• Part 1
• Part 2
• Part 3
• Part 4

So, when we left off in part two, I was leaning towards WordPress as a candidate for a CMS. It’s popular, has tons of themes, plugins, etc. It’s almost perfect, but for only certain situations.

Enter Drupal

Now, I’ve been hearing a lot about Drupal. For years now. I tried it once and I didn’t like it. However, since then, I’ve revisited it. And I’m happy I did.

I must admit, it had a lot to do with president Obama winning the election. The redesign of Whitehouse.gov was an eye opener. So I thought, if it’s good enough for the president, maybe I should give this thing a second look.

Drupal Pros – Reminds Me Of WordPress

• Popularity – Again, like WordPress, a popular CMS is going to have an advantage over most newcomers because of support and community contributions.
• Modules – There are a lot of modules out there that will do most of what your mind can imagine out of the box.
• Themes – There’s a pretty extensive library of themes for Drupal out there. What I haven’t seen though, are third party companies that specialize in these (WordPress has WooThemes, after all). Personally, I’m less interested in readymade themes and more interested in ease of theme development.
• Theme Caching – I’ve said it before, I like the way this works. The consolidation and compression of all the theme CSS and JS files is awesome. It’s great that this works out of the box.
• Multisites – As the name says, this enables you to have tons of sites on the same server running off of the same code base. They can even share modules among themselves.

Highly Customizable

One of the beauties of Drupal is how customizable it is. One of the best examples of these I’ve found is with the concept of an Administrative Theme. This is one thing I’ve notice that WordPress lacks. It is usually very difficult to theme and brand the backend. When clients click into it, they feel they are being tossed into a completely different world.

With a Drupal theme, if done right, the client may not even realize they are editing content.

Extending Functionality

Of course there are entire books dedicated to module development for Drupal. After an initial look, I’ve found the development framework to be a lot more robust that WordPress. However, this is another line that you need to be careful not to cross: The CMS vs. Custom Web Application line.

Generally, I try to find some built in modules or themes to do the things I need. With WordPress, we have things like Flutter and PODS. In Drupal we have two modules: Content Construction Kit (CCK) and Views.

As the name suggests, CCK enables you to add custom content types to your CMS. So, something like events would be quite easy to add. With these you get custom field types (text, image, date, time, etc) and a ton of other goodies.

The Views module allows you to define a custom “view” outside of your regular Page/Post set up. A classic use of this would be to display a list of upcoming events in your sidebar.

Ease of Theming

Now, I will say, it takes a while to get the hang of Drupal theming. It just takes time to understand how the system works. But once you’re gotten to that point, the ease of converting a nicely sliced PSD into a Drupal theme for a client is very evident. You just need to know where to start.

The easiest starting point I’ve found is with two Theming Frameworks: Basic and Zen. These two tools give you everything you need to get up and running with Drupal theming. They are very well documented and provide an excellent starting point.

I love Overrides

The first concept that you need to understand with Drupal theming is that everything’s a node or a block. There are just different types of nodes/blocks, based on content type (pages, post, etc), content name, and even module (CCK, Views, etc).

Much the same way, WordPress templates overrides index.php -> page.php -> page-1.php, etc; Drupal has the same concept, except much better, lol. Say you need your events styled differently from your posts; you would simply located your template file for the post (most likely node.tpl.php) copy it to the appropriate name (We’ll assume events have been implemented using the Views module, so the name would be something like views-view–events.tpl.php). You then open up that file and go wild with whatever design you need in there.

Don’t threat, there is a Devel module that helps you determine which names to use for your overrides simply by hovering over the element. If the file you’re looking for doesn’t exist in your theme, you simply go grab it out of the Drupal core files. I really love the modularity of the theming process. It feels cleaner that a lot of what I’ve seen in the past.

What I’ve Learnt

A Good Cook Doesn’t Use Only One Knife

Who ever said we need to pick one? I believe I’ve narrowed down things to WordPress and Drupal. I’ll use WordPress when I get a project that screams site or blog. Because WordPress does these things very well with Pages and Posts.

When things get more complicated, I’ll transition into Drupal for a more custom and flexible approach.

Stick To What You Know

Talking about theming brings me to an interesting point. Now this is a touchy issue and I’ll simply say that it’s a personal preference and that the intended audience plays a huge role here.

The theming engine is very, very important for a CMS. I haven’t mentioned this in the past and I know realize that I’ve been making this decision subconsciously. Well now, I’d like to explicitly state it:

I prefer a PHP theming engine.

There, I said it. I know PHP and I can work with it. Now, if you (as a developer) were picking a CMS that a (designer) needs to code for, you have a bigger issue. Many designers detest having any sort of code in their template.

Personally, I just find dealing with PHP easier. I know what it does. I don’t need the added complexity of a theme engine layer to try to work around. Now, when things are quite simple (as in variable replacements) that’s all well and good. However, when we start talking about custom functions, etc. I just feel more comfortable working with something I know.

My Apologies

Now I know in Part 2, I promised you guys that I’d get into Silverstripe and ModX. Let me apologize for that. I installed them, tried them out, and quickly dismissed them. Although each had it’s great selling points, they were just too new and unpopular to devote much time into. There were limited modules/plugins and the user communities were tiny in comparison to things like WordPress and Drupal.

Also there was one (Silverstripe I believe) that forced me to edit the theme in the administration section. That’s all well and good for clients who want to modify themes, but I need syntax highlighting, I’m sorry. And the idea of “copy and paste” into the theme edit box got really old really fast.

I know that WordPress allows you to do the same thing, however the theme is still ultimately stored as a file you can modify with a regular editor and not in the database.

I’m sure they had their reasons, but that just didn’t go well with my workflow process.

And The Winner Is (Winners Are)…

WordPress and Drupal.

I’m glad you guys could come alone for this journey of mine. This is by no means a be-all and end-all discussion. I picked these CMS platforms for very specific reasons that have to do with my background. I feel that they’ll serve me well for the types of projects that I have in mind.

Please understand that they may not always be suited for your uses.

As always, all comments and encouraged.

And Merry Christmas!!!!

• Reader Input: Picking A CMS – Part 3
• Reader Input: Picking A CMS – Part 2
• Joomla Template Tip: Optional Modules
• Content Management Systems
• Reader Input: Picking A CMS – Part 1

• Part 1
• Part 2
• Part 3
• Part 4

I made some promises in Part 1 that I was reminded about in Part 2 (Thanks Ian). I didn’t give WordPress enough attention. So, here I go.

WordPress As A CMS has pretty much become a household phrase these days. So, let’s just right in.

