Latest php-mysql technical news

Top Ten Security Vulnerabilities in PHP Code !

2008-08-06T00:13:00.000-07:00

1. Unvalidated Parameters

Most importantly, turn off register_globals. This configuration setting defaults to off in PHP 4.2.0 and later. Access values from URLs, forms, and cookies through the superglobal arrays $_GET, $_POST, and $_COOKIE.

Before you use values from the superglobal arrays, validate them to make sure they don’t contain unexpected input. If you know what type of value you are expecting, make sure what you’ve got conforms to an expected format. For example, if you’re expecting a US ZIP Code, make sure your value is either five digits or five digits, a hyphen, and four more digits (ZIP+4). Often, regular expressions are the easiest way to validate data:

if (preg_match('/^\d{5}(-\d{4})?$/',$_GET['zip'])) {
   $zip = $_GET['zip'];
} else {
   die('Invalid ZIP Code format.');
}

If you’re expecting to receive data in a cookie or a hidden form field that you’ve previously sent to a client, make sure it hasn’t been tampered with by sending a hash of the data and a secret word along with the data. Put the hash in a hidden form field (or in the cookie) along with the data. When you receive the data and the hash, re-hash the data and make sure the new hash matches the old one:

// sending the cookie
$secret_word = 'gargamel';
$id = 123745323;
$hash = md5($secret_word.$id);
setcookie('id',$id.'-'.$hash);

// receiving and verifying the cookie
list($cookie_id,$cookie_hash) = explode('-',$_COOKIE['id']);
if (md5($secret_word.$cookie_id) == $cookie_hash) {
   $id = $cookie_id;
} else {
   die('Invalid cookie.');
}

If a user has changed the ID value in the cookie, the hashes won’t match. The success of this method obviously depends on keeping $secret_word secret, so put it in a file that can’t be read by just anybody and change it periodically. (But remember, when you change it, old hashes that might be lying around in cookies will no longer be valid.)

See Also:

PHP Manual: Using Register Globals
PHP Cookbook: Recipe 9.7 (”Securing PHP’s Form Processing”), Recipe 14.3 (”Verifying Data with Hashes”)

2. Broken Access Control

Instead of rolling your own access control solution, use PEAR modules. Auth does cookie-based authentication for you and Auth_HTTP does browser-based authentication.

See Also:

PEAR Packages: Auth, Auth_HTTP.

3. Broken Account and Session Management

Use PHP’s built-in session management functions for secure, standardized session management. However, be careful how your server is configured to store session information. For example, if session contents are stored as world-readable files in /tmp, then any user that logs into the server can see the contents of all the sessions. Store the sessions in a database or in a part of the file system that only trusted users can access.

To prevent network sniffers from scooping up session IDs, session-specific traffic should be sent over SSL. You don’t need to do anything special to PHP when you’re using an SSL connection, but you do need to specially configure your webserver.

See Also:

PHP Manual: Session handling functions
PHP Cookbook: Recipe 8.5 (”Using Session Tracking”), Recipe 8.6 (”Storing Sessions in a Database”)

4. Cross-Site Scripting (XSS) Flaws

Never display any information coming from outside your program without filtering it first. Filter variables before including them in hidden form fields, in query strings, or just plain page output.

PHP gives you plenty of tools to filter untrusted data:

htmlspecialchars() turns & > " < into their HTML-entity equivalents and can also convert single quotes by passing ENT_QUOTES as a second argument.
strtr() filters any characters you’d like. Pass strtr() an array of characters and their replacements. To change ( and ) into their entity equivalents, which is recommended to prevent XSS attacks, do:
$safer = strtr($untrusted, array('(' => '(', ')' => ')'));
strip_tags() removes HTML and PHP tags from a string.
utf8_decode() converts the ISO-8859-1 characters in a string encoded with the Unicode UTF-8 encoding to single-byte ASCII characters. Sometimes cross-site scripting attackers attempt to hide their attacks in Unicode encoding. You can use utf8_decode() to peel off that encoding.

See Also:

PHP Manual: htmlspecialchars(), strtr(), strip_tags(), utf8_decode()
PHP Cookbook: Recipe 8.8 (”Building a GET Query String”), Recipe 9.8 (”Escaping Control Characters from User Data”)

5. Buffer Overflows

You can’t allocate memory at runtime in PHP and their are no pointers like in C so your PHP code, however sloppy it may be, won’t have any buffer overflows. What you do have to watch out for, however, are buffer overflows in PHP itself (and its extensions.) Subscribe to the php-announce mailing list to keep abreast of patches and new releases.

See Also:

PHP Mailing Lists: http://www.php.net/mailing-lists.php

6. Command Injection Flaws

Cross-site scripting flaws happen when you display unfiltered, unescaped malicious content to a user’s browser. Command injection flaws happen when you pass unfiltered, unescaped malicious commands to an external process or database. To prevent command injection flaws, in addition to validating input, always escape user input before passing it to an external process or database.

If you’re passing user input to a shell (via a command like exec(), system(), or the backtick operator), first, ask yourself if you really need to. Most file operations can be performed with native PHP functions. If you absolutely, positively need to run an external program whose name or arguments come from untrusted input, escape program names with escapeshellcmd() and arguments with escapeshellarg().

Before executing an external program or opening an external file, you should also canonicalize its pathname with realpath(). This expands all symbolic links, translates . (current directory) .. (parent directory), and removes duplicate directory separators. Once a pathname is canonicalized you can test it to make sure it meets certain criteria, like being beneath the web server document root or in a user’s home directory.

If you’re passing user input to a SQL query, escape the input with addslashes() before putting it into the query. If you’re using MySQL, escape strings with mysql_real_escape_string() (or mysql_escape_string() for PHP versions before 4.3.0). If you’re using the PEAR DB database abstraction layer, you can use the DB::quote() method or use a query placeholder like ?, which automatically escapes the value that replaces the placeholder.

See Also:

PHP Manual: escapeshellcmd(), escapeshellarg(), realpath(), addslashes(), mysql_real_escape_string(), mysql_escape_string()
PEAR Package: DB, DB Documentation
PHP Cookbook: Recipe 18.20 (”Escaping Shell Metacharacters”), Recipe 10.9 (”Escaping Quotes”)

7. Error Handling Problems

If users (and attackers) can see the raw error messages returned from PHP, your database, or external programs, they can make educated guesses about how your system is organized and what software you use. These educated guesses make it easier for attackers to break into your system. Error messages shouldn’t contain any descriptive system information. Tell PHP to put error messages in your server’s error log instead of displaying them to a user with these configuration directives:

log_errors = On
display_errors = Off

See Also:

PHP Manual: Error Handling and Logging Functions
PHP Cookbook: Recipe 8.14 (”Hiding Error Messages from Users”)

8. Insecure Use of Cryptography

The mcrypt extension provides a standardized interface to many popular cryptographic algorithms. Use mcrypt instead of rolling your own encryption scheme. Also, be careful about where (if anywhere) you store encryption keys. The strongest algorithm in the world is pointless if an attacker can easily obtain a key for decryption. If you need to store keys at all, store them apart from encrypted data. Better yet, don’t store the keys and prompt users to enter them when something needs to be decrypted. (Of course, if you’re prompting a user over the web for sensitive information like an encryption key, that prompt and the user’s reply should be passed over SSL.)

See Also:

PHP Manual: Mcrypt Encryption Functions
PHP Cookbook: Recipe 14.7 (”Encrypting and Decrypting Data”)

9. Remote Administration Flaws

When possible, run remote administration tools over an SSL connection to prevent sniffing of passwords and content. If you’ve installed third-party software that has a remote administration component, change the default administrative user names and passwords. Change the default administrative URL as well, if possible. Running administrative tools on a different web server than the public web server that the administrative tool administrates can be a good idea as well.

10. Web and Application Server Misconfiguration

Keep on top of PHP patches and security problems by subscribing to the php-announce mailing list. Stay away from the automatic PHP source display handler (AddType application/x-httpd-php-source .phps), since it lets attackers look at your code. Of the two sample php.ini files distributed with PHP ( php.ini-dist and php.ini-recommended), use php.ini-recommended as a base for your site configuration.

Best Practices for Speeding Up Your Web Site

2008-03-27T04:33:00.000-07:00

High Performance Web Sites: The Importance of Front-End Performance

In 2004, I started the Exceptional Performance group at Yahoo!. We’re a small team chartered to measure and improve the performance of Yahoo!’s products. Having worked as a back-end engineer most of my career, I approached this as I would a code optimization project - I profiled web performance to identify where there was the greatest opportunity for improvement. Since our goal is to improve the end-user experience, I measured response times in a browser over various bandwidth speeds. What I saw is illustrated in the following chart showing HTTP traffic for http://www.yahoo.com.

