Gadgetopia

SQL Injection Attacks by Example: This is a fantastic, step-by-step example of a SQL injection attack. If you've heard of these, but not quite understood what they are, then read this. "SQL Injection" is subset of the an unverified/unsanitized user input vulnerability ("buffer overflows" are a different subset), and the ...

Basic PHP Security[SQL INJECTION]: A quick look at the hack du jour: SQL injection attacks. A simple enough thing to defend against.

Comparison of different SQL implementations: This is a phenomenal page listing how the different database server platforms handle standard SQL tasks, for instance row limited, ORDER BY, NATURAL JOINS, etc. Extremely well-researched. The following tables compare how different DBMS products handle various SQL (and related) features. If possible, the tables ...

Microsoft Extends SQL Server Reach: This is cool, though only SQL geeks would care. "Microsoft Corp. will extend the distributed capabilities of its SQL Server 2000 database to over 50 popular, proprietary databases and packaged applications, such as SAP R/3, SAP BW, J.D. Edwards, Siebel and PeopleSoft." Now they just ...

SQL Server Express: One of the things I don't like about Microsoft development platforms is that they're not free. Um, wait a minute... SQL Server Express is a version of SQL Server 2005 designed for building simple, dynamic applications. SQL Server Express helps developers build robust and reliable applications by ...

SQL Server Gets Automatic Patch Updates: This is overdue. "Following the virus and worm devastation wrought by Blaster and SoBig this past week, Microsoft Corp. on Friday admitted that it has finally bitten the bullet and committed to automatic security patch updates for its SQL Server database"

One of our clients has started working with some software that uses the MSDE -- the Microsoft SQL Desktop Engine. This is a stripped down, black-box version of SQL Server for people that need a database server but don't want to pay for SQL Server nor need all its super-powers. ...

The Best of Both Worlds: This Daily WTF is about something else, but it includes this bit in the intro that will make you think about SQL injection attacks. Ponder this. If you've ever worked with a database, chances are you know the difference between "dynamic queries" and "parameterized quires". ...

SQL Server 2005 Driver for PHP: Lo and behold, Microsoft has written a PHP extension. It s a data access component for SQL Server which PHP already has, so I guess I m not sure how it improves things, but it s pretty cool coming from Microsoft, anyway. The SQL Server Driver for PHP ...

Wired 11.07: Slammed!: Here's the story that Wired took some heat about. The first page is a harrowing look at the spead of the SQL Slammer virus written in a style that would make Michael Crichton proud. The second page tells you how it works. "By 12:45 am, huge sections ...

Microsoft SQL Server: Notification Services Product Overview: It strikes me that this would integrate RSS publishing directly into the database server, without needing a Web server as middleware. Organizations can send focused, relevant communications to their customers and employees. These notifications can contain links back to the organization's Web site ...

In an article about the SQL Slammer virus, Nathan Hanks, the CIO of Continental Airlines, said this: If those ports weren't open, slammers would be a non-event. We have MSDE on every single gate PC in our hubs. We immediately failed at putting people on planes. Very interesting. MSDE is ...

Microsoft Tweaks Its Small Biz Server Plans: If you can do without SQL Server, ISA Server, and FrontPage (and most people can), you can get Small Business Server Standard 2003 for just $599 (vs. $1,499 for the full version). "The premium release includes Windows Server 2003, Exchange Server 2003, Windows ...

IBM is planning to announce that they'll be donating the Java-based Cloudscape database to the Apache foundation, to be released as open source. Most business applications require some database functions like storing and looking up price or customer information, whether in a Web page or a laptop program. Cloudscape is ...

Here's an idea for a good service: a database of products, and some way to match them up with their chief competitors. I was looking for a certain type of product today. I found an example of one, and I wanted to find others. But how do you do that? ...

SQLite: An Embeddable SQL Database Engine: I'm just tickled with this little program. I'm not a client applications programmer, but if I was... SQLite is a tiny, file-based database engine. The Windows exectuable is only 280KB and it's statically compiled, so it needs nothing else to run (read: no install). ...

Comparison of relational database management systems: I found this Wikipedia page at the bottom of the SQL comparison I linked to yesterday. It's a comparison of major database platforms and their support of various features. It doesn't get into the SQL like the other page, but there are more platforms ...

