Microsoft Stealth Add-on Introduces Vulnerability to Firefox

Back in August I mentioned that if you installed Microsoft .NET Framework 3.5 then a .NET Framework Assistant Firefox add-on was silently installed as well.  At the time I thought it rather dubious that Microsoft should think it OK to install stuff into a rival's browser without any indication that this was happening.  Well, it looks as if those doubts were not unreasonable.  This afternoon I got the following pop-up message from Firefox:

It turns out that the Microsoft .NET Framework Assistant introduces a vulnerabilty into Firefox, and the Mozilla team have decided to disable it.  For more details see here and here.

Learning jQuery

If you ever need to learn jQuery then probably your best starting point is Jeffrey Way's excellent jQuery for Absolute Beginners Video Series.  It assumes that you have a reasonable grasp of HTML/XHTML, CSS and JavaScript, but then that is only to be expected because jQuery itself is a clever blend of these technologies.

I originally only started on the video series to fill in time until my copy of Learning jQuery 1.3 (Chaffer and Swedberg, Pakt Publishing, 2009) arrived.  However, even though the book was delivered yesterday, and I am only half way through the series, I have learnt so much from the videos that I am going to continue and finish them all before starting on the book.

Update on Thu 2009-10-08 by Tristram Brelstaff

I have just finished this series and here are my thoughts on it. 

I found the pacing ideal: Way doesn't try to put to much into each episode, but I still felt as if I was making significant progress. At various points I was able to stop the video and work ahead on my own, and so was able to reinforce lessons learnt in earlier episodes.

Way's programming style sometimes leaves a bit to be desired: he tends to code fast, leaving missing semicolons, unbalanced parentheses, and ragged formatting to be sorted out the debugging stage.  But this gives him a chance to demonstrate the use of the Firebug debugger.  He also seems to be trying out different editors at various stages in the series, but eventually settles down to NotePad++.

All in all, an excellent introduction to jQuery. 

Jeffrey Way has produced similar video series on PHP and on Wordpress, see here for more details.

Trailing Space

I have just spent half an hour investigating what I thought was a JavaScript problem but which turned out to be caused by an unexpected trailing space in a file name.  What I had assumed was "day04.js" was actually "day04 .js".

To learn YUI or JQuery?

I have been reading up on JavaScript libraries with a view to using one of them for a few little projects I have in mind.  The two main ones, YUI and JQuery both seem very nice and are great improvements on programming in bare JavaScript.  Originally, I was tending towards YUI because it was the first one I came across, and because of the extensive documentation on the Yahoo! web-site.  But then I did a search for job vacancies mentioning these two libraries,  There are around 20 times as many UK vacancies mentioning JQuery than those mentioning YUI.  That settles it, at least for the time being, I am going to learn JQuery.

More Snags in Beginning PHP6, Apache, MySQL Web Development

My progress in working my way through Beginning PHP6, Apache, MySQL Web Development by Timothy Boronczyk et al (Wiley, 2009) has slowed in the past week because I ran into three problems in Chapter 7 (Manipulating and Creating Images with PHP).  Two of these problems turned out to be due to bugs in the book, the other was the result of a dispute between the developers of the PHP GD library and the Debian Linux package maintainers (Ubuntu is based on Debian).  I will deal with the GD library problem first.

• In the Working with the GD Library section (page 175), it is recommended that you use the version of the GD library the comes 'bundled' with all recent versions of PHP.  I assumed that this is what would be supplied in Ubuntu.  I did a quick check that gd_info() showed that GD was indeed installed and supported the required file formats (pages 176-177) and then moved on to the code examples.  However, in the Special Effects section (pages 192-202) I got an error stating "undefined function imagefilter()".  It turns out that there are two versions of the GD library, the original one which is included in PHP supplied with Debian and Ubuntu, and the 'bundled' version which is included in all other recent PHPs.  Only the 'bundled' version includes functions imagefilter (and imageantialias, imagecolormatch, imageconvolution, imagecreatefromxbm, imagecreatefromxpm, imagelayereffect, imagerotate, imagexbm).  What seems to have happened is that the PHP developers extended the GD library with some extra functions but did not feed these extension back into the main GD developement stream.  The Debian maintainers, for good software engineering reasons, refuse to maintain multiple branches of software packages, and so insist on including the original GD in the Debian (and hence Ubuntu) versions of PHP (see here for a good account of this affair).  This is all understandable, but it does make things awkward for the users.  I got round this problem by using the fix suggested here (most of the commands need 'sudo' in front of them though).  This fix was good enough to allow me to complete the examples in Chapter 7 but it might not be good enough for a production installation of PHP; see this comment for details.  All in all, a bit of a mess.  I don't think this would have happened with Python!

• In the Adding Captions section (pages 202-209), if the image caption contains an apostrophe (eg "Tim's image") then, when an image with that caption is previewed, the apostrophe is preceded by a slash (eg: "Tim\'s image").  However, the slash is not present when the image is saved.  There seems to be some sort of implicit encoding and decoding involved in communication via the $_GET array, and the decoding is somehow being omitted in the image preview.  I fixed this by changing the "$_GET['capt']" on page 207 to "stripslashes($_GET['capt'])".

• In the Creating Thumbnails section (pages 212-216), the thumbnail images are not being written to the thumbnails directory and consequently the full-scale images are being replaced by thumbnails and the thumbnails are not being displayed correctly.  The fix is to replace "imagejpeg($thumb, $dir" by "imagejpeg($thumb, $thumbdir" on pages 213 and 215.

You might think that the presence of errors in a book means that it is a bad book, but this is not necessarily so.  I got this book with the intention of learning about web development, and a lot of web development is tracking down and correcting errors in code.  Yes, it can be frustrating, especially if you are in a hurry, but if you have time and patience you can learn a lot from less than perfect books.

Update on Sat 2009-09-19 by Tristram Brelstaff

It appears that my diagnosis of the backslashed apostrophe problem was correct:

PHP ships with the magic_quotes_gpc option enabled in php.ini.  This option instructs PHP to automatically call addslashes() on all cookie data and GET and POST parameters.  This makes it easy to form parameters in database queries, as we'll see in Chapter 8, but can cause trouble with form parameters not used in database queries, because all single quotes, double quotes, backslashes, and NUL-bytes are escaped with backslash characters.

From Programming PHP 2nd Edition by Rasmus Lerdorf, Kevin Tatroe and Peter MacIntyre (O'Reilly, 2006).  As Lerdorf was the creator of PHP, he should know what he is talking about.  My stripslashes() fix was also correct:...

To work with the strings as typed by the user, you can either disable magic_quotes_gpc in php.ini or use the stripslashes() function on the values in $_GET, $_POST, and $_COOKIES. ...