Search Results

Search found 25198 results on 1008 pages for 'non programmers'.

Page 301/1008 | < Previous Page | 297 298 299 300 301 302 303 304 305 306 307 308  | Next Page >

  • How important is Discrete Mathematics for a Computer Scientist?

    - by mort
    As the title says, How important is Discrete Mathematics for a Computer Scientist? Background: I'm pursuing a Master's degree with a focus on fundamentals such as Algorithms, Complexity and Computability Theory and Programming Languages to get a good foundation for working in the field of Parallel Computing. Some more background: My university grants a lot of freedom in the choices of courses for my Master's degree. It's officially called "Software Engineering", but due to a the broad range of electives, a different focus is possible. Interestingly, none of the electives is a lecture in Math! I'm thinking about doing a course about Discrete Mathematics that would take half a semester to complete successfully, even if I can't use it for my degree. So with this question I'm trying to find out if the effort is justifiable.

    Read the article

  • Collaboration between client, web designer, and web developer

    - by Alex
    I am primarily a Web Developer (back end programming) - but intend to offer a complete service to my clients, from concept, to brand design, photoshop mock-ups and everything else in between. I'm aware that it's a good idea to outsource this design aspect of the project to someone that I trust. My question is more about the process: I imagine that in order for the designer to really grasp what the client wants to create, they would need some sort of interaction. Therefore, does anyone know if it is common to bring both parties into a 3 way discussion? Or is it more common to get all of the info from the client, and then pass it onto the designer, and act as a back and forth middleman? Afterall, I am the designer's client. Any insight into this would be great

    Read the article

  • Precising definition of programming paradigm

    - by Kazark
    Wikipedia defines programming paradigm thus: a fundamental style of computer programming which is echoed in the descriptive text of the paradigms tag on this site. I find this a disappointing definition. Anyone who knows the words programming and paradigm could do about that well without knowing anything else about it. There are many styles of computer programming at many level of abstraction; within any given programming paradigm, multiple styles are possible. For example, Bob Martin says in Clean Code (13), Consider this book a description of the Object Mentor School of Clean Code. The techniques and teachings within are the way that we practice our art. We are willing to claim that if you follow these teachings, you will enjoy the benefits that we have enjoyed, and you will learn to write code that is clean and professional. But don't make the mistake of thinking that we are somehow "right" in any absolute sense. Thus Bob Martin is not claiming to have the correct style of Object-Oriented programming, even though he, if anyone, might have some claim to doing so. But even within his school of programming, we might have different styles of formatting the code (K&R, etc). There are many styles of programming at many levels. Sp how can we define programming paradigm rigorously, to distinguish it from other categories of programming styles? Fundamental is somewhat helpful, but not specific. How can we define the phrase in a way that will communicate more than the separate meanings of each of the two words—in other words, how can we define it in a way that will provide additional meaning for someone who speaks English but isn't familiar with a variety of paradigms?

    Read the article

  • Replicate GAE Datastore On A Server LAN in Java

    - by Franz Noel
    There may be instances wherein one Company Client may not have internet connection on their vicinity. Either their Internet Service Provider currently experience a down time or there are some other problems involving the network, but not their LAN. GAE seems to be needing a connection at all times in the internet. I only need GAE Datastore. I'm thinking about a different application. Creating a Java Swing Client, for instance, and connecting to the Office Server via HRD of GAE Datastore. When I tried to check on the solutions for Java, it does not say anything about uploading all data and I do not need the App. I just need the GAE Datastore. In Java GAE, only indexes can be able to be manipulated. So, is there any tricks/ideas that you can use HRD with GAE Datastore on Java with an Internal Office Server combined? This way, it may provide service even during network down times. (Can somebody create me a tag of gae-datastore, please.)

