Akismet

This plugin comes installed by default with WordPress.  When comments are submitted, this plugin with check them against a known list of spam comments that is updated constantly.  When allowing comments on your website or blog, this is a must have.

All in One SEO Pack

The SEO Pack allows you to edit the meta tags associated with your home page and every other page or post on your website.  To maximize your search engine visibility, I highly recommend this plugin.

BackWPup

This is one of the more recent plugin finds I have come across.  I am impressed with the number of available options for configuration when setting up a backup.  You can schedule a cron run for any time of day and can add as many backup jobs as you need.  You have the ability to backup not only the database, but your files as well.  This plugin can email you the backed up files, store them on your server, or send them to offsite storage, such as Amason S3.  Backups are an essential part of any website strategy, so make sure you don’t overlook this plugin if you are using WordPress.

WP-Minify

This plugin will take any Javascript or CSS files, combine them into a single file, and minify the code.  This helps to conserve bandwidth and server request overhead.  WP-Minify will speed up the load time of your website or blog.

WP-reCAPTCHA

CAPTCHA challenges are essential for controlling spam submissions, especially when allowing comments by anonymous users.  reCAPTCHA is my favorite version of the CAPTCHA challenge out there.  This plugin is very easy to use, for both the website owner and visitor.

One night, I was browsing the web and reading some blogs.  I came across the Wibiya toolbar at the bottom of the page on one of these blogs.  I thought, that is really cool, so I visited their website, signed up for an account, and added it to my blog.

The process to add the toolbar to your website is incredibly simple.  You visit their website, sign up for an account, select the applications you would like on the toolbar, then add the code to your website.  In the case of WordPress, there is a great Wibiya plugin available to download.

They have recently launched a premium service to give you more control over the toolbar.  The three levels of this service are plus, pro, and max.  For a small monthly fee, you can add your brand, or even create your own apps for the toolbar!

I recommend you visit their website, signup for an account, and try the toolbar on your website or blog.  I don’t think you will be disappointed.  To design and code a toolbar with this smooth of integration could take months of development and testing.

In case you are curious, this is not a paid review.  When I come across a product or service I really like, I love to share it with others.

Visit the Wibiya website

Visiting and Crawling a Website

The Search Engine process starts by a crawler visiting a website and downloading the content.  A crawler is a program written with the task of downloading content from website pages on a schedule basis.  The list of websites and pages for a crawler to visit come from many sources, such as:

• Submitting a website or page to a Search Engine via a form at their website
• The discovery of new pages or sites by the crawler when downloading a page
• Submission or download of a sitemap

When a crawler visits a website, there are many ways to control its behavior so that content you do or don’t want to show in the search results has the desired effect.  The crawler behavior can be modified using the following techniques.

• robots.txt – The robots.txt file goes in the website root and contains rules for a crawler to follow when visiting your website.  You can allow or deny a crawler access to specific directories or files based on the user agent.  Wikipedia has an excellent article on the details of the robots.txt file and links to additional resources.
• Meta Tags – Meta Tags can be used to control the behavior of a Search Engine crawler on a page by page basis.  In most cases, using the robots.txt file is all that is needed to control what the crawler sees on your website.
• Nofollow Attribute – This attribute allows the webmaster to control which links will pass credit on to the pages they link to and which ones won’t.  This is useful for links added in forums or blog comments.

The Search Engine Index

Each Search Engine has their own algorithm used to sort and rank the crawled web pages.  Most Search Engines have many similarities in the way they sort the pages.  The built index determines what pages will be shown to the user for a particular search query.

The algorithms used to build an index look for things such as how many times a word or phrase shows up on a page, the font size of a word or phrase, the amount of content on the page, formatting, user experience, meta tags, and the number of links to a page.  There are many tutorials and guides available on the Internet on best practices when developing web sites and pages to maximize the user experience and the ability of a Search Engine to crawl the website pages.

Searching and the Display of Search Results

A search is performed using a keyword or group of words to form a phrase.  Most Search Engines include more advanced search functions, such as using Boolean operators and keywords meant to perform a specific function.

Once the search query is entered and submitted, the Search Engine consults its index to return a number of pages that best fix the query according to their algorithm.  Search results can vary from search to search and even more so in different geographic regions.  The search results page is constantly changing and it is rare for a website or page to remain at the same ranking for a long period of time.

