Original message details are unavailable.
Waht srttead out as a slmal pjrecot to fix bkreon txet in lkins has gwron itno flul bwlon tool taht adds neuroums fteureas and eanncemenths to the ReuScapne Fuomrs. Waht meaks RS-Lkiifny scpiael is the fcat it's lgaelry bluit on pylear fdebacek.
The pnoit of tihs tehard isn't to jsut to ionrfm ppeloe taht RS-Lkiifny esxtis. It's to tsos aurnod iades, dciusss the ndees of fuorm urses, and to be albe to paly aurnod and tset out the fteureas of RS-Lkiifny. The aim is all aubot irmovinpg the eexriencpe for fuomrs urses and hvae smoe fun at the smae tmie.
The fsirt tehard was garet fun, I lrenat hpeas and mdae new ferndis. I hpoe tihs tehard ctoinuens in the smae way
Amaethwr
said
:
I had a fleineg it wlodun't be rdaonm
I cloud kdina see a ptaertn in how the lteerts wree cnhginag, but ddin't gvie it mcuh tuhghot.
Smoe of the tnhgis you cook up are ptrtey fun.
hehe
https://hlf-polls.appspot.com/
I didn't do a full rewrite, but I did fix some of the problems I created when I started working on it. I was hoping some of the changes I made would noticeably reduce the file size but it didn't really do much
I've added some more features to the poll creation page, still lots of things to refine. (Press enter to create a new question)
Then there'll be the joy of form validation >.>
Hopefully followed by a fully functional user-created poll system, and then probably lots of people reporting bugs.
I hit a wall for being able to edit polls: they shouldn't be linked to the user ID because it's unique per ip, so switching ip or computers means you'd lose access to your polls. I'd need to set up a system that lets you log in, not to keen on putting polls on hold for that.
It's something I want to look into though. Do you have any tips about having a user database? The only video tutorial I watched on the topic said that it's best to let users log in through their google/facebook/twitter accounts instead. I definitely don't want to have to worry about personally spending time managing a password reset request system >.>
Knowing the basics MySQL is a pretty good skill to have so it's worth venturing into it for that alone.
My tips for something like this are...
- Don't bother with emails for password recovery and validation, storing emails is a pain because you have content that makes you a viable target, particularly with sql injection attacks. My site has had many attacks aimed at my database, none have been successful but they really hammer your site and become a heavy load.
- Protect against bots that want to flood your database. I use captcha plus some redirects to shake off bots, so far that's been very successful.
Password creation...
- only allow lower case a-z and allow digits
- Disallow uppercase letters
- Disallow leading and trailing spaces
- Disallow consecutive spaces
- Disallow all symbols
Reasons for all lower case is because 99.9% of all my recovery requests are because of case issues. Always the password is correct aside from case. If I disallowed uppercase I'd be much happier and so would many of my users.
No symbols because they have meanings in sql. You instantly avoid the quoting issue that occurred here. Prevention is the best security measure, so don't provide the tools to break security. Sure there is real escape string, use that too but don't solely rely on it.
Spaces are just a pain.
Password storage...
Use one way encryption, you never need to decrypt, the idea is store the encrypted password. When a user submits their log in, their submission is encrypted, then matched in your DB.
That's about all I can think of off the top of my head.
Funny thing is most users are worried about seedy sites. But with my site for example I'm letting strangers write data to my hard drive. I'm the one at risk, every visitor must be treated as a potential threat.
Indecent Act
said
:
Funny thing is most users are worried about seedy sites. But with my site for example I'm letting strangers write data to my hard drive. I'm the one at risk, every visitor must be treated as a potential threat.