http://cgi6.ebay.com/aw-cgi/eBayISAPI.dll?RedirectEnter&partner=ShowItem&loc=http%3A%2F%2Fus.ebayobjects.com%2F2c%3B9739597%3B9123118%3Bz%3Fhttp%3A%2F%2Fcontactbay-ws-bayisapi.xm.com%2F

It's amazing that with all the phishing attempts out there, eBay is actually falling down on the job by allowing their own site to redirect unsuspecting users to the phishing web site.

CMX is focused on Adobe products, but also all web technologies -- html, asp, php, coldfusion, sql, css, javascript, and any other technology related to web development.

The Cartweaver development team is pleased to announce the release of the Downloadable Products Plug-in for Cartweaver 3 CF

Now you can deliver your digital products immediately! This Cartweaver plug in allows your customers to download documents, PDFs, music, photos, artwork, software, and other digital products right away!

- Easy to integrate with your Cartweaver 3 CF store
- Upload your digital products via the store admin
- Customers can log in and download immediately after purchase
- Customers can re-download as few or as many times as you allow
- Customers can update contact information
- View entire order history
- Print out previous history

Available now! Go to the Products - Plug-Ins page and log in for availability and pricing.

The class is typically used on a page by itself, or on any page within conditional statements. You link to the page and the file download begins. The class constructor has 3 arguments:

$csvfile = new CSVFile(recordsetName, [quotes true or false], [filename]);

The first is the MySQL recordset. The second optional argument is true or false to put quotes around the fields. The third optional argument is the filename, which defaults to Download.csv by default.

To use it, follow these instructions:

1. If this is a Cartweaver recordset, make sure you include the application.php file at the top of the page:

require_once("application.php");

2. Include the class file:

require_once("yourclassdirectory/CSVFile.php");

3. Create your recordset. Below is a typical Dreamweaver recordset, using the Northwind database that you can download here for MySQL if you don't have it:

mysql_select_db($database_connNorthwind, $connNorthwind);
$query_rs = "SELECT p.ProductID, p.ProductName, p.UnitPrice FROM products p ORDER BY p.ProductID";
$rs = mysql_query($query_limit_rs, $connNorthwind) or die(mysql_error());

For Cartweaver, a typical recordset might look like this:

$query_rs = "SELECT * FROM tbl_orders ORDER BY order_Date";
$rs = $cartweaver->db->executeQuery($query_rs, "rs");

4. Add a line to invoke the CSVFile class:

$csvfile = new CSVFile($rs, true);

5. Link to the file.

Now, when the page is browsed, the file download will begin immediately.

• Creating a Simple Database Web Search - Part 2: ColdFusion
• Creating a Simple Database Web Search - Part 2: PHP
• Create a Simple Database Web Search - Part 1

This was in response to users who like my Dynamic Search extension, but don't need the keyword functionality. The first part shows how to do a simple search using "filters" in Dreamweaver. The second part (separated for PHP and ColdFusion) shows how to hand-code a few modifications to allow for multiple parameters.

There were also 3 articles on building Horizontal Loopers manually using Dreamweaver tools -- only using CSS instead of tables. Those articles are broken down for ASP, PHP, and ColdFusion as well. The ASP article came out a few weeks ago, at the request of one of my customers:

• Creating a Table-less Horizontal Looper in ColdFusion
• Creating a Table-less Horizontal Looper in PHP
• Creating a Table-less Horizontal Looper in ASP

As always, articles at Community MX are free for members, and a very small fee for non-members. I'm always looking for ideas for new articles, so if there is something you want to see use the contact form to make suggestions. Thanks!

