With the exception of websites devoted to TV shows, movies or other multimedia as soon as I see the “loading” screen for a website developed completely in flash I close the window. One of my biggest arguments against the use of a flash based website was the fact that search engines could not index the content and therefore suffer with lower rankings. This is no longer the case.

As of this week google announced that it now has the ability to crawl flash files and index the content. This new feature does not belong soley to google. Adobe released the technology to yahoo as well as google.

As per anything that occurs on the internet this opens new doors for abuse. Search engines will have to find a way to determine legitmate content from black hat SEO practices that include spamming hidden content in an attempt to gain higher search engine positions. You can bet right now there are people that are developing sites using this practice. I think at first they will benefit from these practices and change search engine rankings. Sooner or later the search engines will catch up with them and blacklist those websites (remove them from the index all together).

Google Health

Earlier this week google announced the deployment of their new service that pulls all of your health information to one place under your google login. Maybe on first glance this sounds like a great idea. All of your health records, prescription information in one digital location. Lets forget for a moment the massive amount of information that google gathers everyday. Google employs the best and brightest for security but nothing is 100% secure. It only takes mistake and your information could be anywhere. Most likely the biggest threat comes from the user with poor password selection and management. Google has also teamed up with affiliates to offer a broader range of services such as faxing your health records to your doctor, managing your families health history and prescription management. All of these services linked to your google account. Is this the kind of information you want to store in one place?

OpenId

How many login names and passwords do you have strung across the internet. A blog here, a forum there, bank accounts, shopping. To sign up for just about any service you have to create an account. OpenId is a movement to decrease the amount of online forms you have to fill out to create an account.

From their website

“OpenID eliminates the need for multiple usernames across different websites, simplifying your online experience.

You get to choose the OpenID Provider that best meets your needs and most importantly that you trust. At the same time, your OpenID can stay with you, no matter which Provider you move to. And best of all, the OpenID technology is not proprietary and is completely free.

For businesses, this means a lower cost of password and account management, while drawing new web traffic. OpenID lowers user frustration by letting users have control of their login.

For geeks, OpenID is an open, decentralized, free framework for user-centric digital identity. OpenID takes advantage of already existing internet technology (URI, HTTP, SSL, Diffie-Hellman) and realizes that people are already creating identities for themselves whether it be at their blog, photostream, profile page, etc. With OpenID you can easily transform one of these existing URIs into an account which can be used at sites which support OpenID logins.”

The way it works you sign up for an openID from a provider and instead of using a user name and password for each account you use your single openID URL to login to multiple sites. There is a great article here that sums up all the potential problems of using openID. In a nutshell this could potentially open you up to multiple types of attacks such as phishing and cross site scripting that will allow someone access to all of your accounts. By using a provider you are also telling that provider every site you access.

I think openID has some very valid applications if used properly. First by hosting your own openID URI and bypassing the providers it gives you more control. Secondly if you are using openID for fairly benign tasks like blogs and forums that do not contain any sensitive information it reduces your risk to an exploit.

Mint Personal Finance Managment

This is just one of several online financial management services that caught my eye. I’m always looking for a way to not buy another version of quicken and forever remove windows from my hard drive. The best part about this software is its free! Yep, free as in beer.

This service pulls all of your financial information to one location. It helps you budget, sends emails when accounts are low and even tells you where you can save money. The service also lets you compare your spending habits with others in the same area. It does this all online through your browser via a simple interface.

How is this free? Mint gets their revenue through affiliates that offer you savings alternatives. For example you spent “x” amount of money “here” last month, if you shop “here” instead we can save you “x” amount per month and “x” amount per year.

The problem with having all your financial information in one location should be fairly obvious. Regardless the company seems to be doing well with no shortage of users. The other side of the argument is that unless you store your financial information in some type of encrypted format on your local machine you are probably more venerable to a security problem than using a service like this. This is undoubtedly true. If your bank has a security problem they are responsible for your money. In most cases by using this service you have removed them from responsibility.