Joe Celko's Trees and Hierarchies in SQL for Smarties: A book devoted to nothing but representing hierachies and trees in relational (SQL) databases. Am I a dork because I want it? In this book, Celko illustrates several major approaches to representing trees and hierarchies and related topics that should be ...

Enterprise SQL: This gets more and more absurd the more I look at it. I can't imagine working on this app -- when did SQL become evil? I really want to know what's in the snipped section. I think we need constants for the English langauge: define('A', 'A'); define('B', 'B'); ...

CRN : Daily Archives : Microsoft's SBS Plans An older article that sheds some more light on Small Business Server 2003. "The current plan is to get the price to less than the 'magic' price point of $999 and include Windows Server 2003, the forthcoming Titanium version of Exchange, SharePoint ...

Some time ago, my company was maintaining information in an Access database that we also wanted to use as Web content. We were on a Windows host at the time, so we just FTPed the database up to the server every day. A little kludgy, but it worked well. Then ...

Nine Reasons NOT To Use MS Access To Power A DB-Driven Website: This guy makes a lot of valid points, but he misses the biggest reason people are going to still use Access: it usually doesn't cost anything extra. For someone with a simple site, they're more interested in limiting ...

How to Ship Anything: My hero Joel Spolsky details a fascinating journey down the road of creating a process to ship all the DVDs people have been ordering. My estimate was that it took about three minutes of labor per order, and we only got it that low because we ...

Thoughts on Content Management: This guy and I think alike. In the beginning of the article he touches on the same things I talked about when I compared open and closed content management systems. Then, he runs into the same problem: there are too many types of content, each storing ...

I find myself in a constant struggle between accepting Movable Type for what it is, and working to extend it. There are a few cases where I want to do interesting things with entries, but I don t want to hack into Ben s Perl code. I solved this problem by inserting ...

There's a standard way of handling object updates via HTML forms. Generally speaking, when the user selects an object to edit, you populate an HTML form with all the data from the object, post all these fields when the user presses Submit, then update all the fields of the record ...

Create ASP code for your database with ASPRunner: This is pretty good software. I downloaded the demo, walked through the wizard, and within 3 minutes (from download to finished interface) I had a complete set of pages to view, edit, add, print, search, and export a database table on my ...

Charting the Needs of Small Businesses: Here's some information about the upcoming Small Business Server 2003. The ceiling on the number of client machines has been bumped from 50 to 75. Also, they will have a version of SBS with SQL Server and a version without.

This link runs a slooow SQL query on the RIAA s server. Don t click it; that would be wrong. Found on reddit.com. I clicked it, just out of curiosity. It pulled a press-releases index page. I don t know how someone knows it s slow.

Quick Merge in MySQL: I wished for this functionality in SQL Server for years. There are so many situations when this would come in handy. Using the GROUP_CONCAT function though, I no longer need to loop through them. I concatenate the list on the MySQL side, which returns me one ...

At one point or another, all content management systems (CMS) come down to some kind of datatype. You have to be able to set a field to a string, or an integer, or whatever, and then enforce and manage that piece of data. The idea is that you take these ...

Microsoft Small Business Software: Microsoft has released a six-month free trial of Small Business Server 2003. The rumors were true: there is a Standard Version without SQL Server, and a Premium Version with it. Still no word on pricing, and I can't find it for sale in retail outlets, so ...

MySQL Administrator Downloads: MySQL has an alpha release for the new MySQL Administrator. It's very polished for an alpha, and the entire app looks first-rate. However, it differs from MySQL Control Center in that it's for management of the server, not for development of the database. There doesn't seem to ...

Alexa Web Search Data Services: You can get the entire contents of the Alexa index on disk. Probably several. "The world's largest crawl and massive archive is available. Imagine the entire contents of the world wide web... on disk." Dare you to run a SQL query on this baby, ...

CMP Media's Software Development Magazine Announces Finalists for the 16th Annual Jolt Product Excellence & Productivity Awards: The Jolt Awards for this year have been announced. Everything from the best in books to the best in databases to the best in frameworks. Rails made the list, so did the .Net ...

Mysql Backup: Here's a good-looking program and a relatively rare example of an open-source Windows program, Mysql Backup is a program to backup your mysql databases. You can backup multiple databases and or tables all saved to a SQL file. It also has an scheduler so you can backup your ...