In the figure above, the first bar, labeled “html”, is the initial request for the HTML document. In this case, only 5% of the end-user response time is spent fetching the HTML document. This result holds true for almost all web sites. In sampling the top ten U.S. websites, all but one spend less than 20% of the total response time getting the HTML document. The other 80+% of the time is spent dealing with what’s in the HTML document, namely, the front-end. That’s why the key to faster web sites is to focus on improving front-end performance.

There are three main reasons why front-end performance is the place to start.

There is more potential for improvement by focusing on the front-end. Cutting it in half reduces response times by 40% or more, whereas cutting back-end performance in half results in less than a 10% reduction.
Front-end improvements typically require less time and resources than back-end projects (redesigning application architecture and code, finding and optimizing critical code paths, adding or modifying hardware, distributing databases, etc.).
Front-end performance tuning has been proven to work. Over fifty teams at Yahoo! have reduced their end-user response times by following our performance best practices, often by 25% or more.

Our performance golden rule is: optimize front-end performance first, that’s where 80% or more of the end-user response time is spent.

Discuss the Importance of Front-End Performance

1: Minimize HTTP Requests

80% of the end-user response time is spent on the front-end. Most of this time is tied up in downloading all the components in the page: images, stylesheets, scripts, Flash, etc. Reducing the number of components in turn reduces the number of HTTP requests required to render the page. This is the key to faster pages.

One way to reduce the number of components in the page is to simplify the page’s design. But is there a way to build pages with richer content while also achieving fast response times? Here are some techniques for reducing the number of HTTP requests, while still supporting rich page designs.

Image maps combine multiple images into a single image. The overall size is about the same, but reducing the number of HTTP requests speeds up the page. Image maps only work if the images are contiguous in the page, such as a navigation bar. Defining the coordinates of image maps can be tedious and error prone.

CSS Sprites are the preferred method for reducing the number of image requests. Combine all the images in your page into a single image and use the CSS background-image and background-position properties to display the desired image segment.

Inline images use the data: URL scheme to embed the image data in the actual page. This can increase the size of your HTML document. Combining inline images into your (cached) stylesheets is a way to reduce HTTP requests and avoid increasing the size of your pages.

Combined files are a way to reduce the number of HTTP requests by combining all scripts into a single script, and similarly combining all stylesheets into a single stylesheet. It’s a simple idea that hasn’t seen wide adoption. The ten top U.S. web sites average 7 scripts and 2 stylesheets per page. Combining files is more challenging when the scripts and stylesheets vary from page to page, but making this part of your release process improves response times.

Reducing the number of HTTP requests in your page is the place to start. This is the most important guideline for improving performance for first time visitors. As described in Tenni Theurer’s blog Browser Cache Usage - Exposed!, 40-60% of daily visitors to your site come in with an empty cache. Making your page fast for these first time visitors is key to a better user experience.

Discuss Rule 1

2: Use a Content Delivery Network

The user’s proximity to your web server has an impact on response times. Deploying your content across multiple, geographically dispersed servers will make your pages load faster from the user’s perspective. But where should you start?

As a first step to implementing geographically dispersed content, don’t attempt to redesign your web application to work in a distributed architecture. Depending on the application, changing the architecture could include daunting tasks such as synchronizing session state and replicating database transactions across server locations. Attempts to reduce the distance between users and your content could be delayed by, or never pass, this application architecture step.

Remember that 80-90% of the end-user response time is spent downloading all the components in the page: images, stylesheets, scripts, Flash, etc. This is the Performance Golden Rule, as explained in The Importance of Front-End Performance. Rather than starting with the difficult task of redesigning your application architecture, it’s better to first disperse your static content. This not only achieves a bigger reduction in response times, but it’s easier thanks to content delivery networks.

A content delivery network (CDN) is a collection of web servers distributed across multiple locations to deliver content more efficiently to users. The server selected for delivering content to a specific user is typically based on a measure of network proximity. For example, the server with the fewest network hops or the server with the quickest response time is chosen.

Some large Internet companies own their own CDN, but it’s cost-effective to use a CDN service provider, such as Akamai Technologies, Mirror Image Internet, or Limelight Networks. For start-up companies and private web sites, the cost of a CDN service can be prohibitive, but as your target audience grows larger and becomes more global, a CDN is necessary to achieve fast response times. At Yahoo!, properties that moved static content off their application web servers to a CDN improved end-user response times by 20% or more. Switching to a CDN is a relatively easy code change that will dramatically improve the speed of your web site.

Discuss Rule 2

3: Add an Expires Header

Web page designs are getting richer and richer, which means more scripts, stylesheets, images, and Flash in the page. A first-time visitor to your page may have to make several HTTP requests, but by using the Expires header you make those components cacheable. This avoids unnecessary HTTP requests on subsequent page views. Expires headers are most often used with images, but they should be used on all components including scripts, stylesheets, and Flash components.

Browsers (and proxies) use a cache to reduce the number and size of HTTP requests, making web pages load faster. A web server uses the Expires header in the HTTP response to tell the client how long a component can be cached. This is a far future Expires header, telling the browser that this response won’t be stale until April 15, 2010.

      Expires: Thu, 15 Apr 2010 20:00:00 GMT

If your server is Apache, use the ExiresDefault directive to set an expiration date relative to the current date. This example of the ExpiresDefault directive sets the Expires date 10 years out from the time of the request.

      ExpiresDefault "access plus 10 years"

Keep in mind, if you use a far future Expires header you have to change the component’s filename whenever the component changes. At Yahoo! we often make this step part of the build process: a version number is embedded in the component’s filename, for example, yahoo_2.0.6.js.

Using a far future Expires header affects page views only after a user has already visited your site. It has no effect on the number of HTTP requests when a user visits your site for the first time and the browser’s cache is empty. The impact of this performance improvement depends, therefore, on how often users hit your pages with a primed cache. (A “primed cache” already contains all of the components in the page.) We measured this at Yahoo! and found the number of page views with a primed cache is 75-85%. By using a far future Expires header, you increase the number of components that are cached by the browser and re-used on subsequent page views without sending a single byte over the user’s Internet connection.

Discuss Rule 3

4: Gzip Components

The time it takes to transfer an HTTP request and response across the network can be significantly reduced by decisions made by front-end engineers. It’s true that the end-user’s bandwidth speed, Internet service provider, proximity to peering exchange points, etc. are beyond the control of the development team. But there are other variables that affect response times. Compression reduces response times by reducing the size of the HTTP response.

Starting with HTTP/1.1, web clients indicate support for compression with the Accept-Encoding header in the HTTP request.

      Accept-Encoding: gzip, deflate

If the web server sees this header in the request, it may compress the response using one of the methods listed by the client. The web server notifies the web client of this via the Content-Encoding header in the response.

      Content-Encoding: gzip

Gzip is the most popular and effective compression method at this time. It was developed by the GNU project and standardized by RFC 1952. The only other compression format you’re likely to see is deflate, but it’s less effective and less popular.

Gzipping generally reduces the response size by about 70%. Approximately 90% of today’s Internet traffic travels through browsers that claim to support gzip. If you use Apache, the module configuring gzip depends on your version: Apache 1.3 uses mod_gzip while Apache 2.x uses mod_deflate.

There are known issues with browsers and proxies that may cause a mismatch in what the browser expects and what it receives with regard to compressed content. Fortunately, these edge cases are dwindling as the use of older browsers drops off. The Apache modules help out by adding appropriate Vary response headers automatically.

Servers choose what to gzip based on file type, but are typically too limited in what they decide to compress. Most web sites gzip their HTML documents. It’s also worthwhile to gzip your scripts and stylesheets, but many web sites miss this opportunity. In fact, it’s worthwhile to compress any text response including XML and JSON. Image and PDF files should not be gzipped because they are already compressed. Trying to gzip them not only wastes CPU but can potentially increase file sizes.

Gzipping as many file types as possible is an easy way to reduce page weight and accelerate the user experience.

Discuss Rule 4

5: Put Stylesheets at the Top

While researching performance at Yahoo!, we discovered that moving stylesheets to the document HEAD makes pages load faster. This is because putting stylesheets in the HEAD allows the page to render progressively.

Front-end engineers that care about performance want a page to load progressively; that is, we want the browser to display whatever content it has as soon as possible. This is especially important for pages with a lot of content and for users on slower Internet connections. The importance of giving users visual feedback, such as progress indicators, has been well researched and documented. In our case the HTML page is the progress indicator! When the browser loads the page progressively the header, the navigation bar, the logo at the top, etc. all serve as visual feedback for the user who is waiting for the page. This improves the overall user experience.

The problem with putting stylesheets near the bottom of the document is that it prohibits progressive rendering in many browsers, including Internet Explorer. Browsers block rendering to avoid having to redraw elements of the page if their styles change. The user is stuck viewing a blank white page. Firefox doesn’t block rendering, which means when the stylesheet is done loading it’s possible elements in the page will have to be redrawn, resulting in the flash of unstyled content problem.

