1. It would require me to learn another programming language.
2. I would have multiple applications to maintain instead of just one.
3. What about other mobile devices (the iPhone isn’t the only  one)?

These questions and some new frameworks have forced me to make a decision.  Being a single developer for HiddenWord.org, I just can’t justify developing multiple applications and maintaining them by myself.  That’s why I’ve decided to just keep my web application on the web.  It will be easy enough to make a mobile version of the application that will hopefully work on all mobile devices and I still have one application to maintain.  I plan on testing out jQuery Mobile to do this.  Check it out.  It looks promising.

This way I have a web application that works in your desktop browser and at the same time is optimized for a number of mobile operating systems.

Secure Pages in Content Management

One of the things I’ve been working on a lot in the last several years is Content Management Systems.  I would like to expand our systems to allow truly secure pages.  In this case if someone needed a secure page they could simply create that through the system.  They would be asked to create a password for the page.  The idea would be that the data itself is encrypted in the database and can only be decrypted if the proper password is entered.  Permissions to the page would also be controlled by an Access Control List, which is something I’ve already done with the current systems I’ve worked on.  I’ve thought about ways to use that data to help encrypt the real data even further.

Encrypting Data on my System

One of the other things I would like to do is write a small application that would allow me to encrypt data right on my system.  I’ve looked into ways to use PHP (something I’m already familiar with) to write a desktop application.  The application might be a CLI application that could be compiled into machine code, running a sqlite database (not sure if there is way to make that a part of the compiled program or not).  The application would simply let me enter some information, like passwords, and store it all encrypted right on my system.

I thinking about playing around with writing this and when I am done I might release it for free.  Let me know if you would be interested in such a tool.

Compass is a lot like Less that I talked about in my previous article.  What I liked about Compass more is that it has different CSS frameworks already built in.  Compass has Blueprint built into it, as well as YUI and others.  Compass makes it really easy to integrate that into your project.

How Does Compass Work

Compass compiles it’s style sheets from Sass, which requires Ruby.  When you save you .sass file it will compile the .css file.  In your sass files you can use variables and mixins (which are set of style properties that are applied to basically a variable that can be applied to any other CSS element).

How does Compass relate to Object Oriented CSS

Here is where it gets a little tricky.  The idea of re-using styles is totally possible with Compass.  However the actual style sheet that is compiled from source can get really fat, really fast.  For every single page you have a separate set of styles.  It doesn’t really go along with the idea of keeping you style sheets small for really large sites, like I talked about in my previous article about CSS development.

What does all this mean?  For each developer it may have different meanings.  The pros of compass is that you are truly keeping your presentation separate from your content, which is the recommended web standard approach.  If you are going to use Compass you will have to find that balance between large websites and keeping your style sheets small.  I like Compass and I’m going to use it.  However I’m finding out real fast that my style sheet is growing pretty big.  I can still use the normal class styles in the blueprint framework.  Using those classes for layout can help in keeping my style sheet smaller.  On our intranet we are using the blueprint classes on forms to keep the style sheet smaller, yet building the core page layouts into the style sheet.

I recommend Compass as it’s an easy way to manage your style sheet source and make global changes.  If you have a large site with a lot of hits, I also recommend finding that balance in keeping your style sheets small.

I wrote a couple of articles about a year ago describing an idea I had for implementing security into a CakePHP app to insure that cross site scripting attacks don’t get though.  Just recently I’ve been working on it again for a new app, slightly changing my approach.  Since I’ve never shared all of my code on how I’ve fully implemented and configured my set up with the HTML Purifier, I’m going to do that now.  Of course some of the code I’ve already shared, but this will be all of it together.

I originally had everything set up as a component.  What I want to do is clean everything up before I actually save it to the database.  And I mean everything.  Any data that can be altered from a form should be run through some sort of clean up process, to ensure it’s security.  The problem with having it set up in a component is that in Cake that can only be accessed from a controller, right?  So what I really want is for this clean up process to happen in the background for any data that is saved, without me having to write any extra code in a controller.  That’s when I decided to take my component and move into my AppModel.  I suppose this could be done as a behavior as well, but I’m not real familiar with writing those.

