Zonealarm goes scareware

Users of the free personal firewall Zonealarm now get a popup notification that their computer may be at risk, slightly longer article in english and in german. I'm not known for spending a lot of money on security software, but i'm concerned and surprised by the decision of zonealarm to use scare tactics to get people to buy their software. I do urge everyone to not buy any zonealarm products since that kinda behavior shouldn't be rewarded. And what's next ? Do they give you a warning whenever they make a new product ? Warning you that your computer is now at risk of data loss if they just happen to make a backup program ?

Webdesign, chapter twelve: CMS part 4

This post is titled making things (slightly) more comfortable.
In the last post I showed you how you can get one page out of the database that I've created for this "CMS". I'm using air-quotes here because it's so far away from any freely available CMS that it shouldn't even be called that.... but we're getting there (slowly).
To get a specific page out of our database we need to specify what we actually want to get. In SQL this is done with a WHERE clause in our query. We're going to change our SELECT query to the following, to get the page specified by the URL field in our addcontent page:

$query = "SELECT * FROM xyious_content WHERE URL = '" . $PHP_SELF . "' ORDER BY ID DESC";

The ORDER BY in the end there just tells the DB to sort descending (DESC) by the ID field, so that we could just add a new page with the same URL into our database and that query would get the newer one (first, but we only get 1 row from our result set which would then be the newest entry).
That where clause is the only change we actually need to make to our display content page to make it universal, which means you can just copy and rename the file to get any page out of the database you want without changing a single character inside the file. Now that's way more comfortable than writing a whole page for every web page that you want to show people. However, it's not quite as comfortable as it should be, since you still need to put data into the database, copy and rename the display content php file, and make sure that the URL you entered when putting data into the database matches exactly the filename for the display content file. Luckily php can just do all that for you.
So we change our add content page to just write the file for us, so that the filename matches what we entered, the file is created at the same time as the content arrives at the database, so that it can be served immediately, so that there now is only a single step you need to go through when making a whole new page on your site, entering the content into the form we made. Now in the add content page we need to first check if the file we're trying to write already exists, since we don't really want to just overwrite potentially important files (or have someone else do that, considering so far the file is just out there, unprotected, and everyone could just enter all kinds of stuff into our database, so that everyone could just overwrite every single file on our website if we would just overwrite instead of checking. First we create a variable named filename in which we store the filename, and we get the value from the URL field of our form. We actually skip the first character of the URL field since it must be a slash (since $PHP_SELF has a slash in the beginning). Then we check if the file already exists, and if it does we're just not going to send any data to the db since we need to chose a different filename first:

$filename = substr($_POST['URL'], 1);

if (file_exists($filename)) {

echo "<h2>File already exists</h2>";

} else {

in the else clause we just put all of the code we already had, including the mysql_query() part. Below that we now put some code to actually create the file and copy the contents of a template file, then show us how many bytes were written so we can confirm that it actually worked:

$template = file_get_contents("template.php");

$file = fopen($filename,"w") or exit("Unable to open file!" . $filename);

echo fwrite($file, $template) . " bytes written";

fclose($file);

 The php code is very straightforward, file_get_contents gets the whole contents of a file and puts them into a single string variable, fopen opens a file, the second parameter there is "w" so that we can actually write into said file, the or exit part will prevent further execution of the php script in case we can't open the file, fwrite writes the contents of a string into a file, it returns the number of bytes written which we then echo to the website, and fclose quite obviously closes the file.
Amazingly enough that's already all we need for one step adding of a whole website to our server.

Webdesign, chapter eleven: CMS part 3

I guess that at some point someone might actually want to display the content that they have added to their database, so that's what we're going to do now.
For this we just use the same file that we had used in chapter 6 and take out the content. Now at the very top (before the doctype) we're putting the code to get data out of our database, first we use the same connect that we used to get data into the DB, and we obviously select the same DB:

$connection = mysql_pconnect('localhost', 'xyious', 'password');
mysql_select_db("WebsiteDB", $connection) or die(mysql_error());

then we write a simple query to get the data, execute it, save the result in $result, get a single row from that and save that in $row:

$query = "SELECT * FROM xyious_content ORDER BY ID DESC";
$result = mysql_query($query);
$row = mysql_fetch_row($result);

After that we start writing the actual web page, doctype, head, the links/imports for the css. Then as a title we use:

<title><?php echo $row[5]; ?></title>

then we continue with the closing tags and the opening div, at which point we add the following code:

<?php echo "<h1>" . $row[5] . "</h1>";
if ($row[6] != "") {
echo "<p style='text-align: center'>" . $row[6] . "</p>";
}
echo "<p>" . $row[7] . "</p>";
?>

In case you didn't remember, row 5 is the Headline, 6 is Description, 7 is Content.
Everything else remains the same as it has been in post6.
Right now we would have to make a reasonably specific page for every single web page, although we could already store all of the content in the database. That's obviously not very comfortable or useful, so we're going to change and add a few things soon.

Webdesign, chapter ten: CMS part 2

So basically we now have a table which could hold content if we wanted it to. Obviously that doesn't get us all that far. Now we have the hard parts, first we need to get data into said table, then we need to get it back out.
I'm going to use php to do all of the data stuff, you could obviously also use ASP (which makes things very easy, considering the visual studio is free and an excellent tool, not just for ASP development (can write neat little programs with it pretty quickly, too), or you could use ruby, which has a nice framework for web development with ruby on rails, or even a number of other languages. I use php because it's free, fast, and supported by damn near any web server out there.
So for now we're going to make a page that has nothing but a form on it, a very simple one at that, with only a few text inputs, where one could just enter all the data we need to make a whole new website.
First we need to connect to the database (the following code is all php code, so i'm omitting the php tags):

$connection = mysql_pconnect('localhost', 'xyious', 'password');

with that we're making a new variable called $connection, to which we're saving the result of the function mysql_pconnect. That function makes a persistent connection to the database, which I use in favor of mysql_connect for several reasons. mysql_connect should be used in most cases, though. The parameters for that function are server, user, password. Now we need to select the Database we're using:

mysql_select_db("WebsiteDB", $connection) or die(mysql_error());

That function obviously selects our db, if no connection can be made to the database, the whole script will just stop functioning right there and then, and give out an error (that's what that or die is for, which calls the function mysql_error() which gets the error that occurred.
Now we're going to evaluate the input we get from our form (yes this seems weird, since we don't even have that form yet.... but we're getting there in a minute).
We're going to make a variable named error that we increment every time there is an error, and then we check the variable after validating all the input to see if everything worked correctly:

$error = 0;
if (!$_POST['Author']) $error++;

and we check URL, Headline and Content the same way. We don't check tags or description because those don't need to have a value. Next we're going to build our query string, which will insert the values we get into our database:

if (!$error) {
$query = "INSERT INTO xyious_content (Author, URL, Headline, Content";
if ($_POST['Tags']) { $query .= ", Tags";}
if ($_POST['Description']) { $query .= ", Description";}
$query .= ") VALUES ('" . $_POST['Author'] . "', '" . $_POST['URL'] . "', '" . $_POST['Headline'] . "', '" . $_POST['Content'];
if ($_POST['Tags']) { $query .= "', '" . $_POST['Tags'];}
if ($_POST['Description']) { $query .= "', '" . $_POST['Description'];}
$query .= "')";

That is quite a bit of code for someone just starting, but mainly we're just making a new variable named query that holds the query string, and then just appends strings to the end of it, like tags if we entered any. The syntax (we use) to put our data into our database is:

INSERT INTO <tablename> (<column1>, <column2>, ...) VALUES ("<value1>", <value2>, ...)

The columns do not have to be in the same order as they are in the database, but you don't need to specify which columns you're putting which values into if you put a value into every column you have. I need to specify the columns because I'm leaving out 2 columns (ID and Timestamp) which are automatically filled if no value is provided.
Now we just need to execute the query and our content will be in the database:

if (mysql_query($query, $connection)) {
echo "<h2>Content Added</h2>";
} else {
echo "<h2>" . mysql_error() . "</h2>";
}

We're just giving out a short message if content was added successfully, and the error if it wasn't.
Next we just display the form so we can actually get some data and then we're done:

<form action='<?php echo $PHP_SELF;?>' method='post'>
<table frame="void" rules="none">
<tr><td><label for="Author">Author</label></td>
<td><input type="text" id="Author" name="Author" size="100"></td></tr>