The HTML specification clearly states that stylesheets are to be included in the HEAD of the page: “Unlike A, [LINK] may only appear in the HEAD section of a document, although it may appear any number of times.” Neither of the alternatives, the blank white screen or flash of unstyled content, are worth the risk. The optimal solution is to follow the HTML specification and load your stylesheets in the document HEAD.

Discuss Rule 5

6: Put Scripts at the Bottom

Rule 5 described how stylesheets near the bottom of the page prohibit progressive rendering, and how moving them to the document HEAD eliminates the problem. Scripts (external JavaScript files) pose a similar problem, but the solution is just the opposite: it’s better to move scripts from the top to as low in the page as possible. One reason is to enable progressive rendering, but another is to achieve greater download parallelization.

With stylesheets, progressive rendering is blocked until all stylesheets have been downloaded. That’s why it’s best to move stylesheets to the document HEAD, so they get downloaded first and rendering isn’t blocked. With scripts, progressive rendering is blocked for all content below the script. Moving scripts as low in the page as possible means there’s more content above the script that is rendered sooner.

The second problem caused by scripts is blocking parallel downloads. The HTTP/1.1 specification suggests that browsers download no more than two components in parallel per hostname. If you serve your images from multiple hostnames, you can get more than two downloads to occur in parallel. (I’ve gotten Internet Explorer to download over 100 images in parallel.) While a script is downloading, however, the browser won’t start any other downloads, even on different hostnames.

In some situations it’s not easy to move scripts to the bottom. If, for example, the script uses document.write to insert part of the page’s content, it can’t be moved lower in the page. There might also be scoping issues. In many cases, there are ways to workaround these situations.

An alternative suggestion that often comes up is to use deferred scripts. The DEFER attribute indicates that the script does not contain document.write, and is a clue to browsers that they can continue rendering. Unfortunately, Firefox doesn’t support the DEFER attribute. In Internet Explorer, the script may be deferred, but not as much as desired. If a script can be deferred, it can also be moved to the bottom of the page. That will make your web pages load faster.

Discuss Rule 6

7: Avoid CSS Expressions

CSS expressions are a powerful (and dangerous) way to set CSS properties dynamically. They’re supported in Internet Explorer, starting with version 5. As an example, the background color could be set to alternate every hour using CSS expressions.

      background-color: expression( (new Date()).getHours()%2 ? "#B8D4FF" : "#F08A00" );

As shown here, the expression method accepts a JavaScript expression. The CSS property is set to the result of evaluating the JavaScript expression. The expression method is ignored by other browsers, so it is useful for setting properties in Internet Explorer needed to create a consistent experience across browsers.

The problem with expressions is that they are evaluated more frequently than most people expect. Not only are they evaluated when the page is rendered and resized, but also when the page is scrolled and even when the user moves the mouse over the page. Adding a counter to the CSS expression allows us to keep track of when and how often a CSS expression is evaluated. Moving the mouse around the page can easily generate more than 10,000 evaluations.

One way to reduce the number of times your CSS expression is evaluated is to use one-time expressions, where the first time the expression is evaluated it sets the style property to an explicit value, which replaces the CSS expression. If the style property must be set dynamically throughout the life of the page, using event handlers instead of CSS expressions is an alternative approach. If you must use CSS expressions, remember that they may be evaluated thousands of times and could affect the performance of your page.

Discuss Rule 7

8: Make JavaScript and CSS External

Many of these performance rules deal with how external components are managed. However, before these considerations arise you should ask a more basic question: Should JavaScript and CSS be contained in external files, or inlined in the page itself?

Using external files in the real world generally produces faster pages because the JavaScript and CSS files are cached by the browser. JavaScript and CSS that are inlined in HTML documents get downloaded every time the HTML document is requested. This reduces the number of HTTP requests that are needed, but increases the size of the HTML document. On the other hand, if the JavaScript and CSS are in external files cached by the browser, the size of the HTML document is reduced without increasing the number of HTTP requests.

The key factor, then, is the frequency with which external JavaScript and CSS components are cached relative to the number of HTML documents requested. This factor, although difficult to quantify, can be gauged using various metrics. If users on your site have multiple page views per session and many of your pages re-use the same scripts and stylesheets, there is a greater potential benefit from cached external files.

Many web sites fall in the middle of these metrics. For these properties, the best solution generally is to deploy the JavaScript and CSS as external files. The only exception I’ve seen where inlining is preferable is with home pages, such as Yahoo!’s front page (http://www.yahoo.com) and My Yahoo! (http://my.yahoo.com). Home pages that have few (perhaps only one) page view per session may find that inlining JavaScript and CSS results in faster end-user response times.

For front pages that are typically the first of many page views, there are techniques that leverage the reduction of HTTP requests that inlining provides, as well as the caching benefits achieved through using external files. One such technique is to inline JavaScript and CSS in the front page, but dynamically download the external files after the page has finished loading. Subsequent pages would reference the external files that should already be in the browser’s cache.

Discuss Rule 8

9: Reduce DNS Lookups

The Domain Name System (DNS) maps hostnames to IP addresses, just as phonebooks map people’s names to their phone numbers. When you type www.yahoo.com into your browser, a DNS resolver contacted by the browser returns that server’s IP address. DNS has a cost. It typically takes 20-120 milliseconds for DNS to lookup the IP address for a given hostname. The browser can’t download anything from this hostname until the DNS lookup is completed.

DNS lookups are cached for better performance. This caching can occur on a special caching server, maintained by the user’s ISP or local area network, but there is also caching that occurs on the individual user’s computer. The DNS information remains in the operating system’s DNS cache (the “DNS Client service” on Microsoft Windows). Most browsers have their own caches, separate from the operating system’s cache. As long as the browser keeps a DNS record in its own cache, it doesn’t bother the operating system with a request for the record.

Internet Explorer caches DNS lookups for 30 minutes by default, as specified by the DnsCacheTimeout registry setting. Firefox caches DNS lookups for 1 minute, controlled by the network.dnsCacheExpiration configuration setting. (Fasterfox changes this to 1 hour.)

When the client’s DNS cache is empty (for both the browser and the operating system), the number of DNS lookups is equal to the number of unique hostnames in the web page. This includes the hostnames used in the page’s URL, images, script files, stylesheets, Flash objects, etc. Reducing the number of unique hostnames reduces the number of DNS lookups.

Reducing the number of unique hostnames has the potential to reduce the amount of parallel downloading that takes place in the page. Avoiding DNS lookups cuts response times, but reducing parallel downloads may increase response times. My guideline is to split these components across at least two but no more than four hostnames. This results in a good compromise between reducing DNS lookups and allowing a high degree of parallel downloads.

Discuss Rule 9

10: Minify JavaScript

Minification is the practice of removing unnecessary characters from code to reduce its size thereby improving load times. When code is minified all comments are removed, as well as unneeded white space characters (space, newline, and tab). In the case of JavaScript, this improves response time performance because the size of the downloaded file is reduced. Two popular tools for minifying JavaScript code are JSMin and YUI Compressor.

Obfuscation is an alternative optimization that can be applied to source code. Like minification, it removes comments and white space, but it also munges the code. As part of munging, function and variable names are converted into smaller strings making the code more compact as well as harder to read. This is typically done to make it more difficult to reverse engineer the code. But munging can help performance because it reduces the code size beyond what is achieved by minification. The tool-of-choice is less clear in the area of JavaScript obfuscation. Dojo Compressor (ShrinkSafe) is the one I’ve seen used the most.

Minification is a safe, fairly straightforward process. Obfuscation, on the other hand, is more complex and thus more likely to generate bugs as a result of the obfuscation step itself. Obfuscation also requires modifying your code to indicate API functions and other symbols that should not be munged. It also makes it harder to debug your code in production. Although I’ve never seen problems introduced from minification, I have seen bugs caused by obfuscation. In a survey of ten top U.S. web sites, minification achieved a 21% size reduction versus 25% for obfuscation. Although obfuscation has a higher size reduction, I recommend minifying JavaScript code because of the reduced risks and maintenance costs.

In addition to minifying external scripts, inlined script blocks can and should also be minified. Even if you gzip your scripts, as described in Rule 4, minifying them will still reduce the size by 5% or more. As the use and size of JavaScript increases, so will the savings gained by minifying your JavaScript code.

Discuss Rule 10

11: Avoid Redirects

Redirects are accomplished using the 301 and 302 status codes. Here’s an example of the HTTP headers in a 301 response:

      HTTP/1.1 301 Moved Permanently
    Location: http://example.com/newuri
    Content-Type: text/html

The browser automatically takes the user to the URL specified in the Location field. All the information necessary for a redirect is in the headers. The body of the response is typically empty. Despite their names, neither a 301 nor a 302 response is cached in practice unless additional headers, such as Expires or Cache-Control, indicate it should be. The meta refresh tag and JavaScript are other ways to direct users to a different URL, but if you must do a redirect, the preferred technique is to use the standard 3xx HTTP status codes, primarily to ensure the back button works correctly.

