A few days ago I read a post on Browie.com about rotating affiliate marketing offers. The logic behind this is great and everyone in affiliate marketing should be doing this, so kudos to Browie for reminding us and showing the noobs how it's done. However, I noticed a glaring PHP security flaw that I wanted to point out.

Here is the code that Browie gives as an example:

The problem lies in the first line of code. One thing I have learned is NEVER do an extract() on $_REQUEST, $_GET, $_POST or any other global variable. In this particular case I'm not really sure why extract() is being used or why the $_REQUEST var is needed, but I do know that it opens up the script to be used as a jump page for anyone (albeit not really reliable). For instance, if you knew the location of the jump page, which you could find out from the ad link, then all you would have to do is construct a url like example.com/jumppage.php?offer[3]=http://mylink.com&offer[4]=http://mylink2.com and your urls would be added to the $offer array and be randomly jumped to. So unless you are super evil and can think of a way to really exploit this (messing with their stats?), then this isn't a huge security risk. However, the point is that it allows anyone to inject variables into the script and make the script do things it was not intended to do. So even though the risk in this script is minimal, it's best to just avoid it all together so that it doesn't start to become a habit. Case in point: Just last week I came across some custom third party code on a client site that allowed me to login to their system without a username or password because of a combination of doing an extract() on $_REQUEST and not escaping variables in an sql query. Not a very fun thing to find.

In case you are wondering, here is how I would rewrite the script:

Notice that the $_REQUEST variable is missing since I don't see why it is needed, but if you have to use $_REQUEST variables then make sure that you call them like so:

I suggest you use either $_GET or $_POST since you should know where your variables are coming from (ie don't be lazy).

However if you are on a shared host like I am, then the checked out files might not have the right permissions for your setup. My host is running PHPSuExe and that means that all executable files can only be writable by the user (644 for files and 755 for directories). But the checked out files and directories are all writable by the group (664 and 775). What to do?

I just SSH in, cd to the blog directory, and do a recursive chmod that removes the group write privilege from all files and folders. For example if your blog is in the typical cpanel root:

cd public_html
chmod -R g-w .

Works every time.

Adobe Photoshop and Corel PhotoPaint are useful tools, no doubt, but there's more to image editors than determined by the price tag alone. I know they say you get what you paid for, but there are times when the best things in life are free, like these web-based alternatives to Photoshop. Check them out if you need efficient editors on a low budget:

• The GIMP: It may rhyme with wimp, but it's certainly far from one. The GNU Image Manipulation Program is one of the hottest free image editors you'll find out there. It comes with almost all the features that pricey design packages have, and as for those that are missing, the open developing community for the GIMP will soon take care of that. This promising package is available for Windows, Mac, Linux and UNIX users.  
• Piknik: Its integration with the popular photo sharing application Flickr has only added to the appeal of this image editor – Piknik allows you to edit and add special effects to your photos on Mac, Windows and Linux systems.
• Pixia: lets you add layers, insert text, apply filters, resize, draw, crop, adjust color and brightness, and do a few other things as well to your pictures. A good tool to work with images and email them to all your friends.
• PhotoPlus: This versatile photo editor opens Photoshop files, supports layers just like Photoshop, has a cool “undo” option that lets you take care of any number of blunders, and lets you add links to graphics through the Image Maps tool.
• Seashore: A fast photo editor specifically for Mac users, this program lets you gradients and textures for text and brush strokes and supports multiple layers and alpha channel editing. It uses the same file format as the GIMP. 
• Paint.NET: This package which is based on the .NET framework and runs on computers that use the Windows operating systems and have Microsoft .NET Framework 2.0 installed. It features filters to handle blurring and sharpening and color control among other options, and allows layers.
• Krita: Available for use on systems that run the UNIX or Linux operating systems, this image editor which is a part of the KOffice suite, offers support for 16-bit images. It supports various filters, color management, CMYK and high dynamic resolution images.
• Picasa 2: You could use this program just because it's from Google even if you are not too sure of the features and tools. The integrated Hello account (which has unfortunately been disabled now) allowed you to send any number of photos through email in a very short time.
• FotoFlexr: A comprehensive image editor, this tool lets you edit photos from Flickr, myspace, facebook, and Picasa among other online album applications.
• Pixenate: This free online photo editing tool allows you to print, share or upload pictures to an online album. You can use standard editing tools and even apply fun effects.

So What's the Advantage?

The main advantage to using a css framework is speed. Once you figure out what the framework can do, it speeds up development quite a bit by helping to standardize the web development workflow. Blueprint can be the bridge between design and code.

So often it's the designer that creates the problems in web development...I know because I am one. A simple stroke of design genius can snowball into a usability nightmare or make HTML/CSS markup a living hell. A grid system like Blueprint gives a designer definite bounds to work within, and puts them on the same page with the CSS developer and information architect.

