Hot answers tagged web-development
11
Why not to simply check if such username exists in database? This will leave you with 2 possible outcomes.
User entered a correct username.
You then can simply log what you log now.
User entered his password in in username field, therefore username is invalid.
Just enter a log entry saying that there was failed log in attempt by unidentified user?
And of ...
11
While I absolutely agree about demanding code quality, it IS very difficult to quantify, and if you have nothing in your contract with the agency then I don't see how you can get them to rework a presumably working solution.
Maybe the only thing you can take from this for the future is trying to come up with some kind of code quality control on top of your ...
9
That depends on your exact way of doing it. Right now it seems to me you have a git repo in your httpdocs that you deploy to, basically using HEAD as your actual website - that is NOT the correct way. I'm not sure how you are able to push to this configuration at all?
What you want to do is use a bare repo somewhere outside the httpdocs-folder, and checkout ...
7
Any time you rely on anything coming from the client it can be spoofed. You definitely want to do some kind of hashing with some kind of server side "salt" which is stored securely on the server so you can encrypt / decrypt your client validation tokens without relying on anything "originating" from the client.
7
When you say "web application logic" you mean on the client side, in the JavaScript on the client's browser? If so, the answer is simple. You can't trust what happens on the client's browser, or even that the client is using a browser. It could be a hacking tool that makes your code think it's running in a browser. Heck, some standard browsers even let ...
6
I've had to deal with something similar when we outsourced some front-end coding (HTML/CSS only) to a "web agency". What came back looked pixel perfect like the mockups, but was copy-and-pasted all over the place. The agency explicitly knew that they were working on non final front-end code, which would be brought to life with some backend code and some ...
6
I would go with 2.
create a table Sub-pages which references it's parent section by a
Foreign Key
When you have to do such Sections Sub-pages like things then I would go with creating separate tables so that it becomes more efficient in organizing the data.
There's one scenario that I know which I would like to tell you. If you store all the ...
4
There's no such thing a simultaneous order. Your server is going to have to process one of the basket add actions first. At the point that happens the product should be locked, and any subsequent basket add actions should return an out-of-stock message. If the customer doesn't checkout within a fixed time (often one hour) it's normal to remove the lock on ...
3
First it's good that you are not considering client-side authentication as this can be spoofed.
The main problems I see with using the server's built-in mechanisms for authentication are:
Portability - Moving your application to a different server, becomes significantly more difficult.
A lack of separation between local server users and remote web ...
3
In the beginning, there were standards. Then, every browser decided to interpret them differently, add new features, and just plain forget the standard. Unfortunately, coding against all these browsers is a headache. Most of the normal layout will "just work," but fancy things (HTML5, CSS3, etc.) will not work in older versions of IE and probably doesn't ...
3
You can't use technology to fix problems with the client. A bug tracker has not yet been invented which knows which bugs it should report to you and which it should ignore because the client simply doesn't know how to use the product.
As such, I suggest if you want to avoid such problems in the future, you develop a tactic for gathering specification ...
3
First: don't let the agency get any more work out of your project. That would confirm their business model (ie: hourly tasks given to junior devs for crazy money).
I guess from experience that they created some custom modules which suck and did not follow any of Drupal best practices. They may even have changed some core functionnality (like some custom ...
2
So write a series of small Hello World apps, each exercising a different feature.
Take a photo and display it on the screen
Show the current lat/lon/altitude of the phone
Show the current G forces on the phone
and so on. Converting those features into a useful product is "just" details. (OK, a LOT of details).
When you're learning a new technology it ...
2
If the agency did terrible work the first time, there's every reason to believe that they will do so in the future. You might be able to talk them into doing more work without further payment (but I wouldn't count on it) and you might be able to supervise them closely enough that they deliver what you actually want, but that's highly likely to take so much ...
2
Depending on the scale of your operation (not specified) and the platform you're targeting (not specified) your range of options is very wide.
Assuming you're targeting a Unix/Linux platform, the default image processing library for #1 is ImageMagick - http://www.imagemagick.org/script/index.php It's been around for ever and is widely supported on a broad ...