The main thing to remember is that redirects slow down the user experience. Inserting a redirect between the user and the HTML document delays everything in the page since nothing in the page can be rendered and no components can start being downloaded until the HTML document has arrived.

One of the most wasteful redirects happens frequently and web developers are generally not aware of it. It occurs when a trailing slash (/) is missing from a URL that should otherwise have one. For example, going to http://astrology.yahoo.com/astrology results in a 301 response containing a redirect to http://astrology.yahoo.com/astrology/ (notice the added trailing slash). This is fixed in Apache by using Alias or mod_rewrite, or the DirectorySlash directive if you’re using Apache handlers.

Connecting an old web site to a new one is another common use for redirects. Others include connecting different parts of a website and directing the user based on certain conditions (type of browser, type of user account, etc.). Using a redirect to connect two web sites is simple and requires little additional coding. Although using redirects in these situations reduces the complexity for developers, it degrades the user experience. Alternatives for this use of redirects include using Alias and mod_rewrite if the two code paths are hosted on the same server. If a domain name change is the cause of using redirects, an alternative is to create a CNAME (a DNS record that creates an alias pointing from one domain name to another) in combination with Alias or mod_rewrite.

Discuss Rule 11

12: Remove Duplicate Scripts

It hurts performance to include the same JavaScript file twice in one page. This isn’t as unusual as you might think. A review of the ten top U.S. web sites shows that two of them contain a duplicated script. Two main factors increase the odds of a script being duplicated in a single web page: team size and number of scripts. When it does happen, duplicate scripts hurt performance by creating unnecessary HTTP requests and wasted JavaScript execution.

Unnecessary HTTP requests happen in Internet Explorer, but not in Firefox. In Internet Explorer, if an external script is included twice and is not cacheable, it generates two HTTP requests during page loading. Even if the script is cacheable, extra HTTP requests occur when the user reloads the page.

In addition to generating wasteful HTTP requests, time is wasted evaluating the script multiple times. This redundant JavaScript execution happens in both Firefox and Internet Explorer, regardless of whether the script is cacheable.

One way to avoid accidentally including the same script twice is to implement a script management module in your templating system. The typical way to include a script is to use the SCRIPT tag in your HTML page.

      script type="text/javascript" src="menu_1.0.17.js">

An alternative in PHP would be to create a function called insertScript.

In addition to preventing the same script from being inserted multiple times, this function could handle other issues with scripts, such as dependency checking and adding version numbers to script filenames to support far future Expires headers.

Discuss Rule 12

13: Configure ETags

Entity tags (ETags) are a mechanism that web servers and browsers use to determine whether the component in the browser’s cache matches the one on the origin server. (An “entity” is another word for what I’ve been calling a “component”: images, scripts, stylesheets, etc.) ETags were added to provide a mechanism for validating entities that is more flexible than the last-modified date. An ETag is a string that uniquely identifies a specific version of a component. The only format constraints are that the string be quoted. The origin server specifies the component’s ETag using the ETag response header.

      HTTP/1.1 200 OK
    Last-Modified: Tue, 12 Dec 2006 03:03:59 GMT
    ETag: "10c24bc-4ab-457e1c1f"
    Content-Length: 12195

Later, if the browser has to validate a component, it uses the If-None-Match header to pass the ETag back to the origin server. If the ETags match, a 304 status code is returned reducing the response by 12195 bytes for this example.

      GET /i/yahoo.gif HTTP/1.1
    Host: us.yimg.com
    If-Modified-Since: Tue, 12 Dec 2006 03:03:59 GMT
    If-None-Match: "10c24bc-4ab-457e1c1f"
    HTTP/1.1 304 Not Modified

The problem with ETags is that they typically are constructed using attributes that make them unique to a specific server hosting a site. ETags won’t match when a browser gets the original component from one server and later tries to validate that component on a different server, a situation that is all too common on Web sites that use a cluster of servers to handle requests. By default, both Apache and IIS embed data in the ETag that dramatically reduces the odds of the validity test succeeding on web sites with multiple servers.

The ETag format for Apache 1.3 and 2.x is inode-size-timestamp. Although a given file may reside in the same directory across multiple servers, and have the same file size, permissions, timestamp, etc., its inode is different from one server to the next.

IIS 5.0 and 6.0 have a similar issue with ETags. The format for ETags on IIS is Filetimestamp:ChangeNumber. A ChangeNumber is a counter used to track configuration changes to IIS. It’s unlikely that the ChangeNumber is the same across all IIS servers behind a web site.

The end result is ETags generated by Apache and IIS for the exact same component won’t match from one server to another. If the ETags don’t match, the user doesn’t receive the small, fast 304 response that ETags were designed for; instead, they’ll get a normal 200 response along with all the data for the component. If you host your web site on just one server, this isn’t a problem. But if you have multiple servers hosting your web site, and you’re using Apache or IIS with the default ETag configuration, your users are getting slower pages, your servers have a higher load, you’re consuming greater bandwidth, and proxies aren’t caching your content efficiently. Even if your components have a far future Expires header, a conditional GET request is still made whenever the user hits Reload or Refresh.

If you’re not taking advantage of the flexible validation model that ETags provide, it’s better to just remove the ETag altogether. The Last-Modified header validates based on the component’s timestamp. And removing the ETag reduces the size of the HTTP headers in both the response and subsequent requests. This Microsoft Support article describes how to remove ETags. In Apache, this is done by simply adding the following line to your Apache configuration file:

      FileETag none

Discuss Rule 13

14: Make Ajax Cacheable

People ask whether these performance rules apply to Web 2.0 applications. They definitely do! This rule is the first rule that resulted from working with Web 2.0 applications at Yahoo!.

One of the cited benefits of Ajax is that it provides instantaneous feedback to the user because it requests information asynchronously from the backend web server. However, using Ajax is no guarantee that the user won’t be twiddling his thumbs waiting for those asynchronous JavaScript and XML responses to return. In many applications, whether or not the user is kept waiting depends on how Ajax is used. For example, in a web-based email client the user will be kept waiting for the results of an Ajax request to find all the email messages that match their search criteria. It’s important to remember that “asynchronous” does not imply “instantaneous”.

To improve performance, it’s important to optimize these Ajax responses. The most important way to improve the performance of Ajax is to make the responses cacheable, as discussed in Rule 3: Add an Expires Header. Some of the other rules also apply to Ajax:

However, Rule 3 is the most important for speeding up the user experience. Let’s look at an example. A Web 2.0 email client might use Ajax to download the user’s address book for autocompletion. If the user hasn’t modified her address book since the last time she used the email web app, the previous address book response could be read from cache if that Ajax response was made cacheable with a future Expires header. The browser must be informed when to use a previously cached address book response versus requesting a new one. This could be done by adding a timestamp to the address book Ajax URL indicating the last time the user modified her address book, for example, &t=1190241612. If the address book hasn’t been modified since the last download, the timestamp will be the same and the address book will be read from the browser’s cache eliminating an extra HTTP roundtrip. If the user has modified her address book, the timestamp ensures the new URL doesn’t match the cached response, and the browser will request the updated address book entries.

Even though your Ajax responses are created dynamically, and might only be applicable to a single user, they can still be cached. Doing so will make your Web 2.0 apps faster.

10 ways to increase pages increased

2008-01-22T16:45:00.000-08:00

For a while now webmasters have fretted over why all of the pages of their website are not indexed. As usual there doesn't seem to be any definite answer. But some things are definite, if not automatic, and some things seem like pretty darn good guesses.

Editor's Note: If you know a good way to increase the number, or are certain (or can guess) of a way to get all of a website's pages crawled, then please join the conversation by letting us know in the comments section.

So, we scoured the forums, blogs, and Google's own guidelines for increasing the number of pages Google indexes, and came up with our (and the community's) best guesses. The running consensus is that a webmaster shouldn't expect to get all of their pages crawled and indexed, but there are ways to increase the number.

PageRank

It depends a lot on PageRank. The higher your PageRank the more pages that will be indexed. PageRank isn't a blanket number for all your pages. Each page has its own PageRank. A high PageRank gives the Googlebot more of a reason to return. Matt Cutts confirms, too, that a higher PageRank means a deeper crawl.

Links

Give the Googlebot something to follow. Links (especially deep links) from a high PageRank site are golden as the trust is already established.

Internal links can help, too. Link to important pages from your homepage. On content pages link to relevant content on other pages.

Sitemap

A lot of buzz around this one. Some report that a clear, well-structured Sitemap helped get all of their pages indexed. Google's Webmaster guidelines recommends submitting a Sitemap file, too:

· Tell us all about your pages by submitting a Sitemap file; help us learn which pages are most important to you and how often those pages change.

That page has other advice for improving crawlability, like fixing violations and validating robots.txt.

Some recommend having a Sitemap for every category or section of a site.

Speed

A recent O'Reilly report indicated that page load time and the ease with which the Googlebot can crawl a page may affect how many pages are indexed. The logic is that the faster the Googlebot can crawl, the greater number of pages that can be indexed.