Now if your designer doesn't totally screw things up with a stroke of genius, then the guy or gal that marks up the HTML and CSS probably will. They'll think of ultra clever semantic names that later end up being not so semantic. They'll invent a new layout system because the last ones they did just weren't good enough. They'll probably take whatever whimsical approach seems appropriate for the design that was presented to them.

With Blueprint, the approach is different. A web developer can now layout the basic structure of the page (ie header, columns, footer,etc) using CSS that's provided by the framework. The best part about this is that it takes thinking out of structural layout. You'll be surprised at how much time you wasted thinking about what to name things like columns let alone the time it actually took to write the CSS for it. After using Blueprint for layout I wondered why I tortured myself by starting with a blank slate each time I started marking up a site.

If you're lucky enough to have an information architect in your workflow, then Blueprint is going to be a dream come true. Instead of using an image editor like PhotoShop to make wireframes, the information architect can just use Blueprint to make them. In fact, if your designer is also the IA, then why not have them start there. If you can establish your grid and layout with CSS before design then you will be twice as prepared when you actually get to designing. Plus, there's the added benefit of being able to reuse the code that the IA started at the CSS phase.

Hopefully, by now, the advantage of using a css framework is obvious. The IA starts the design process with Blueprint, hands the grid system and wireframes to the designer who now has a real template to work from, and then the design and basic grid system gets handed to the CSS developer to put it all together. Blueprint helps to standardize your workflow, and standards speed things up by automating simple tasks.

Jef Croft, one of the guys that helped write Blueprint, wrote:

They’re especially great for those working on tight deadlines and those working in teams (teams wherein multiple people work on the same CSS — they benefit from having a consistent set of coding patterns), and also for those working on several sites of a similar nature (for example, a team working at a news company which runs 20+ newspaper sites).

In my experience Blueprint is the best grid system out there right now. It has the cleanest, most flexible, and most supported code to allow your team to work together. However, any grid system can speed up development and there are a few to choose from: 960, YAML, Grid Designer, YUI Grids CSS. The main point is that if you can standardize on a common way to layout pages then all of your developers will work better together.

You Want More?

Here are some more in depth articles...

• Which CSS Grid Framework Should You Use for Web Design? - A pretty in depth look at CSS Grids and Blueprint
• What’s not to love about CSS frameworks? - A casual and humorous overview.
• Five Simple Steps to designing grid systems - A very in depth look at Grid Systems

...and here are some great tools for Blueprint CSS...

• Blueprint Grid CSS Generator - This tool will help you generate more flexible versions of Blueprint's grid.css and compressed.css and grid.png files.
• Grid - Grid is a highly configurable JavaScript bookmarklet which overlays a layout grid on any web-site you wish
• Photoshop GridMaker Script - Creates guides in Photoshop for css grids.

Anyway, it's a good idea to run a server out of your office or home just to get familiar with how it works and what it can do. That's what I finally set up this week and now my web development arsenal is pretty complete with a Windows laptop and desktop, Apple G4, and Ubuntu Linux on an old Pentium 3.

What will I do with my Linux box? Plans are to run PHP and Perl server applications off of it that are too memory intensive for a shared host web server. I've been getting more into running php and perl programs from the command line interface, and want to move that development to Linux.

So how do you get it?

First of all you need a decent computer, and I think the Pentium 3 with 512 MB of RAM that I have is about the slowest thing you're going to want to run it on (I got it for free). However, if you are just running a web server that won't get a lot of use, then a slower computer is not all that bad. It's when you get into running the various desktop apps (KDE or Gnome) that you need at least 1GB of memory.

The flavor of Linux I chose is Ubuntu and I picked it because it came with an easy web server install. You can pick whatever flavor you want but the most popular ones seem to be Debian, Ubuntu, Fedora, and SUSE. There are lots of comparison sites (here and here)out there on the net, just Google it.

Once you get your distribution downloaded, installing it is usually pretty easy. They've really come a long way to make the process of installing Linux easier for everyone and if your hardware is common then you shouldn't have a problem. I have to admit that I had a bit of a problem because I decided to remove the DVD drive before installing and messed up the Master/Slave drive hierarchy. I don't know a lot about putting computers together, but now I know about that Live and learn.

What to do once it is installed?

So if you get Linux installed, what the heck do you do with it? If you've installed a 'normal' version with a GUI then you can pretty much use it like any other computer. Linux is a great, cheap alternative to purchasing an OS if you need an extra computer for basic tasks like word processing or browsing the web.

If you are like me and installed a web server, then it doesn't come with a GUI. Get ready to type some command line instructions. Really though, once I installed the Ubuntu web server it was ready to go with Apache, PHP, Perl, and mySQL and I didn't have to configure anything special to start using it right away. Any programmer can use this setup to start building web spiders and other fun stuff, and deploy it right out their home office like I do (just don't do anything too spammy or your ISP might shut you down).