• Official Sys-Con Announcement
• Ben Forta's blog
• Brian Rinaldi's Blog
• Michael Dinowitz's Blog of Fusion
• Sean Corfield
• Ray Camden
• TJ Downes
• Simon Horwith
• Matt Woodward - Post 1
• Matt Woodward - Post 2
• Oliver Merk
• Brian Meloche

The funniest part of this is the almost universal distaste for Sys-con. Their web site has always been horrible, and they consistently "borrow" content from other places to make up for their own lack of content. They have always treated authors badly, saying that authors are a dime-a-dozen and there is no need to pay them. The web site is the most hideous creation on the Internet. Remember that book "Web Pages that Suck"? The Sys-con site could have filled the entire book. No need to look elsewhere. Brian Meloche said it best: "Sys-con.com looks like it was developed by a crystal meth addict." I would add that the addict was probably drunk at the time.

I've been to one of their conferences (AJAX World), and while well-run, it was a complete commercial. There were 10 sessions, and only one of them had any type of technical content. I got in for free, but feel ripped off for having taken the time to attend.

I think the decision was probably made a long time ago. The URL cfdj.com has already fallen to a link whore...that doesn't happen overnight. If that is true, it's a shame that they didn't feel obligated to tell the editorial staff (see Simon's post).

This is funny too...I took a screenshot in case it gets removed, but on many of the sys-con home pages, two of their "borrowed" blogs are blasting sys-con:

That's poetic justice.

There are still plenty of other places to get CF content. Community MX is still alive and well and delivering some good quality CF content in addition to content relating to all of Adobe's products and other web technologies.

somevariable=1%20and%201=convert(int,(select%20top%201%20username%20from%20adminusers))

or

somevariable=1%20and%201=convert(int,(select%20top%201%20char(97)%2bpassword%20from%20adminusers))

or an attack specific to SQL Server:

somevariable=convert(int,(select top 1 table_name from information_schema.tables))--sp_password

somevariable=convert(int,(select top 1 table_name from information_schema.tables where table_name not in (dtproperties)))--sp_password

somevariable=convert(int,(select top 1 table_name from information_schema.tables where table_name not in (dtproperties,sysconstraints)))--sp_password

somevariable=convert(int,(select top 1 table_name from information_schema.tables where table_name not in (dtproperties,sysconstraints,syssegments)))--sp_password

somevariable=convert(int,(select top 1 table_name from information_schema.tables where table_name not in (dtproperties,sysconstraints,syssegments)))--sp_password

The first problem was an exploit of the user's default error handling page -- if no error handling is in place, the error message might contain the username, password, or other information:

Error Executing Database Query. [Macromedia][SQLServer JDBC Driver][SQLServer]Syntax error converting the varchar value 'yourpassword' to a column of data type int. <br>The error occurred on line 102.

In the real attack, the user password was shown on the page. The password was prefaced with the letter "A" -- the char(97) in the attack. This is in case the password started with a number. This can be prevented by using <cfqueryparam> or other device specific to your programming language to make sure integer values are passed as integers.

The second problem is that the default web database user has access to tables that should never be accessible to the web. The malicious user was able to obtain table information from information_schema.tables, and work from there, systematically building each time on information that was previously obtained.

The best possible scenario is to turn off all table access to the web and only access data through stored procedures. That is not always possible. At the very minimum, only expose the data necessary for the site, and only allow access to statements that are required for operation of the site. For example, if you have a table called "Payments", and this is only available to admins, create two SQL username/password logins and use one for the publicly accessed site and one for the admin section. Turn off all permissions to the "Payments" table for the web user. Create "SELECT" permissions only on tables that only need to have data displayed.

As a DBA (which you are if you have a web site with a database and you are the person responsible for the database), you need to know how to secure your data. That involves setting up specific database users for specific access. If a web host gives you a dbo user for a specific database, do not under any circumstance use this username for your web site. This user can be used to create web user logins with specific access. MySQL has similar security features. Access users are out of luck.

The other key is never displaying error messages to users. Make sure your error handling page only shows a pretty message to the user with no information in it, like "You've created an error. Go back and try again." Or prettier than that.