Why I Love WordPress

• Popularity – It’s arguably the most popular blogging platform out there. Popularity means a huge community, active development and lots of community contribution (plugins and themes anyone?)
• Posts and Pages – WordPress does this extremely well. That’s what it’s made for.
• Plugins – There are thousands of plugins that extend this tool and makes life a breeze for a lot of us.
• Themes – Again, another benefit of popularity is that there are tons of themes out there to pick from and build upon. Every project doesn’t have to start from a blank slate.

WordPress is excellent at what it does. It’s also good at some of the things it wasn’t designed to do. You have a lot of things to work with in WordPress: Posts, pages, categories, tags, widgets, and even the dreaded custom fields.

The idea is to find that balance and know the limitations.

Know When To Hold ‘Em, Know When To Fold ‘Em

Bet you never figured Kenny Rogers would teach us about Web Design. If it’s a simple site with a couple of pages, some articles or news (aka Posts) and couple of images here and there, then WordPress is a no-brainer.

Now before I continue I need to clarify something in terms of my goal. WordPress can be used as a CMS for just about any site. yes, I said it. It does a lot and you can bend it to it’s limits. However, my ultimate goal is to provide a nontechnical client with something easy to use. This becomes very difficult when your content takes different forms in terms of custom content. When I need a list of Events (which each have a title, time, description, poster, etc) things get hairy. Custom fields only bring us so far.

This is where I have a problem. When things get too complicated and you need custom things, we run into a bit of a problem. Just because you can do something doesn’t mean you should. Custom fields extend WordPress tremendously, however I’ve found that they can get a bit difficult for a nontechnical person to use. Now there are a few things that have been done to make this thing more pleasant.

Easing WordPress Stress

As a benefit of the huge community and its popularity people have contributed things to WordPress to make using it as a CMS more pleasurable. There’s Flutter, PODs (just found out about this), Magic Fields (fork of Flutter), Custom Write Panels, and more. From what I’ve seen, Flutter, Magic Fields and PODs are the most powerful among these.

All of these have their limitations, but as with most things, it goes back to the 80-20 rule: These plugins will work wonderfully for 80% of your applications. There other 20% is going to be a problem.

What I Don’t Like About WordPress

The Administration section is part of my problem. For just a blog, I can set up a client as an “editor” and things work beautifully. However, with things like Custom Fields, etc. it gets complicated to explain to clients how to do certain things. Also, when you need a little bit more oomph, you give the user a higher role. But that tends to expose too much to the users.

I’ve played with a couple permission and role plugins, but none seemed to do what I needed. Either that or I didn’t know how to use them properly.

What Did I Miss?

So all you WordPress Wizards, is there anything I missed?

• Reader Input: Picking A CMS – Part 4
• Reader Input: Picking A CMS – Part 2
• Reader Input: Picking A CMS – Part 1
• InsaneGB Review – Free Web Server 5GB Disk Space, 20GB Bandwidth
• WordPress Installed

• Part 1
• Part 2
• Part 3
• Part 4

On the quest for the perfect CMS (Picking a CMS Part 1), I’ve decided to switch focus a little bit.

New Standards

As you guys can see, I’ve had way too much on my hands to do a thorough job on the quest for the perfect Content Management System. But then something came to mind. Aren’t we all busy? No matter how wondering or beautiful a CMS is; it’s not use if all that beauty is buried so deep that people can’t find it. If you have to dig more than three (3) pages down on a Google Search page, then it’s not good enough.

Popularity – Just Like In High School

I know, I know, it isn’t fair, but that’s how life is. The popular guys got the girls, they made the football team, and they drive better cars. That’s just how life is. If a CMS is popular enough, it’s going to have certain things going for it.

It’s going to have more contributors. That means more eyes on the code (let’s hope that this will be a good thing). The more people that know about it means, the more people that write about it. Now I will admit, there’s a little “chicken vs. egg” thing going on there. Maybe it gets popular because people write about it. But for our purposes it doesn’t matter. The fact is, there will be more formal and informal documentation.

I’ll be the first to admit that popular doesn’t always mean better. Take WordPress for instance. Although I’ve never looked, I’ve been assured that the code is quite mangled. But notice what I said, I’ve never looked, and neither will your clients. No matter how elegant your code is and how fast it runs; none of that matters if your product doesn’t get out there do serve it’s purpose. With all it’s flaws, I’ve seen WordPress run some of the largest blogs out there, so they must be doing something right. No one returns a BMW because they don’t like the layout of the engine.

So what does populartiy mean? Sorry to all the new kids on the block. You might be cool, but I just can’t take that risk.

Plugins, Modules and Addons.

I don’t care what you say, no matter how cool a CMS is, it will never everything that you want it to do. That’s why we need tons of plugins, modules, addons or whatever you want to call them. Let’s face it, clients always know what they want, until they don’t and you have to radically change your plans.

Also, plugins are an excellent way for other people to contribute to the community without having to hack the core or something.

New Playbook – 20 Minute Dry Run

With all of this said, I have a new plan of attack. I’m going to right some of these CMSs off the list right off the bat. Again, I’m sorry to the new comers. It isn’t fair, but that’s just the way it is. New platforms run the risk of being underdeveloped and not very well documented or supported. That’s not a risk I’m willing to take on a client’s site.

To get things on one baseline, I’m actually using a previous site as a common ground for testing. It encompasses some common functionality that I feel all CMSs should be able to handle: Images, Blogs, etc.

Where Are We So Far?

I’ve been told that Frog CMS is an excellent choice of a CMS. However, based on my new rules it’s not an option. It’s been in verion 0.9.5 since April 2009. And recently the author (yes, I think there’s only one) posted a Still Alive post. So, no offense, but this one’s not for me.

ModX seems to have a huge list of Extras on it’s page, so it’s still on my list. I’m assuming this shows an active community. Let’s keep our fingers crossed.

What Have I Tried?

Those who ignore the past are destined to repeat it.

Leave The Past In The Past

These words are what keep me away from Joomla. I left Joomla at version 1.5 over three (3) years ago. Although people always swear this is true, the version numbers don’t show enough significant change from the mess I remember. So, I’m not touching this thing with a ten foot pole.

Testing The Drupal Waters

I did bite the bullet and installed Drupal. I mean, if it’s good enough for the President of the United States, I should at least give it a try, don’t you think? There are some things that I like so far:

• Admin Templates/Themes  - The backend is extremely flexible. You can change the look, and even the menus that are listed.  With a few modules, you can fine tune the permissions and give clients access to only what you want them to have. So, the argument of “too complicated for clients” can be countered.
• Template Caching – I’m not sure how it works, but I love it. Certain things in the template are cached. One of which being the CSS and JS files. You can even combine and minify these. I just love that.
• Multisites – You can set up a nice little web farm that all runs on the same Drupal core code. They can even share custom modules. I’m guessing it’s something like WordPress MU, but I’ve never tried this myself.