I know this hasn't been a tutorial on the specifics of how to set up Linux but you can find those on the distribution site that you download from. That is the best place to find that kind of information along with support if you run into trouble. If you end up setting up Linux or already have it set up, post a comment and tell us how you use it in your development arsenal.

Assumtions

First I need to tell you about how my WordPress blogs are set up. I usually set up my blogs in the root directory, and that is how this tutorial assumes you have done it as well. This means all of our coding will be going on inside of the WordPress install. Of course, your setup may be different than this, so just keep that in mind.

I'm also assuming that you've been good and have upgraded to WordPress 2.6. The WP developers have changed how the core code is included in WP 2.6 and this tutorial reflects that.

Set Up

To begin create a directory in your WordPress install for testing (this directory should be parallel to the wp-content folder). You can call it anything you like - I'm calling mine 'tool'. Next, create a blank index.php file in that folder.

Go on to learn how to include the WordPress core code...

Big surprise that Jonathan van Clute won, but he deserved it since he really knows his stuff. I was glad to see Carl come in 2nd; he's a smart guy. I think Ian Jani got lucky in third place and it could have been anyone else.

As far as the Gurus go, it was very unfortunate for Shoemoney that his baby had such problems after she was born. Not exactly the best way to enter this world, but I'm glad that she's doing better now and hopefully Shoe and his wife can get into the groove of being parents of 2 kids soon (if there is such a groove ). John Chow got voted off and I'm not really sure I agreed with that. I think he gives the most honest view of the show in his shocking behind the scenes take on TAC. So since Shoe and John were out, Ken McArthur had the show all to himself to promote the JV Alert conference and his book...good for him.

It sounds like there could be a TAC 2 in the works already so I'm excited to see that if it happens.

I've also been having the itch to learn the Perl programming language, and I thought this would be a good project to get my feet wet.

Strategy

Since the majority of blogs I read are in written in WordPress, it's pretty easy to take advantage of the GET string that can be used to access each post. The GET string looks like http://www.devtrench.com/?p=2. Normally, post id's start with 1 and auto increment from there, so all we have to do is figure out what the id is of the latest post, and write some code that will loop over a scraper that many times. Sometimes the latest post id will be hidden in the HTML of the post somewhere, and other times you just have to guess at it for a while until you figure it out.

Code

Here's the Perl code that I'm currently using to do this. It's meant to be run from the command line, and I output the data to a file using '> output.txt' after the command. Also, I ripped off most of this code from PLEAC-Perl, which is an online Perl cookbook. Cookbooks can really accelerate learning a language when you want to do specific tasks like this.

Hopefully this code is commented enough for you to understand what is going on.

This was a fun experiment for me and a great way to finally get around to learning Perl. I always find that if I create small tasks like this for myself that learning a language or framework is much more interesting and rewarding. Now if you want to do this in PHP, which is what I usually program in, you can follow the same logic using curl as your user agent.

Hint 1: If you use this code as is it will print out HTML. Surround the HTML that it generates with basic <html> and <body> tags and create your own styles in the <head>. Then you can view it in a web browser and print to PDF.

Hint 2: The blog I was trying to scrape did not allow me to hotlink images from my HTML file, but saving the page as HTML from FireFox was a workaround for that, and then I saved that created page as a PDF.

So why am I hooked? I think it's mainly because of the people on the show. I've followed the blogs of John Chow and Jeremy Schoemaker for quite some time and I've met Jeremy a few times now through NPMMO meetings so just seeing them on camera is fun. As for the rest of the contestants, I didn't know who any of them were before the show (not even the apparently infamous Jonathan van Clute guy), so it's been cool to see who they are and what they can do. I guess I think it is interesting to see how people are networked and who they are friends with. It really shows that part of affiliate marketing is about who you know.

It's also pretty interesting to see how people will whine when put into a position like this. I think that team XY7 whines more than my 4 year old daughter. It's hilarious and think that's probably why they are losing. They pretty much screw themselves in episodes 3 and 4 because they can't play with the punches being thrown at them, and instead of stepping up to the challenge they totally whine about it. If you do that in real life you lose too.

Things really got interesting in Episode 4 when Jeremy's team pulled ahead and got the #1 spot for the day, team XY7 lost another member, and team XY7 and team Toolbarn were combined. Jeremy is apparently stepping down for a bit or indefinitely since his wife went into labor 3 weeks early and gave birth to a yet unnamed little girl. It will be cool to see if he comes back on the show and what his role will be.

Looking forward to more episodes tomorrow and all next week.

My first impressions were that I expected a little bit more professional production (the opening credits were really bad), but overall the people involved and challenges they are facing are very interesting to me. There were no affiliate marketing secrets revealed in this first episode, and I guess time will tell if it holds true that some will be. I think a major factor in this show will be the fact that a new show will air every day. The players seemed very reluctant to talk knowing that that their competitors might know their plans the very next day.

So we'll see how it goes, I know I'm looking forward to tomorrow at 1:00