    Read the article

  • sending credential to linkedIn website and get oauth_verifier without sign in again

    - by akash kumar
    i am facing problem regarding sending credentials to other website and after login(automatically not clicked on sign in here) and get oauth_verifier value Detail is bellow.... I want to send emailaddress and password through form(submit button)from my website(i.e liferay portal) to another website(suppose linkedIn) it should automatically authorize and return oauth_verifier to my website. that mean i dont want my website user to submit emailaddress and password to linkedIn again. actually i want to take emailaddress and password in my website and show the user LinkedIn connection,message,job posting in my website it self,i dont want to redirect user to LinkedIn website and sign in there and again come back to my website. I have taken consumer key and secret key from LinkedIn for my aplication. i am using linkedIn api and getting oauth_verifier for access token but for that i have to take user to LinkedIn for signIn, actually it should happen in backend

    Read the article

  • Scripting custom drawing in Delphi application with IF/THEN/ELSE statements?

    - by Jerry Dodge
    I'm building a Delphi application which displays a blueprint of a building, including doors, windows, wiring, lighting, outlets, switches, etc. I have implemented a very lightweight script of my own to call drawing commands to the canvas, which is loaded from a database. For example, one command is ELP 1110,1110,1290,1290,3,8388608 which draws an ellipse, parameters are 1110x1110 to 1290x1290 with pen width of 3 and the color 8388608 converted from an integer to a TColor. What I'm now doing is implementing objects with common drawing routines, and I'd like to use my scripting engine, but this calls for IF/THEN/ELSE statements and such. For example, when I'm drawing a light, if the light is turned on, I'd like to draw it yellow, but if it's off, I'd like to draw it gray. My current scripting engine has no recognition of such statements. It just accepts simple drawing commands which correspond with TCanvas methods. Here's the procedure I've developed (incomplete) for executing a drawing command on a canvas: function DrawCommand(const Cmd: String; var Canvas: TCanvas): Boolean; type TSingleArray = array of Single; var Br: TBrush; Pn: TPen; X: Integer; P: Integer; L: String; Inst: String; T: String; Nums: TSingleArray; begin Result:= False; Br:= Canvas.Brush; Pn:= Canvas.Pen; if Assigned(Canvas) then begin if Length(Cmd) > 5 then begin L:= UpperCase(Cmd); if Pos(' ', L)> 0 then begin Inst:= Copy(L, 1, Pos(' ', L) - 1); Delete(L, 1, Pos(' ', L)); L:= L + ','; SetLength(Nums, 0); X:= 0; while Pos(',', L) > 0 do begin P:= Pos(',', L); T:= Copy(L, 1, P - 1); Delete(L, 1, P); SetLength(Nums, X + 1); Nums[X]:= StrToFloatDef(T, 0); Inc(X); end; Br.Style:= bsClear; Pn.Style:= psSolid; Pn.Color:= clBlack; if Inst = 'LIN' then begin Pn.Width:= Trunc(Nums[4]); if Length(Nums) > 5 then begin Br.Style:= bsSolid; Br.Color:= Trunc(Nums[5]); end; Canvas.MoveTo(Trunc(Nums[0]), Trunc(Nums[1])); Canvas.LineTo(Trunc(Nums[2]), Trunc(Nums[3])); Result:= True; end else if Inst = 'ELP' then begin Pn.Width:= Trunc(Nums[4]); if Length(Nums) > 5 then begin Br.Style:= bsSolid; Br.Color:= Trunc(Nums[5]); end; Canvas.Ellipse(Trunc(Nums[0]),Trunc(Nums[1]),Trunc(Nums[2]),Trunc(Nums[3])); Result:= True; end else if Inst = 'ARC' then begin Pn.Width:= Trunc(Nums[8]); Canvas.Arc(Trunc(Nums[0]),Trunc(Nums[1]),Trunc(Nums[2]),Trunc(Nums[3]), Trunc(Nums[4]),Trunc(Nums[5]),Trunc(Nums[6]),Trunc(Nums[7])); Result:= True; end else if Inst = 'TXT' then begin Canvas.Font.Size:= Trunc(Nums[2]); Br.Style:= bsClear; Pn.Style:= psSolid; T:= Cmd; Delete(T, 1, Pos(' ', T)); Delete(T, 1, Pos(',', T)); Delete(T, 1, Pos(',', T)); Delete(T, 1, Pos(',', T)); Canvas.TextOut(Trunc(Nums[0]), Trunc(Nums[1]), T); Result:= True; end; end else begin //No space found, not a valid command end; end; end; end; What I'd like to know is what's a good lightweight third-party scripting engine I could use to accomplish this? I would hate to implement parsing of IF, THEN, ELSE, END, IFELSE, IFEND, and all those necessary commands. I need simply the ability to tell the scripting engine if certain properties meet certain conditions, it needs to draw the object a certain way. The light example above is only one scenario, but the same solution needs to also be applicable to other scenarios, such as a door being open or closed, locked or unlocked, and draw it a different way accordingly. This needs to be implemented in the object script drawing level. I can't hard-code any of these scripting/drawing rules, the drawing needs to be controlled based on the current state of the object, and I may also wish to draw a light a certain shade or darkness depending on how dimmed the light is.