Onward and Upward

The quest continues with Silverstripe and ModX. Stay tuned.

• Reader Input: Picking A CMS – Part 4
• Reader Input: Picking A CMS – Part 3
• Reader Input: Picking A CMS – Part 1
• WordPress 2.5 – The Vista of Blog Platforms
• Moving WordPress To A Different Domain

Personally, I’m ecstatic that Microsoft has released Internet Explorer 8. The great part is that they’ve stuck it in the Windows Automatic Updates and they’ve already started rolling it out Windows users. I damn near threw a party to celebrate.

Of course, we won’t be seeing the real benefits for a while (maybe for a few years, even), but the point is, the process has begun. Does this mean we can say goodbye to IE 6, CSS hacks, and IE conditional tags? Well, of course not! It’s never that easy when it comes to Windows or Microsoft. But again, the process has begun.

Am I saying that there are no problems with the other browsers? No I’m not. Try to find an old copy of Firefox 1.5 and load up a current website. It’s going to look very ugly. The point is, Firefox (I’m not sure about the other browsers) has long ago implemented automatic updates to their products. Old versions, simply disappear.

You Just Can’t Make People Happy

For years, Microsoft has been getting flack about old versions of Internet Explorer. The irony is that, now they’ve finally done something about it, but not everyone is happy.

The blogosphere is heating up over some some interesting options in the Internet Explorer 8 installation process. Eager to spread its shiny next-generation browser, IE 8, to the masses, Microsoft has included an option which resets the user’s default browser in what some argue is too subtle a manner. The “Express” option during the IE 8 install is designed to make the install quicker and easier for novice users.

Seriously, What’s The Big Deal?

The funny thing is that, unlike many installations I’ve seen, the “Express” option isn’t checked by default. Both choices are blank. You can’t accidentally perform the Express install by just hitting the Next button (yes, that’s how I perform most of my installs). You have to purposefully click the “Express” button.

However, I don’t see what the big deal is, honestly. I don’t see how this is different from any other browser install. I can’t be sure (I’ve never had a clean install for a while) but, I don’t think there’s a way to stop the Firefox Automatic update, once it gets started. I open up my browser and magically there’s a new version. At least Microsoft takes you through the installation process.

My point is, who cares? If a user is savvy enough to install Firefox or Opera, this is the worst case scenario:

• Install IE 8 and unknowingly set it to default.
• Hit the “Internet” button and be surprised when IE 8 loads up.
• Get’s slightly annoyed
• Click the “Firefox”/”Opera” icon
• Get prompted to make that browser default again.
• Go on with life.

It takes all of 4.5 seconds to correct the problem. Are the other browser makers that scared that people will actually say:

Hmmph, well since it’s already defaulted let me see what it’s about. Wow, IE 8 is actually cool.

So what? Is that really sure a bad thing? If, God forbid, Microsoft finally gets something right and builds a better browser, then what’s the harm in people using it?

Mozilla has nothing to fear from me, personally. I can’t live without my Firefox Add-ons. Or maybe I’m just bias; as long as IE 6 goes away I’ll be happy.

Opera’s Solution?

Opera wants the commission to make Microsoft offer alternate browsers using the same Windows Update service the latter relies on to upgrade IE. “That’s one possible remedy,” said Lie, who called it a “must-carry” solution, meaning Windows would have to provide multiple browsers, not just IE.

That is the most ridiculous thing I’ve ever heard. Does Ubuntu automatically install Opera/Safari (hell it might, I’m not really sure but I know it does Firefox)? Does OS X have Firefox/Opera on the list when performing an update? The answer is no! So why would Microsoft do something that stupid? OS X comes with Safari and most regular users don’t question it; Ubuntu comes with Firefox installed and most regular users don’t question it. So what’s the big deal with Microsoft doing the same?

I say leave it up to the user. Right now, it doesn’t matter for a regular user because they are not using a better browser. It doesn’t matter for advanced users, because they know better. Again, this is my bias talking. We’ve started ti slowly inject Internet Explorer 6 with cyanide, now we get to watch it’s slow, painful death; Yay!

Now if we could only get the cooperate enterprise, government, and educational masses to perform the Windows Update, I’ll go ahead and dance a jig.

• Browsers Have Multiple Personalities, Your Designs Should Too
• 5 Ways To Annoy Your Audience
• Make Your Web Site Not Suck In Internet Explorer – IE CSS Min-Height Hack
• HSBC Direct Doesn’t Support Firefox 3.0 – Another Reason To Dump IE 6.0
• Firefox 1.5 Released

Introduction

There are tons of Version Control Systems (VCS) out there: Source Safe (Microsoft’s Baby, which sucks by the way), CVS, and SVN. Git is different from those in one major way: It’s a distributed system as opposed to a centralized one. That means, there is no central repository that users check out revisions from. There can be a central one, but it’s not a requirement. Every use has a complete copy of the entire repository on his system at any one time.

I’m only (intimately) familiar with SVN. So you can read more on the differences between Git and SVN. They range from faster processing, due to the fact that everything is local; to reduced disk space usage by Git.

Personally, Git is a great choice for my type of work. Sometimes, I just want to have Version Control in one directory for one project. I don’t want to get messy with all the central repositories and servers and everything like that. Also, if you travel, you just slap that entire folder on a USB drive and take it to any other computer and continue working. If that computer has Git installed, you can perform your commits or you can wait to commit when you reach home.

Let’s Get Started – Installation and Setup

First off, let me apologize to the Linux users. I found one simple git tutorial for Ubuntu. Everything else pointed to building from source. I guess that’s not that hard.

Windows and OS X users are in luck. There are prepackaged installers for both systems.

For Windows, download the msysgit package and you’re ready to go. If you think you need more of a UI you can get TortoiseGit, which is a shell extension for Windows Explorer. One plus I’ve noticed with this tool is that it has a great diff viewer. Be advised: I’ve been warned that git is slower on a Windows system, so you might want to avoid Windows for those huge projects.

OS X users also have a great option: OS X Git Installer. Or you can build from source like the other Linux users.

There’s not much to set up after that. Most of the Git usage is from the command line, so there’s no need for any other fancy tools.

Now, there are a ton of tutorials out there on how to get started, so I’m not going to bore you with that, but I will highlight some of the things I’ve found.

Hosting Remote Repositories

One of the great advantages I’ve found with Git is that it doesn’t need a central or remote repository. That’s great if you don’t need to work offline. However, that’s not to say it can’t have one.

I’m sure everyone has heard of GitHub. This is, by far, the major Git hosting service. But, there are limitations (of course). Their free plan doesn’t allow private projects and it’s limited to 300 MB in size. There are some other places where you can host Git projects, however if you already pay for a web hosting service you may have all you need.

