SQL Injection

As a programmer you should always be aware of possible SQL injection attacks.  Make sure that you scrub all of your data before using it, especially in a db query.

Do not just blindly accept that the parameters you receive are going to be good. 

For example, if you are going to show a post from a blog, your url might look like http://www.cyborgcomputing.com/showPost.php?ID=5.  That would show post #5, right?

What if it was http://www.cyborgcomputing.com/showPost.php?ID=5+union+select+1,2,3,4,5,6+–

You would have a MAJOR problem if your query in PHP is
$result = mysql_query(”SELECT * FROM post WHERE ID=” . $_REQUEST['ID']);

Try it out on your own and see (The links above are not real).  If you are expecting an ID, you should rewrite your PHP to.
$ID = preg_match(’/^\d*$/’, $_REQUEST['ID']) ? $_REQUEST['ID'] : 1;

Now your ID has to be a series of digits, otherwise you return post #1.


Are You Ready For an Mac? You Should Be Now.

MacTipsDaily just tipped me off to a very funny new commercial from Mac. With any mac purchase, Apple will have one of it’s “Apple Genius’” move all your files from your old PC to your new shiny Mac. What are you waiting for?


TubeMogul is a Video Delivery Service

TubeMogul has been defined as the FriendFeed for video.

I have just tried the service out and think that it is great so far. Give me a few days to really get under the hood.

First you upload to only one service, TubeMogul. From there, you launch the video to multiple video services like (YouTube, AOL, Yahoo, Revver, etc…) If you really want to get your videos out into the wild, then you have no excuse anymore.

Let me know if you have used this service, or if there others like it.


If You Don’t See All Your Memory In Your Dell…

I have had a Dell PowerEdge 850 running Linux for a year now and have not done much with it.

I always noticed that when I was on it, there seemed to be a load on the CPU, and I always assumed it was because there was very little memory. Adding memory has been on the agenda ever since I bought the machine, but I was waiting to I really started using it.

So, like any good tech, I went out and bought 4 Gigs of memory and installed it. Turns out I already had 1 Gig in the machine, so now I am up to 5 Gigs. BIOS says 5 Gigs, so it must be true. I restart the machine and go to my site, and it seems faster… YAY!!!

Only to find over the next day that it slows to a crawl again. I looked at ‘free -m’ and ‘top’ and see that I only have 256M of memory. WHAT?!?!!? I just installed 4 extra Gigs. I tried everything, doing research on the Internet, upgrading almost everything in Linux. Remote rebooting (which I dread everytime I do it). Nothing worked.

So then I decided to go back to Atlantic.net where my server is colocated and try and find out what happened. I changed a couple of things in BIOS, rebooted and what do you know, 5G is reported in Linux.

I wasn’t positive what fixed it, because I changed multiple variables at once… :(

Then talking to a good friend of mine, Daniel DellaPosta, he tells me that there is a setting in Dell’s BIOS “OS Install Mode”. If that is turned on, then you only get 256M of memory to use. The sad part is I tried getting ahold of him first, but he wasn’t available (such a busy busy man). Oh well, patience on my part would have saved me hours.

Terms that I searched for were:
Linux only see 256M
Linux can’t see all of my memory


Why Do Employees Seem So Much More Greedy?

I am not a business owner, but my boss sure treats me like one. I have a vested interest in the success of bowlingball.com.

That being said, I was raised in such a way that says working is a privilege and not a right. You should value your job and work hard. You are being paid for your time that is spent on the job, so your time and needs are secondary to that of the business.

Why do employees today feel that it is their right to surf the Internet, take personal phone calls, text message, etc… Why do we see more and more news stories telling us that employees are only productive 40-60% of the time they are being paid. Does this mean employers should only pay them 40-60% of their pay?

Employees seem to get outraged when they are told what they can and can not do. “How dare you tell me that I can’t take a phone call”.

Vacation and time off appears to be expected. It used to be that as an employee you asked for permission to take time off. Now it seem that you tell your boss when you will not be there. And they are expected to say ok.

On top of all of this I often see customers complaining about where their bowling balls are made. “You should have stated on your website that those Brunswick Bowling Balls were made in Mexico and not the US”. Did they ever stop to think that employees work cheaper and harder outside the US. I am sure that if the unions allowed their members to work somewhere close to even 90% productive hours, then Brunswick would not have found the need to move their plant to Mexico.


Bowl Expo


Twitter and Firefox: like they were just meant to be together

Do you Twitter?

If so, do you find it tedious to go to the Twitter site and login just to see what your friends are doing, or to update your account?

If you use FireFox, then you must checkout the TwitterFox Add On, it keeps you constantly up to date on what the people you are following are doing, and gives you quick and easy way to update your followers.

There are other great programs, for Mac OS X I have used TWhirl which also works on Windows. You just need to have Adobe Air installed first.


Mazooma Payment Option

I am in the middle of implementing Mazooma as a payment option on bowlingball.com. It is an interesting payment method from what I have seen.

The integration has been very simple so far. They do make it easy.

From a technical point of view, here are the sticking points for me.
1) They request the customer’s username and password for their bank.
2) Mazooma acts as an agent on behalf of the customer
3) The customer never sees their bank’s website

So Mazooma must create a payee (if necessary) and then schedule a payment. So the question is can the customer then cancel the payment within their bank’s interface?

I am still gathering more information, and I am not 100% positive that we actually offer this payment option at this point.


bowlingball.com has just announced the new Hammer Emeral Vibe

Just saw the latest post at bowlingball.com and the latest releases. The Hammer Vibe Emerald is the latest “Entry Level” Bowling Ball.

The terms Entry Level, Mid Performance, High Performance, and all the others are just not useful anymore. There are plenty of good bowlers that need and should use Entry Level, and many beginners that can easily use High Performance bowling balls.


Brian Halstrom Bowls a Perfect Game

My team mate Brian Halstrom just shot a perfect 300 bowling game on 5/8/2008 at Deltona Lanes. He was using his Storm Street Rod to accomplish the feat.

This site hosted by bowlingball.com - Find the best deals on Bowling Balls, Bowling Bags, Bowling Shoes, and Bowling Accessories.