Tangled Web

Why not ask a Google Engineer?

So you’ve got a bunch of people who you would like to provide with content on your website.  You also do not want everyone that visits your site to view this information.  How do you allow access to some members, but not to others?  The simple solution is to create a members area in your site by creating .htaccess and .htpasswd files!

The .htaccess file is a simple text file that allows you to change some of the configuration directives of the web server.  The .htaccess file is much more powerful than just that and I hope to explain more about it in this article.  It is worth noting that .htaccess files are not compatible with Windows Servers.

The .htaccess file has many uses including:  Blocking Users by IP Address, Preventing or Allowing Directory Listings, and Changing Error Documents.  In this post I will focus on using the .htaccess file to password protect your folders.  This can be useful if you wish to set up something like a “Members” area on your web page that will allow only users that have a username and password access to these areas.  You can create a .htaccess and a .htpasswd file in order to set up simple user/pass protection.

Password protection relies on two files.  The .htaccess file tells the webserver that viewing content in such folders requires authorization.  The second is the .htpasswd file and it contains the information about the users and their passwords.  The information in your .htpasswd file will be very simple and will look like this:

webuser:qkbPmuht5Gzgc

Read the rest of this entry »

If you would like to set up a simple e-mail list or sign-up form for customers visiting your website to fill out, one of the simpler programs to use is a FormMail script. FormMail allows you to embed a form composed of several fields on your website. When a user fills in the fields and submits the form, the information is emailed to an address of your choice. FormMail is not a part of the HTML, it runs as its own program. However, FormMail can be customized with things like number of recipients, syntax check, and thank you pages from within the <form> </form> line of the HTML code.

While FormMail scripts are useful, they do have some drawbacks. One major drawback is that the form and the email address associated with it are open to spammers. However, Tectite (http://www.tectite.com/formmailpage.php), a brand of free FormMail script, will run submitted information through several filters and tests which can determine whether the information qualifies as spam. Tectite’s FormMail can be customized by editing the HTML code or by purchasing Tectite’s FormMail Configuration Wizard.

In this example we will simply edit the script and the HTML code. Editing these files should be done using a simple text editor. Web-based editors may alter the code and cause it not to work. An easy way to get started is to download Tectite FormMail (http://www.tectite.com/formmail.zip). In the formmail.php file included, add in your email at line 239 or 240 (depending on which version you receive): Read the rest of this entry »

What is PHP?

First off, I suppose we should start with a (very) brief introduction about what PHP is.  PHP which stands for PHP: Hypertext Preprocessor (yeah, it doesn’t make sense to me either) is a formatting language used to make dynamic web sites.  As it turns out, PHP originally stood for personal home page, but has evolved quite a bit since its inception in 1994.  PHP is now a widely used scripting language used on millions of web pages and web servers.

What is a php.ini file?

One of the most powerful tools available for a PHP user is the php.ini file.  Unfortunately, the power and utility of this file often goes overlooked.  The php.ini file can be used to drastically alter the way that PHP behaves.  Since it would be a real pain to have to adjust PHP every time you needed to make a change, the developers implemented the php.ini file.  PHP searches for this file every time that it fires up and then reads the file and follows the directives defined within.  This file can be used to alter the functionality of PHP and add increased levels of security for your web applications.  Lets take a look at some common uses:

Disabling Functionality

There are some features of PHP that you will probably never want to use.  It may be a good idea to completely disable them from the start in order to prevent possible malicious attacks.  In the event that an attacker was able to upload a script to your site, this is an excellent way to disable that script from the start.  Some top functions to diable are php_uname, getmyuid, getmypid etc.

Restrict File Uploads

Here you can turn off or limit the file upload functionality of your PHP scripts.  If you are not using the file upload functionality in any of your scripts then it is probably a good idea to turn it off completely.  This makes it more difficult for attackers to upload files to your web server.  To disable file uploads you need to change the file_uploads directive to “Off”

Securing Error Messages

Error messages are some of the most common paths to information disclosure.  They often contain information such as installation path, database info, and scripting variables.  This information might be extremely useful to you as it can help you figure out what the problem with your site is, however it is worthless to users and can be used to gain access by an attacker.  You can use php.ini to hide errors when PHP encounters a problem.

Feel free to submit any uses for the php.ini file in the comments section.  I’d love to facilitate a discussion!

First, we should start with a little information on what exactly Google Adwords is. Other search engines offer similar services, but we will focus on Google as it is one of the most popular search engines. What Google and other search engines offer is referred to as Pay-Per-Click advertising. When you search for something on a search engine, you have probably noticed the related advertisements at the top and to the right of your search results. Those advertisements are the result of companies who use Adwords.

You can open up a free account with Google and the next step is to create an advertisement and choose some keywords and phrases that are associated with your business and website. These phrases have a certain price associated with them and you pay that price each time someone clicks on your advertisement, hence, pay-per-click advertising. The more you pay per click the higher up on the list you will appear. This leads to my first point…

Spend $ to Make $ Chances are it is going to cost a bit of cash in the beginning until you decide on the keywords that work the best. It is easy to come up with a few keywords and bid low in an effort to save some money. Unfortunately, you will not likely see any results from this attempt. With Adwords, it is unlikely to see any results if you are not listed on the front page of search results. Rarely do people navigate past the first page of responses of their search and if they do they are not likely to be the type of traffic you want to your site.

If a keyword is out of your price range to begin with then it is too competitive of a keyword to bother with. Go back to the drawing board and think of something new.

Location With Google Adwords you can set up your account so that when people in your geographical area search for one of your keywords your advertisement will come up. This is a great option for small shops that are looking to increase website traffic and business.

Reiterate Try starting out by picking many different keywords that are all within your price range that will appear on the front page. With Google Adwords you can even set a certain budget so you do not end up way over budget. The next step is very important. Do nothing…

…

Let your first selection of keywords ride out for a couple months. If you get frustrated after just a few weeks and change your keywords you will not be able to really judge your efforts. After a few months get rid of the keywords that are not bringing in any traffic. Try using Google Analytics to evaluate your attempt. Try tweaking some of your keywords to bring in customers that were searching for your customers.

Give it Time It is going to take a while in order to properly utilize Google Adwords. It is important to keep going back to your keywords and tweaking them in order to get better performance out of them. Put the initial investment and effort into your Adwords and in due time you will be seeing a great return on your investment!