    Read the article

  • C++ Building Static Library Project with a Folder Structure

    - by Jake
    I'm working on some static libraries using visual studio 2012, and after building I copy .lib and .h files to respective directories to match a desired hierarchy such as: drive:/libraries/libname/includes/libname/framework drive:/libraries/libname/includes/libname/utitlies drive:/libraries/libname/lib/... etc I'm thinking something similar to the boost folder layout. I have been doing this manually so far. My library solution contains projects, and when I update and recompile I simply recopy files where they need to be. Is there a simpler way to do this? Perhaps a way to compile the project with certain rules per project as to where the projects .h and .lib files should go?

    Read the article

  • New promising webdevelopment language?

    - by Rick
    I'm looking for a new language focused on webdevelopment. I know there are many current language/framework combination that are very suited for webdevelopment; ASP.Net, Ruby on Rails, PHP with numerous frameworks, etc... I like shiny new things! I like digging through language documentation or even an interpreter to figure out why something is not working the way I expect it to. Sure I could use an existing solution, but that wouldn't be fun! Are there any new up and coming language focused to webdevelopment (optionally language + webframework setup would be fine too)?

    Read the article

  • "continue" and "break" for static analysis

    - by B. VB.
    I know there have been a number of discussions of whether break and continue should be considered harmful generally (with the bottom line being - more or less - that it depends; in some cases they enhance clarity and readability, but in other cases they do not). Suppose a new project is starting development, with plans for nightly builds including a run through a static analyzer. Should it be part of the coding guidelines for the project to avoid (or strongly discourage) the use of continue and break, even if it can sacrifice a little readability and require excessive indentation? I'm most interested in how this applies to C code. Essentially, can the use of these control operators significantly complicate the static analysis of the code possibly resulting in additional false negatives, that would otherwise register a potential fault if break or continue were not used? (Of course a complete static analysis proving the correctness of an aribtrary program is an undecidable proposition, so please keep responses about any hands-on experience with this you have, and not on theoretical impossibilities) Thanks in advance!

    Read the article

  • Text Editor with SSH/Terminal/FTP/Putty combo for develeping in Rails on Windows

    - by Panoy
    I plan to learn Ruby on Rails and would like to code in my development box which runs on Windows XP. I have Ubuntu Server (forgot the version ;p) running as my web server with Rails installed on it. I have been considering using Vim as my text editor of choice in XP but would like to know any text editor and accompanying shell/FTP/Putty/SSH (or whatever you may call it) program that can access those files in my Ubuntu server. It is better if the shell can be called or is bundled inside the text editor. I would like to know your combinations (text editor + shell) and your experiences on it when you were able to develop your Rails projects on that combination. Cheers!

    Read the article

  • Is reliance on parametrized queries the only way to protect against SQL injection?

