Are you ready for AJAX risks?
626763
AJAX lets you give your Web site a cool, slick user interface. But there are downsides. Find out the best ways to manage potential AJAX woes, in this excerpt from Enterprise Ajax.
653298
In the last part of this series, you'll learn how to build a declarative component for an application with a list of customers which is populated from a server-side data handler using AJAX. By David Johnson, Alexei White, and Andre Charland. 0910
521521
The results of the latest poll from the International PHP Magazine are in. The question this time asked which, of the options given, were your favorites in the Smyfony project's feature set. There was a clear winner above all of the others - the scaffolding that it makes so simple.   Some of the other options that were included but didn't get nearly as many votes were:  Simple templating and helpers Multilingualism and I18N support Object model and MVC separation Ajax support  Following at a distant second was the "Object model and MVC separation" choice (and to others, "Enterprise ready" and "Ajax support" nipping close at its heels).   Be sure to cast your vote in this week's poll that asks your opinion on some of the rules that the PHP Throwdown has set in place. Vote for the one that you think fits best with the spirit of the competition.
620434
(InfoWorld) - SANTA CLARA, CALIF. -- AJAX (Asynchronous JavaScript and XML) Web application development can be roller skates for the Web; it must be used appropriately or it can be dangerous, said Jesse James Garrett, the IT consultant credited with coining the term "AJAX." Garrett gave a keynote presentation at the AJAXWorld Conference & Expo on Tuesday morning. While noting the benefits of AJAX, chiefly its enabling of asynchronous interaction over the Web, Garrett cautioned that AJAX is not usable in all instances. It is similar to how it would not be good to roller skate around a shopping mall, he said.  "We're going to introduce AJAX into places where it doesn't belong," said Garrett, who is director of User Experience Strategy and a founding partner of Adaptive Path. Afterward, Garrett elaborated. "I think a lot of people are trying to use AJAX for doing kind of more dynamic content navigation -- the stuff that the Web is already pretty good at, and that's a place where it starts to break down," Garrett said. This use of AJAX breaks the conventions of the "back" button, he said. Garrett's roller skate assessment struck a chord with attendee Vera Algoet, a Web developer at the Monterey County Office of Education. Although not currently an AJAX developer, Algoet cited the possibilities of fun and danger with using AJAX. "I havenât done any [AJAX development] yet, but I've read some things about security concerns," she said. But AJAX offers the possibility of improved applications, Algoet said. "I just want to make better applications" that are easier to use, she said. Recalling the genesis of the term "AJAX," Garrett said his company was hired by a large insurance company to improve an application to capture more business. Setting about trying to find a solution for responsiveness on the Web, Flash was first thought of as a solution, he said. But it became apparent there was a different way to approach the problem. "We built a prototype of this approach, we tested it with the insurance agents, and the response was overwhelmingly positive," Garrett said. "We actually had people laughing out loud with delight at processing an insurance policy." To persuade the insurance company president to fund the project with $2 million, Garrett came to the conclusion that he needed an easier way, just one word, to encapsulate what he was trying to do. He then came up with the word, AJAX. Garrett noted that AJAX is a concept involving asynchronous interaction and the use of browser-native technologies. Communicating the importance of these applications is critical, he stressed. "The challenge for us in designing these AJAX applications is in figuring out how to communicate to users the possibilities of using these applications," Garrett said. AJAX, he said, allows for incremental migration. "With AJAX, we can apply it in bits and pieces. We can incrementally migrate components of this new application to this new model where it makes sense, rather than having to move the whole thing all at once," said Garrett. Additionally, AJAX developers are able to learn from each other's approaches. While AJAX technologies have been around for a while, it was not until 2005 that everybody got behind this approach, Garrett said. This was because the end of the browser war presented a relatively stable landscape and scripting languages became prominent. The innovation posed in the AJAX-based Google Gmail and Google Maps applications also contributed, he said. AJAX usage figures presented by Evans Data at the conference show a promising future. About 1.7 million developers now use it and another 1.9 million have evaluated it or plan to use it, according to Evans. An Adobe official at the show stressed that Adobe's Flex and Flash technologies can work with AJAX rather than rival it. "Flex and the Flash platform [are] not here at all to replace or try to compete with AJAX," said Christophe Coenraets, senior technology evangelist at Adobe. "Flex and AJAX work together to deliver the right experience," he said. Coenraets also briefly discussed Adobe's planned Apollo technology for running browser-based applications outside of a browser. This technology, which currently is an alpha stage of development, enables users to run Flex and Flash applications offline and allows access to local resources. JackBe at the conference unveiled its Presto REA (Rich Enterprise Application) platform, for delivering enterprise AJAX applications that are based on SOA and Web services. "It provides a governed access to SOA services," said Rob Vonderhaar, vice president of marketing at JackBe. The platform goes into a beta release in November, with general availability planned for the first quarter of 2007.