The ROW_NUMBER Function

The ROW_NUMBER function works similar to an identity column in a table.  It will assign a unique number, starting at 1 and incrementing depending on the sort order specified.  Duplicate rows will receive a unique number with this function.

The example below assigns a column value starting at 1 and incrementing according to the lastname column in ascending order.

Select ROW_NUMBER() over (order by lastname asc), firstname, lastname
From person
Order by lastname asc, firstname asc

The RANK Function

The main difference between the RANK function and the ROW_NUMBER function is how duplicates are treated.  They are not assigned a unique number with RANK.  The duplicates will each have the same number.  The next unique row after two or more duplicates will have the next number in the series after skipping the appropriate number based on the number of duplicates.

The following example is the same as above, but with the RANK function.

Select RANK() over (order by lastname asc), firstname, lastname
From person
Order by lastname asc, firstname asc

The DENSE_RANK Function

The DENSE_RANK function is very similar to the RANK function, except after assigning a number to a series of duplicates, then next value will be n + 1.  There are not gaps in the number when using this function.

The following example is similar to the two above, but with the DENSE_RANK function.

Select DENSE_RANK() over (order by lastname asc), firstname, lastname
From person
Order by lastname asc, firstname asc

The NTILE Function

The NTILE function is used to divide the resultset into a number of groups.  Say you have 100 rows in your resultset and you use NTILE(4).  You will end up with 4 groups of 25 rows, with each row of each group having a unique number assigned to that group.

The following example is the same query as the ones above, but splits the resultset into four groups using the NTILE function.

Select NTILE(4) over (order by lastname asc), firstname, lastname
From person
Order by lastname asc, firstname asc

The Partition By Clause

The partition by clause is used to further subdivide the resultset to be ranked by grouping on a particular column.  Using the same query as above, let’s add a zipcode.  This will result in the following query when using the RANK function.

Select RANK() over (partition by zipcode order by lastname asc), firstname, lastname, zipcode
From person
Order by zipcode asc, lastname asc, firstname asc

This query will rank by the lastname in ascending order within each zipcode column.  The partition by clause makes each of the functions above much more useful when applying a rank to query results.

The Contact Form

First off, we need to create a contact form using html.

<form method="post" action="contactFormSubmit.php">
	<label for="name">Name:
		<input type="text" />
	</label>
	<label for="email">Email Address:
		<input type="text" />
	</label>
	<label for="subject">Subject:
		<input type="text" />
	</label>
	<label for="body">Message:
		<textarea name="body" cols="60" rows="10"></textarea>
	</label>
	<input type="submit" value="Send" />
</form>

In the form above, there are five fields created.  Not all fields have to be required, but these fields are a good starting point for a visitor to contact you.  By capturing their name and email address, you can have a way to reply to them.

How to Send Email in PHP

With PHP, you can send email via the built-in mail() function.  The function is defined as follows:

mail(to, subject, message, headers)

• to – email address (who you are sending the message to)
• subject – the subject of the email
• message – the content of the email
• headers – additional details to add to the email, such as who the email is from

Now, we need to create a PHP script to handle the form data sent to the server.  Below is one example of such a script:

$name = !empty($_POST['name']) ? htmlentities($_POST['name']) : '';
$email = !empty($_POST['email']) ? $_POST['email'] : '';
$subject = !empty($_POST['subject']) ? htmlentities($_POST['subject']) : '';
$message = !empty($_POST['body']) ? htmlentities( $_POST['body']) : '';
if (!strpos($email,'@')) {
	echo 'Invalid Email Address';
} else {
	$to = 'youremailhere';
	$headers = 'From: '.$email;
	mail($to,$subject,$message,$headers);
}

In the above code, replace “youremailhere” with the email where you would like the message to be sent.

Additional Considerations

This is only a simple example of what can be implemented using the PHP mail() function.  You may want to consider some of the following when implementing a contact form on your website:

• Spam – This script does not check for spam submissions.  To avoid spam in your contact form, I recommend implement a CAPTCHA, such as reCAPTCHA.
• Validation – Further validation may be needed to make sure the contact form is safe from script or other types of injection attacks.  The email address in this script is only validated by looking for the @ symbol in the string.  I recommend using a function to validate email addresses.  There are a number of good examples across the Internet, but a good one is here.