I’ll have to admit this service looks amazing but it also looks like a target. I’ll be watching them closely as my quicken software draws closer to reaching the “you must buy another version” point.

Conclusion

Have you ever seen the Life Lock commercial with the CEO driving around new york city, his SSN plastered to a billboard behind a truck? Yeah he got his identity stolen. Nothing is 100% secure and you have to weight the benefits to the risks. Google health? No way, not for me. Its just far too much information in one location and not just my health records. OpenID? Yes, I think it has its applications if done correctly although I have yet to use it myself. Online financial management? The service just looks too good for me to give it a thumbs down. My inner dork is overpowering my paranoia on this one.

Charter is not the first ISP to play this game, a company named Phorm is already testing this technology in the UK. The implications of this type of data mining are wide.

Imagine every move you make on the internet not only being tracked but software anticipating what you might be looking for based on your history. The first and most obvious issue here is privacy. This has been compared to telephone companies listening to your conversations to decide what type of junk mail to send you.

A more realistic comparison equates this to listening to your phone conversation, going through your junk mail and pasting their own advertisements over the top. For example you go to visit a blog or a news article, charter will intercept that data and add their own over the top of what is being retrieved from the server. The internet is not only being monitored, and logged but also being manipulated before the content reaches you.

Not only does this become a privacy concern but it is also stepping on the toes of other advertising affiliates. The two biggest ways to discourage charter and other ISP’s from engaging in this activity is changing your ISP and lawsuits. For me personally I would love to see google lead the way to deter this type of behavior. With the majority of their income coming through targeted advertising they stand to lose allot.

In all honesty your ISP knows what web sites you visit already. When you put an address the request goes to your ISP’s DNS (domain name server) by default to route your request to the proper web page. If you have charter you have already seen this action if you misspell a domain name that doesn’t exist. Charter brings up their own not so helpful recommendations for your failed attempts. You can bet they make money off of this as well. You can bypass their DNS servers by setting going through OpenDNS

In the past I have not paid too much attention to the hype of traveling the internet anonymously. These types of “services” is causing me to think twice. Another project that makes it hard to track movements is the Tor Project. “Tor is a software project that helps you defend against traffic analysis, a form of network surveillance that threatens personal freedom and privacy, confidential business activities and relationships, and state security.[from the tor website]”

The above methods help keep your activities your own. Another easier step is to just block the ads as they come to your browser. If you use firefox (and you should) there is a simple plugin called Adblock that will stop adverts from being displayed.

Just another reason to be glad I canceled my cable subscription.

A large portion of the spam found on the internet runs through ISPs in China. So not only are they doing a wonderful job at adding large amounts of lead to consumer products they are also responsible for hosting those wonderful messages that greet you in your inbox. One of the most notorious of these ISP’s is chinanet.

Because reputable hosting companies do not allow spam to go through their mail servers the spammers use your own php mail forms to send their wonderful greetings across the globe. Some of them are sophisticated enough to only send a small portion of mail through your form each day to keep the hosting company from flagging it. Once they find your unsecured form they will not let up.

They achieve this by injecting their own headers into your text fields to include a list of recipients and the message. The easiest way to prevent them from doing this is to check the fields for strings used to add these headers with a regular expression. What we are looking for are newline characters, hard returns, their coded equivalents, content-type, to:, cc: and bcc:.

We simply create a function that checks for these inputs and stops the script.

function fieldCheck($data)
{
if (eregi("(%0A|%0D|\n+|\r+)(content-type:|to:|cc:|bcc:)", $data))
{
die ('Sorry, no spammers allowed.');
}
}

Now for each field text field you have in your mail form you simply run the variable through this function. For example you will probably have at least two text fields for the user to enter their name and email address.