    - by Chris Walton
    All I have seen on SQL injection attacks seems to suggest that parametrized queries, particularly ones in stored procedures, are the only way to protect against such attacks. While I was working (back in the Dark Ages) stored procedures were viewed as poor practice, mainly because they were seen as less maintainable; less testable; highly coupled; and locked a system into one vendor; (this question covers some other reasons). Although when I was working, projects were virtually unaware of the possibility of such attacks; various rules were adopted to secure the database against corruption of various sorts. These rules can be summarised as: No client/application had direct access to the database tables. All accesses to all tables were through views (and all the updates to the base tables were done through triggers). All data items had a domain specified. No data item was permitted to be nullable - this had implications that had the DBAs grinding their teeth on occasion; but was enforced. Roles and permissions were set up appropriately - for instance, a restricted role to give only views the right to change the data. So is a set of (enforced) rules such as this (though not necessarily this particular set) an appropriate alternative to parametrized queries in preventing SQL injection attacks? If not, why not? Can a database be secured against such attacks by database (only) specific measures? EDIT Emphasis of the question changed slightly, in the light of the initial responses received. Base question unchanged. EDIT2 The approach of relying on paramaterized queries seems to be only a peripheral step in defense against attacks on systems. It seems to me that more fundamental defenses are both desirable, and may render reliance on such queries not necessary, or less critical, even to defend specifically against injection attacks. The approach implicit in my question was based on "armouring" the database and I had no idea whether it was a viable option. Further research has suggested that there are such approaches. I have found the following sources that provide some pointers to this type of approach: http://database-programmer.blogspot.com http://thehelsinkideclaration.blogspot.com The principle features I have taken from these sources is: An extensive data dictionary, combined with an extensive security data dictionary Generation of triggers, queries and constraints from the data dictionary Minimize Code and maximize data While the answers I have had so far are very useful and point out difficulties arising from disregarding paramaterized queries, ultimately they do not answer my original question(s) (now emphasised in bold).

    Read the article

  • HTML Canvas: Should my app x, y values be global?

    - by Joe
    I have a large file of functions. Each of these functions is responsible for drawing a particular part of the application. My app has x and y parameters that I use in the setup function to move the whole app around in order to try different placements. So, naturally, I need to use these x and y values to anchor each function's component rendering so that everything moves in unison if the global x,y values ever change. My question is, is it bad practice/architecture to have these x,y values in the global namespace and having the each function directly access them like so? function renderFace() { var x = App.x; var y = App.y; // drawing here } is there a better way i'm missing?

    Read the article

  • [PHP] Version Changes: How considerable are the compatibility issues in project?

    - by AdityaGameProgrammer
    For example if we consider ActionScript2.0(based on Objects but programming does not implement much OOP ) vs 3.0(highly OOP) its like a whole new scripting language in the sense of approach, programming style,features you get the idea. In PHP we can see current versions going from 3-5. brief version changes Question :Developers who work on PHP is it easy to migrate from version to version? Question :Are there any extensive compatibility issues, forward or backward? Question :Does your project stick to a particular version till the end ? Question :Does the programming style ,approach change from version to version? Question :If you had to get started on PHP to contribute to a project built earlier versions, would learning the latest version be counterproductive towards this aim? Some related topics i had come across on SE How should I be keeping track of php script version/changes? What is happening to PHP 6? It would be Really helpful in understanding if you could answer this topic directly to the questions put forth.

    Read the article

  • Learning about security and finding exploits

    - by Jayraj
    First things first: I have absolutely no interest in learning how to crack systems for personal enrichment, hurting other people or doing anything remotely malicious. I understand the basis of many exploits (XSS, SQL injection, use after free etc.), though I've never performed any myself. I even have some idea about how to guard web applications from common exploits (like the aforementioned XSS and SQL injection) Reading this question about the Internet Explorer zero-day vulnerability from the Security SE piqued my curiosity and made me wonder: how did someone even find out about this exploit? What tools did they use? How did they know what to look for? I'm wary about visiting hacker dens online for fear of getting my own system infected (the Defcon stories make me paranoid). So what's a good, safe place to start learning?