154380
Paul Reinheimer, one of two behind the funcaday website (providing details on one PHP function each day and special content on the weekends) has posted a supplement to this weekend's posting covering escaping.   The disadvantage with the escape for now, not for later approach is simple. If you save a user's post to the database, then that user's post is displayed 2,000 times there will be some serious differences. [...] You will need to balance your security concerns with performance needs.   The comments on his post back up his suggestions (and include other tips like a recommendation to cache on an even higher level - page blocks).
758748
This week you'll learn how to construct a complete and working Ajax application. As with any Ajax application, it will make use of an HTML document, JavaScript routines, a server-side routine (in PHP) and a callback function to deal with the returned data. By Phil Ballard. 0806
344312
Joshua Eichorn is back today with the answers to the questions as posed by the readers of his blog previously.   Your AJAX answers from my AJAX questions post are below, I hope everyone finds them helpful.   The questions answered include:  How can I find out whether a connection is broken? Why would you want to use HTML_AJAX when there are far better tools for the job, pure javascript solutions such as prototype or jquery? What is the best way to 'degrade' a website when Javascript/XMLHttpRequest support is disabled? When utilizing an AJAX API such as Google Maps, how do you execute embedded Javascript commands in a page generated on-the-fly?    ...as well as a few more. Where appropriate, he also includes code to help illustrate his point.
218661
The DeveloperTutorials website has a new tutorial posted today that covers their method for combining Ajax and PHP to create a custom form handler.   For this project, I needed a form to send an email to the client once it's been validated and checked to be ok. [...] I decided to spice things up a bit with a little AJAX and a few effects from Scriptaculous. So let's dive into exactly how I did it.   They create their form first - a standard user info type of thing - and set it up to use the WForms validation script in PHP. They include the Javascript the script needs to run the validation and to handle sending the form's contents back out via an email.
365469
Ajax Magazine has posted a new interview with Joshua Eichorn, the author of the PEAR HTML_AJAX package about who he is, details on the package, and what's to come.    I have contacted Joshua Eichorn, author of HTML_AJAX for an interview and as promised here is the interview. I asked Joshua about AJAX, HTML_AJAX, his experience, projects, current status,future projects and much more.    The interviewer starts off with general questions - who is he, how did he get started in PHP - that sort of thing. There's a mention of the time that Joshua has worked on phpDocumentor as well as his involvement in a local user group. They move on to the harder questions, talking about "why PEAR?" and what's next for the package's development...
566915
If you've ever had the frustration of working with Ajax in Internet Explorer and have noticed it caching the requests/results, you might want to check out this new post on the JSLabs blog for a helpful hint.   While working on an AJAX project over the weekend, I ran into the following issue: (through a GET request), every time I tried to call a certain function, It was returning the same data (which was supposed to be different each time)   First, he tried just changing the headers (via PHP's header function) to see if IE would understand the new message, but to no avail. He finally figured out that, despite whatever headers were sent or how much the content changed, what he really needed to do was to provide the script some kind of unique identifier with each request (just appended to the url) so that IE knew the request was different. His weapon of choice was a date/time value.
577548
The term Ajax is often referred to as a new type of technology, but is actually several technologies that work together. How it does so is the subject of this article. By Lee Underwood. 1114
350929
As Ed Finkler points out there's a new article posted (written by him) on the C7Y site (from php|architect) talking about his Inspekt library - an introduction to the filtering library showing how to help make your applications safer.   Inspekt is a library for PHP4 and PHP5 that aims to make safe input handing easier, and unsafe actions more difficult. Inspekt establishes a new development approach by wrapping input within "cage" objects, and requiring the developer to use validation and filtering methods to test and manipulate the input data. This article provides a brief introduction to Inspekt and its capabilities.   The article covers all of the basics - what the library can do for you, how it integrates into your application and how it helps to protect you from potential problems with the data in your superglobals ($_GET, $_POST, $_REQUEST, etc).