The only requirement is that the service allows SSH shell access. After that, you’re good to go. There’s a lovely tutorial on how to install git on a shared host. Even if you don’t want to read the tutorial, you can just copy and paste the commands.

Currently, I’m on HostMonster‘s hosting service for $8/month. So tacking Git onto that already existing host just made sense.

Git Work Flow (And Modification) I’ve Adopted

Some time ago, I stumbled across this article on web based work flow for Git.

The key idea in this system is that the web site exists on the server as a pair of repositories; a bare repository alongside a conventional repository containing the live site. Two simple Git hooks link the pair, automatically pushing and pulling changes between them.

It’s actually a great idea. You have one central repository or hub and one “live” site. The hub has is a bare repository; it has no workspace and you can’t checkout any files. The prime, however, has it’s own work space, which hosts your live site.

When you push into the hub the hooks (set article for setup) automatically push those changes over to the prime or live repository. Likewise, the prime has hooks that function when a commit is done: they push changes back to the hub. So ideally, all your major development would be pushed to the hub which, in turn, pushes those changes to the live site. Now if you make a one off change to the live site (who says that never happens) you can hit commit and it will push those changes back to your hub.

I don’t need that level of automation for what I’m doing. So, I do have a central repository, however, I push to my live site directly. I have a branch in my project called live when I merge or rebase stuff from master into. I think push this branch to the live site. My live site has a hook that does a simple git reset --HARD in the working directory to update everything.

That’s all I got for now.

• Installing A LAMP Web Server System With Fedora Core 6
• Automate MySQL Database Backup With WebCron – No Cron Jobs? No Problem – Part 1
• Should A Business Use Free Web Hosting?
• InsaneGB Review – Free Web Server 5GB Disk Space, 20GB Bandwidth
• Finally We’ve Moved To DreamHost – Quality Web Hosting

Fiona King presents 10 Best Ruby/RoR Web Hosts Compared ? 2009 posted at WHDb.

general

Marcus Hochstadt presents Using A CMS For A Content-Rich Website posted at Marcus Hochstadt, saying, “Marcus describes how he migrated one of his static HTML sites into a Content Management System. Which platform did he choose and why?”

javascript

Jason Maletsky presents Show Partial Content, Slide Animate with jQuery posted at Website Builders Resource, saying, “This plugin will show a partial amount of content from a and allow the user to click a link from the title or a link at the bottom to view the rest of the content with a sliding action.”

That concludes this edition. Submit your blog article to the next edition of Web Development 2.0 using our carnival submission form. Past posts and future hosts can be found on our blog carnival index page.

Technorati tags: web development 2.0, blog carnival.

• Web Development 2.0 Carnival – November 21, 2008
• Web Development 2.0 Carnival – September 24, 2007
• Web Development 2.0 Carnival – September 8, 2007
• The Secret of CakePHP Advanced Routing – Even Better URLs
• Website Promotion with DiscountClick

So I’m sitting here last night minding my own business and Chris Coyier sends out a tweet talking about how it took him 10 minutes to upgrade. So I figure, why not? I already had the WordPress Automatic Upgrade plugin ready to go, so I figured it would be a breeze. I guess I was wrong.

What Went Wrong

So I follow all the steps in the automatic upgrade. Everything seems to be going fine, however after the database upgrade I was bumped back into the admin screen. Everything was looking totally screwed up. Icons were scattered all over, colors were wrong, things were positioned incorrectly. It basically looked like the CSS style sheet was screwed up for some reason.

So I figured that my CSS and possibly JS files are still cached on my browser and that’s what causing the problem. So I did a screen refresh; nothing. I did a forced refresh; nothing. I cleared the cache; nothing. I cleared all the cookies; nothing. I started up Internet Explorer; nothing.

So the obvious answer was that something was wrong with the automatic upgrade plugin. I spent the next 20 minutes installing manually (twice) just to get back to scare one. Maybe it was the host? Maybe it was my machine? Maybe my internet connection?

What Actually Happened – My Server Setup, That’s What

Now I need to brief you a lil’ bit on the stuff I have set up on my server.

Some time ago, I was researching serving up compressed (Gzipped) data from my blog. Now I think WordPress has an option for this, at least they used to. Regardless, I use WP-SuperCache and I know that it has that functionality. However, what would really be great is if I could gzip my CSS and JS files. That’s what paying too much attention to Website Grader does to you.

The first problem is that my current host doesn’t support mod_gzip. Therefore I had to use a less elegant method. I didn’t want to use any PHP method, since I figured that would be too much work for the server. So, this is my setup (don’t worry, I’ll most details later):

• Setup Apache rewrites to point all JS and CSS files to js.gz and css.gz if available. Here, I also set expires headers for way in the future.
• Download and compile minifying script
• Gzip minified scripts
• Set up the above in a daily cron job

Now, those of you chuckling right now, have seen huge mess that this is going to develop into. Basically, I make the server serve up compressed versions of the stles and JavaScript if available.

So, after doing the WordPress upgrade, although I had brand. new .css and .js files, my .js.gz and .css.gz files were still from WordPress 2.6.5. No wonder my admin screen was in a mess.

Sorry for blaming you, Mr. 2.7. So far everything looks great, I must say.

• InsaneGB Review – Free Web Server 5GB Disk Space, 20GB Bandwidth
• Yay! WordPress 2.5. Almost Perfect
• Moving WordPress To A Different Domain
• FeedBurner + Google search cache = Instant Blog Back Up
• CakePHP Installation Guide: Just Add Water and 2 Medium Eggs

Dereck presents My Google Penalty and My Response posted at I Will Not Die.

Sly presents 5 Search Engine Optimization Tips for WordPress Blogs posted at Slyvisions dot Com.

Although I’m more or less devoted to CakePHP as my PHP Frameowrk, it’s also good to diversify sometimes. Greg Allard presents Quick Thumbnails in Django posted at Code Spatter.

Margaret Garcia presents Top 20 iPhone Apps for Entrepreneurs posted at Web Design Schools Guide.

That concludes this edition. Submit your blog article to the next edition of Web Development 2 using our carnival submission form. Past posts and future hosts can be found on our blog carnival index page.

Technorati tags: web development 2, blog carnival.

• Web Development 2.0 Carnival – December 26, 2008
• Web Development 2.0 Carnival – September 24, 2007
• Web Development 2.0 Carnival – September 8, 2007
• HTML Tutorial
• Fixing the Back Button and Enabling Bookmarking for AJAX Apps

Reasonable Requirements

Now some of these requirements I can understand. Some of them are actually reasonable. I can deal with a minimum length; although these days they seem to be getting longer than eight (8) characters.

I just don’t think that I need this type of protection. Although I don’t use the same password for every website (any more, lol). Currently, I use an algorithm to generate a password for a new site. It’s a combination of a common stem or base and appending the service name that I’m logging into (eg. Yahoo, Gmail, etc.)