<form>
 
Name:
<input name="name" size="30" type="text" />
 
Email:
<input name="email" size="30" type="text" />
 
    <textarea name="msg"></textarea>
</form>

Now before the mail() function is called we check for those characters with the fieldCheck() function we just created. Now if any of those characters present the script stops.

fieldCheck($name);
fieldCheck($mail);
// run your mail function

Don’t try to run the fieldCheck() function on the text area data. It will fail if a user hits a hard return for a new paragraph. You can check this data by creating another function that does not check for newlines and hard returns “%0A|%0D|\n+|\r+” and only check for the “content-type:|to:|cc:|bcc:”

So it would look like this …

function fieldCheck($data)
{
if (eregi("(%0A|%0D|\n+|\r+)", $data))
{
die ('Sorry, no spammers allowed.');

For this script I’m storing the information in two separate tables. One table contains the description attributes of the image (address, price, listing number and description) with the thumbnail path and attributes (width and height). The other table contains only the images used for the slide show. The example I’m using here is to upload real estate listings. By having one table with the main images and the other table with the description and thumbnail attributes you can easily add more images to any listing.

This is just an example of the script and assumes a couple things. It assumes you have validated the user, and the input to keep your database safe. It also assumes you are using only .jpg images and does not restrict the size. As always, validate and clean your information before upload.

The first thing we need is our form for uploading the images. For this example we are going to upload 5 images of a real estate listing the MLS number(id), address, price and property description. I broke it up into two files pre-upload.php and upload.php.

pre-upload.php

<form action="upload.php" enctype="multipart/form-data" method="post">
 
MLS Number:
<input name="mls" type="text" />
 
Address:
<input name="address" type="text" />
 
Price:
<input name="price" type="text" />
<input name="max_file_size" type="hidden" value="2000000" />
<input name="upload0" type="file" />
<input name="max_file_size" type="hidden" value="2000000" />
<input name="upload1" type="file" />
<input name="max_file_size" type="hidden" value="2000000" />
<input name="upload2" type="file" />
<input name="max_file_size" type="hidden" value="2000000" />
<input name="upload3" type="file" />
<input name="max_file_size" type="hidden" value="2000000" />
<input name="upload4" type="file" />
<input name="max_file_size" type="hidden" value="2000000" />
<input name="upload5" type="file" />
<input name="submit" type="submit" value="submit" />
</form>

While we added a max value size of 2mb’s to the form input this should not be used as a max size validation as the user will not get any type of error message for values above 2mb. The first image “upload0″ will be the image that is stored twice, once as thumbnail and once as a regular image.

The real work comes in upload.php. Make sure you chmod777 the folder you are going to use to upload the images.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187

// connect to the database with your preferred method
// now lets list the variables
$mls = $_POST['mls'];
$address = $_POST['address'];
$price = $_POST['price'];
$description = $$_POST['description'];
// width and height max values for the main images. Its best to set
// them both at the same value or you will end up with distorted images
// if you upload both landscape and portrait layouts.
$width = '640';
$height = '640';
// Here we set the name and path for the thumbnails. I chose to put the thumbs
// and the main images in separate folders based on their unique MLS number.
$thumbName = "images/$mls/thumb.jpg";
// Set the thumb max width and height
$twidth = '250';
$theight = '250';
 
//first I want to make sure they actually posted an MLS number or we reject it
if(empty($_POST['mls']))
{
  die("
 
You didn't enter a MLS number. Please go back
 
");
}
 
//now lets make sure this folder doesn't already exist so its not written over
if(file_exists("images/$mls"))
{
  die("
 
You are trying to add a listing that already exists
 
");
}
 
// so far so good lets create the directory on the server and assign the filename
$oldmask = umask(0);
mkdir("images/$mls", 0777);
umask($oldmask);
$ext = '.jpg';
$fileName = "images/$mls/";
 
// now we will check to see if there is a file, if there is we will put it in an array
// for processing. If there is a file we are going to number them 0-5
for($i=0; $i<10; $i++)
  if(!empty($_FILES["upload$i"]['name']))
  {
     $pic[$i] = $_FILES["upload$i"]['name'];
  }
 