So here is my AppModel:

< ?php
class AppModel extends Model{
 
	function cleanUp($html) {
		App::import('vendor', 'HTMLPurifier', array('file' => '../../vendors/HTMLPurifier.auto.php'));
 
		$config = HTMLPurifier_Config::createDefault();
 
		//The List of Allowed elements and attributes
		//This may be information we want to stick in the database at some point so we can change it on the fly.
		$allowed = 
			"strong,"
			. "em,"
			. "strike,"
			. "p[style],"
			. "ol,"
			. "ul,"
			. "li,"
			. "br,"
			. "sub,"
			. "sup,"
			. "span[style],"
			. "blockquote,"
			. "dd,"
			. "dl,"
			. "dt";
 
		// configuration goes here:
		$config->set('Core.Encoding', 'UTF-8'); // replace with your encoding
		$config->set('HTML.Doctype', 'XHTML 1.0 Transitional'); // replace with your doctype
		$config->set('HTML.DefinitionID', 'myset');
		$config->set('HTML.DefinitionRev', 1);
		//$config->set('Cache', 'DefinitionImpl', null);  //cache disabled for development. remove later!
		$config->set('HTML.Allowed', $allowed);
		//$config->set('HTML', 'EnableAttrID', true);
 
		//CSS configuration
		$config->set('CSS.AllowedProperties', array('text-decoration', 'text-align', 'padding-left', 'color'));
 
		$purifier = new HTMLPurifier($config);
 
		$pure_html = $purifier->purify($html);
 
		return $pure_html;
	}
 
	function stripAll($data) {
		App::import('Sanitize');
 
		if (empty($data)) {
			return $data;
		}
 
		if (is_array($data)) {
			foreach ($data AS $key => $val) {
				$data[$key] = $this->stripAll($val);
			}
			return $data;
		} else {
			$data = Sanitize::html(Sanitize::stripScripts($data), true);
			return $data;
		}
	}
 
}
?>

The first method (cleanup) contains my HTML Purifier configuration.  After everything is initiated, I simply pass it my html and return the purified version.  The second method (stripAll) is one I’ve published before.  This is basically for any content that doesn’t need any html in it.  In my case that’s almost all of the content.

The next thing I needed to do was decide what content gets passed to which method.  I decided to handle this with the beforeSave method in each model.  Here’s a couple of different versions.

Here is my Study model:

function beforeSave() {
	if (isset($this->data['Study']['description'])) {
		$description = $this->cleanUp($this->data['Study']['description']);
	}
	$this->data = $this->stripAll($this->data);
	if (isset($this->data['Study']['description'])) {
	        $this->data['Study']['description'] = $description;
	}
	return true;
}

Here is my User model:

function beforeSave() {
	$this->data = $this->stripAll($this->data);
	return true;
}

The difference in the two models is based on what content I want passed to what method.  In the case of the Study model, the description field can contain html.  So I check to see if it’s being passed and if so run it through the purifier, then clean all the data, and place the purified html data back.  In the case of the User model, I don’t want any of the data to contain html, so strip it all.

The benefits to this approach is that I don’t have to pass all the data to a component from my controller.  I don’t have to remember to do anything if I decide to create a new action that writes data to the database.  In fact, the only time I have to worry about it is if I create a new field in the database and want to allow it to contain html.  Then I have to remember to add an if statement for that field.

I would be interested in knowing every one’s thoughts on performance with this approach.

After a little thought I came up with the possible scenarios for a deployment.

1. Update the Application code
2. Update the core framework code
3. Database change of any type (creating tables, alters, deletes, etc.)

So the main idea here is to have a set of update files that will be used to update the application. We already have a deployment script that works great for the application code.  I’m not going to get into all the details of that, but all it is a Linux shell script that takes a tar file of our application code and unarchives it and replaces the old application code.  The script doesn’t overwrite certain config files, like the database config file and or our core config file. The script also makes sure that that appropriate users, groups, and permissions are all set correctly for the app.  It’s a script that we have worked on gradually over a year or so to perfect it.  It’s pretty solid now and we haven’t had any problem with it lately.  So now the idea is to take that script and modify it some more to add the core framework upgrade.  It will do the same thing as the application code.  If there is an upgrade tar file available for the core framework, then unarchive it and replace it.