My Problem With Requirements

Currently, my stem only consists of lowercase letters and numbers. I know it’s not the most secure base, but it’s long enough and it serves the purpose. What I can’t stand is a site that needs me to enter a special character or an upper case character.

Call me crazy, I just hate having to hit the stupid <Shift> key when I need to be typing in a password. Hell, I hate holding down the shift key, period. So for all you website administrators out there, please don’t force me to do anything I don’t want to. The only thing this results in, is me forgetting my password the next time I come to your site.

• Microsoft, Yahoo, and Zimbra Releaseing New Ajax Powered Webmail
• JavaScript Only Links, Why? Someone Tell Me Why, Please
• Spell Out a Detailed Contract
• CakePHP Installation Guide: Just Add Water and 2 Medium Eggs
• 6 Places to Use Ajax

The Problem

But the other day, I decided to open a second account with HSBC and I got the following error:

A Technical Error Has Occurred

I was only trying to transfer money from one account to another, I didn’t get it. So I figured there must be some problem with the website right? So I wait it out for a few days to let them fix their problem. But alas, the next time I checked, same problem. So finally, I decided to write their Tech Support and I got the following back in a lovely email:

Recently our website had some updates that your Internet browser may not
yet recognize.  As such, please delete your browser’s cookies and
temporary Internet files and attempt the transfer again.   If you are
still unable to perform the transfer, please contact us at the number
below so that we may help troubleshoot the problem.

The following are HSBC-supported browsers:

Windows:
Internet Explorer – versions 6.0 and 7.0
Mozilla/FireFox ? version 1.5 and 2.0

Macintosh:
Safari ? version 2.0

So I followed the instructions: I cleared my cache and deleted my cookies (even though it pained me), but it still didn’t work. I sat there and scratched my head for a minute before I finally realized what the heck was going on. Then I loaded up my copy of Internet Explorer 7.0 and did a transfer with no problems. Then I read the rest of the email. Yep, the recent updates to the website were not compatible with Firefox 3.0. Now I don’t understand something, because it’s not like there was any fancy AJAX functions. I just click the button that says transfer.  Later I found a link to HSBC’s Support Page and found this remedy to my problem:

1) Keep your browser up-to-date.
HSBC Direct website supports MS Internet Explorer 5.5 SP4 or higher.
Currently HSBC Direct website does not support other web browsers such Firefox & Mozilla, Please use MS Internet Explorer and keep your computer & browser up-to-date.

So, let me get this straight, I need to keep my browser updated, but not too updated. OK, HSBC.

What I Think Happened

So let me take a wild crack at what happened, some executives at HSBC made the decision for the new updates on the website and they insisted that the developers support older browsers; IE 6, for example. Usually, there’s not much wrong with this if it’s done right. They got away with some hackish code that seems to work for what they had at the time, then Fireofx 3.0 came out with this strange idea called standards compliance and just messed up their whole backwards compatible world.

Again, let me point of this is what I think happened, but this is a classic reason, why we should be supporting better standards for web development.

But all of this is easier said than done. Before going down any path, you need to examine your market before making such decisions. But you also need to consider future markets. How much is it going to cost to fix this lil boo boo? Possibly a lot. Are they going to fix it anytime soon? I’m guessing no. I don’t think Firefox 3.0 (seeing, that it’s just a few months old) has any sort of market share that they are going to care much. So all you Linux and Mac users better not follow all those upgrade warnings for your browser. You won’t be able to transfer funds. Typical example of powerful people in expensive suits making decisions about technology.

What Should Be Done

Now, I’m not anti-Microsoft or even anti-IE-6, but I am anti-stuff-that-wastes-my-time. The problem isn’t IE 6 per say. IE 6 had a purpose, back in 2001 and (for the most part) it fulfilled that purpose. The real problem is that we’re trying to implement 2008 technology on a 7 year old platform. You don’t really see this many other places in the tech world. New software comes out and you don’t have enough RAM, then tough nuts, you need to upgrade. Microsoft is notorious for this actually. SQL Server 2005 refuses to restore a backup fro SQL Server 2000, and they say tough nuts. The brand new Call of Duty 4 for the XBox 360 (I assume) won’t run on a regular XBox will it? Nor do PS3 games work on PS2 and Nintendo Wii games don’t work on a Gamecube. So I’m really tired of hearing this crap about IE 6 is being pushed by the market and not the industry. The industry controls the market. A lot of IE 6 users don’t really know any better. They got IE 6 and people make accommodations for them in the name of backwards compatibility.

Now, I’ve heard people say that all this browser compatibility issues is due to “developer whining”. And, they’d be right to a certain extent. But what very few realize, is that developer whining often translates directly to a dollar figure. The more time that goes into patching crappy, workaround code for older browsers; the less time that’s being spent on new development and fixing legitimate bugs. And when some HSBC-like snafu happens, someone needs to fix it. Now plain out boycott is a bit harsh. There are some people that can’t upgrade for good reason (the folks in the cooperate office with the older PCs that they don’t have rights to install stuff on). But I’m much in support of the gentle nudge approach like is done on Save The Developers:

<script src="http://www.savethedevelopers.org/say.no.to.ie.6.js"></script>

This brings up a nice lil’ AJAX-ish looking slide down image in the upper right corner with the details on why the user should upgrade. And no, it’s not a ploy to push Firefox. The first link on the page is to download IE 7. Even though, I’m a Firefox lover, I might not be using it if I started browsing with IE 7. To be honest, tabbed browsing is what did it for me. It had nothing to do with compatibility, with code, etc; because at that time I didn’t know better and didn’t care.

Now as a developer, I would love to see a boycott, but that’s not realistic; because like it or not, IE 6.0 still has a large grasp (at least 25%) on the market. However, I do explain the problems with IE 6.0 and I explain to them why it’s going to take more time and cost more to develop for. It’s simple Math: it takes time to do all those JavaScript and CSS hacks.

So we need to cuddling the users of Internet Explorer 6.0: ween them off the bottle, get the thumb out of their mouth, get them off the tit and on some formula. All IE 6.0 users, it’s time to ditch the Pampers a get some Big Boy Pants. 2001 was a long time ago, in the life of web technology, it’s time to grow up.

• 5 Ways To Annoy Your Audience
• Internet Explorer 8 – The Drama Begins
• Make Your Web Site Not Suck In Internet Explorer – IE CSS Min-Height Hack
• Browsers Have Multiple Personalities, Your Designs Should Too
• Blog Theme Designers Given Up on IE 6?

My Set Up

I won’t go into detail, but I think being on Dreamhost has something to do with it, because trying all this on my local PC with XAMPP Lite on Windows XP.