This is mainly just html. <form> will make a new form, action tells the web page what to do with the data it gets, in this case we're just putting a php variable there that will put the address of itself (hence the evaluation code on top there, the form and the evaluation are the same page, it doesn't have to be and in many cases you have one page for the form and another page that just does the evaluation, but it's fairly straightforward to have it all together in one page, especially if it doesn't get outrageously long), method is the method of submitting the data, get and post are the 2 options we could use. get doesn't allow for values over 255 characters, so we have to use post here. Then we make a table just to align things right, and then we have the inputs. The label just puts a label on the input so we know what we have to enter, and then we just have input type text so we have a text field that we can enter data into. We do the same (label and input) for url, tags, headline, description. We use a textarea for the content, since it potentially gets very long, and then we just have a submit button that sends our values to the database:

<td><textarea id="Content" name="Content" Cols="100" rows="25"></textarea></td></tr>
<tr><td></td><td><input type="submit" name="submit" value="add"></td></tr>

And that's it. Now we can put stuff into our database, with no way of getting it back out. It's also not very comfortable.

Webdesign, chapter nine: CMS part 1

CMS stands for content management system, and is what quite a few websites use to manage their content. The content of the whole website is stored in a database and tools are used to store data or display data. Which means that the php files on the webserver don't even have content anymore, they're just used to get the content from the database and send it to the browser.
What I'm going to do now is write my own CMS. Now I obviously won't go so far as to include all the functions that any of the open source CMS have, I will just write a very basic CMS that is more of a proof of concept than something that actually should be used. I will, however, be using it to display my homepage at xyious.com. The CMS I will write will be so basic that it could be explained in a single blog post, it will be tiny compared to what's out there for free (list here). Don't try to go through that whole list and check out every single one of them, though. A few commonly used ones are Drupal, Impress, Joomla!, Typo3 and Wordpress. If you want to use a CMS, have a look at those first, see how they work, see if they do what you want them to do, and after all that, if you need something different, you can still have a look at other alternatives (or write your own !!! ;).

I will use MySQL as my database, since it's the only one offered by my hosting provider. I would prefer using PostgreSQL, since there are no licensing issues at all, among other advantages.
A database is a glorified spreadsheet (please don't send me hate mail, I do know that's not quite true), you have rows and columns that you store data in (in 99% of all databases) and you have functions to get the data back out. Every column has a name or identifier that you can (or have to) use to get your data.
We're gonna make a new table in our MySQL database like this:

CREATE TABLE `xyious_content` (
`ID` INT UNSIGNED NOT NULL AUTO_INCREMENT ,
`Timestamp` TIMESTAMP DEFAULT CURRENT_TIMESTAMP NOT NULL ,
`Author` VARCHAR( 255 ) NOT NULL ,
`URL` VARCHAR( 255 ) NOT NULL ,
`Tags` VARCHAR( 255 ) NOT NULL ,
`Headline` VARCHAR( 255 ) NOT NULL ,
`Description` VARCHAR( 255 ) NOT NULL ,
`Content` TEXT NOT NULL ,
PRIMARY KEY ( `ID` )
);

Create table obviously is the command to create a table (shocking i know), xyious_content is the name of the table we create, then on every line we have a column that we create. ID is the name of the first column, INT is the datatype, in the unsigned variety, not null means that we can never put "NULL" into this column and auto_increment means that we don't need to actually put a value into this column, if no value is provided the last automatically entered value is incremented by one and that value will be used. The other datatypes we use are Timestamp, which saves a point in time (if no value is given the current date and time will be used), Varchar which means that a string of characters can be entered between 0 and 255 chars long, and Text which is a variable length text type that holds really long texts if it needs to. Primary Key means that we can reference any row by this column, which means that it has to be a unique value. I hope I didn't add to the confusion with that paragraph. Please check the documentation of your database if anything is unclear.

Webdesign, chapter eight: CSS media query (fixing chapter 6 !)

I just wanted to post a quick entry about the chapter 6 that I kinda screwed up.
In the mean time I have remade the layout that I had wanted to use for my website using float instead of fixed position. I do think that it should work using fixed position, but it apparently does not.
Mainly we just have 2 lines that give us the 2 column layout that we would like to have:
div.sidebar-left-outter {float: left; width: 15%; height: 100%; }
div.main-outter {float: right; width: 85%; height: 100%; }

And then in the media query CSS file we have the following block of code:
@media screen and (max-width: 799px) {
div.main-outter, div.sidebar-left-outter {float: none; width: auto; height: auto; margin: 0 auto;}
}

So mainly we're just clearing the float to make text not float around our 2 columns (which it never does, which is why I think it's a misapplication of the float property, but many people recommend doing it this way), then we set the width to auto, which tells the browser to use all the available space. Obviously we can't have 100% height on both elements that both use 100% width, since then we could only see one of them, and we set the margins to 0.