While this contact form is considerably more complex than a mailto link, it is worth the extra effort to be able to be contacted by any of your website visitors.

Content Construction Kit (CCK)

CCK is by far my favorite module.  I can’t imagine a site being built in Drupal without it.  CCK allows you to create new content node types, as well as add additional fields to an existing content type.  There are a number of additional modules you can install for just about any sort of form field you can think of.  This module is so important to Drupal, they are going to include it in the core modules for the 7.x release.

Visit the CCK project page

Views

Views is another very useful module and is a must have for any Drupal installation.  With Views, you can build lists from any data source in Drupal and customize the look and feel of the data.  The way it works is similar to designing a query in a database query designer application, but it is much simpler and offers far more flexibility.  I think Views should join CCK as a core module.

Visit the Views project page

Administration Menu

The administration menu module creates a dropdown menu at the top of the page when logged in as an administrator.  This is very useful for quickly navigating to the various admin areas of the website.

Visit the Administration Menu project page

Nodewords

The nodewords modules allows  the editing of meta tags for any content created in Drupal.  This is very useful for SEO purposes to have precise control over the meta tags and content of those tags appearing in your website code.

Visit the Nodewords project page

Global Redirect and Pathauto

These two modules work well together to aid in rewriting the url to a more human friendly version.  Global Redirect will redirect any duplicate paths to the correct alias.  Pathauto allows you to manage the alias generated for each page of content.

Visit the Global Redirect project page

Visit the Pathauto project page

Rules

This module allows the administrator to setup rules, conditions, and actions.  Using the rules module, you can modify the workflow of your website.  Say you want a user to be directed to a specific page when they login if they have a certain role.  This module can do that, and much more.

Visit the Rules project page

Google Analytics

Every site needs to have some sort of analytics tracking.  Analytics are essential for improving your website by studying trends.  One of the best packages out there is Google Analytics.  Google provides a very easy to use interface for viewing website statistics and trends.  The best part about it?  It’s free.

Visit the Google Analytics project page

Webform

The webform module is useful for creating any sort of form within node content without knowing how to program or create your own module.  I have found it especially useful for custom contact forms.

Visit the Webform project page

Captcha and reCaptcha

These two modules are useful for stopping spam submissions in your website forms.  The reCaptcha module presents the user with two words to enter from a distorted image.  I have found this one to be the most effective and easiest to implement captcha system.  The captcha challenge can be applied to any form registered with Drupal.

Visit the Captcha project page

Visit the reCaptcha project page

Validation API

This module allows the administrator to define custom validations for any form field on your website.  I have found this very useful for CCK Field validation beyond the built-in validation.

Visit the Validation API project page

I’m sure you’re thinking that first paragraph seems like an ad.  Well, that may be so, but I enjoy every minute I am able to develop code using jQuery.

Example: Alternate Background Colors in a Table

Let’s start with a table layout.

<table id="example">
<thead>
<tr>
<th>Column 1</th>
<th>Column 2</th>
<th>Column 3</th>
</tr>
</thead>
<tbody>
<tr>
<td>Data 1</td>
<td>Data 2</td>
<td>Data 3</td>
</tr>
<tr>
<td>Data 4</td>
<td>Data 5</td>
<td>Data 6</td>
</tr>
<tr>
<td>Data 7</td>
<td>Data 8</td>
<td>Data 9</td>
</tr>
</tbody>
</table>

To alternate background colors, the following code can be used.

$('#example tbody tr:odd').css('background-color','#CCCCCC');

In the above code, css selectors are used to get a handle to every other tr in the table tbody section.  Then, the background color is applied to every other table row.  Only one line of Javascript code is needed to accomplish this!

To learn more, visit the jQuery website.

Sitepoint

Sitepoint has several blog updates each day.  Each post is very well written and informative.  I have learned many new techniques from this blog. Sitepoint also has a large collection of development articles, an excellent forum community, and, in my opinion, the best written development books.  I am the proud owner of more than ten of their development books.

Visit the Sitepoint website

Smashing Magazine

The reason I really love to read Smashing Magazine is their articles are incredibly in depth and provide a great learning experience.  The amount of time spent and attention to detail in each article is the best I have seen in a blog.