A lot of people want to roll their own search with Movable Type. Us, for instance Gadgetopia has a two-tiered search system based on whether the search term appears in the title, keywords, or body of the entry (see this post for more information). Our search is done in ...

fabFORCE.net: Here's a really fantastic MySQL administration tool. Open source, even. DBDesigner 4 provides powerful features to create a visual model of any database. Starting from a reverse engineering engine to automatically retrieve a model from existing databases, extensive modeling tools and editors to a syncronisation function which will apply ...

I got quoted the other day in an article about the SQL Slammer virus in the local newspaper. (Note: I don't think the above link is going to stay valid, so I've blatantly disregarded copyright laws and reprinted the article here as well.) Web worm slows area businesses Jay Kirschenmann ...

Steve Friedl's Home Page: I've unknowingly linked to Steve Friedl several times, but never explored the rest of his site. He's a freelance IT consultant in Southern California. His site has gems like this primer on SQL injection attacks, a fantastic article on how to be a good consultant, his ...

MySQL - Dynamically Insert and Update Values In a MySQL Database Using OOP: Good stuff, because I hate writing admin interfaces. Just hate it. We will make a class that goes out and looks for the values for us and builds a SQL statement on the fly. All we have ...

Beyond Proprietary Databases: Helen Borrie on the Future of Firebird: Here's an interesting interview with one of the people behind Firebird, an emerging open-source, multi-platform database server. It's a fork of a mature commercial database called InterBase. InterBase is an enterprise-level database Firebird is the same, but better. You'll ...

Announcement: Upcoming Content Revision to MSDN Subscriber Downloads: Microsoft is going to stop distributing a whole slew of programs in the wake of the Java settlement. It's trying to purge itself of anything that uses the current JVM. Due to a settlement agreement reached in January 2001, the following products ...

Caravel Content Management: Caravel is a content management system with the somewhat odd implementation of storing everything in LDAP, rather than a traditional SQL database. I don't know of any other system that does this. This project was open-sourced from a system used to power 2,000 Mennonite churches. See the ...

Everyone's favorite Web-based database management interface has released a new version with some snazzy improvements. Some highlights: * Displays results for multi-statement SQL requests * Saves export files to the server on which it's running (previously, you had to save them locally) * Displays the last-inserted auto-increment field (handy for ...

What do you do with sites that need a single table of data updated? These are sites which are totally static, except for this one thing... For instance, we have a client for which we built a static site. But they have a page which lists all the locations where ...

US-MI-Detroit-ASP/ASP.Net/SQL Developer: This job description is awfully arrogant, but the real kicker this this part at the bottom: "Qualified applicants will compete via thorough oral, written and practical hands-on tests. Qualified applicants will also undergo detailed screening, including reference checks. For your resume to be considered, it MUST be submitted ...

Amazon SimpleDB™- Limited Beta: Amazon has announced SimpleDB, which allows you to build a database in the cloud and query it from anywhere. It s not SQL, however, and it s not relational it s structured data. Amazon SimpleDB is a web service for running queries on structured data in real time. ...

'Most important ever' MySQL reaches beta: I found this stat in this article about MySQL 5.0, and I'm amazed by it: [MySQL] accounted for 40 percent of open source database deployments, while Firebird and PostgreSQL accounted for 39 percent and 11 percent of deployments respectively. Firebird has a 39% share ...

Buzz Game: Home: This is fascinating. The Tech Buzz Game is a fantasy prediction market for high-tech products, concepts, and trends As a player, your goal is to predict how popular various technologies will be in the future. Popularity or buzz is measured by Yahoo! Search frequency over time. Predictions ...

Microsoft ex-staffer pleads guilty to theft: Another guy has just been indicted for stealing $17 million worth. "Kori Robin Brown, 31, a former administrative assistant at the company's Xbox video console and games division, ordered more than $6 million worth of Microsoft's SQL Server database software and sold it for ...

Macromedia - ColdFusion Support Forums - Cold Fusion/SQL Server programmer needed: I agree with just about everything here: Please DON'T respond [...] If we have a tense moment or we say that we don't like the way you did some work and that it's not absolutely perfect and you're not ...