    Read the article

  • Authentication for users on a Single Page App?

    - by John H
    I have developed a single page app prototype that is using Backbone on the front end and going to consume from a thin RESTful API on the server for it's data. Coming from heavy server side application development (php and python), I have really enjoyed the new different design approach with a thick client side MVC but am confused on how best to restrict the app to authenticated users who log in. I prefer to have the app itself behind a login and would also like to implement other types of logins eventually (openid, fb connect, etc) in addition to the site's native login. I am unclear how this is done and have been searching - but unsuccessful in finding information that made it clear to me. In the big picture, what is the current best practice for registering users and requiring them to login to use your single page app? Once a user is logged in, how are the api requests authenticated? Can I store a session but how do I detect for this session in the API calls? Any answers to this would be much appreciated!

    Read the article

  • How do you update copyright notices?

    - by James
    So now it's 2011, and as I carry on coding on our active projects it's time to update some copyright notices. eg. Copyright Widgets Ltd 2010 to Copyright Widgets Ltd 2010, 2011 My question is when do you update the copyright notices? Do you change the notice in the head of a file the first time you work on that file? Since a module is one piece of code consisting of many files that work together, do you update all notices in that module when you change a single file in that module? Since a program is one piece of code (maybe consisting of many modules), do you update all notices in that program when you change a single file in that program? Or do you just go through and change en-mass over your morning coffee on the grounds your about to start programming and updateing things?

    Read the article

  • What are the steps to grouping related classes into packages

    - by user2368481
    I've been googling this for some time, but what I haven't found are the clear steps needed to be taken to group related classes into packages in Java. In my case, I have about a number of .java files that I'd like to group into 3 packages according to the MVC pattern. One package for Model classes, one package for View classes and one package for Controller classes. I've identified which belong in what package, but not sure of the next step.

    Read the article

  • Isolating test data in acceptance tests

    - by Matt Phillips
    I'm looking for guidance on how to keep my acceptance tests isolated. Right now the issue I'm having with being able to run the tests in parallel is the database records that are manipulated in the tests. I've written helpers that take care of doing inserts and deletes before tests are executed, to make sure the state is correct. But now I can't run them in parallel against the same database without uniquely generating the test data fields for each test. For example. Testing creating a row i'll delete everything where column A = foo and column B = bar Then I'll navigate through the UI in the test and create a record with column A = foo and column B = bar. Testing that a duplicate row is not allowed to be created. I'll insert a row with column A = foo and column B = bar and then use the UI to try and do the exact same thing. This will display an error message in the UI as expected. These tests work perfectly when ran separately and serially. But I can't run them at the same time for fear that one will create or delete a record the other is expecting. Any tips on how to structure them better so they can be run in parallel?

    Read the article

  • Examples of limitations in IT due to different bit length by design

    - by Alaudo
    I am teaching the course "Introduction in Programming" for the first-year students and would like to find interesting examples where the datatype size in bits, chosen by design, led to certain known restrictions or important values. Here are some examples: Due to the fact that the Bell teleprinter used 7-bit-code (later accepted as ASCII) until now have we often to encode attachments in electronic messages to contain only 7 bit data. Classical limitation of 32-bit address space leads to the 4Gb maximal RAM size available for 32-bit systems and 4Gb maximal file size in FAT32. Do you know some other interesting examples how the choice of the data type (and especially its binary length) influenced the modern IT world. Added after some discussion in comments: I am not going to teach how to overcome limitations. I just want them to know that 1 byte can hold the values from -127..0..+127 o 0..255, 2 bytes cover the range 0..65535 etc by proving examples they know from other sources, like the above-mentioned base64 encoding etc. We are just learning the basic datatypes and I am trying to find a good reference for "how large" these types are.

    Read the article

  • Why fork a library for your own application?