Visit the Smashing Magazine website

Six Revisions

Six Revisions is one of those blog sites you can’t be disappointed with. They cover a variety of topics from development to design, freebies, and tutorials.  The articles are very well written and informative.

Visit the Six Revisions website

Viperchill

Not too long ago, I discovered Viperchill in a similar post such as this on another blog.  I visited the website and was immediately impressed with the quality and in depth coverage of the articles presented.  While it is a newer blog, the future for this blog is very bright

Visit the Viperchill website

Nettuts+

Nettus+ is another great blog I love to read.  Each week, I end up reading several articles and I am impressed with their choice of article content.  Not only is their content interesting to read, but you can learn quite a bit.

Visit the Nettuts+ website

SQL Injection Example

Let’s say you have a login form for authentication to your website marked up as so:

<form  method="post" action="serversidescript">
<label  for="username">Username:
<input  type="text" name="username" id="username" />
</label>
<label  for="password">Password:
<input  type="password" name="password" id="password"  />
</label>
<input  type="submit" name="submit" id="submit"  value="Login" />
</form>

On the server side, the script with SQL code could look something like this:

$sql = "select * from users where username = '$username' and password = '$password'";

The problem with this code is the variables from the form are input directly into the SQL query without checking their values.  An attacker could bypass your authentication with the following code:

Username: sometext
Password: ‘ or ’1′=’1

The sql query line then becomes:

$sql = "select * from users where username = 'sometext' and password = '' or '1' = '1'";

The injected SQL code will effectively make this statement become “select * from users”.

How To Secure Against SQL Injection

The best way to secure your site against this type of attack is to assume any input from the user is malicious.  Implementing defenses to check the input values against rigid validation and/or escaping dangerous characters will secure your website against SQL Injection attacks.

Each scripting language has its own set of useful functions to help with sanitizing input data from the user.  In many cases, there are frameworks available, such as .NET, to further aid in defending against this type of attack.

Regular expressions, if used properly, are very effective at checking user input against a character set pattern.  Make sure to thoroughly test your regular expressions.  Even one mistake can have huge unintended results.

The Select Statement

The select statement is used to retrieve data from a database.  Select is the first SQL keyword used when retrieving the data.  Let’s take a look at a simple example.

Select * from table

In this example, all columns will be retrieved from the table.  In the location of the *, column names, separated by commas, can be placed to select individual columns, rather than all columns.  This feature is demonstrated in the next example.

The From Clause

From is used to determine what table to retrieve data from.  In the example above, we are selecting from a table named “table”.

The Where Clause

Where is used to limit the result set retrieved from a table.  While the where clause is not required, it is used very often to retrieve the smallest result subset of data necessary.  The following example demonstrates the use of the where clause.

Select column1, column2, column3 from tablename where column2 = 'Test String' and column3 is not null

In the example above, the conditions to limit the result set can be compared in a variety of ways.  The first comparison uses the equals operator to test where the value of column2 is equal to Test String.  In SQL, strings are enclosed in single quotes.  If single quotes are included in the string, a second single quote is used to escape the single quote character.  The second comparison will match values in column3 where the value is not equal to null.  Null is used to denote an empty column that has no value.

The Order By Clause

Order by is used to sort the result set into a format usable by your application.  Let’s take a look at an example:

Select * from tablename order by column1 asc, column4 desc

In the example above, the result is sorted first in ascending order by column1, and then in descending order by column 4.  The order by clause always comes after the where clause.

The Update Statement

The update statement is used to change the value of existing data in a database.  The following is a simple example:

Update tablename set column1 = 5 where id = 8

The table to update the data follows the update statement.  The set keyword is used to denote what data to update and in which columns.  The where clause is critical in an update statement.  It determines what rows will be updated.  If the where clause is omitted, all rows will be updated.

The Delete Statement

The delete statement is used to remove rows of data from a database table.  In the example below, the row with an id value of 8 will be removed.

Delete from tablename where id = 8

As with the update statement, the where clause is critical so you do not delete more rows than intended.  If the where clause is omitted, all data from the table will be removed!

Resources To Learn More

MySQL

• MySQL website – http://www.mysql.com/

SQL Server

• SQL Server website – http://www.microsoft.com/sqlserver/

For the many other relational database systems in existence, refer to the documentation that came with the database software or visit the company website to learn more.