FileMaker Pro 7 review by PC Magazine: Here's an interesting review of the new FileMaker Pro 7. Compared with Microsoft Access, FileMaker retains a distinctive edge in usability. Granted, Access has the advantage when it comes to implementing larger-scale applications that have heftier programmatic needs. But Version 7 extends FileMaker's ...

C# 3.0 new language features; Maybe I'm just sheltered, but some of the new features of C# 3.0 look insanely cool. Especially this one: Extension methods (adding methods to classes by including the this keyword in the first parameter of a method on another static class). Here's the example; public ...

Is Perl Still Relevant?: An interesting answer from Tim O'Reilly about whether or not he thinks Perl is still relevant. In terms of the competitive landscape among programming languages, in addition to PHP, Python has long been gaining on Perl. From about 1/6 the size of the Perl market when ...

I'm embarking on a (very cool) project to port an app from SQL Server to Postgres. To this end, I need to get up-to-speed on Postgres stored procs. I looked around for some good books. Joseph Scott -- Postgres champion that he is -- recommended a few as well. However, ...

DATABASE DEBUNKINGS - HOME: My dreams have come true -- I am Fabian Pascal's "Quote of the Week." He took this quote from the rip roarin' argument we had a few weeks ago. I said: What I need in a database is place where I can persist and retrieve data. ...

Once again, I've been tinkering with the search on this site. We've gone through several iterations here, but I think this one is a keeper. Most recently, I abandoned the SQL-based search system I was using and switched to using Google. However, much to my surprise, it didn't work that ...

IBM sets DB2 database free: This slipped under the radar about a week ago: there's now a free version of DB2. DB2 Express-C is the same database as IBM's commercial offerings but the company places limits on what kind of hardware it can run on. It can be deployed on ...

PostgreSQL 8: Inheritance: Joseph Scott -- a champion of PostgreSQL -- pointed this little feature out in a comment to my post on the relational data model. It's a method in PostgreSQL of subclassing tables. You can create a table that would have a one-to-one relationship with a "parent" table ...

Here's a handy feature for a database... Tables can have primary keys, but what about a database-wide primary key? When a row is inserted, the "id" field would be populated with a numeric key that's unique to the entire database, not just that table. Additionally, a two-column system table would ...

One of the continuing quandries I've had with XML is the management of multiple XML documents. If I have one, big XML document, then it's easy to work with to parse with an API, to transform with XSLT, to query with XPath. But what if I have many documents? ...

Build a Smarter Search Engine: This is an article from JavaPro magazine about building a Case Based Reasoning (CBR) search engine: "A man walks into a car dealership and tells the salesperson about his perfect car. It would be red, have four doors, a large trunk, 300 horsepower, side airbags, ...

Why the light has gone out on LAMP: This guy eloquently tears up MySQL and PHP. IMO, MySQL once filled a niche (cheap data store) that today is better filled by SQLite but has moved out of it into a area where it doesn't compete nearly as well (that of ...

I've complained off and on about the lack of user-defined fields in Movable Type. Today was finally the day I got off my high-horse and messed with some code. Here is a method to add a new field to the MT database. The field can store whatever you like, can ...

WordPress's idea of SQL injection security: addslashes: I found this post while I was in the middle of wrestling with this, exact problem and it was driving me nuts, so I'm sympathetic to this guy's plight. And he puts it so well. I've decided to launch a whole new category ...

The idea of "tagging" content is suddenly everywhere. With Flickr and del.icio.us and Technorati embracing the concept of tags, suddenly it's getting some broad acceptance. But what are "tags"? At the most basic level, they're just keywords categorization without a master table of categories. Categorization that people can make ...

RightFields: My goodness, when it rains it pours. I mentioned the other day that I found a plugin that allowed you to do blog-specific custom fields in Movable Type, which is wicked groovy. Things like that keep me from ranting about things like this, which really makes everyone happy. Well, ...

PHPRunner - PHP code generator for your MySQL database: A few weeks ago, I talked about ASPRunner, which is a code-generation engine to build ASP pages to manage ODBC databases. At the end of that post, I whined that I wanted something similar for PHP/MySQL. Well... PHPRunner creates set of ...

The taxonomy was always supposed to be the be-all and end-all of information architecture. A good, solid category structure was how all the information in an enterprise was supposed to fit together. But they're harder to build than you think. There are shades of gray and complications. You need related ...