And don't use words or letters for username/password combinations. Passwords should be 10 characters or more, and contain letters, numbers, and special characters. Brute force password guessing programs can figure out a password quickly if you use English language words or just letters.

I'm getting these attacks on my site too. It's scary sometimes having a web site, but hopefully there are safety measures in place to keep these parasites out.

My latest book, "The Essential Guide to Dreamweaver CS3 with CSS, Ajax, and PHP", has just been published, and is now shipping from Amazon.com (and possibly other places). It's a major rewrite of "Foundation PHP for Dreamweaver 8", and has six chapters devoted to working with Spry, including one that shows you how to combine Spry with PHP to make an accessible online gallery. Roughly 60% of the material in the book is new. For more details, see my site:

http://foundationphp.com/egdwcs3/

I recommend it highly to anyone interested in Dreamweaver and/or PHP.

For those of us in local bands, Talas was a band that we all looked up to and wanted to be like. As an aspiring guitar player, I would go to Talas shows 2 or 3 nights every week, and eventually saw them over 300 times. They never disappointed and had hundreds of songs in their repertoire. Talas consisted of Dave Constantino on guitar, Billy Sheehan on bass, and Paul Varga on drums. The music was hard rock, but with a melodic edge to it, or pop with a hard rock edge...take your pick. Dave's original band -- The Tweeds -- was around the area in the 60's and had a regional hit single called "Thing of the Past", which was a Beatle-esque ballad. When Talas broke up in the early 80's, Dave re-formed The Tweeds with Paul Varga and played smaller clubs with small amps for that 60's sound, and sometimes even a box to beat on instead of a drum to get that early Elvis sound.

Talas had a few regular gigs, including Monday nights at Harvey and Corky's Stage One, a small local bar that was also the place to be on any given night. They would have free drinks until 10PM, and Talas would get on about midnight and play until 3AM or later. Harvey Weinstein eventually went on to become a big name movie distributor, but back then he was a concert promoter in Western NY. Talas would also allow other bands to open up for them, including touring bands promoting records. One night, I was fortunate enough to see U2 opening for Talas at Stage One on a tour promoting one of their early albums. At the time I remember thinking they were one of the cooler bands who came through, but they have since gone onto bigger things. I was at Stage One on a Monday night seeing Talas the night John Lennon was shot, and Talas did a set of Lennon tunes to close the night.

Talas had a few reunion shows after many years of being apart -- in 1997 they played Kleinhans Music Hall in Buffalo, which was later released as a live CD called If We Only Knew Then What We Know Now. I didn't know about that show, unfortunately. Then in 2001 they did a reunion show on the waterfront in June in Buffalo, which was later released as a live DVD. I was there that night, along with about 18,000 people. What an amazing night that was. They did all the old Talas classics like "Thickhead" and "Sink Your Teeth" and some of the most popular cover tunes they used to do back in the 70's/80's like "Battlescar", "Stealin'", and "Helter Skelter".

The highlight of my years seeing Talas -- and one of my own personal musical highlights -- was one New Year's Eve at a club called the Lone Star, when Dave called me up on stage to do a song with them. That was an amazing experience I'll never forget. During the first set he stuck his guitar neck out into the crowd and let me finger the chords as he strummed the guitar. Then in the next set, he called me up. A couple of my band mates were there, along with most of my friends. We did the old Sammy Hagar tune "One Way to Rock", and it sounded great from where I stood. It was very cool to be on stage jamming with Billy, Dave, and Paul. They didn't know me, as I didn't talk much, but still they took a chance and let me do a song. I'm grateful for that.

The new CD is more bluesy than the songs that Dave did in Talas, but has a much more prominent guitar. I highly recommend it. Dave's guitar is always tasteful, and reminiscent of Montrose, Page, Clapton, and other rock guitarists of that era. He also had the best sound I've heard, with a Les Paul plugged straight into a Marshall. On the Talas albums, he never seemed to cut loose in the studio the way he did in live shows and played in a very restrained way, but on this CD he has more of an opportunity to showcase his playing. As Dave was the guitar player that I saw the most when I was first starting out, I developed a similar style myself, although I also had many other influences. The CD also features the Rinehart brothers on bass and drums, who coincidentally lived directly behind me when I was growing up in Tonawanda, NY, although at the time I didn't know they were musicians. It's a small world.