    - by Mr. Shickadance
    Why should a programmer ever fork a library for inclusion in a widely used application? I ask this question because I was reading an article about why Chromium isn't packaged for many Linux distros like Fedora. Apparently its largely due to the fact that Google has forked a number of libraries, modified them, and included them in Chromium. This has driven up the complexity of packaging releases. There are a number of reasons why this can be a bad thing, but how strong a case can you actually make for doing so in a large widely used application such as Chromium? The original article: http://ostatic.com/blog/making-projects-easier-to-package-why-chromium-isnt-in-fedora Isn't it usually worth the effort to make slight modifications to your own program in order to use a popular and well developed library?

    Read the article

  • Domain Models (PHP)

    - by Calum Bulmer
    I have been programming in PHP for several years and have, in the past, adopted methods of my own to handle data within my applications. I have built my own MVC, in the past, and have a reasonable understanding of OOP within php but I know my implementation needs some serious work. In the past I have used an is-a relationship between a model and a database table. I now know after doing some research that this is not really the best way forward. As far as I understand it I should create models that don't really care about the underlying database (or whatever storage mechanism is to be used) but only care about their actions and their data. From this I have established that I can create models of lets say for example a Person an this person object could have some Children (human children) that are also Person objects held in an array (with addPerson and removePerson methods, accepting a Person object). I could then create a PersonMapper that I could use to get a Person with a specific 'id', or to save a Person. This could then lookup the relationship data in a lookup table and create the associated child objects for the Person that has been requested (if there are any) and likewise save the data in the lookup table on the save command. This is now pushing the limits to my knowledge..... What if I wanted to model a building with different levels and different rooms within those levels? What if I wanted to place some items in those rooms? Would I create a class for building, level, room and item with the following structure. building can have 1 or many level objects held in an array level can have 1 or many room objects held in an array room can have 1 or many item objects held in an array and mappers for each class with higher level mappers using the child mappers to populate the arrays (either on request of the top level object or lazy load on request) This seems to tightly couple the different objects albeit in one direction (ie. a floor does not need to be in a building but a building can have levels) Is this the correct way to go about things? Within the view I am wanting to show a building with an option to select a level and then show the level with an option to select a room etc.. but I may also want to show a tree like structure of items in the building and what level and room they are in. I hope this makes sense. I am just struggling with the concept of nesting objects within each other when the general concept of oop seems to be to separate things. If someone can help it would be really useful. Many thanks

    Read the article

  • What to include in metadata?

    - by shyam
    I'm wondering if there are any general guidelines or best practices regarding when to split data into a metadata format, as oppose to directly embedding it within the data. (Specific example below). My understanding of metadata is that it describes data (without the need to actually look at the data), allowing for data to be quickly search/filtered for easy access. Let's take for example a simple 3D model format. The actual data file itself is a binary file containing vertices and colors. Things like creation date, modified data and author name would be things that describe the binary data, so I would say these belong as metadata (outside of the binary file). But what if the application had no need to search or filter by these fields? Would it be acceptable to embed these fields directly into the binary data itself? Could they be duplicated in both the binary data and the meta data, or would this be considered bad practice? What about more ambiguous fields such as the model name, which could be considered part of the data itself, but also as data describing the binary data?... How do you decide which data to embed in the actual binary file, as opposed to separating into a more flexible metadata format? Thanks!

    Read the article

  • Should *'s go next to the type or the variable name? [closed]

    - by derekerdmann
    Possible Duplicate: int* i; or int *i; or int * i; When working in C or C++, how should pointers be declared? Like this: char* derp; or this: char *derp; I typically use the first method, because the variable is a character pointer, but I know that it can create confusion when declaring multiple variables at once: char* herp, derp; herp becomes a character pointer, while derp is just a character. I know it often comes down to coding style, but which one is "better?" Should I sacrifice clarity to eliminate potential confusion?

    Read the article

  • Using machine learning to aim mirrors in a solar array?