This could involve simplifying the structures and/or navigation of the site. The spiders have difficulty with Flash and Ajax. A text version should be added in those instances.

Google's crawl caching proxy

Matt Cutts provides diagrams of how Google's crawl caching proxy at his blog. This was part of the Big Daddy update to make the engine faster. Any one of three indexes may crawl a site and send the information to a remote server, which is accessed by the remaining indexes (like the blog index or the AdSense index) instead of the bots for those indexes physically visiting your site. They will all use the mirror instead.

Verify

Verify the site with Google using the Webmaster tools.

Content, content, content

Make sure content is original. If a verbatim copy of another page, the Googlebot may skip it. Update frequently. This will keep the content fresh. Pages with an older timestamp might be viewed as static, outdated, or already indexed.

Staggered launch

Launching a huge number of pages at once could send off spam signals. In one forum, it is suggested that a webmaster launch a maximum of 5,000 pages per week.

Size matters

If you want tens of millions of pages indexed, your site will probably have to be on an Amazon.com or Microsoft.com level.

Know how your site is found, and tell Google

Find the top queries that lead to your site and remember that anchor text helps in links. Use Google's tools to see which of your pages are indexed, and if there are violations of some kind. Specify your preferred domain so Google knows what to index.

Yahoo finds fault with Google's secret sauce

2008-01-17T17:56:00.000-08:00

As complex as Google's PageRank may be, search experts at Yahoo seem to think it's not complex enough. Based on patent filings, Yahoo is dabbling in ranking algorithms that incorporate more user behavior data in advance of the company's next run at toppling Google's haloed relevance.

Editor's Note: Yahoo, as usual, is fairly confident in its ability to create a search algorithm that meets or exceeds the quality of Google's. Lots of search players have felt the same and have yet to deliver. Do you think Yahoo will ever catch Google or is it just too late to take down the Mountain View Monolith. Let us know in the comment section.

Seeing will be believing when it happens, of course, as Google is highly secretive about how its search engine calculates PageRank. If history is any indication, they're already way ahead on behavioral factoring.

Nonetheless, Yahoo can afford the best search engineers in the business (if they can get them before Google does, anyway) and the patent filings shed some light on how PageRank is currently calculated and ways it might be improved in the future.

Bill Slawski, Director of Search Marketing at KeyRelevance, goes into painstaking detail of Yahoo's user data challenges at his SEObytheSea blog. Patent language, especially when dealing with algorithms, can be confusing and dense, so we'll just highlight a few interesting points and leave the lexicographical deciphering to you.

Some Yahoo assumptions about PageRank and flaws associated:

Internal and external links are often weighed equally even though internal links can be less reliable and more self-promotional. Some links, like disclaimer links, are rarely followed.
PageRank ignores that webpages are often purchased and repurposed, decay or become less valuable over time at variable rates.
Current calculations, like TrustRank, are engineered more to combat webspam than to reflect actual user behavior.
Sometimes PageRank deals with links in bulk, aggregating according host or domain, also known as blocked PageRank.

What Yahoo plans to do about it:

Measure link weight influenced by the frequency with which users follow a link
Note when links are ignored and users leave (teleport) to another page of their choosing
Calculate the probability that a user stops and reads a webpage rather than views it and moves on.
Incorporate user data into the algorithm "User Sensitive PageRank could reflect "the navigational behavior of the user population with regard to documents, pages, sites, and domains visited, and links selected."
Personalize PageRank based on demographic information age, gender, income, user location)
Emphasize recent information
Weigh anchor text more heavily the patent filing calls anchor text "one of the most useful features used in ranking retrieved Web search results"

January Newsflash

2008-01-13T18:23:00.000-08:00

Python has been declared as programming language of 2007. It was a close finish, but in the end Python appeared to have the largest increase in ratings in one year time (2.04%). There is no clear reason why Python made this huge jump in 2007. Last month Python surpassed Perl for the first time in history, which is an indication that Python has become the "de facto" glue language at system level. It is especially beloved by system administrators and build managers. Chances are high that Python's star will rise further in 2008, thanks to the upcoming release of Python 3.
A couple of interesting trends can be derived from the 2007 data. First of all, languages without automated garbage collection are losing ground rapidly. The most prominent examples of languages with explicit memory management, C and C++, both lost about 2% in one year. Another trend is that the battle between scripting languages seems to be going on in the background. There is a continuous flow of new scripting languages. In 2006, Ruby entered the main scene, followed this year by Lua. In the top 50, Groovy and Factor are new kids on the block. None of these new scripting languages seem to stay permanently, they are just replaced by successors.
What were the big movers and shakers in 2007? The big winners are Lua (from 46 to 16), Groovy (from 66 to 31), Focus (from 78 to 41), and Factor (new at 45). The most prominent shakers are ABAP (from 15 to 29) and IDL (from 23 to 48).
What is to be expected in 2008? And, what became of the forecasts for 2007? At the beginning of 2007, I thought C# and D would become the winners and Perl and Delphi the losers. C# was indeed one of the big winners, and Perl one of the big losers. But the forecasts for D and Delphi were completely wrong. There has been no breakthrough for D. On the other hand, Delphi reclaimed a top 10 position... What about 2008? C, C++ and Perl will continue to fall. C and C++ because they have no automated garbage collection. C++ will get an extra push down because Microsoft is not actively supporting the language anymore. Perl is just dead. Java and C# will eventually be the 2 most popular languages. So I expect them to rise further in 2008. What new languages will enter the top 20 in 2008 is a wild guess, but I think ActionScript and Groovy are really serious candidates.
Nguyen Quang Chien suggested to rename the OCaml entry to Caml. This has been done. Thanks Nguyen!

In the tables below some long term trends are listed about categories of languages. The tables show that dynamically typed object-oriented languages are still becoming more popular.

Category	Ratings January 2008	Delta January 2007
Object-Oriented Languages	56.1%	+4.0%
Procedural Languages	40.9%	-3.6%
Functional Languages	1.9%	+0.2%
Logical Languages	1.1%	-0.6%

Category	Ratings January 2008	Delta January 2007
Statically Typed Languages	56.2%	-1.5%
Dynamically Typed Languages	43.8%	+1.5%

TIOBE declares Python as programming language of 2007 !!

2008-01-13T18:21:00.000-08:00

The TIOBE Programming Community index gives an indication of the popularity of programming languages. The index is updated once a month. The ratings are based on the world-wide availability of skilled engineers, courses and third party vendors. The popular search engines Google, MSN, Yahoo!, and YouTube are used to calculate the ratings. Observe that the TIOBE index is not about the best programming language or the language in which most lines of code have been written.

The index can be used to check whether your programming skills are still up to date or to make a strategic decision about what programming language should be adopted when starting to build a new software system. The definition of the TIOBE index can be found here.

Position Jan 2008	Position Jan 2007	Programming Language	Ratings Jan 2008	Delta Jan 2007	Status
1	1	Java	20.849%	+1.69%	A
2	2	C	13.916%	-1.89%	A
3	4	(Visual) Basic	10.963%	+1.84%	A
4	5	PHP	9.195%	+1.25%	A
5	3	C++	8.730%	-1.70%	A
6	8	Python	5.538%	+2.04%	A
7	6	Perl	5.247%	-0.99%	A
8	7	C#	4.856%	+1.34%	A
9	12	Delphi	3.335%	+1.00%	A
10	9	JavaScript	3.203%	+0.36%	A
11	10	Ruby	2.345%	-0.17%	A
12	13	PL/SQL	1.230%	-0.34%	A
13	11	SAS	1.204%	-1.14%	A
14	14	D	1.172%	-0.16%	A
15	18	COBOL	0.932%	+0.30%	A
16	46	Lua	0.579%	+0.48%	A--
17	22	FoxPro/xBase	0.506%	+0.05%	B
18	19	Pascal	0.456%	-0.11%	B
19	16	Lisp/Scheme	0.413%	-0.26%	A--
20	27	Logo	0.386%	+0.07%	B

IBM developerWorks: Mastering regular expressions in PHP, Part 1

2008-01-06T21:06:00.000-08:00

The IBM developerWorks website has posted the first part of a series they've created to help PHP developers become more informed about what regular expressions are and how they can harness their power for their applications.

Pattern matching is such a common chore for software that a special shorthand â€" regular expressions â€" has evolved to make light work of the task. Learn how to use this shorthand in your code here in Part 1 of this "Mastering regular expressions in PHP" series.

In this first part of the series, they look at the basics - the idea behind regular expressions, some of the common operators, the PHP functions to use them and example of how to use them to match/split out strings and capture just the data you need from the given input.

CakePHP 1.2 Release (and a New Site Design)

2008-01-03T19:19:00.000-08:00

As Chris Hartjes points out there's a new release of the popular PHP framework CakePHP (as well as a new web site design).

You can grab the latest download directly from the homepage or look into the manual to find out more about the framework and how it can be used.