// count the total number of pictures to be resized, uploaded and stored
$totalPics = count($pic);
 
// now lets loop the process for each file
for($i = 0; $i<$totalPics; $i++)
  // here is where you can do some file checking for example lets make sure its a .jpg.
  // This would also be a good place to check the file size.
  if (!eregi('^image/p?jpeg(;.*)?$', $_FILES["upload$i"]['type']))
  {
     // we already made the directory so lets make sure we remove it before we kill
     // the script.
    rmdir("images/$mls");
    die("
 
Sorry, this was not a .jpg file
 
");
  }
  // The images met whatever conditions you set so we move forward.
  else
  {
    if(is_uploaded_file($_FILES["upload$i"]['tmp_name']) and
    copy($_FILES["upload$i"]['tmp_name'], "$fileName$i$ext"))
    {
      // find the dimensions
      $simg = imagecreatefromjpeg("$fileName" ."$i". "$ext");
      $currwidth = imagesx($simg);
      $currheight = imagesy($simg);
      // if its a portrait layout lets set the max height
      if($currheight>$currwidth)
      {
        $zoom = $width/$currheight;
        $newheight = $height;
        $newwidth = $currwidth*$zoom;
      }
      // if its a landscape
      else
      {
        $zoom = $width/$currwidth;
        $newwidth = $width;
        $newheight = $currheight*$zoom;
      }
 
      // Alright we have the dimensions sorted out now lets build the image. Using
      // imagecreatetruecolor() instead of imagetruecolorpalette() gives us a better
      // resolution
      $dimg = imagecreatetruecolor($newwidth, $newheight);
      $palsize = imagecolorstotal($simg);
      for($e = 0; $e<$palsize; $e++)
      {
        $colors = imagecolorsforindex($simg, $e);
        $imagecolorallocate($dimg, $colors['red'], $colors['green'], $colors['blue']);
      }
      imagecopyresized($dimg, $simg, 0, 0, 0, 0, $newwidth, $newheight, $currwidth, $currheight);
      // here is where you can set the quality I set it to 90 so they end up being fairly large
      imagejpeg($dimg, "$fileName" ."$i". "$ext", 90);
      imagedestroy($simg);
      imagedestroy($dimg);
 
      // Round off the width and height attributes so we can store it in the database
      $newheight = round($newheight);
      $newwidth = round($newwidth);
 
      // now lets add the main images to the database
      $sql = "INSERT INTO images SET
                filename='$fileName$i$ext',
                width='$newwidth',
                height='$newheight'
                ";
 
      if(mysql_query($sql))
      {
        echo "images uploaded and resized";
      }
      else
      {
        echo "error uploading and resizing images";
      }
    }
  }
 
// lets do it all again for the thumbnail images
// The first image in the upload form "upload0' will be the image we turn into a thumb.
// I added a "t" to all the thumbnail variables
if(is_uploaded_file($_FILES['upload0']['tmp_name']) and
copy($_FILES['upload0']['tmp_name'], "$thumbName"))
{
  $tsimg = imagecreatefromjpeg("$thumbname");
  $tcurrwidth = imagesx($tsimg);
  if($tcurrheight>$tcurrwidth)
  {
    $tzoom = $twidth/$tcurrheight;
    $tnewheight = $theight;
    $tnewwidth = $tcurrwidth*$tzoom;
  }
  else
  {
    $tzoom = $twidth/$tcurrwidth;
    $tnewwidth = $twidth;
    $tnewheight = $tcurrheight*$tzoom;
  }
  $timg = imagecreatetruecolor($newwidth, $tnewheight);
  $tpalsaize = imagecolorstotal($tsimg);
  for($e = 0; $e<$palsize; $e++)
  {
    $colors = imagecolorsforindex($tsimg);
    imagecolorallocate($tdimg, $colors['red'], $colors['green'], $colors['blue']);
  }
  imagecopyresized($tdimg, $tsimg, 0, 0, 0, 0, $tnewwidth, $tnewheight, $tcurrwidth, $tcurrheight);
  imagejpeg($tdimg, $thumbName, 95);
  imagedestroy($tdimg);
  $tnewheight = round($tnewheight);
  $tnewwidth = round($tnewwidth);
}
 