    - by Buttons840
    I've been thinking about solar collectors where several independent mirrors to focus the light on a solar collector, similar to the following design from Energy Innovations. Because there will be flaws in the assembly of this solar array, I am proceeding with the following assumptions (or lack thereof): The software knows the "position" of each mirror, but doesn't know how this position relates to the real world or to other mirrors. This will account for poor mirror calibration or other environmental factors which may effect one mirror but not the others. If a mirror moves 10 units in one direction, and then 10 units in the opposite direction, it will end up where it originally started. I would like to use machine learning to position the mirrors correctly and focus the light on the collector. I expect I would approach this as an optimization problem, optimizing the mirror positions to maximize the heat inside the collector and the power output. The problem is finding a small target in a noisy high-dimensional space (considering each mirror has 2 axis of rotation). Some of the problems I anticipate are: cloudy days, even if you stumble upon the perfect mirror alignment, it might be cloudy at the time noisy sensor data the sun is a moving target, it moves along a path, and follows a different path every day - although you could calculate the exact position of the sun at any time, you wouldn't know how that position relates to your mirrors My question isn't about the solar array, but possible machine learning techniques that would help in this "small target in a noisy high dimensional-space" problem. I mentioned the solar array because it was the catalyst for this question and a good example. What machine learning techniques can find such a small target in a noisy high-dimensional space? EDIT: A few additional thoughts: Yes, you can calculate the suns position in the real world, but you don't know how the mirrors position is related to the real world (unless you've learned it somehow). You might know the suns azimuth is 220 degrees, and the suns elevation is 60 degrees, and you might know a mirror is at position (-20, 42); now tell me, is that mirror correctly aligned with the sun? You don't know. Lets assume you have some very sophisticated heat measurements, and you know "with this heat level, there must be 2 mirrors correctly aligned". Now the question is, which two mirrors (out of 25 or more) are correctly aligned? One solution I considered was to approximate the correct "alignment function" using a neural network which would take the suns azimuth and elevation as input and output a large array with 2 values for each mirror which correspond to the 2 axis of each mirror. I'm not sure what the best training method is though.

    Read the article

  • Are SQL Injection vulnerabilities in a PHP application acceptable if mod_security is enabled?

    - by Austin Smith
    I've been asked to audit a PHP application. No framework, no router, no model. Pure PHP. Few shared functions. HTML, CSS, and JS all mixed together. I've discovered numerous places where SQL injection would be easily possible. There are other problems with the application (XSS vulnerabilities, rampant inline CSS, code copy-pasted everywhere) but this is the biggest. Sometimes they escape inputs, not using a prepared query or even mysql_real_escape_string(), mind you, but using addslashes(). Often, though, their queries look exactly like this (pasted from their code but with columns and variable names changed): $user = mysql_query("select * from profile where profile_id='".$_REQUEST["profile_id"]."'"); The developers in question claimed that they were unable to hack their application. I tried, and found mod_security to be enabled, resulting in HTTP 406 for some obvious SQL injection attacks. I believe there to be sophisticated workarounds for mod_security, but I don't have time to chase them down. They claim that this is a "conceptual" matter and not a "practical" one since the application can't easily be hacked. Their internal auditor agreed that there were problems, but emphasized the conceptual nature of the issues. They also use this conceptual/practical argument to defend against inline CSS and JS, absence of code organization, XSS vulnerabilities, and massive amounts of repetition. My client (rightly so, perhaps) just wants this to go away so they can launch their product. The site works. You can log in, do what you need to do, and things are visibly functional, if slow. SQL Injection would indeed be hard to do, given mod_security. Further, their talk of "conceptual vs. practical" is rhetorically brilliant, considering that my client doesn't understand web application security. I worry that they've succeeded in making me sound like an angry puritan. In many ways, this is a problem of politics, not technology, but I am at a loss. As a developer, I want to tell them to toss the whole project and start over with a new team, but I face a strong defense from the team that built it and a client who really needs to ship their product. Is my position here too harsh? Even if they fix the SQL Injection and XSS problems can I ever endorse the release of an unmaintainable tangle of spaghetti code?

    Read the article

< Previous Page | 297 298 299 300 301 302 303 304 305 306 307 308  | Next Page >