Rails for PHP Developers Website Launched

2008-01-03T18:37:00.000-08:00

Mike Naberezny has start up a new resource to try to bridge some of the gap between PHP and Ruby and to help developers of either to get a bit more insight into the others' side - Rails for PHP Developers (based on the book published by the Pragmatic Programmers).

Rails for PHP Developers is a new site for PHP developers who are also interested in Rails and Ruby. PHP and Ruby are great complementary tools that are sometimes seen as adversarial, which is really unfortunate. We use both and we'll be writing regular articles to help cross-pollinate ideas and promote collaboration between the communities.

There's already some good content there - useful perlisms in ruby, a look at PHP object attributes and some information about the release of the site itself.

The Web's Most, Biggest, Best, and Worst of 2007

2008-01-01T05:13:00.000-08:00

Yes, another year-end retrospective

2007 was a frenzied year for all things digital, and could be marked as when the revolution really began to take hold. Social media took center stage, impacting everything from politics to major corporate maneuvers to raising awareness of social causes.

Editor's Note:Superlatives are always a matter of opinion. What's the best, worst, biggest, or most to one person is trivial to another. Anything you'd like to add to the list? Let us know in the comments section.

There were lawsuits, mysteries, legal abuses, policy shifts, embarrassments, scandals, oppressions, miscalculations, bubble discussions, and significant innovations. All and all, 2007 was a big year for anybody with a stake on the Net.

So, without further ado, we present the Most, the Biggest, the Best, and the Worst of 2007.

PayPal: New Solutions for PHP Developers

2007-12-12T03:08:00.000-08:00

Overview

The PayPal Solutions Directory brings together PayPal screened and approved third-party solutions. Popular shopping carts. Leading hosting solutions. Experienced website consultants. So whether you're integrating PayPal yourself or for a client, this is the place to quickly find what you're looking for.

PayPal Compatible Carts

Whatever PayPal product you're using, you're sure to find the perfect shopping cart. Browse through a complete list of compatible carts with pricing information and spotlighted featured items.

Get in the Solutions Directory

Are you an e-commerce solutions provider that would like to be listed in the PayPal Solutions Directory?

Get listed

Google Giving Kids A Chance To Develop For Them

2007-11-30T16:10:00.000-08:00

In an effort to introduce secondary school and high school students to open source software development, Google has announced the Google Highly Open Participation Contest at the Open Source Developer's Conference in Brisbane, Australia.

Students can compete for prizes such as cash and t-shirts; ten grand prize winners will receive a chance to visit the Googleplex in Mountain View, Ca.

The contest features tasks that fall into the categories of code, documentation, research, outreach, quality assurance, training, translation, and user interface.

Over the past three years, college level students have participated in the Google Summer of Code where they have been introduced to open software development.

Throughout that time, thousands of people from around the world have begun developing and writing millions of lines of code together, and now it's time for Google to turn their attention to the younger crowds.

Download a Free Trial of Ektron CMS400.NET

As we thought about what we could do to help encourage students before university and build a pipeline of future talent, we developed the Google Highly Open Participation Contest - the first contest from our open source team exclusively for secondary school and high school students.

Google is working with ten open source organizations for the pilot effort to come up with a list of tasks to be completed by the students.

The organizations include: Apache Software Foundation, Drupal, GNOME, Joomla!, MoinMoin, Mono, Moodle, Plone, Python Software Foundation, and SilverStripe CMS.

The contest is open to students that are 13 years of age or older and have not yet begun university training.

Students will be able to claim their tasks until 12:00am PST on Jan.22, 2008.

We hope that students who participate will be long-term contributors to these and other open source projects in the future, and we look forward to announcing the grand-prize winners on February 11.

If you need more information, check out Google's Developer Home.

How to look your Best in search results

2007-11-27T15:44:00.000-08:00

Mom always said, "Put your best foot forward." It's valuable advice, because often how you appear on a first meeting sends subtle signals about you and can influence what happens next. We should also be concerned the same way with how we appear, what information is presented about us, in the search results.

Editor's Note: While influencing where your site ranks in Google's search results is an involved science, controlling what the searcher sees about your site is much simpler. Of prime interest is the "snippet," where the most control can be exerted. Have you experimented with your snippet? If so, tell us what worked for you in the comments sections.

Because nobody makes snap judgments like a searcher.

During a recent trip to Google's Kirkland, Washington office, Matt Cutts and colleagues spent an hour creating impromptu videos on various search-related topics. The first to be posted involves " the anatomy of a search snippet," and how much control a webmaster has over what information is displayed in search results.

The answer to how much control is: quite a bit, actually. This article will explore Cutts's explanation of the snippet, and ways to make the best of your search presence. Much of managing your appearance in the search results involves telling Google what to index and what not to index.

Homepage Title

The first thing you see in your search result is the title, and this is the first thing that Cutts also addresses. In honor of being in the Pacific Northwest, he used Starbucks' search result as an example, which labels its homepage as "Starbucks Homepage." This is your first impression.

Cutts questioned whether the word "homepage" was a good choice (Google took the title directly from the page) as few would search for that word. Starbucks being so recognizable, it hardly matters, but for smaller business it's a good idea to optimize wherever you can. "Starbucks Coffee" might have been a better SEO choice.

A usability expert might argue, though, that straightforward is best, and giving the searcher what he or she expects to see will have a direct impact on whether a link is clicked. Watch the Video.

The Snippet

The snippet is where the webmaster has the most control of what is displayed about his or her site. Google often pulls the snippet text directly from the meta description tags, and Cutts recommends experimenting with the text to see what yields the best results for individual sites.

Longer snippets, as we've noted before, help searchers with informational queries, and may also be of benefit for SEO reasons. Shorter ones work better for navigational queries.

Google may also pull snippets from other places as well, depending on the query or situation. If no description is available, Cutts says Google may grab information from the Open Directory Project (dmoz) or other directories. Or, to find the context of a query, Google may look to beyond meta description tags to increase relevance.

If there is content you don't want to appear in the snippet, you can add the "nosnippet tag" to your HTML, which looks like this:

Cache Page

Under Your Command

Your title

Your snippet

What's indexed

What's cached

How long is something
indexed

The language

Experimentation

The cache page acts as a backup if a website is for some reason unavailable. It will show an archived version of your site, show when it was last crawled by the Googlebot, and serves as a sort of content freshness indicator. Regularly updating content is a good way to influence what appears there, but also useful is the ability to tell Google what not to archive. To prevent the Googlebot from creating a cached version of a page, use the NOARCHIVE tag, which looks like this

Site Links

Cutts was quick to assure viewers that site links were algorithmic and not payment based. In the Starbucks example, these would be headed "Store Locator" and "Career Center." So there may not be a lot of control over Google chooses as an important related page to increase searcher relevancy, other than using a NOINDEX tag for certain pages so the Googlebot knows what to skip, and making sure the language is clear as to what the pages you do want indexed are for.

If a page is seasonal or promotional only and you want Google to stop crawling that page after a certain time period, you can use the "unavailable_after" tag. Effective use of the tags mentioned also help control what appears on the "more results" page.

PHP 5.2.5 Released

2007-11-22T15:11:00.001-08:00

PHP 5.2.5 has now been released and is ready for download. According to the php.net site,

{{This release focuses on improving the stability of the PHP 5.2.x branch with over 60 bug fixes, several of which are security related. All users of PHP are encouraged to upgrade to this release.}}

Highlights of the release include:

Upgraded PCRE to version 7.3
Updated timezone database to version 2007.9
Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable.
Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc() functions
Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll())
Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax)
Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23)
Over 60 bug fixes.

You can read the release announcement, see the changelog, or download this version.

PayPerPost Bloggers Unranked By Google

2007-11-22T15:08:00.000-08:00

PageRank zero became the big number for blogs participating in Izea's PayPerPost program; Google's move to drop the rankings of those blogs drew a harsh rebuke from Izea's CEO.

PayPerPost Bloggers Unranked By Google

Ted Murphy has been a lightning rod for criticism ever since the unveiling of PayPerPost, an ad system where bloggers are paid to write about an advertiser. Murphy's company, now called Izea, fought back against early complaints about non-disclosure by instituting a disclosure policy.

Compared to what happened recently, that brouhaha looks like a minnow compared to what the big fish in the search industry did to PPP bloggers. Murphy blogged that Google had tweaked the PageRank of a number of those bloggers, dropping them to PR 0.

When it comes to finding blogs on Google, PageRank is one of a number of factors used to qualify the authoritativeness, and therefore the placement, of a site or blog in Google's search results. Higher PR sites tend to rank well, which means people are more likely to find them and visit.

"Once again Google has proved that PR has little to do with blog traffic, influence or relevance and everything to defending their monopolistic stranglehold on search and online advertising," Murphy said in his post.

He suggested services like PPP and similar competitors offering revenue to bloggers all have a common denominator: they aren't Google AdSense. Google's content network of AdSense participants extends the reach of its AdWords ad platform.