Pick up the CD at Dave Constantino's web site.

1. Enhanced speed. This is a big one. There were some benchmarks shown of 50% and more increase in many of the basic ColdFusion constructs, such as initiating CFCs (9 times faster, as I remember) and simple things like cfparam, date functions, and regular expression throughput. Since these are things I use all the time, I will be interested in doing some of my own benchmarks.
2. Multiple CF Administrator logins. This is one of those things that has been asked for every year probably since the first CF version. It's something that should have been in the product from the start, as the current CF7 and earlier installations assume that you are the only person on the server. That is almost never the case.
3. Debugging. Anyone who knows me knows that I have been harping about lack of debugging in CF for ages, and actually switched a lot of my own development to PHP only because the development environments are more friendly with debugging. I hate having to debug with trace statements and cfdump. It is so 80's.

There are a lot of cool things about CF, but the new CF 8 looks really great and worth the upgrade price. Just the performance enhancements alone are worth it. The public beta is at labs.adobe.com

Ben Forta talks about the performance enhancements in his blog

TODCON is always a key event for the Dreamweaver community, despite it's small size. I should say because of -- not despite -- it's small size. Everybody is accessible, and by the end of the conference everybody ends up knowing each other. This year it was even better, as Adobe sent over a dozen representatives to meet with the attendees to gather feedback. They sent some of the top-level people on the Dreamweaver team, including the product manager Kenneth Berger. I got to talk shop for quite a while with Randy Edmunds (formerly from the Drumbeat team) and former Interakt guys Lucian and Christian. I also met and reconnected with some people I've known through the newsgroups and the Dreamweaver community. Being Vegas, there was also gambling, drinking, and eating. I played a bit of poker and went down a little, but didn't get to play very much. Mostly I was preparing presentations and socializing, with a little poolside relaxation mixed in.

I also didn't see a lot of the presentations, but of the ones I saw, the keynote was the most interesting -- showing the cool new features of Photoshop CS3 and Fireworks CS3, which I have not used yet. I was sorry I didn't get to see any of the Flex presentations, but CFUnited at the end of the month will have quite a few of those.

Next year TODCON will likely return to Orlando, but if you have a chance to get to one you really should check it out.

I'm doing two sessions at TODCON -- "Working with Dreamweaver Data and Beyond" and "Custom Tags in ColdFusion". The first session will show standard DW server behaviors and application objects and show how to modify them to do horizontal looping, multiple inserts and updates, and combination pages that do insert/update/delete. The custom tag session will show an intro to custom tags but also get into an advanced use of using a custom tag as a template for an entire site, which is how this site was built and all other sites I build. I'll show how any design template, such as a Community MX jumpstart, can be adapted using this technique.

If you're coming, I'll see you there. If not, you're missing a great conference.

I'll be at both TODCON and CFUnited this year, so if anyone wants to see a demo of CW, see me.

www.cartweaver.com

Correction: Pricing for upgrades is $100 until the end of May. More time available. The full price of $295 is now in effect for new users

There are many companies out there with shopping cart software, and some have come and gone. I'm sure many of them are great products, too. One thing about me that you might know if you've purchased extensions from this site is that I try to stand behind my code. I came to Cartweaver after version 2 had already been out, and translated the complete existing cart to PHP. I have complete ownership of the PHP code for Cartweaver, having translated or written every line of code in the product, and complete ownership of support for that product. For me, a product is like a child. You might send them off when they grow up, but you are always there for them. Now I have ownership of the CF code as well. Although I didn't write most of it, I am imtimately familiar with it. It's another of my children. Some of the larger companies that sell cart software stand behind their products, but you never really know who wrote what, or who to contact regarding problems. To me, writing code for a large project like this is like writing a novel or giving birth. This one was a douzy. I probably should have gotten the epidural.

