Coffee on the Keyboard

Stop Supporting IE6

As a community, as a whole, web designers and developers need to stop supporting Internet Explorer 6. Now. Completely.

I’ve been thinking a lot about browser compatibility as I’ve been working on Today’s Meet. My CSS is valid, but it doesn’t work quite right in IE6. The interface is completely JavaScript-based, and will only become moreso in the future. How much time should I put into making it all work with IE6?

None. Read the rest of this article »

Tags: Browsers, Code, CSS, Design, enabling, flaw, Front-end, out-of-date, security, Web 2.0
Posted in CSS, Design

Responsible SQL: How to Authenticate Users

Most SQL-injection articles set a horrible example for young programmers.

Here is a very typical “bad example” of why you need to escape user data before it goes into SQL queries:

(ed. The symbol « is a line break that’s not in the real code.)

The point, of course, is that you must sanitize your user input, or else this person would run this query:

Which grants the sneaky user all your admin privileges. Other versions have nefarious users dropping your users or articles tables.

The problem is: this is the wrong way to authenticate users. These examples are written for beginners to understand the importance of sanitizing input, but they also provide a model to those beginners for how user authentication works. And it’s a very bad model.

This is a long one, more after the break. Read the rest of this article »

Tags: attack, Back-end, Code, Database, injection, MySQL, PHP, security, sql
Posted in Database, MySQL, PHP