2
The most typical cause of this is something large being transmitted in the traffic and you don't notice it because you are working locally at loopback or lan speeds while the customer is slowed by all the intervening internet delays. Something passing session state around or a large viewstate in the postbacks.
If the client end is interacting directly with ...
2
I think using git to manage the set of files needed to run your site is a clever idea.. as a matter of fact there are several services already doing this (as far as I know): microsoft's azure and some node.js hosting sites like nodester.com, just to name a couple..
As also @phi said, I'd not place the repository on the very same folders you publish through ...
2
Have you considered a virtual machine appliance? That's how GitHub does it for GitHub Enterprise, and how Microsoft does it for their beta software (particularly early stage beta).
This provides a few different advantages:
Restricts client access to code. In GitHub's case, this means that their non-open-sourced core components remain out of the sight of ...
2
There are lot of encoding software's available in the market. Just google to get the details
For example
Zend Guard
A simple tool like
PHP encoder
2
Scope
To me, scope is perhaps the most important question for any project. It drives costs, schedule, feature set, and often quality as well. It has a big influence on staffing and on whether your team is able to do the project (if it is too small, you better throw it back, too big, stay out of its way or bring in a partner). Your lifecycle model may ...
2
DO'S
Start by asking the customer why they want an website? If needed,
guide them through a discussion about using it to grow business in
terms of sales, leads, orders etc.
Ask as many questions you can about their business now like how
are you getting orders, what is the process, how can it be done
better.
Try to understand the business process on how to ...
1
There are a few questions that will affect the design here:
Do you already have information that will determine the set/order of tasks, or will the order effectively be random? In the latter case, you could generate the task list when you create a new session and pass it along in the session data, along with an indicator where in the list the user is.
If ...
1
I can think of to types of redundance:
Have a second fallback provider that hosts a copy of your REST service and a mirror of your data and let your app call the fallback if the main system is down.
have a local file copy of your last rest-service-calls-results in case that the server is offline.
both solutions can be costly. The alternative is to accept ...
1
A traditional trade-off in outsourcing any part of the business to a supplier, not just cloud computing: you get to give up working on the bits that are "plumbing" in what you offer, and focus on the parts where you think you can add most value. On the other hand, you give up control of the plumbing to another company, which introduces its own risks.
Your ...
1
The most powerful tool you can use is your brain.
When you first start a project you and your client should discuss the requirements, agree on them, write up a document and then both agree to it. Then you make it.
Any changes should be submitted as change requests through a proper change request document. Any changes you can charge extra for as the ...
1
Consider resizing the image not on upload but on demand (and caching the results).
This has a bonus feature; whenever you encounter a new use case that requires a new size, you can generate it easily by changing the parameters in the new code. It won't require you to run computation on your entire set of images all at once before it works.
1
If you are using these images on your website, store them exactly in all different sizes you are going to use on your website.
Image Scaling is a very important factor in a website's performance, and saves bandwidth and page-load time.
Scale images in accordance to your need, as disk space doesn't costs much.
See what google has to say about image scaling ...
1
Whether or not to use SQL or Lucene for searching depends on how sophisticated you need for your searching to be.
If you don't need keyword based search, then stick with SQL.
If you are interested in a more intelligent ordering of the results, then use Lucene.
If you need keyword based search across a large amount of data, then use Lucene.
If you do ...
1
For PHP you can write your own C/C++ extensions and get good performance benefits that way. If I had a really CPU intensive part of my web application I would probably make a small C++ library that offloaded that processing to the extension and then returned the result back to the PHP and then the PHP outputs it to the browser.
The other thing people don't ...
1
Just to be safe, the logging in my current app does not store parameters passed to login or password-reset methods. The log call has an optional parameter that controls this, which, when set to true, replaces the stored parameters object with [Redacted]. Sure, so I miss out on a little data, but I have their IP addresses, and I'd rather not risk getting ...
Only top voted, non community-wiki answers of a minimum length are eligible