See Cartweaver 3 in action at http://www.cartweaver.com/demos/. Existing CW 2 customers get the current upgrade price of $100. If you purchased within the last 60 days, the upgrade is free. To get your free upgrade, go to the Cartweaver site and add the product to your cart. After you login, the purchase price will be reduced to $0.00 so that you can add the product to your purchases and download it. Address any purchase questions to the support site at http://support.cartweaver.com/.

To purchase, go to http://www.cartweaver.com/

In the coming weeks and months I hope to have some articles and add-ons for Cartweaver 3.

A couple of weeks ago I decided on a whim to share some of my accumulated knowledge of the harp. So I figured out how to transfer footage from my digital videocam to my MacBook and compress it for export, and then I filmed and uploaded a couple of free-form harp lessons to YouTube entitled "Blues Harmonica Secrets Revealed."

One thing led to another. Now, two weeks later, I seem to have created my own channel at YouTube, with 20+ lessons in the can, 250 subscribers, and more than 35,000 combined hits. Just yesterday I decided to supplement the lessons by uploading a bunch of Satan and Adam videos, since there wasn't a single bit of footage of my duo on the web. I dug deep into the archives and found some stuff from the days when we were playing the Harlem street, plus our appearance at the 1993 Philadelphia Folk Festival. Later today I'm going to upload some stuff from a 1992 gig in Syracuse that will hopefully convince people that I'm NOT lying when I call Sterling the greatest one-man blues band in the history of the blues. It's late-night, end-of-set stuff where he's throwing down the way he used to on 125th Street in Harlem--stuff we never really got onto our CDs. But I've got the videotape to prove it.

I also found a video of outtakes featuring my harp teacher, the late (and legendary) Nat Riddles in a Richmond-area cable show called "Blues TV."

Here's my YouTube URL, for anybody interested in checking out all this stuff:

http://www.youtube.com/profile?user=KudzuRunner

If you have any interest at all in learning harmonica or brushing up on techniques, or just hearing some good music, check out the videos and subscribe to the series.

Update 6/23/2007: More on Adam Gussow...

All in all, I'm very pleased with MS support, even though in the end it was not much help. They are very keen to help, and will stick with you for hours. I wish the upgrade had worked, but I wish for a lot of things...

Obviously, the core idea of having a successful business is giving the customer what he wants. If an Internet service provider fails to give good service or charges too much, the customer can go elsewhere.

Read more here and here. Hands off the Internet has a few interesting studies.

Instead of worrying about what free people do in a free country, perhaps Google, Microsoft, and the others should put their money where their mouths are and stop allowing countries like China to block web searches it doesn't like. From the NYTimes:

"Yet Google's conduct in China has in recent months seemed considerably less than idealistic. In January, a few months after Lee opened the Beijing office, the company announced it would be introducing a new version of its search engine for the Chinese market. To obey China's censorship laws, Google's representatives explained, the company had agreed to purge its search results of any Web sites disapproved of by the Chinese government, including Web sites promoting Falun Gong, a government-banned spiritual movement; sites promoting free speech in China; or any mention of the 1989 Tiananmen Square massacre. If you search for "Tibet" or "Falun Gong" most anywhere in the world on google.com, you'll find thousands of blog entries, news items and chat rooms on Chinese repression. Do the same search inside China on google.cn, and most, if not all, of these links will be gone. Google will have erased them completely."

When you think about it, a web search brings up ALL relevant search terms. Even though Google and other web searches can be "bought" by rabid opponents of free speech doing "Google bombing", the net is still a pretty neutral and free place in this country...despite or because of the fact that the federal government hasn't gotten involved yet. Government regulations are like cancers that once introduced, begin to grow unfettered until all life is sucked out.