Fairly simple, right?  So with one script and one command at the prompt we can upgrade our application code and our core framework without fail.  This is great!

However, then came the real problem, how to handle database changes.  Some database changes are easy, like creating tables, some are not, requiring complex data manipulation that would require a program to modify the data and check for accuracy.  Luckily for us, the framework we chose to use for our application can take care of this if we want it to.  CakePHP has the console, which would simply be a command at the prompt that we could add to our deployment script, that could execute a program for us and handle any database changes that I can think of.

Any database changes that can be done with just sql are kept in a .sql file in CVS.  So our upgrade program will take the sql file and execute it to make any database changes the file contains.  Since we have a program that is executing we can then do any complex data manipulation to guarantee it’s integrity.

Some might see a small downside to this.  The fact that we may possible have a upgrade program that has to be modified for every new deployment, could seem unnecessary.  After all, if we just have a few small application code changes with no database changes, why go through the trouble of an upgrade program?  At least 50% of the time that’s going to be the case for us.  The fact still remains that I don’t want to jump through hoops to make a deployment, possibly forgetting something.  If we have a program that’s tested and checked for accuracy we can be more confident that when it comes to time for the real deployment, every thing’s going to work. The bottom line is that if it’s well thought out our program can look to see what update files are available, so if there is no .sql, we know there is nothing to be done.  This could be a consistent thing that would never have to change.  So the program would be smart enough to know what to do based on what’s provided.  If you don’t need the program to do anything, then it would be programmed to do nothing, which should be easy to do anyway.

Right now some of this is theoretical as I haven’t finished it yet.  I’m sure there is still improvements that can be made too.  But thanks to well designed frameworks, like CakePHP, that allow us to make stuff like this easier.  If anyone is interested, I’ll publish a sample of the deployment code when I’m done with it to show you how it works in more detail.

http://screencast.com/t/xQSSdPGBcI

The BlueprintCSS Framework

First, there is the Blueprint CSS framework.  It provides a solid grid set up and, for me, has made building pages with different layouts a breeze.  I have a set of reusable classes that I don’t have to write additional CSS for when I decide I want to change my layout up, or add a new page with a completely different layout.  It also includes reset styles, styling for forms, and IE bug fixes.

Less

Second, there is Less.  I haven’t actually tried this out yet, but the idea of developing in this fashion is attractive to say the least.  With Less, you can use variables to hold values and then declare those variables in other places.

@brand_color: #4D926F;
 
#header {
    color: @brand_color;
}
 
h2 {
    color: @brand_color;
}

This way when the time comes that you decide you want to change colors, all you have to do is change it in one place in your style sheet.  Less also allows nested rules.

#header {
    color: red;
    a {
        font-weight: bold;
        text-decoration: none;
  }
}

Less requires Ruby and once your styles are written you have to compile them into browser readable CSS files.  So in the case of the above example, your CSS would be compiled into:

#header {
    color: red;
}
 
#header a {
    font-weight: bold;
    text-decoration: none;
}

Object Oriented CSS

Third, I came across this presentation about Object Oriented CSS by Nicole Sullivan.  Nicole Sullivan was a performance guru and Yahoo engineer.  Her job was front end development for high performance sites and applications that would perform well under millions of hits.

OO CSS is an interesting idea where you write code that can be reused over and over again, rather than writing new CSS for every new page that has to be built or every new module that has to be created.  She explains the way we’re currently developing sites is that our style sheets will continue to grow and grow as the life of the site goes on.  With an OO CSS approach it keeps our style sheets leaner and file sizes smaller.

In conclusion, these are a couple of new ways to look at developing our CSS.  It’s also worth noting that frameworks like Blueprint and an Object Oriented CSS approach to developing would allow us to reuse our CSS more effectively and keep files sizes down, making download times and performance better.

