a ton of widgets already available.

10. The Exec-PHP WordPress plugin allows PHP code inside you posts. The PHP code is stored alongside you post content in the database and executed before rendered to HTML. This plugin is great because you can embedded custom PHP code in your post and have that managed by WordPress. All of the WordPress PHP functions are visible from Exec-PHP code. This plugin was written by Sören Weber.

There are a ton of other great WP plugins. The ones I have listed above are the ones I have found indispensable. Here is a quick list of runner up plugins that you might find it useful… For a popular WordPress blog you will need WP-Cache for faster loads. To display AdSense ads alongside your content you will need AdSense-Deluxe. I also recommend the Gravatars WP plugin.

What is your favorite WordPress plugin?

Technorati Tags: wordpress, plugin, google, analytics, adsense, sitemap, php, delicious, widgets, exec-php, php, cache, wp, spam, akismet, tags, bookmarks

But if you want to dynamically display images on you Joomla! site, I recommend you take a look at the AJAX Header Rotator module made available by JoomlaWorks. AJAX Header Rotator also requires a image directory path but instead of displaying a single random image, this module will load all the images and display one at a time. The AJAX Header Rotator rotates through images randomly or sequentially. Behind the scenes, AJAX Header Rotator uses jQuery to rotate through the image set.

A note of warning, I had to hack the AJAX Header Rotator module because I felt it lacked a few key parameters. For one, AJAX Header Rotator loads all the images in the image folder and I had felt there should be max number of files that it loads and rotates through on each user visit. I also added a parameter to enter the image alt text. And finally, the module code always displayed the same first image so I had to shuffle the images array to display a distinct image as the initial image.

Technorati Tags: joomla, cms, module, php, ajax, javascript, jquery, design, image rotator, rotator

header('Location: index.html');

I opted to use PHP solution instead of the HTML meta refresh tag. You can do the same thing by placing this tag in your html output.

<meta
  http-equiv='refresh'
  content='0;URL=http://www.juixe.com'>

Of course, you can redirect to another page in just about in every language, including JavaScript as this snippet of JavaScript code demonstrates it:

document.location.href='index.html'

JavaScript:

<script
   type='text/javascript'
   src='directory/file.js'>
</script>

CSS:

<style type='text/css'  media='all'>
   @import 'directory/file.css';
</style>

Icon:

<link
   rel='Shortcut Icon'
   href='directory/file.ico'
   type='image/x-icon'>

PHP:

<?php @ require_once ('directory/file.html'); ?>

For the PHP import, by placing the @ symbol before require_once suppresses any error messages that might be generated in the included PHP file.

JSP:

<%@ include file='jspfile.jspi' %>

And, well, I guess the list can go on and on. You can use Struts Tiles to include other JSP snippets. I am sure that other languages and frameworks have the same functionality.