For ColdFusion coding I have been using Eclipse at work for the past couple years, only because that is the standard that we have at the office and require it's Subversion support, but it's sadly lacking in many key areas. It doesn't have a design view, which is a pretty basic feature for a web development environment. Also, the most frustrating part is that the code hinting, code completion, and context-sensitive help is pretty poor, and often inaccurate. I don't know how many times I've hit a key and had some bizarre code completion happen that has no relation to what I'm typing. A good coding environment is two steps ahead of you and knows what you want to type next. Apple's Xcode IDE is brilliant in this regard, as is Microsoft's coding environments. Dreamweaver is finally starting to get there, after all these years. Not quite there yet, but it's much better than alternatives for ColdFusion programmers, in my view. For PHP coding, it's pretty great, too.

All of my available extensions seem to work without issue in Dreamweaver CS5. If anyone has any issues, please let me know.

Update: I've been getting a lot of emails about this, and yes I am still doing custom modification work when I have the time available. Also, my CW blog posts are still available at http://blog.cartweaver.com/index.cfm?blogger=1.

Bigger news is that through these blues jams I've joined a couple of local bands -- The Alpha Dog Blues Band and the Southside Georgetown Bluesbreakers. Alpha Dog plays regularly at the Cowboy Cafe, JVs, and 219 Restaurant. The Bluesbreakers have played one gig at the DC Blues Society fish fry this past month.

Through the jams I've met a lot of great people and fine musicians. Some cool local DC bands to check out if you can are Idle Americans, Big Boy Little Band, Swampkeepers, Hot Rods and Old Gas, and the Andy Poxon Band.

Alpha Dog Blues Band is playing the following dates:

http://www.bloombit.com/Articles/2008/05/ASCII-Encoded-Binary-String-Automated-SQL-Injection.aspx

I put something like this in my application.cfm file to re-rout the attackers temporarily:

<cfif FindNoCase('user>0',cgi.query_string) OR findNoCase('declare',cgi.query_string)
OR findNoCase('EXEC(@',cgi.query_string)>
    <cflocation url="http://www.ftc.gov">
</cfif>

On the other hand, some things look like they were tacked on as an afterthought, and the overall interface is not as user-friendly as a basic Windows program should be that has been around for as many years as it has. The title bar is gone and the path to the current file has been stuck into a little spot that is reserved for page tabs. It sounds like a minor thing, but it's one of the most important parts of coding in a multi-tab editor. As soon as you open more than a few pages, the file path is cut off, and with a few more open, it disappears. Major step backwards here:

The other obvious usability problem here is the black text on dark grey in the tabs. On a laptop it's impossible to see, as is the white text on the dark grey. Also, the individual pages have a close button (X) which is a great bonus, but it would have been nice to have a close button on the frequently used panels (like Find/Replace) so you don't have to right click to pick a menu item to close a panel. Also, the entire border of the program is gone, making it blend into other open programs on your desktop. I understand this is the new "owl" interface, but owls should be left in the woods to live in trees. We really don't need the artsy fartsy stuff in a code editor.

But all in all, I would recommend the program. I use Eclipse all day long at my place of employment, and it is simply not as intuitive or easy to use as DW. Code view in DW has come a long way since the days of Ultradev. Download it and try it out, and by all means make suggestions in the forums on things that can be made better.

http://cgi6.ebay.com/aw-cgi/eBayISAPI.dll?RedirectEnter&partner=ShowItem&loc=http%3A%2F%2Fus.ebayobjects.com%2F2c%3B9739597%3B9123118%3Bz%3Fhttp%3A%2F%2Fcontactbay-ws-bayisapi.xm.com%2F

It's amazing that with all the phishing attempts out there, eBay is actually falling down on the job by allowing their own site to redirect unsuspecting users to the phishing web site.

CMX is focused on Adobe products, but also all web technologies -- html, asp, php, coldfusion, sql, css, javascript, and any other technology related to web development.

The Cartweaver development team is pleased to announce the release of the Downloadable Products Plug-in for Cartweaver 3 CF

Now you can deliver your digital products immediately! This Cartweaver plug in allows your customers to download documents, PDFs, music, photos, artwork, software, and other digital products right away!

- Easy to integrate with your Cartweaver 3 CF store
- Upload your digital products via the store admin
- Customers can log in and download immediately after purchase
- Customers can re-download as few or as many times as you allow
- Customers can update contact information
- View entire order history
- Print out previous history

Available now! Go to the Products - Plug-Ins page and log in for availability and pricing.