Here’s What I Tried

In addition to trying all of the above on my existing blogs, I’ve tried the fresh install approach. I installed a fresh copy of WordPress and then bit by bit, I copied in database tables. All seemed to go fine, for a while, then (for some reason) I would just get that error again. It didn’t matter what the browswer was either. When I attempt to insert an image the screen would blank out.

Here’s The Problem

I noticed that the stuff would always break when I copied over the options table to my WordPress database. So after many, many hours and copying records (almost) one by one into the newly installed WordPress database, I’ve finally narrowed it down. The WordPress address (URL) needs to be all lowercase or else the thing just doesn’t work. I don’t really have an explanation for it and frankly, after all this time, I don’t really care; I’m just happy it finally works.

Now, I suppose that it’s my fault for wanting fancy looking URLs, so I take the blame.

Hope everyone else finds this helpful.

• WordPress Installed
• Comment Relish Plugin + High CPU Usage – Fixed The Right Way
• Moving WordPress To A Different Domain
• One Down Two To Go
• Yay! WordPress 2.5. Almost Perfect

Now, I’m having mixed emotions about this. On one hand, I’m happy that people are finally putting the nail in IE 6.0′s coffin. However, I’m slightly pissed that I can’t use these themes. I, more than anyone, should know the reasons why we should abaondon IE 6.0 and move on to better, more productive web development and enjoyment. But, the purist in me still doesn’t want to leave the poor saps who are trapped behind the veil (whether is by software contraints or ignorance) of Internet Explorer 6.0 behind.

Browser statistics show that IE 6 still maintains between 26% and 37% of the web browser market. Right now, that’s just too many people to ignore.

• I Hate Internet Explorer 6.0 Even More
• IE Hack: CSS Centering – Another Reason I Hate Internet Explorer
• 5 Ways To Annoy Your Audience
• LinkMania: January 18, 2007
• Internet Explorer 8 – The Drama Begins

They Say PHP Sucks

You’ll hear the same claims every single time: “Google PHP Sucks you’ll see how much PHP sucks”. Oh please! This is some of what the haters usually use for the argument:

• “There are too many functions“
• PHP Isn’t OOP
• Everything is strung together – This claim usually talks about the interaction between PHP and/or SQL

In Defense of PHP

The number one claim is that everything in PHP feels like it’s clunky and may fall apart at any time. Granted, I’ll be the first to admit that I hate boring SQL queries. Keyword here is boring. Within the past year, I’ve really gotten to see that SQL has a lot of power. Learning of all of awesome power, just makes me hate writing crap like:

select title, body, post_date from posts where id = 32

Functions, Functions, Functions

I, myself, have never really understood the “too many functions” argument. Maybe it does make the documentation a bit muggy to get through, but how many functions that are in there have very little to do with me. I don’t care, I just use a handful of them.

PHP is OPP – That’s All There Is To It

We need to make a distinction here: PHP 5 is Object Oriented. The problem is a lot of PHP code that you can find out there isn’t. PHP has this classic gift and a curse: it makes it damn easy to get something functional out the door in a hurry.

I mean, I’d love to see a bit more OOP, but that’s an implementation issue. And the piles of arrays for data storage are a lil’ bit of a pain, but again, that’s an implementation issue.

PHP Is Not A Framework – Get Over It

Now, I know what you’re thinking: “Baz, you’re a lazy bastard, that’s isn’t so hard to write”. And you’re be totally right. But after the 25th time writing this or some simple variation of this, you can’t help but feel that you’re wasting your time. Now here’s the kicker: This isn’t a problem isolated to PHP. Most other programming languages (listen to me well: Programming Languages) suffer the same fate. You’re going to see SQL strung out throughout code in any language, I don’t see why people keep blaming PHP for this.

This is a classic in the PHP vs. Rails saga. Haters often compare PHP, a simple programming (scripting even) language to a very complex web development framework. I don’t care what you say, but that’s like comparing a factory stock model car to a car with 2 years of work and $20,000 of after market parts. Luckily, the folks at Rails Envy have made an attempt at clearing this up with their mention of CakePHP:

Time To Take Responsibility

As programmers and web developers, I think it’s time to take a lil’ bit of responsibility for the type of code we write. I don’t know about you, but regardless of the language, I can write some very nasty code. It all depends on the frame of mind. I’ve seen varying levels of PHP code: I’ve seen dozens and dozens of code blocks (not functions) in one index.php file. I’ve also seen nice, clean, refactored, DRY code.

Granted, PHP makes it a bit easier to be lazy, but do we blame the language for that? Come on guys, let’s put on our big boy pants, read a book about code design, and apply it to any language that you’re coding in. PHP powers some of the largest sites on the internet, someone’s doing it right. Stop being mad because you can’t. Stop using the programming language as a crutch and learn how to apply proper coding techniques to any language.

Bottom Line:

Some of the largest sites on the internet — sites you probably interact with on a daily basis — are written in PHP. If PHP sucks so profoundly, why is it powering so much of the internet?

The only conclusion I can draw is that building a compelling application is far more important than choice of language. While PHP wouldn’t be my choice, and if pressed, I might argue that it should never be the choice for any rational human being sitting in front of a computer, I can’t argue with the results.

Source: PHP Sucks, But It Doesn’t Matter [Coding Horror]

• PHP vs. VB6
• To Suck or Not to Suck, That is Question for JavaScript
• Steal Browser History with SpyJax
• CakePHP vs. Ruby On Rails – A Very Bias Look at Why I Choose CakePHP
• Ten Reasons to Learn C (not C++)

As of Changeset 6918 this has now been integrated into the CakePHP core. So, we’ll have something to look forward to in the official release of CakePHP 1.2. Mind you, there may be a lot of other hidden gems in there, I just haven’t been paying attention lately .

Most of the functionality is as we remember, with a few exceptions:

• $this->Article->restrict(‘Comment’) now becomes
  $this->Article->contain(‘Comment’)
• $this->Article->find(‘all’, array(‘restrict’ => array(‘User’))); turns into
  $this->Article->find(‘all’, array(‘contain’ => array(‘User’)));

For a complete list of the differences and changes you can check out the
Containable Test Cases for excellent examples of how to use this to it’s full potential.

• Cute CakePHP Trick of the Day – GenerateList Empty Slot In List
• WYBISYG – What You Bake Is What You Get – CakePHP + FCKEditor
• CakePHP Auth Component For Dummies Tutorial
• Web Development vs. Desktop Development
• CakePHP Contact Form – Quick and Dirty

[Shameless Plug]

Enter 3HN Designs.com

3HN Designs comprises of a group of, you guessed it, three (3) developers that have a common goal: to provide quality designs at an affordable price.

Services Provided include:

• Website Design
• Web Application Development
• Logos
• Search Engine Optimization
• etc.

