Topper on ColdFusionhttp://www.cftopper.com/Topper on all things ColdFusionTopper on ColdFusionhttp://www.cftopper.com/images/rsslogo.jpghttp://www.cftopper.com/en-us400MySQL - Create a user with access to just one databaseWed, 08 Apr 2009 11:27:00 GMT
GRANT ALL ON mydatabase.* TO username@"%"
IDENTIFIED BY 'mypassword';

But when I logged in as this user, he could see all the databases. The only way to give the user full access to just one database, so far as I can see is by spelling out what the user can do with

GRANT SELECT,INSERT,UPDATE,DELETE,CREATE,DROP,ALTER ON mydatabase.* TO username@"%"
IDENTIFIED BY 'mypassword';
]]>http://www.cftopper.com/index.cfm?blogpostid=225eTag()Wed, 25 Mar 2009 02:14:00 GMTeTags.

eTag() is a handy function that you can use to perform client-side programmable caching of your coldfusion pages.

To get the benefit just call <cfset eTag( "My Page" )> and the next time a user visits this page, they will get a 403 not modified response and execution will stop here.

Getting advanced... add in the date..

<cfset eTag( "#pageName#_#lastUpdatedDate#" )>

... this will regenerate the page IF the lastUpdatedDate has changed.

We use this extensively in Teamwork Project Manager to reserve dynamic pages almost instantly. It also reduces server load because processing stops.

Here is the code:

<!--- eTag will return a 304 not modified response if possible --->
<cffunction name="eTag" output="no">
    <cfargument name="eTag" type="string" required="yes">
    <cfargument name="useHash" type="boolean" required="no" default="yes">
   
    <cfif useHash>
        <cfset ARGUMENTS.eTag = Hash( ARGUMENTS.eTag )>
    </cfif>
   
    <cfheader name="ETag" value="""#ARGUMENTS.eTag#""">

    <cfif ( StructKeyExists( CGI, 'HTTP_IF_NONE_MATCH' ) and CGI.HTTP_IF_NONE_MATCH contains ARGUMENTS.eTag )>
        <cfcontent reset="yes">
        <!--- nothing has changed, return nothing --->
        <cfheader statuscode="304" statustext="Not Modified">           
        <cfabort>
    </cfif>
   
</cffunction>]]>http://www.cftopper.com/index.cfm?blogpostid=224The BP PartyFri, 16 Jan 2009 09:13:00 GMT
The BP Party - your invited!

In case you can't read the writing, download the big version here - The BP Party (pdf)

And please spread the word in case I miss anyone.
Details again:

Date: February 21st 2009
Time: 9pm
Activity: Copious Drinking
Notes: It's fancy dress! You must come dressed up as something beginning with B or P. Prient, Princess, Baker, Pink, Boy George, Barney.. whatever you want..
Accomodation: Lots of B&Bs in town or just contact me directly - My house is crash friendly.
]]>http://www.cftopper.com/index.cfm?blogpostid=223Form Wizard launchedTue, 30 Dec 2008 08:24:00 GMTForm Wizard for ColdFusion.

It will save your hours and hours of tedious work designing forms for your website, and then doing the javascript validation, database store, email notifications etc.

And the look and feel can be extended to integrate with any website design.


Form Wizard for ColdFusion


It's the shanizzle.]]>http://www.cftopper.com/index.cfm?blogpostid=222Tip: Change the Railo port to port 80Thu, 13 Nov 2008 07:57:00 GMT Here's a quick Railo tip..

To change the default railo server port from the current default of 8600 to port 80:

  1. Open the C:\Program Files\Railo\conf\resin.conf file.
    (You can use the free Notepad++ for this if you don't have another suitable editor, windows notepad won't do.)
  2. You'll find <http address="*" port="8600"/> around line 62
  3. Change that to port 80 and restart the server.
]]>http://www.cftopper.com/index.cfm?blogpostid=221MySQL Optimisation Tip #2: Store counters in seperate tablesSat, 08 Nov 2008 06:38:00 GMTStore counters in seperate tables
A common scenario, you have a "pages" table and you want to store a hit counter in that table so you will know which pages are the most popular, you would have something like:

CREATE TABLE `pages` (
  `pageId` int(10) unsigned NOT NULL auto_increment,
  `pageName` varchar(255) NOT NULL,
  `pageHTML` text NOT NULL,
  `pageHitCounter` int(10) unsigned NOT NULL default '0',
  PRIMARY KEY  (`pageId`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8;


Now when you want to update the hit counter you will do something like:

UPDATES pages set pageHitCounter = pageHitCounter+1 WHERE pageId = 12

This is fine for normal database schemas... but if you are using the MySQL Query Cache feature (which you should), every time you execute the update you will invalidate the cache making the whole cache feature just about useless.

Instead what you can do is store the hitCounter for each page in a seperate table.

So add something like

CREATE TABLE `pageHitCounter` (
  `pageId` int(10) unsigned NOT NULL auto_increment,
  `pageHitCounter` int(10) unsigned NOT NULL default '0',
  PRIMARY KEY  (`pageId`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8;

and update that instead. That was a fairly contrived example but you get the idea - be careful not to invalidate the cache.]]>http://www.cftopper.com/index.cfm?blogpostid=220MySQL Optimisation Tip #1 - Turn on the query cacheWed, 05 Nov 2008 12:59:00 GMTThe Query Cache
If your using MySQL in production you should turn on the query cache - this is off by default ( even if you have installed using the wizard and choosen "dedicated server" ).