The class is typically used on a page by itself, or on any page within conditional statements. You link to the page and the file download begins. The class constructor has 3 arguments:

$csvfile = new CSVFile(recordsetName, [quotes true or false], [filename]);

The first is the MySQL recordset. The second optional argument is true or false to put quotes around the fields. The third optional argument is the filename, which defaults to Download.csv by default.

To use it, follow these instructions:

1. If this is a Cartweaver recordset, make sure you include the application.php file at the top of the page:

require_once("application.php");

2. Include the class file:

require_once("yourclassdirectory/CSVFile.php");

3. Create your recordset. Below is a typical Dreamweaver recordset, using the Northwind database that you can download here for MySQL if you don't have it:

mysql_select_db($database_connNorthwind, $connNorthwind);
$query_rs = "SELECT p.ProductID, p.ProductName, p.UnitPrice FROM products p ORDER BY p.ProductID";
$rs = mysql_query($query_limit_rs, $connNorthwind) or die(mysql_error());

For Cartweaver, a typical recordset might look like this:

$query_rs = "SELECT * FROM tbl_orders ORDER BY order_Date";
$rs = $cartweaver->db->executeQuery($query_rs, "rs");

4. Add a line to invoke the CSVFile class:

$csvfile = new CSVFile($rs, true);

5. Link to the file.

Now, when the page is browsed, the file download will begin immediately.

• Creating a Simple Database Web Search - Part 2: ColdFusion
• Creating a Simple Database Web Search - Part 2: PHP
• Create a Simple Database Web Search - Part 1

This was in response to users who like my Dynamic Search extension, but don't need the keyword functionality. The first part shows how to do a simple search using "filters" in Dreamweaver. The second part (separated for PHP and ColdFusion) shows how to hand-code a few modifications to allow for multiple parameters.

There were also 3 articles on building Horizontal Loopers manually using Dreamweaver tools -- only using CSS instead of tables. Those articles are broken down for ASP, PHP, and ColdFusion as well. The ASP article came out a few weeks ago, at the request of one of my customers:

• Creating a Table-less Horizontal Looper in ColdFusion
• Creating a Table-less Horizontal Looper in PHP
• Creating a Table-less Horizontal Looper in ASP

As always, articles at Community MX are free for members, and a very small fee for non-members. I'm always looking for ideas for new articles, so if there is something you want to see use the contact form to make suggestions. Thanks!

• Official Sys-Con Announcement
• Ben Forta's blog
• Brian Rinaldi's Blog
• Michael Dinowitz's Blog of Fusion
• Sean Corfield
• Ray Camden
• TJ Downes
• Simon Horwith
• Matt Woodward - Post 1
• Matt Woodward - Post 2
• Oliver Merk
• Brian Meloche

The funniest part of this is the almost universal distaste for Sys-con. Their web site has always been horrible, and they consistently "borrow" content from other places to make up for their own lack of content. They have always treated authors badly, saying that authors are a dime-a-dozen and there is no need to pay them. The web site is the most hideous creation on the Internet. Remember that book "Web Pages that Suck"? The Sys-con site could have filled the entire book. No need to look elsewhere. Brian Meloche said it best: "Sys-con.com looks like it was developed by a crystal meth addict." I would add that the addict was probably drunk at the time.

I've been to one of their conferences (AJAX World), and while well-run, it was a complete commercial. There were 10 sessions, and only one of them had any type of technical content. I got in for free, but feel ripped off for having taken the time to attend.

I think the decision was probably made a long time ago. The URL cfdj.com has already fallen to a link whore...that doesn't happen overnight. If that is true, it's a shame that they didn't feel obligated to tell the editorial staff (see Simon's post).

This is funny too...I took a screenshot in case it gets removed, but on many of the sys-con home pages, two of their "borrowed" blogs are blasting sys-con:

That's poetic justice.

There are still plenty of other places to get CF content. Community MX is still alive and well and delivering some good quality CF content in addition to content relating to all of Adobe's products and other web technologies.

somevariable=1%20and%201=convert(int,(select%20top%201%20username%20from%20adminusers))

or

somevariable=1%20and%201=convert(int,(select%20top%201%20char(97)%2bpassword%20from%20adminusers))

or an attack specific to SQL Server:

somevariable=convert(int,(select top 1 table_name from information_schema.tables))--sp_password

somevariable=convert(int,(select top 1 table_name from information_schema.tables where table_name not in (dtproperties)))--sp_password

somevariable=convert(int,(select top 1 table_name from information_schema.tables where table_name not in (dtproperties,sysconstraints)))--sp_password

somevariable=convert(int,(select top 1 table_name from information_schema.tables where table_name not in (dtproperties,sysconstraints,syssegments)))--sp_password

somevariable=convert(int,(select top 1 table_name from information_schema.tables where table_name not in (dtproperties,sysconstraints,syssegments)))--sp_password

The first problem was an exploit of the user's default error handling page -- if no error handling is in place, the error message might contain the username, password, or other information:

Error Executing Database Query. [Macromedia][SQLServer JDBC Driver][SQLServer]Syntax error converting the varchar value 'yourpassword' to a column of data type int. <br>The error occurred on line 102.