They offer static web design, along with a custom CMS approach and other forum, gallery, and shopping cart scripts.

Under The Hood

So what does the finished product comprise of? Well it depends on what you pay for. At the base price of $500.00, you’ll come away with a nice, fresh looking XHTML/CSS web site that you can mangle to your hearts content.

If you choose to shell out a lil’ bit more, you get something a little more flexible, in that it’s dynamic and you can edit a change the content at your leisure. Now this is my favorite part: it’s written in CakePHP. Nothing flashy, just a editable regions using FCKEditor or TinyMCE. There are also some nice generic options that can be changed, such as: site name, contact email address (for the contact form), etc.

So, if you’re in over your head on a project or you just don’t have the time to deal with a website right now, head over to 3HN Designs for Quality Website Design

[/Shameless Plug]

P.S. I say they because it’s a little bit less shameless then we

• Spell Out a Detailed Contract
• Content Management Systems
• Weebly Editor – Web 2.0 WYSIWYG Editor
• Dclick Ads – Another Quick Start Up Advertising Site
• SEO Inc – Search Engine Optimization Company

With all the Twitter Rails scaling issues, it’s funny to see this headline from TechCrunch. Guys over at Twitter have renounced this claim though.

Will this make me abandon my quest for learning Ruby on Rails? I highly doubt it. Scaling becomes an issue on extremely high traffic sites. And a lot of the issues that come into play with such a high traffic site, can be easily remedied by things like optimizing queries and caching.

Source: Twitter Said To Be Abandoning Ruby on Rails [TechCrunch]

• Do We Not Understand What Bias Means?
• The Top Five Technologies You Need to Know About In 2007
• CakePHP vs. Ruby On Rails – A Very Bias Look at Why I Choose CakePHP
• Stop Hating On PHP And Learn To Code Better
• Enter CakePHP – Rapid Development Framework – No Really!

To all the folks that haven’t seem to understand my whole objective, let me help you guys out. I have general interests in a lot of areas and I also work a 9 to 5 job. So I don’t really have the time and dedication required to poor my heart and sole into everything that comes along. I do a brief overview of something before I spend tons of time delving into it. People are pissed that I’m comparing CakePHP to Ruby on Rails and haven’t even tried it yet. This is where the brief overview comes in; I took a quick look and realized that for what I was doing at the time, Ruby on Rails would have been more trouble that it was worth.

Furthermore, the title of the post said “Bais Look”. I state all the reasons, why I pick CakePHP. The first one is that I’m lazy. Again, whatever I do is for a purpose. Other than general interests, I just don’t have time to sit and pour over every framework. Where does it end? CakePHP, Ruby on Rails, etc? I’m not an overactive hobbyist. I take a quick look at things that spark my general interests, then figure out how to make the best of use of them. But I’m aware that a lot of people have different opinions and people are passionate about their opinions. So, you guys are excused .
With that said, I’m sorry to disappoint either the CakePHP or Ruby on Rails community (depending on how you look at it, lol). I’ve started a project lately, for which I think I required the stability, establishment, and huge resource of plugins, etc that Ruby on Rails has to offer. Also, they got a a few books and it never hurts to broaden your horizons. At least when I mention Ruby on Rails to a potential employer, they’ll know what I’m talking about. But regardless of what you like, what you’re passionate about, or why you use what you use; remember this: No One Cares. It’s all about what you do with it.

• Enter CakePHP – Rapid Development Framework – No Really!
• Your Choice of Web Development Framework Doesn’t Matter
• Poll Results – What Do You Look for in a PHP Framework?
• Twitter to Bite the PHP Bullet?
• CakePHP vs. Ruby On Rails – A Very Bias Look at Why I Choose CakePHP

So I go through the process and I’m not totally disappointed. There were the normal problems we have with all upgrades and some new ones:

• Theme Issues: This only happened on one of my blogs. Heck, it’s an old theme, so that’s to be expected. The widgets didn’t quite work right, but it was fixable.
• Plugin Issues: Of course there will be those. Some plugins haven’t been updated yet, some just required me to update them. And with the new plugin update feature, it was quite easy to fix these problems. Then, there are some plugins I just had to totally disable, but upgrades for these are coming out everyday. I’m down to one old plugin that hasn’t been updated yet.
• Admin Changes: They decided to redesign the way the administrative section looks and operates. They moved around some stuff in Write section to make it cleaner. But by far, the worst thing they did is switch to a fixed width format; ugh. But nothing that couldn’t be fixed with a quick plugin (Remove Max Width).
• Image Stuff: There is a multi-image Flash uploader and some new gallery features, but I’m not a big picture guy, so

Should Have Waited for Service Pack 1

Everything looks all nice and slick, but after a few days I began to regret my choice. The way images have been inserted is rather different: You need to click media button, the click Gallery, then click and image, then click Insert Into Post. Once you’ve done that, the media window closes. Some people are pissed by this new change since it makes inserting multiple images a pain in the ass. That stupid media window isn’t exactly light on resources.

Now this is when it does work. There are three (3) blogs that I manage and for some ridiculous reason, the Insert Into Post button does me the great pleasure of clearing the media window, hence I can’t insert any of my images. I’ve Googled this issue and some people point to problematic plugins and such. The funny thing is, I event went the step of deactivating all plugins on the blog, with no success. So WordPress 2.5, what gives? Using Firebug I’ve been able to catch the error that happens:

uncaught exception: Permission denied to get property Window.send_to_editor

I guess I was too eager. Hopefully, someone is rapidly working on 2.5.1.

• Yay! WordPress 2.5. Almost Perfect
• WordPress 2.5+ Upload Image Error – Finally Fixed!
• Top 10 CSS Image Galleries – DIY
• I Hate Internet Explorer With A Passion
• How To Make PayPerPost and Google Adsense Play Nice – MightyAdsense Plugin Hack

With a Remember Me cookie, you hit the lil’ checkbox and it stores a lil’ cookie on the user’s computer. This cookie can contain various information (we’ll get to that later) but it essentially enables the user to bypass the login process the next time he comes to the page requiring authentication.

So, the simplest way to proceed is to list changes by file, so strap in your seat belts, here goes.

The Obvious, The Login Form – login.ctp

Now of course you need to add the checkbox and a label for said checkbox. Simple enough:

echo $form->checkbox('remember_me');
echo $form->label('remember_me');
...
OR
echo $form->input('remember_me', array('label' => 'Remember Me', 'type' => 'checkbox'));

The top is my preference since it places the checkbox before the label. Just a personal choice.

