Archive for May, 2008

Project Management Software: Basecamp vs. MyIntervals

Project management software! If you aren’t using it now, you’re likely not being as productive as you otherwise might be.

I have, in the past, used Basecamp to manage my projects (in conjunction with Blinksale). Recently, however, I have been wanting something a little different, so after eying it for a few weeks, I finally set up a trial account with MyIntervals this morning (both software packages offer a free trial).

Pros? Cons?

Well, they each have their strengths, I suppose.

Basecamp is stronger on the communication side of things (with “Writeboards”, Messages, and even chat software integrated). They also pride themselves on the simplicity of their software, and in my experience, clients rarely have any trouble learning how it works. It doesn’t have any invoicing functionality, but I have made up for that deficiency by integrating it with Blinksale.

MyIntervals, on the other hand, is stronger on time management. It has detailed time tracking and reporting interfaces, as well as invoicing functionality, and has a good many more features then Basecamp has.

It’s just been one day, but so far, I am really liking MyIntervals, and their emphasis on time management/tracking, so I will most likely be staying with them.

Nathan Malone

P.S. I am currently able to accept a limited number of additional clients for my PHP Development services. Interested in discussing the possibility of my handling your project for you? Contact me!

MySQL Injection Attacks

As a PHP developer, I work quite a bit with MySQL database tables, both in the course of developing new websites / web applications, as well as modifying or adding features to existing websites.

One thing that always surprises me when working on code written by others is how frequently the code is subject to what is called MySQL Injection Attacks.

MySQL Injection Attacks are basically where, due to poorly written code, hackers can execute custom MySQL commands (that the developer did not wish the script to be able to execute). These hacks can range from deleting all data in a database table, to logging in as a user, to even stealing data from databases in certain cases.

Well-written MySQL queries can easily prevent such attacks. However, many developers, either out of ignorance or, well, laziness, just don’t properly write their queries.

Let’s back up a few steps here. Some servers, especially in past years, have had a PHP option called Magic Quotes (deprecated as of PHP 5.3.0) enabled. This option automatically “escapes” special characters in data that users submit, say, through a web form.

This escaping is necessary on all user-submitted data that is used in a MySQL query. However, setting the server to automatically escape all user-submitted data is problematic for several reason.

A much better way of doing it is to escape each piece of user-submitted data right when it is inserted into the query. Most MVC frameworks which contain some database model have their own custom-named function that can do this for you.

For those of you who are writing in raw PHP code, PHP has a built-in mysql_real_escape_string function, which you can use to obtain the same results (many custom database libraries use that function).

Anyway, there is no excuse for programmers to not take this small, basic step in securing their web applications, so make sure you take advantage of the tools at your disposal here.

Nathan Malone

P.S. I am currently able to accept a limited number of additional clients for my PHP Development services. Interested in discussing the possibility of my handling your project for you? Contact me!

Productivity and Time Management

Although this is not necessarily related to PHP development, the subject of time management and productivity is one that affects everyone. In my experience, those of us who work fulltime online (doing site development, internet marketing, or related work) often make poor use of our time.

The nature of the work is that it often exposes us to many distractions, ranging from email (always log out of email when you’re working!) to chat (same here…) to an interesting link you happen to stumble upon.

Although I have read many productivity and time management books through the years, many of which were helpful, there are a few things that are unique to fulltime web professionals, a group that none of the books I read specifically targeted.

However, late yesterday afternoon, I got an email with a link to a half-hour video put out by Eben at Guru MasterMind titled Becoming a Productive Modern Guru, which had some very helpful advice.

If you have read or studied the subject in the past, you will likely hear some familiar techniques, but if you take the time to watch it, you will hopefully pick up some new “tools” to improve your productivity.

Nathan Malone

P.S. I am currently able to accept a limited number of additional clients for my PHP Development services. Interested in discussing the possibility of my handling your project for you? Contact me!