In the real attack, the user password was shown on the page. The password was prefaced with the letter "A" -- the char(97) in the attack. This is in case the password started with a number. This can be prevented by using <cfqueryparam> or other device specific to your programming language to make sure integer values are passed as integers.

The second problem is that the default web database user has access to tables that should never be accessible to the web. The malicious user was able to obtain table information from information_schema.tables, and work from there, systematically building each time on information that was previously obtained.

The best possible scenario is to turn off all table access to the web and only access data through stored procedures. That is not always possible. At the very minimum, only expose the data necessary for the site, and only allow access to statements that are required for operation of the site. For example, if you have a table called "Payments", and this is only available to admins, create two SQL username/password logins and use one for the publicly accessed site and one for the admin section. Turn off all permissions to the "Payments" table for the web user. Create "SELECT" permissions only on tables that only need to have data displayed.

As a DBA (which you are if you have a web site with a database and you are the person responsible for the database), you need to know how to secure your data. That involves setting up specific database users for specific access. If a web host gives you a dbo user for a specific database, do not under any circumstance use this username for your web site. This user can be used to create web user logins with specific access. MySQL has similar security features. Access users are out of luck.

The other key is never displaying error messages to users. Make sure your error handling page only shows a pretty message to the user with no information in it, like "You've created an error. Go back and try again." Or prettier than that.

And don't use words or letters for username/password combinations. Passwords should be 10 characters or more, and contain letters, numbers, and special characters. Brute force password guessing programs can figure out a password quickly if you use English language words or just letters.

I'm getting these attacks on my site too. It's scary sometimes having a web site, but hopefully there are safety measures in place to keep these parasites out.

My latest book, "The Essential Guide to Dreamweaver CS3 with CSS, Ajax, and PHP", has just been published, and is now shipping from Amazon.com (and possibly other places). It's a major rewrite of "Foundation PHP for Dreamweaver 8", and has six chapters devoted to working with Spry, including one that shows you how to combine Spry with PHP to make an accessible online gallery. Roughly 60% of the material in the book is new. For more details, see my site:

http://foundationphp.com/egdwcs3/

I recommend it highly to anyone interested in Dreamweaver and/or PHP.

For those of us in local bands, Talas was a band that we all looked up to and wanted to be like. As an aspiring guitar player, I would go to Talas shows 2 or 3 nights every week, and eventually saw them over 300 times. They never disappointed and had hundreds of songs in their repertoire. Talas consisted of Dave Constantino on guitar, Billy Sheehan on bass, and Paul Varga on drums. The music was hard rock, but with a melodic edge to it, or pop with a hard rock edge...take your pick. Dave's original band -- The Tweeds -- was around the area in the 60's and had a regional hit single called "Thing of the Past", which was a Beatle-esque ballad. When Talas broke up in the early 80's, Dave re-formed The Tweeds with Paul Varga and played smaller clubs with small amps for that 60's sound, and sometimes even a box to beat on instead of a drum to get that early Elvis sound.

Talas had a few regular gigs, including Monday nights at Harvey and Corky's Stage One, a small local bar that was also the place to be on any given night. They would have free drinks until 10PM, and Talas would get on about midnight and play until 3AM or later. Harvey Weinstein eventually went on to become a big name movie distributor, but back then he was a concert promoter in Western NY. Talas would also allow other bands to open up for them, including touring bands promoting records. One night, I was fortunate enough to see U2 opening for Talas at Stage One on a tour promoting one of their early albums. At the time I remember thinking they were one of the cooler bands who came through, but they have since gone onto bigger things. I was at Stage One on a Monday night seeing Talas the night John Lennon was shot, and Talas did a set of Lennon tunes to close the night.

Talas had a few reunion shows after many years of being apart -- in 1997 they played Kleinhans Music Hall in Buffalo, which was later released as a live CD called If We Only Knew Then What We Know Now. I didn't know about that show, unfortunately. Then in 2001 they did a reunion show on the waterfront in June in Buffalo, which was later released as a live DVD. I was there that night, along with about 18,000 people. What an amazing night that was. They did all the old Talas classics like "Thickhead" and "Sink Your Teeth" and some of the most popular cover tunes they used to do back in the 70's/80's like "Battlescar", "Stealin'", and "Helter Skelter".