Despite the ominous drop in PageRank, it has been suggested that the blogs victimized by the change have not suffered a loss in traffic, according to Tony Hung. "My take on things is that Google wants to make an example out of Izea," he wrote.

Traffic may not be impacted today, but the effects of the dramatic lowering of PageRank may be evident in the months to follow. As the dominant search engine, Google drives traffic to websites, and the higher they place in search results, the better the chance a site will receive a visit.

If the PageRank drop knocks blogs out of places where they had been ranking well in search, we expect that traffic will fall as well, and we will hear about this again.

Unvalidated Robots.Txt Risks Google Banishment

2007-11-22T15:03:00.001-08:00

The web crawling Googlebot may find a forgotten line in robots.txt that causes it to de-index a site from the search engine.

Unvalidated Robots.Txt Risks Google Banishment

Webmasters welcome being dropped out of Google about as much as they enjoy flossing with barbed wire. Making it easier for Google to do that would be anathema to being a webmaster. Why willingly exclude one's site from Google?

That could happen with an unvalidated robots.txt file. Robots.txt allows webmasters to provide standing instructions to visiting spiders, which contributes to having a site indexed faster and more accurately.

Google has been considering new syntax to recognize within robots.txt. The Sebastians-Pamphlets blog said Google confirmed recognizing experimental syntax like Noindex in the robots.txt file.

This poses a danger to webmasters who have not validated their robots.txt. A line reading Noindex: / could lead to one's site being completely de-indexed.

The surname-less Sebastian recommended Google's robots.txt analyzer, part of Google's Webmaster Tools, and only using the Disallow, Allow, and Sitemaps crawler directives in the Googlebot section of robots.txt.

Give Your Website A Voice With Speaking Characters

2007-11-21T15:11:00.000-08:00

------------------------------------------------------------------------------------------

Give Your Website a Voice With an Animated Speaking Character

A SitePal speaking character is proven, easy-to-use and cost-effective tool to enhance your customers online experience and improve the site conversion. Try it free for 15 days.

Engage site visitors on personal level
Provide information on your products
Persuade your visitors to take action
Stand out from the competition

The result? Increased time-on-site, message recalls, conversions and sales.

SitePal Proved 144% Higher Conversions

Anita Campbell, CEO of Small Business Trends.com and renowned small business expert, wanted to see if SitePal can improve the sign up rate of the email newsletter on her website and decided to run an A/B test. 50% of the site visitors were shown a SitePal speaking character inviting them to subscribe for the newsletter, and the other 50% were shown a version of the page without a SitePal character.

The results: After just 1 week, we got more than double the sign-ups using the SitePal character, as without it. The conversion rate was 144% higher! The avatar focused the attention of visitors on the newsletter and was successful in convincing visitors to take the extra steps to subscribe. The SitePal avatar exceeded my expectations. The SitePal character is a powerful sales and marketing tool for a website.

- Anita Campbell, CEO, Small Business Trends.com

SitePal Is Easy!
With SitePal, creating and publishing your own speaking character is as easy as 1,2,3. Using our online editor, you can easily customize any character to your liking, and add your audio message by using our Text-to-Speech or Record-by-Phone feature. The process is automated, no technical experience is required.

Visit www.SitePal.com to learn more and start your 15 day free trial!

Get top 10 rankings on Google & Yahoo with IBP's proven Top 10 Optimizer

2007-11-21T15:08:00.000-08:00

If you want to get high rankings on Google and other major search engines then you must optimize your web pages. IBP's Top 10 Optimizer helps you optimize your web pages quickly and easily.

Fact: If you want to get high rankings on Google and other major search engines then you need optimized web page content and high quality inbound links. IBP helps you get both.

IBP helps you get high Google rankings in three easy steps:

	Download IBP now and install it on your computer. IBP runs on Windows 98/Me/2000/XP/Vista.
	Start IBP and enter your website address in IBP's Top 10 Optimizer tools.
	Follow the instructions and benefit from top 10 search engine rankings on Google & Yahoo!
IBP tells you in plain English and in great detail what you have to do to get a top 10 ranking for your specific keyword in the search engine you've chosen. IBP supports all important search engines.

IBP uses a proven method that works

A search engine optimization method that really works is to analyze the web pages that currently have a high ranking for your important keyword. Since these pages have a top 10 ranking, the pages must have all the best settings.

With IBP, analyzing the top ranked web pages is as easy as 1-2-3. IBP analyzes the web pages that currently have a top 10 ranking in the search engine of your choice and compares them with your page.

IBP tells you how the pages have achieved that ranking and how you must change your web pages and the links to your website to obtain a similar ranking. Improving your website has never been so easy. IBP helps you get more customers and more sales with increased search engine rankings.

How to optimize your website for Google

IBP's Top 10 Ranking report demystifies Google's ranking algorithm and tells you in easy-to-understand words how to optimize and prepare your website specifically for better results in Google.

Suppose you want to know how to get a top 10 ranking for the search term "outdoor equipment" in Google. IBP will tell you how to optimize your website for exactly that search term in Google.

IBP's advice is based on in-depth analysis of current, up-to-the-minute top 10 results in Google for that search term and it is specifically for that search term and specifically for Google..

IBP's high quality analysis results are always up-to-date, specific, and accurate. You won't get that level of search engine optimization accuracy with any other tool.

IBP also works with Yahoo's latest search engine ranking algorithm, with MSN Search and all other major search engines. IBP helps you get the rankings you deserve.

Is your search engine optimization company really good?

Did you hire a search engine placement or a search engine optimization company to get high rankings for your site? Use IBP to find out if they really optimized your site for high rankings on Google.

Of course, IBP also works with other search engines. Don't wait any longer and download the free IBP trial now.

Read what our customers say about IBP:

Jean-Boucher, Magicien.biz, says:

"I have bought books, e-books and applications about SEO, I subscribe to numerous newsletters related to SEO, but the only tool I don't regret buying is IBP. With IBP, I have managed to place my website on the first place for my target keyword.

I'm first in Yahoo & MSN and I am currently 3rd with Google. The beauty of this program is that it works with any language. All you have to do is to follow the clear instructions. Thank you IBP."

Michael Wong, Mikes-Marketing-Tools.com, says:

"IBP is a search engine optimization tool that turns SEO novices into experts overnight! [...] The report is not only comprehensive, but goes into the kind of detail that would take a professional optimizer quite a few hours to produce.

You then simply go through the checklist and make the appropriate changes to your web page. [...] You really have to see for yourself. It's so simple, even a complete computer novice can use it. I highly recommend it!"

Yvonne Walker, HerbalLuxuries.com, says:

"I just purchased IBP and I love the product. I had previously purchased a couple of other programs before buying IBP, wow what a difference. The reports are very in-depth.

The main items that differentiate IBP from the others are the reports make sense and they are clear and concise. The other thing is the design of the software, nice interface, easy to follow. Thanks for such a great tool that actually works."

Richard Bravo, Jackson Hole Real Estate Company, says:

"I just wanted to let you know your software ROCKS! After just one week of implementing data from our IBP reports we have seen 23 NEW listings.
We jumped an average of 10 spots that put us on the first page of most of our key phrases and we just hit #1 on one of our most coveted key words. Yee-Haw! Thanks for developing such a great tool."

Order IBP now 100% risk-free. We take the risk, you get the results. IBP helps you get higher search engine rankings, more customers and more sales.

Click here to download the free trial version.

MySQL Lunch & Learn Program

2007-11-20T16:13:00.001-08:00

The "MySQL Lunch-n-Learn Program" is designed to be a fun and informal educational event for your team. MySQL provides the technical experts, and brings lunch! Select a topic of your choice:

MySQL Enterprise Monitor, Replication Monitor, and Scale-Out
MySQL High Availability and Scalability Architectures
MySQL Performance Tuning - Advanced Tips & Tricks
MySQL Partitioning
MySQL for Data Warehousing
MySQL for the Oracle DBA
MySQL Cluster - Carrier Grade Edition (for Telecoms only)
Embedded Databases: Why MySQL is a perfect fit for ISV applications

X-Cart 4.1.9 released and announced

2007-11-20T16:08:00.001-08:00

Qualiteam Software Ltd. company, a provider of e-commerce software solutions, used by tens of thousands online merchants in 111 countries worldwide, released a new version of X-Cart v 4.1.9. New release of X-Cart features further improvements in core functions, payment modules and addons.

The major changes between v4.1.8 and v4.1.9 are:

Completely re-worked X-Magnifier add-on, see below for details.
Improved installation wizard now suggests solutions.
HTML meta keywords and description tags moved above JavaScript code for SEO purposes.
Shipping Label Generator module has been updated (USPS labels retrieval, code refactoring).
Major improvement in online payment processing security. 3DSecure transactions support enabled in the following modules:

eSelect Plus. Transaction API
iDEB
Caledon
eSec.Direct
eSec.ReDirect
WebCraft/Transactium
PayFlow Pro (via PayFlow FPS)
Authorize.NET
PsiGate
Netbilling
USA ePay

Qualiteam Software announces a new version of X-Magnifier add-on, which features usability and performance improvements, including:

A completely stretchable zoom window.
Improved usability (scaling images with mouse scroll wheel button, "fit to page" button, thumbnail management interface in admin zone).
Customizable zoom window (two predefined skin sets come with the add-on out-of-the-box).
Improved performance (46% less memory needed).

