The Dev Shack » ColdFusion

Adobe Releases Public Betas of ColdFusion 9 and ColdFusion Builder

mfleming — Mon, 13 Jul 2009 10:59:21 +0000

This is just a quick note that Adobe has released the public beta versions of ColdFusion 9 and the new ColdFusion Builder. Download links are below. I would also like to point out that while you try these versions out, please report any bugs you find to Adobe. This will benefit them by allowing them to address the issues and it will benefit the community as a whole, as in the end it makes for a better more stable product.

Download ColdFusion 9 Beta

Download ColdFusion Builder Beta

ColdFusion Gets Some Gartner Love

mfleming — Fri, 15 May 2009 11:12:33 +0000

Finally, some good press for ColdFusion! Mark Driver, a Gartner analyst, recently published an analyst note on ColdFusion. It has some good things to say about ColdFusion and that Abobe has strong support for the product. Nice to see others praising a product that we in the ColdFusion community have praised for years.

The report is not free, but Kristen Schofield has some excerpts posted on her blog.

Will Twitter Kill RSS Feeds?

mfleming — Thu, 07 May 2009 11:32:55 +0000

I have read numerous articles this week on the subject of Twitter replacing RSS feeds for some people, so I thought I would share my two cents on the subject. I’ll start by saying I was a late adopter to Twitter, having been signed up for only a few months now. Over that time period Twitter is slowly overtaking my reading of news from my RSS feeds. I have always been a huge fan of Google Reader, and it’s been my primary source of news, sports information, tech blogs, etc… Every day now I find myself removing feeds from Reader once I see the site I was subscribed to also offers a Twitter feed. In the near future I can say I will probably not use Google Reader anymore. Twitter will become my main source of content. So count me in the large group of folks who see Twitter as an RSS killer.

In the next couple of weeks I will be sharing a ColdFusion based project I have created that aggregates RSS based content on certain news subjects (Pro Cycling and Motorsports). This is just one other step I have taken to provide a means of having more content viewable via Twitter.

ColdFusion: Grab Yourself a TinyURL

mfleming — Mon, 20 Apr 2009 11:03:18 +0000

I have been working on a new application the last few days and one of the requirements was to generate a short URL. There are many different URL shortening services out there today, but I decided to go with one of the original services, TinyURL. Although this service does not provide any sort of API, they do offer a quick and dirty HTTP post method of grabbing a short URL. Using CFHTTP in ColdFusion makes this easy, and only requires a single line of code:

All this does is call the TinyURL post URL and pass in the URL you would like shortened. The post simply returns the text that contains the shortened URL. Now that was to easy! It is a good idea to check the status code of the HTTP call. If a status of 200 is returned, then all is well. If not you can handle the error any way you would like.

Preventing XSS (Cross-Site Scripting) Attacks in ColdFusion

mfleming — Mon, 13 Apr 2009 22:19:47 +0000

With the recent issues Twitter has faced in recent days, I thought it would be important to show how you can prevent XSS attacks in ColdFusion. For a detailed explanation of what XSS is you can read a good summary here. So how can you protect against this type of attack?

ColdFusion has some built in functionality to make this really easy. These are the steps I would recommend you take to help prevent XSS attacks:

You can enable Global Script Protection in your application. You can accomplish this by using the scriptProtect attribute in your application.cfc. You can set this to automatically add some protection to your form, URL, CGI and cookie variables. You can also pass in a column delimited list of the scopes you wish to add the default protection to.
You can also globally enable script protection at the server level via the ColdFusion Administrator. Under settings is a checkbox to Enable Global Script Protection. This will default every application on the server to use script protection by default.
Use HTMLEditFormat around ANY variables that contain user submitted input. This function will convert any submitted HTML tags into their HTML character entity. This can help to stop malicious Javascript code for example from being served to the browser.
The sure fire way to prevent this type of attack is to simply search and replace any maliciuous data. In other words, replace script tags, etc… with nothing.
Validate user submitted input on the server side. If you are expecting a numeric value in a field, make sure it’s numeric. Also validate maximum lengths. If you have a state field that is only 2 characters in length, validate it to make sure it’s no bigger.

As you can see ColdFusion provides many features and functions to aid you in preventing an XSS attack on your site. It’s up to you to put these practices in place!

10 Skills Developers Will Need

mfleming — Fri, 03 Apr 2009 11:09:58 +0000

Justin James at TechRepublic posted an article yesterday that covers his opinion of the 10 skills developers will need in the next 5 years. You can read his article and I’m sure you will agree with some of his items and there will be some you take a different view on. Here are my thoughts:

I agree 100% with the first item in the list, that you should already know or learn at least one of the most popular languages (.NET, PHP or Java). That does not mean you need to be proficient in every one of them, but I would agree that you should be in the process of at least being very proficient in one of these. I know and love ColdFusion, and as long a Adobe updates and stands behind the product I will use it. I have started some deep learning of .NET (with C#) and it has expanded my horizons. After being reluctant about .NET at first, I can now say it like it. Knowing more than one language will also help you to determine what platform will be the best for your projects in the future. A certain platform will not always be the best solution to a particular problem. Having a knowledge of other languages will help you make the right decision and be successful.

I am not sure if Justin was listing his items in order of importance, but if he was I would disagree with having mobile development listed as the last item in the list. Mobile applications are gaining steam every day and there is one important factor that seems to get overlooked sometimes. Depending on your application, most organizations are looking to put a little part of that on a mobile device or at least have a website that displays well on a mobile browser. Take a look at the most popular websites currently, those like Twitter, MySpace, Facebook, etc… They are started on the web, but you can find tons of dedicated mobile apps for your Blackberry, iPhone, etc… that take advantage of those technologies. I may have moved this item up a little further in the list.

I do agree with item four on his list, knowing and understanding web services. Web services easily allow you to release an API or some other hooks into your application. This easily allows third party integration with your application, which is getting more and more common every day.

That’s it for my thoughts. What are your thoughts?