The highlight of my years seeing Talas -- and one of my own personal musical highlights -- was one New Year's Eve at a club called the Lone Star, when Dave called me up on stage to do a song with them. That was an amazing experience I'll never forget. During the first set he stuck his guitar neck out into the crowd and let me finger the chords as he strummed the guitar. Then in the next set, he called me up. A couple of my band mates were there, along with most of my friends. We did the old Sammy Hagar tune "One Way to Rock", and it sounded great from where I stood. It was very cool to be on stage jamming with Billy, Dave, and Paul. They didn't know me, as I didn't talk much, but still they took a chance and let me do a song. I'm grateful for that.

The new CD is more bluesy than the songs that Dave did in Talas, but has a much more prominent guitar. I highly recommend it. Dave's guitar is always tasteful, and reminiscent of Montrose, Page, Clapton, and other rock guitarists of that era. He also had the best sound I've heard, with a Les Paul plugged straight into a Marshall. On the Talas albums, he never seemed to cut loose in the studio the way he did in live shows and played in a very restrained way, but on this CD he has more of an opportunity to showcase his playing. As Dave was the guitar player that I saw the most when I was first starting out, I developed a similar style myself, although I also had many other influences. The CD also features the Rinehart brothers on bass and drums, who coincidentally lived directly behind me when I was growing up in Tonawanda, NY, although at the time I didn't know they were musicians. It's a small world.

Pick up the CD at Dave Constantino's web site.

1. Enhanced speed. This is a big one. There were some benchmarks shown of 50% and more increase in many of the basic ColdFusion constructs, such as initiating CFCs (9 times faster, as I remember) and simple things like cfparam, date functions, and regular expression throughput. Since these are things I use all the time, I will be interested in doing some of my own benchmarks.
2. Multiple CF Administrator logins. This is one of those things that has been asked for every year probably since the first CF version. It's something that should have been in the product from the start, as the current CF7 and earlier installations assume that you are the only person on the server. That is almost never the case.
3. Debugging. Anyone who knows me knows that I have been harping about lack of debugging in CF for ages, and actually switched a lot of my own development to PHP only because the development environments are more friendly with debugging. I hate having to debug with trace statements and cfdump. It is so 80's.

There are a lot of cool things about CF, but the new CF 8 looks really great and worth the upgrade price. Just the performance enhancements alone are worth it. The public beta is at labs.adobe.com

Ben Forta talks about the performance enhancements in his blog

TODCON is always a key event for the Dreamweaver community, despite it's small size. I should say because of -- not despite -- it's small size. Everybody is accessible, and by the end of the conference everybody ends up knowing each other. This year it was even better, as Adobe sent over a dozen representatives to meet with the attendees to gather feedback. They sent some of the top-level people on the Dreamweaver team, including the product manager Kenneth Berger. I got to talk shop for quite a while with Randy Edmunds (formerly from the Drumbeat team) and former Interakt guys Lucian and Christian. I also met and reconnected with some people I've known through the newsgroups and the Dreamweaver community. Being Vegas, there was also gambling, drinking, and eating. I played a bit of poker and went down a little, but didn't get to play very much. Mostly I was preparing presentations and socializing, with a little poolside relaxation mixed in.

I also didn't see a lot of the presentations, but of the ones I saw, the keynote was the most interesting -- showing the cool new features of Photoshop CS3 and Fireworks CS3, which I have not used yet. I was sorry I didn't get to see any of the Flex presentations, but CFUnited at the end of the month will have quite a few of those.

Next year TODCON will likely return to Orlando, but if you have a chance to get to one you really should check it out.

I'm doing two sessions at TODCON -- "Working with Dreamweaver Data and Beyond" and "Custom Tags in ColdFusion". The first session will show standard DW server behaviors and application objects and show how to modify them to do horizontal looping, multiple inserts and updates, and combination pages that do insert/update/delete. The custom tag session will show an intro to custom tags but also get into an advanced use of using a custom tag as a template for an entire site, which is how this site was built and all other sites I build. I'll show how any design template, such as a Community MX jumpstart, can be adapted using this technique.

If you're coming, I'll see you there. If not, you're missing a great conference.

I'll be at both TODCON and CFUnited this year, so if anyone wants to see a demo of CW, see me.

www.cartweaver.com

Correction: Pricing for upgrades is $100 until the end of May. More time available. The full price of $295 is now in effect for new users