Webdesign, chapter seven: CSS media query part 2

Ever since i wrote the last blog entry I've been wondering how we can have a layout for internet explorer (who to this day doesn't get media queries) than for the browsers who understand media queries.
Now we have made a beautiful layout that changes from a standard 2 column layout to a 1 column layout depending on how wide the browser window is, and there's no way to tell internet explorer what to do without the risk of screwing it all up.... well obviously there is. Actually there are a few ways, but i didn't really like any of them, so eventually I came up with my own.
So for that we just take advantage of the fact that IE doesn't get the media queries.
We just include the basic CSS file first like so:
<link rel=stylesheet href="include/body.css" type="text/css">
<link rel=stylesheet href="include/print.css" type="text/css" media="print">
and then ! below the basic CSS file (so that it's closer to the content, and therefore overwrites the basic CSS if neeeded:
<script>
@import url('include/queries.css') screen and (min-width: 1px);
</script>

Now we have a basic style for our website in case the browser doesn't get media queries yet, and we can have a nice layout for everyone who uses a decent browser (whole thing visible on my homepage).

Webdesign, chapter six: CSS media query

I think I have a new pet peeve. There are way too many designers who put specific dimensions on their websites/blogs/etc. Even the default blogger theme has a set width in pixels. Most designs on the CSS Zen Garden have a width in pixels. Now obviously they want their stuff to look good, and I have to respect that. However, I don't really think it looks good when viewed on a monitor that isn't the specific single one that they used to make the design. You can't even make your design for the "most popular" monitor in use today since there are so many different sizes and even aspect ratios that it just doesn't make sense. Yet still, A LOT, of websites use dimensions in pixels rather than percentages.
Now that I'm done with my rant.... We can't really just make our content width and sidebar width use percentages instead of pixels and be happy with it. In the best case we will have a few users that will see a scrollbar on the navigation while not having very much room to see the content, in the worst case our site isn't usable at all for some people. Also when someone wants to print out our page because of the excellent content we have, they're probably not interested in seeing what links you have on the left there.
With that I give you CSS media types (not usable in Internet Explorer until version 9 comes out).
You can define CSS media types in 3 different ways (seems like anything in CSS has 3 different ways of doing it):
When loading a separate CSS file as we have been doing it:
<link rel="stylesheet" href="style.css" type="text/css" media="screen">,
The @media rule:
@media screen { p {color: blue;}}
The @import rule:
@import url("style.css") screen;

Now obviously we're making a new style sheet for the print media type with dark text on white background, in case we're not already having that as our standard style sheet.
But, and even more importantly, now we can use CSS 3 media queries to see how wide the user's screen is, and, if necessary, put the navigation below the content:
In our print style sheet we change the three lines below:
div.sidebar-left {display: none;}
body {color: #000; background-color: #fff; font-size: 100%}
h1 {text-align: center; margin: 0;}

we also took out the div.main code since we only have the 2 columns and if we don't give it any style information it will just inherit the styles from the body which is what we want right now. (note I actually changed the sidebar class to sidebar-left !)

Now we just have to change the style sheet for the screen a bit by putting in a few media queries:
For now I just appended the following to my style sheet:
@media screen and (max-width: 600px) {
div.main {position: fixed; top: 0%; left: 0%; width: 100%; height: auto;}
div.sidebar-left {position: static; width: 100%;}
}

The whole thing is visible here. It's quite interesting to see what happens when you resize the window (changing width to less than 600 pixels).

Now as i said before, the Internet Explorer can not handle media queries and neither can older browsers. The first part of that last sentence is important, older browsers are obviously less and less of a problem as we go forward, all of the talk about having your browser up to date so you don't get hacked and the media attention it has received lately has obviously helped that situation along a bit. Either way for now we have a style sheet that includes the styles that we want and we just hope that everyone using a browser that can't handle media queries has at least 601 pixel wide monitors.