// now lets add the listing information and thumbnail information to the "listing" table
$sql = "INSERT INTO listing SET
         mls='$mls',
         address='$address',
         price='$price',
         description='$description',
         filename='$thumbName',
         width='$tnewwidth',
         height='$tnewheight'
         ";
 
  if(mysql_query($sql))
  {
    echo "Listing and information stored in database";
  }
  else
  {
    echo "Error: Listing did not store in database";
  }

The dentist closest to my house had one review and it was a one star ( out of 5). Curiosity got the best of me and I thought I would read what must be a horror story about a local dentist. It turns out the rating had nothing to do with the dentist in question. Whoever the reviewer was had given the dentist a one star rating because he or she has received a speeding ticket while driving by. The comment from the reviewer went on to warn drivers to stay away from this area because of the police department. The reviewer even mentioned in the post that he or she was sure the dentist was ok.

I’m sure you see the problem. Your business can get a poor rating for any reason or none at all from anyone. This could drive away potential customers. Internet surfers have ADD, if the information can not be found quickly with minimal reading they will look elsewhere. For most readers they would of seen a 1 star rating and went on to look at other dentists.

This is very common among online communities. In addition to service rating web sites, online forums tend to be a place where complaints valid or not are made. Its in your best interest to dedicate someone from your business to look for these things through a simple search query. You can even set up automatic alerts to be emailed when your business name shows up on a search engine listing.

The easiest to deal with are forum posts. You can often register and either publicly work towards a solution or give your side of the story. Most readers can tell a crazy customer that won’t be satisfied from a legitimate complaint especially when the company in question works towards a resolution.

In the end I found a dentist that had a few high ratings and reviews and went with them based solely off of what others had written. Don’t just use google, try the other search engines also to make sure your seeing all the top results.

Network Solutions is the industry leader in domain name registration. There was a time when they were the only source to register your domain. Now you can find a handful of discount registers all over the internet. While Network solutions charges $35/year for a .com or .net address another registrar will charge only $9/year or less. The cheaper domain name solutions have led to an increase in domain name tasters.

Recently Network Solutions has implemented a new procedure to combat these tasters that has left a sour taste in the mouths of the online community. If you use Network Solutions to check the availability of domain name and it is available Network Solutions automatically resisters that domain so it can not be registered through another source. Go ahead give it a shot think of a random domain name and check its availability then use another registrar to see if its still available. You will find that Network Solutions has already registered the domain. They now own it.

This is called “front running,” and its completely automated. If you want the domain name you just searched for you are forced to buy it from Network Solutions. This costs Network Solutions nothing because registers are allowed a 5 day grace period to protect from credit card fraud. So for the next five days you have to pay the $35 if you want that domain instead of the $9 bucks you might spend with another service. While this is perfectly legal it raises ethical concerns.

Network Solutions has defended their decision to implement this procedure in order to combat domain name tasters.

This does not mean that the domain name is waiting for you to purchase for the next five days as there is no information passed to associate your search with you or your account. In fact it occurs even if you don’t have an account with Network Solutions and your not logged in. This will undoubtedly catch many casual users off guard as Network Solutions has one of easier to use interfaces when it comes to searching for a domain name. They will check for misspellings and names that are similar automatically.

In the past I have always recommended Network Solutions to anyone who is registering a domain name as they are the industry leader. Losing control of your domain name can be expensive and time consuming. Given the recent policy changes my opinion (as well as a large part of the internet community) that has changed. In fact I will be moving a couple of my domain names to a new registrar, which will no doubt be a convoluted and painful process.