Yeah, I'm pissed. Really pissed. When does comment spam become a DDOS attack? There's a fine line, and some a**hole crossed it this morning. I knew there was a problem when I sat down to eat my cereal and read the news this morning and the Windows XP Home login ...

Given that Microsoft products appear to be full of security holes, more and more thought is being given to migrating to other platforms. However, this has problems of its own. Macs are expensive, and Linux isn't quite ready as a desktop platform. This leaves a lot of people in limbo ...

Announcing FogBugz On Demand: Fog Creek moves into the world of hosted software. I’m happy to announce that FogBugz On Demand is now available. This is a professionally-hosted version of FogBugz 5.0, previously only available as a download. In the end, $21 per user per month is not a phenomenal ...

As I become a more experienced developer, I'm learning when you should and shouldn't break the rules. While following every rule of programming and data modeling is wonderful, sometimes you need to bend the rules for the sake of simplicity and expediency. Always remember, an app in the hand is ...

I worked on improving the search on this site today. Search has been through a number of iterations. First, I used the basic Movable Type search. But it was slow and I wanted to do some interesting things with search. So last year, I switched to using a SQL "LIKE" ...

A friend of mine sent me this joke today. Pretty funny. A cowboy was herding his herd in a remote pasture when suddenly a brand-new BMW advanced out of a dust cloud towards him. The driver, a young man in a Brioni suit, Gucci shoes, Ray Ban sunglasses and YSL ...

So you want to give blogging a go at your company, but you dread the thought of getting sign off on new software, setting everything up, handling permissions issues, etc. What a huge pain, especially when you have no idea if anyone is going to even like the concept. Never ...

On PHP: There have been a lot of blogs jumping around on PHP in the last few days, and I've finally tracked it back to its source. Tim Bray -- one of the "pillars of the Web," if I can be so bold -- posted about PHP a week ago. ...

Is the relational model of data storage the best, most effiicient way to store data? I'm talking about the traditional database model of tables, fields, row, foreign keys, etc. What are the other ways? There's object oriented, where you have a table of classes and attributes, object instances and properties ...

I've been involved with dozens of content management systems both designing and building them, and working with some of the big, enterprise systems. During this time, I hit upon a seemingly obvious point that it took me a while to grasp: content management and content publishing are two different ...

About four months ago, I asked you all to send me a screencap of the Gadgetopia home page sitting in your browser window. I promised to do some analysis of the results, and I kept meaning to get to it, but never got to it. Tonight, I finally sat down ...

If you manage a Web site for more than a few months, you run into problems of content rot. You'll be cruising through some old pages, and you'll find stuff that's...off, for one reason for another. For instance, when this blog first started, I was anal-retentive about enclosing BLOCKQUOTEd text ...

Moving or migrating Windows Small Business Server (SBS) has got to be one of the more wretched tasks of a Windows system admin. Moving servers is never fun, but SBS is especially bad. You see, SBS is designed for up to 75 users on a single network and it's designed ...

I've been spending some time working with Smarty lately. This is ostensibly a "templating language" for PHP. But I think it goes beyond that. I assert that Smarty has become a sub-language all by itself. (Update: I thought of a much better name for this: "sand-boxed PHP." That's what Smarty ...

Someone (I don't know who), said "Half of intelligence is knowing the answer. The other half is knowing where to find the answer." In today's world, we all know how to find the answer. But has that made us less inclined to know the answer from memory? Google has just ...

Let me throw out an observation. Your application is worth exponentially more to me if I can write my own user interface for it. No, wait -- that's jumping the gun. Let me back up a bit: Your application is not your user interface. The interface is just a nice, ...

When you get neck deep into a content management implementation, you can lose sight of the actual publishing mechanism-- how the content gets from your system to the end user's browser. No matter how sophisticated your CMS is, at some point, a user enters a URL and some content comes ...

I've been toying with an idea lately, and instead of actually doing it (don't have the time), I'm going to throw it out here for fun. My idea is for an extremely simplistic content management system -- one based on HTML files and a scheduled file system crawl. First, some ...

I got to thinking the other day: exactly when do you have a content management system? We ve all built apps that manage content, but when do you graduate from a relational database with an admin section (RDBWAAS) to the lofty and deserved title of content management system? (Incidentally, I ...