For my example, I have two models.   A NewsCategory models and a News model.  NewsCategory hasMany News and News belongsTo NewsCategory.

My Unexpected Results

The query I thought would work didn’t produce the results I expected.  Here is the first find method I had in my NewsCategory Controller.

function index() {
 
	$newsArticles = $this->NewsCategory->find('all', array(
		'contain' => array(
			'News' => array(
				'order' => 'News.created DESC',
				'limit' => 3
			)
		)
	));
 
	$this->set(compact('newsArticles'));
}

I was expecting all of my NewsCategory records with 3 associated News records for each NewsCategory.  What I got was a total of 3 News records, regardless of how many NewsCategory records I had.  So now I had to figure out how I was going to get 3 news records for every returned NewsCategory.

The Solution

I don’t know if this is the best way to achieve me goal, but it worked fine for me.  What I decided to do was create a new method inside my NewsCateogry model.  This model would find my NewsCateogry records then loop through that data and find the News records and merge them back into the data set.  From my controller I just simply called this new method.

function index() {
	$newsItems = $this->NewsCategory->findNewsPage();
	$this->set(compact('newsItems'));
}

Now inside my NewsCategory model is the new method.

function findNewsPage() {
 
	$newsCategories = $this->find('all', array(
		'order' => 'sort_order',
		'recursive' => -1
	));
 
	foreach ($newsCategories AS $key => $val) {
 
		$newsArticles = $this->find('first', array(
			'conditions' => array('id' => $val['NewsCategory']['id']),
			'contain' => array(
				'News' => array(
					'limit' => 3,
					'order' => 'News.created DESC'
				)
			)
		));
		unset($newsArticles['NewsCategory']);
 
		$results[] = Set::merge($newsArticles, $newsCategories[$key]);
 
	}
	return $results;
 
}

And that’s it!  I now get all of my NewsCategory records with 3 News records for each NewsCategory record.  Its worth mentioning that Cakes Set class was a life saver for this task.

The Life

I don’t talk about my personal life as much these days, but we just recently had a new baby boy.  He’s about 7 weeks old now.  That’s one of the things that’s obviously been keeping me busy.

I’ve also been slightly bothered with issues with people’s religious views, or lack there of.  Some suggesting that Christianity, among other religions, have a “heard mentality”.  I would go as far as to say that it’s quite the opposite.  The ones suggesting this would be the ones with the “heard mentality” belief system.  I may talk about this topic more in future posts, but it’s an issue for another time.

The Word

As some of you may have noticed, HiddenWord.org is currently down and it’s been that way for several weeks now.  The time came for me to renew my hosting service and I decided not to do so.  I’m currently rebuilding the app from the ground up (and doing so very slowly).  I couldn’t justify spending more money to keep the old app up and running when the new one is so close to being completed.  I have no time frame for completion, as I’m trying to finish up some other projects first so I can devote full attention to HiddenWord.org.  So I’m not sure exactly when it will be done.  Keep an eye on this site and you’ll here about it when it is released.

Some of the new HiddenWord.org features:

• More secure
• Test before you sign up
• You control the organization of your studies
• Add multiple verses at once to a study

I hope you find these features as exiting as I do.  I’m also going to be looking for alpha testers soon, so if you’re interested in testing out the app, let me know.

The Cake

As some of you know I’ve been developing with the CakePHP Framework a lot lately.  That’s the same framework that HiddenWord.org will be built on.  I love it and the more I use it the more I grow to appreciate it even more.  It seems to be heavily tested and pretty solid.  I’ve been using it now for almost 2 years and I still learn little things here and there.

The other day I was working on a piece of code that I was trying to retrieve some related data and found that one of the methods didn’t work the way I expected it to.  It’s not a framework problem, it’s just not what I expected.  I found that I had to write my own little method to do what I really wanted it to do.  The thing about CakePHP is that sometimes you have to write your own methods for more complicated tasks.  Even when you have to do that though, it’s still usually fairly easy to accomplish your goal using the tools built into the framework.  I am planning on sharing this information in a later article to demonstrate how easy a more complicated task is to achieve in CakePHP.

That’s it for this post.