Implementing the “Remember Me” Cookie – users_controller.php

Here’s where all the fun takes place. First off don’t forget to include the Cookie component in the $components array. Now, remember that blank function login(), well this is where we dump all the magic:

function login() {
	//-- code inside this function will execute only when autoRedirect was set to false (i.e. in a beforeFilter).
	if ($this->Auth->user()) {
		if (!empty($this->data) && $this->data['User']['remember_me']) {
			$cookie = array();
			$cookie['username'] = $this->data['User']['username'];
			$cookie['password'] = $this->data['User']['password'];
			$this->Cookie->write('Auth.User', $cookie, true, '+2 weeks');
			unset($this->data['User']['remember_me']);
		}
		$this->redirect($this->Auth->redirect());
	}
	if (empty($this->data)) {
		$cookie = $this->Cookie->read('Auth.User');
		if (!is_null($cookie)) {
			if ($this->Auth->login($cookie)) {
				//  Clear auth message, just in case we use it.
				$this->Session->del('Message.auth');
				$this->redirect($this->Auth->redirect());
			} else { // Delete invalid Cookie
				$this->Cookie->del('Auth.User');
			}
		}
	}
}

This login() function is run every time a user accesses a page that needs authentication (I think ). When this is blank and authRedirect set to true, the Auth Component works its magic and determines what needs to be done if the user is already logged in and if he’s not. But, since we wanna do fancy stuff, we need to implement it ourselves.

Writing the Remember Me Cookie

We first check if the user is logged in, by checking $this->Auth->user(). If he is, we check $this->data for the Remember Me checkbox. Now, if $this->data does not exist that means that the user has already been logged in; that is he’s not coming from the login form, therefore we just redirect. However, if $this->data exists we’re coming from the login form AND if the remember me button was checked, we proceed to do cookie magic.

We set up an array for storing the username and password, pull that information from $this->data, then we write this to the cookie on the user’s computer. That’s it. (I see an unset() for the remember me cookie. To be honest, I can’t remember why we do this. lol). Now before you get your panties all in a bunch about saving passwords to the user’s browser, consider these points:

1. The password field we’re using here has already been hashed by the Auth Component
2. The Cookie is written with further hashing
3. There’s an alternative that we’ll discuss a lil’ bit later

One thing you should be aware of: With this implementation the $cookie array needs to have the association match those in $this->data['User']. What I mean is, if in $this->data you have ‘uname’ and ‘passwd’, then the cookie array, then the $coolie array must match these with it’s associations or else the login function won’t work.

So that’s writing the cookie. We use this cookie in the next if block.

“Me Want Cookie” – Login The User from The Cookie

As I said before, Auth runs this login() function every time we try to access an authenticated page. If the user is NOT logged in ($this->Auth->user() is false), then we attempt to read the cookie from the user’s browser. If the cookie was read successfully, we force a login of that user using $this->Auth->login($cookie).

If the login() is successful we need to do a lil’ bit of cleanup. As far as the Auth component is concerned, the user isn’t authorized to view the page and it has already populated the error in the Session, so we need to manually delete this error message: $this->Session->del(‘Message.auth’);

The Alternative I Spoke About

In general (meaning, outside the realm of just CakePHP) there is the feeling that we should not be storing any sensitive information in a cookie. Let’s stick a pin in that for now. So, if you really don’t want to, there’s an alternative: You can simply store the user ID in the cookie. The login() function would be modified as follows:

• Write UserID only: $cookie = $this->Auth->user(‘id’); No usernames and passwords involved (happy now?)

Now here’s how this works. The function $this->Auth->login($cookie) checks the parameter we pass. If we pass an array of username and password, then it does a basic login, which translates to a find() in the database for that username and password combination. If we pass a numeric parameter (as in just a user id) it does a find for that user id in the database. So, here’s an example to illustrate:

Library Scenario
User logs in at the library and hits remember me (he shouldn’t, but oh well, he did). That cookie is written to the browser. Then he goes home and finds out that someone has been fiddling with his account, so he changes his password. With the first method, the library folk’s login attempt will fail, then the Cookie would be deleted (even if it’s not deleted, subsequent attempts would just fail until the cookie expires).

Now with the second method, all we login with is a user id. Whether or not the password is changed, folks at the library will still have free reign over his account as long as his ID remains the same (and we all know that IDs don’t change just like that) and the cookie is still active. Suddenly, storing a hashed password doesn’t seem so insecure now, does it?

Of course, the point can be argued that even with the password hash, the user could (in theory) hack the cookie and replace all that hashed stuff with a plain text user ID and Auth will force a login anyway. We could do a bit of checking before we pass the $cookie variable to the login() function. We could ensure that it has a username and password portion, but all of this cookie hacking stuff is out of the scope of this tutorial and generally leads to the answer of no remember me cookies period. But regardless, CakePHP’s cookie routine uses basic hash encryption, which is hashed with the application’s SALT value, so cookie hacking in CakePHP is going to be a task, but nothing’s impossible right?

No More Cookie – Don’t Forget To Cleanup

We need to ensure that cookies are cleaned up when the user logs out, so just add the line $this->Cookie->del(‘Auth.User’); to your logout() function.

Last but Not Least – beforeFilter()

Maybe this shouldn’t have been left for last, but there is a method to my madness. So, we’ve just set up this awesome set of routines and we send cookies left and right and do auto logins and we feel great, but then it doesn’t work and we wonder why.

As you’ll see in the commented code above, we need to set $this->Auth->autoRedirect = false in a beforeFilter() somewhere or else Auth doesn’t run anything in our tricked out login() function. Hence the reasons for all the manual redirects.

So, you now have all the information required to make this work. Enjoy.

Note, this tutorial is taken from something I’ve submitted to the CakePHP Book, some time ago. By far, this is now the main reference for anything CakePHP. Please check out the Authentication Section for more details.

• CakePHP Auth Component For Dummies Tutorial
• CakePHP Auth Component – Tutorial Two
• CakePHP Contact Form – Quick and Dirty
• Bindable Behavior Now In CakePHP Core
• phpBB 2.0.18 released

• New fresh Admin theme
• Nice Dashboard
• You can modify the link for “Incoming Links”. Technorati anyone?
• Finally included Tag Management
• Concurrent Post Editing Protection
• One Click Plugin upgrades. Oh yes. It’s about time.
• Built in Gallery
• Nice Flash Media Uploader

There’s just ONE thing that rubs me the wrong way.

They’ve gone an given the admin theme a fixed width layout, designed for a 1024px monitor. Why, WordPress, why? This is really a pain, after I decided to get (not one, but) two 19″ Wide Screen LCD monitors. Luckily, there’s a plugin that puts things back into perspective.

• WordPress 2.5 – The Vista of Blog Platforms
• Why My WordPress 2.7 Install “Failed”
• I Think I Owe IE 6 An Apology, Nah.
• Fixed vs. Fluid Layouts and Screen Resolutions
• WordPress Installed