For detailed changes description see the CHANGELOG file, which is included into X-Cart installation package, or can be downloaded from the File Area section of your Support Help Desk account.

CRE Loaded 6.2 SP1 - Now Available for Download

2007-11-20T16:05:00.000-08:00

Chain Reaction Ecommerce (CRE), makers of the popular open source shopping cart CRE Loaded, announce the release of CRE Loaded 6.2 SP1 with several new services, partner tie-ins, and essential updates and fixes. All CRE Loaded 6.2 storeowners (applies to Standard, Pro and Pro B2B applications) can visit www.creloaded.com and download SP1 for FREE.

New Services available via the CRE Loaded 6.2 SP1 admin panel:

CRE Merchant^SM for the best rates in credit card processing. (Available for US users only at this time)
CRE Messenger^SM for in-store sales and customer-service chat .

New Partner Integrations available inside the CRE Loaded 6.2 SP1 admin panel:

PayPal Pro integration and PayPal certification.
BuySAFE transaction bonding service enhances customer trust and security.
MyStoreRewards pay-per-performance buyer-loyalty program.

Key updates and fixes include:

Godaddy.com – now completely compatible.
Google Feed support enhancements.
Enhanced Create Order and Edit Order functions for better product selection.
Enhancements to Sub-Product handling to provide more consistent functionality.
Major enhancements to the Affiliate presentation and reporting to reduce confusion.
Enabled editing of product prices when editing an order.
Fixes applied to the backup.php and backup_mysql.php to better support compression.
Corrections to the PayPal IPN module to support Invoice Number and Printing.
Easy Populate Advanced Import / Export updated to work in a PHP 5.2 environment.
Several enhancements to better support special characters, such as apostrophes, in product names and attributes.
A major change to Sessions to provide more stability.
Correction to Date handling for Spanish-language sites.
Several enhancements to Coupon handling and functionality.

It is highly recommended that SP1 be installed on all CRE Loaded 6.2 shopping carts. Visit the link below to download. Pro and Pro B2B customers must login and go to their Mydownloads link. Standard users Get Patch 12 (SP1) HERE. Click and then locate the file.

PHP Designer 2007 - Professional version 5.3 is available!

2007-11-20T10:07:00.000-08:00

MPSOFTWARE proud announces the new release of PHP Designer 2007 - Professional version 5.3 featuring more than 50 new features, enhancements and bug fixes.

Version 5.3 includes:

- Significant improvement in speed and performance

- PHP Code Explorer
* Support for dependencies (include, include_, require and require_once)
* Support for classes, extends classes and implements
* Support for functions
* Support for grouped variables with counts
* Support for context of variables (global, local - inside function)
* Support for constants
* Support for interfaces
* Jump to extends classes, implements and dependencies
* Get information on the fly about where each item is declared in, including phpDocumentor information
* Search filter

- PHP Code Completion
* Support for PHP 4.4.6 and PHP 5.2.1
* Intelligent suggestion on the fly!
* Customizable
* Auto trigger by variables ($), PHP class (: and PHP object (->)
* Support for native/user functions, variables and constants
* Support for context of variables (global, local - inside function)
* Support for simple and nested objects
* Support for keywords (include, if, else etc.)
* Support for class member visibility (private, protected, public, static, final, var)
* Support for extends classes and implements
* Support for interfaces
* Get description about all native functions, what PHP version it is supported in and what it returns.

- HTML Code Completion
* Support for HTML and XHTML
* Intelligent suggestion on the fly!
* Auto trigger
* Show information on the fly about tag attributes
* Customizable

- CSS Code Completion
* Support for CSS 1 and CSS 2.1
* Intelligent suggestion on the fly
* Auto trigger

- Code Tip for PHP
* Support for PHP 4.4.6 and PHP 5.2.1
* Intelligent suggestion on the fly
* Auto trigger inside functions and by mouse clicking
* Support for multiple functions
* Support for multiple lines
* Extended information about functions (classes and types)
* Fixed position (always at beginning of function call)

- Project Manager
* Parse project for classes, functions, variables, constants, extends, implements, interfaces etc.
* The active project is protected against renaming

- Jump to File/Project Declaration (classes, functions, interfaces, constants and variables)
- Search and jump to File/Project Declaration (classes, functions, interfaces, constants and variables)
- Support for Frameworks
- Embedded PHP in the HTML highlighter
- Asia characters are now displayed corrected when working in PHP/HTML/CSS/JS
- Support for key strokes in the file/project browser
- New file-templates for PHP and HTML
- File overview in the File tabs
- Close all files except active file
- The AutoClose Bracket has been improved when working in PHP/HTML/CSS/JS
- Show hint with active line position when scrolling
- Support for deleting Desktop Layouts
- Fixed loading syntax highlighters on upstart
- Fixed saving and loading HTML versions on upstart
- Support for the extended PHP manual in the code libraries
- New statusbar in the browser preview
- Fixed loading highlighters
- Fixed the alignment properties in Table and Images
- Fixed layout on the Getting Started page
- Support for an edit popup-menu in the search toolbar
- Support for tabs/tabs-to-spaces in the auto-completion, snippets and templates
- Support for external looking up in the PHP manual
- Fixes and enhancements

This new release can be downloaded at http://www.mpsoftware.dk

This new release is free for registered customers who have previous ordered version 5.x.x.

VirtueMart Developer Central launched!

2007-11-20T09:59:00.000-08:00

The VirtueMart Team is very proud to announce the Launch of the new Portal "VirtueMart Development Central" dev.virtuemart.net.

This will be the place where users can help develop VirtueMart, report Bugs and Feature Requests, start their own Projects and much more. Your own Project? Yes, you've read correctly: the Developer Platform is meant for Open Source Projects who work together with or enhance VirtueMart (like Payment & Shipping Modules, Frontend Modules etc.) - Extensions for VirtueMart. Every Project receives free Space for Documents, Trackers, Forums, Wiki, SVN/CVS.

The Portal is powered by a Free Open Source Community License of CodeBeamer. Thanks to Intland GmbH the VirtueMart Community now can make use of the full Power of an Enterprise-Level Collaboration Suite.

The Tasks from the Flyspray Bugtracker have been transferred to the new Trackers keeping their attachments, comments and IDs.

The SVN Repository will move to the new Location tomorrow (Nov. 21st 2007). How to access SVN then can be read in the new Wiki.

Please head over to dev.virtuemart.net and see yourself.

Latest php-mysql technical news

Top Ten Security Vulnerabilities in PHP Code !

1. Unvalidated Parameters

2. Broken Access Control

3. Broken Account and Session Management

4. Cross-Site Scripting (XSS) Flaws

5. Buffer Overflows

6. Command Injection Flaws

7. Error Handling Problems

8. Insecure Use of Cryptography

9. Remote Administration Flaws

10. Web and Application Server Misconfiguration

Best Practices for Speeding Up Your Web Site

High Performance Web Sites: The Importance of Front-End Performance

1: Minimize HTTP Requests

2: Use a Content Delivery Network

3: Add an Expires Header

4: Gzip Components

5: Put Stylesheets at the Top

6: Put Scripts at the Bottom

7: Avoid CSS Expressions

8: Make JavaScript and CSS External

9: Reduce DNS Lookups

10: Minify JavaScript

11: Avoid Redirects

12: Remove Duplicate Scripts

13: Configure ETags

14: Make Ajax Cacheable

10 ways to increase pages increased

Yahoo finds fault with Google's secret sauce

January Newsflash

TIOBE declares Python as programming language of 2007 !!

IBM developerWorks: Mastering regular expressions in PHP, Part 1

CakePHP 1.2 Release (and a New Site Design)

Rails for PHP Developers Website Launched

The Web's Most, Biggest, Best, and Worst of 2007

PayPal: New Solutions for PHP Developers

Overview

PayPal Compatible Carts

Other Solutions

Get in the Solutions Directory

Google Giving Kids A Chance To Develop For Them

How to look your Best in search results

PHP 5.2.5 Released

PayPerPost Bloggers Unranked By Google

Unvalidated Robots.Txt Risks Google Banishment

Give Your Website A Voice With Speaking Characters

Get top 10 rankings on Google & Yahoo with IBP's proven Top 10 Optimizer

IBP uses a proven method that works

Is your search engine optimization company really good?

MySQL Lunch & Learn Program

X-Cart 4.1.9 released and announced

CRE Loaded 6.2 SP1 - Now Available for Download

PHP Designer 2007 - Professional version 5.3 is available!

VirtueMart Developer Central launched!