264364
(InfoWorld) - Even if text editors have been prominent in AJAX (Asynchronous JavaScript and XML) development, developers nonetheless would benefit from an IDE, panelists agreed at the EclipseCon 2007 conference on Wednesday. In a session entitled, "What Does Eclipse Need to Do to Become the IDE for AJAX?", panelists from companies such as IBM and Nexaweb said AJAX could use an IDE and that AJAX could benefit from Eclipse technologies. "I remember when Java first came out and all I used was a text editor," said panelist Robert Goodman, senior programmer at IBM. He said he did not like the first Java IDEs. But now, he could not go back to writing Java without one. "I think that's eventually what you'll get on JavaScript," Goodman said. Eclipse's own AJAX-related projects include the AJAX Toolkit Framework, for editing, compiling and debugging AJAX applications, and Rich AJAX Platform, serving as a runtime for AJAX applications. Panelists also cited issues in AJAX development. Detailing his own experience with AJAX complexity, panelist Coach Wei, CTO at Nexaweb, told of writing an AJAX application and running into trouble. Eventually, he found a problem related to a CSS (Cascading Style Sheets) file.Â  JavaScript now is being used to write large libraries, which was not anticipated, according to Goodman. "We haven't proven yet that you can really do this in JavaScript," Goodman said. Panelists noted that although AJAX can be difficult, it is still the way to go for desktop interaction in Web applications. "Definitely, the reason to do AJAX is for those sexy, dynamic Web apps," said Eric Clayberg, senior vice president of product development at Instantiations. Panelists supported consolidation in the area of AJAX runtimes, noting the existence of runtimes such as Dojo. An audience member emphasized that rather than devising new technologies, it may be a good idea to leverage what has already been done. "They should be standing on the shoulders of giants," said Hal Hildebrand, an architect in Oracle's Java platform group, after the session. AJAX is a new interface technology and lots of work already has been done in this area, he said. Another audience member, Kyle Shank, developer of the RadRails IDE for Ruby on Rails, cautioned against relying on a single framework for AJAX. "I would caution everyone who's interested in AJAX to not depend on one framework and actually write your apps in a way that [they] don't depend on one framework," Shank said. RadRails was built on the Eclipse Rich Client Platform. Companies represented on the panel, such as Aptana, Instantiations, and Nexaweb, offer tools for AJAX developers. Also on Wednesday, EclipseCon featured a session where attendees could air gripes about Eclipse. Attendees expressed desires for improvements such as a native installer, which would tailor installations of Eclipse to suit the target platform. Nested projects support, enabling projects to be maintained within other projects, also got a thumbs-up. Improvements to Eclipse dialog capabilities and the Eclipse Graphical Editing Framework also were suggested. Scripting enhancements were requested as well, as was stronger support for the Subversion version control system. Others in the audience noted that work is being done in areas such as scripting. The Eclipse Monkey project is a dynamic scripting tool for automating routine programming tasks. One attendee said it is possible to create nested projects within Eclipse but there is no wizard for automating this function.
635724
In a new post on his blog, Christian Wenz mentions the latest results of the SANS Institute's Top 20 Internet Security Attack Targets list which both includes a new entry ("Users") and several mentions of PHP and PHP-related applications.   Of course you can debate how such a Top list came together and what the real value behind that is, but there are two specific points in this year's list that I found quite interesting.   There's two targets for the PHP community to worry about - sysadmin/hosting and things developers need to keep in mind. Items on these lists include:  Always test and deploy patches and new versions of PHP as they are released Use Intrusion Prevention/Detection Systems to block/alert on malicious HTTP requests. Consider using Apache's mod_security to block known PHP attacks If you use PHP, migrate your application to PHP 5.2 as a matter of urgency. Encode all output using htmlentities() or a similar mechanism to avoid XSS attacks  You can check out the full information over on the SANS Institute website.
258362
A new year is just around the corner. Is your portfolio ready?
708667
Lorenzo Alberton is back today with another tutorial dealing with the PEAR::Pager class. This time, he focuses on using it with some simple Javascript and Ajax.    Not everyone has jumped on the (Ajax) bandwagon, though, and many libraries still exist without implementing this feature, so you're faced with the dilemma: should I keep using that old library and give up my cool AJAX ideas, or should I implement my own version?   If you're looking for a pager class with these requisites, I'm happy to reassure you about PEAR::Pager: it is AJAX-ready, and has been since a long time ago. 100% buzzword-compliance guaranteed!    He gives two examples of what he means - one just using the Pager package to create Javascript lists and divide them into paginated chunks and the other to work with an Ajax connection (via PEAR::HTML_AJAX) to grab the data and push it into a container DIV on the page.
431743
Worldwide spending on securing Web content is literally the hottest IT market today. With Web-based threats growing almost exponentially, IT and network managers are struggling mightily to stave off disaster while still letting employees reap the many benefits of the Web. The Webcast Barbarians At The Gate: Why Web Filtering Is So Hot, dives into the sources of the trouble while offering common-sense approaches to a secure Internet computing strategy.