The query cache basically remebers the results of your queries and saves them from being executed twice unnecessarily resulting in huge performance improvements.

Bare in mind that any inserts or updates will reset the parts of the query cache that relate to the affect tables. Luckily most applications read from the table much more often that they write data into them.

How to turn on the Query Cache


  1. Open your my.ini (or my.cfg) file in notepad and set query_cache_type to 1. There are 3 settings for this: 0 (disable / off), 1 (enable / on) and 2 (on demand).
    Tip: If you can't find this in your config file, so just add it in.
  2. Now you need to tell MySQL how much memory space to use. For this, find (or add) the query_cache_size option and set it to something that makes sense. This is a global setting so all sites and applications on the server will share this. You could try 30MB to start with
    query-cache-size = 20M
  3. You will need to restart MySQL for the caching to begin.


How to know of the cache is being used


After restarting your server, execute the following SQL:

SHOW STATUS LIKE 'q%';

You will get something like:

Qcache_free_blocks    1613
Qcache_free_memory    202554688
Qcache_hits    679493
Qcache_inserts    207317
Qcache_lowmem_prunes    0
Qcache_not_cached    4532
Qcache_queries_in_cache    3488
Qcache_total_blocks    8788

The important two are Qcache_queries_in_cache and Qcache_not_cached.

Qcache_queries_in_cache is the total number og queries that are currently cached in memory.

Qcache_not_cached is the total number of queries that were executed where MySQL could not use a cached version.

References

]]>http://www.cftopper.com/index.cfm?blogpostid=219ColdFusion Optimisation Tip #1 - Use StructKeyExists instead of isdefinedWed, 05 Nov 2008 12:57:00 GMTUse StructKeyExists instead of isdefined
Many of ye know this old nugget already so sorry if you know this already but StructKeyExists is much much much faster than isdefined.

As Simon Whaylay says:
"IsDefined() checks not just if a variable exists, but if it is also syntactically correct. This clearly has runtime implications. That is why, when dealing with structures you should avoid isDefined() in favour of structKeyExists()."

The Proof


*** Code Here ***

The Result


        IsDefined over 100000 loops: 337ms

        StructKeyExists over 100000 loops: 36ms

References


  • http://www.simonwhatley.co.uk/isdefined-vs-structkeyexists
  • http://mkruger.cfwebtools.com/index.cfm?mode=alias&alias=isdefined%20vs%20structkeyexists
  • http://corfield.org/entry/isDefined_vs_structKeyExists
]]>http://www.cftopper.com/index.cfm?blogpostid=218Tip: Protect your MySQL from SQL InjectionMon, 20 Oct 2008 07:23:00 GMT
sql-mode=NO_BACKSLASH_ESCAPES

Before you do this, If you have a simple search on your site and a user inserts

test\'' OR 1 = 1   --

instead of just

test

The \'' will get escaped and your SQL statment will turn from something like:

WHERE variable LIKE 'test' AND userId = 55;

to something like:

WHERE variable LIKE 'test' OR 1 = 1 -- AND userId = 55;

Because -- is the start of a a comment in MySQL, the AND userId = 55 bit will be ignored.]]>http://www.cftopper.com/index.cfm?blogpostid=217Great Review for TeamworkPMTue, 02 Sep 2008 10:47:00 GMTreview of our software, Teamwork Project Manager from about.com!]]>http://www.cftopper.com/index.cfm?blogpostid=216Supporting Multiple LanguagesMon, 25 Aug 2008 12:39:00 GMT The Translation engine at work
Google API Translation at work
Over the weekend, I wrote a resuable script that converts snippets of English text to 20 other languages using the new Google translate Ajax API for our Teamwork Project Manager software.

The script was hacked together quickly and isn't the best most structred code in the world but it works well - it cycles through any strings in the languages table that haven't been converted yet and one by one, converts them to a foreign language. Every time, the script has 20 results, it saves the changes to the database.

Watching it at work is pretty cool with strings coming back in Arabic, Chinese, Russian etc.

The strings are stored in the following table MySQL table:

CREATE TABLE `languagestrings` (
  `languageStringId` int(10) unsigned NOT NULL auto_increment,
  `languageStringRef` varchar(255) collate utf8_bin NOT NULL,
  `languageCode` char(2) character set utf8 NOT NULL,
  `languageString` text character set utf8 NOT NULL,
  `languageStringUsageCount` int(10) NOT NULL default '0',
  PRIMARY KEY  (`languageStringId`),
  UNIQUE KEY `langStringRef` (`languageStringRef`,`languageCode`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8 COLLATE=utf8_bin;

And translating the strings is done with the function
translate( ref, english_default, bUpdateNow, language ) which works like so:

#APPLICATION.teamworkpm.translate( "Your Projects", "Your Projects", false, "ES" )# gives "Su Proyectos".

Here is the translate function code:

*** Code here - open article to view ***

You can see that if the string has already been looked up, the result is returned immediately so that this function is nice and fast.

If a string doesn't exist for a given language, the default english version is inserted for that language, so that it can be translated later.

The languageStringUsageCount is updated whenever a string has to be looked up, usually after a server reboot. This will be useful when we want to strip the database of strings that are no longer used in a few months.

The "update now" argument allows programmers to quickly change the value of english strings directly from the code base during development.

Hopefully this will help you get your own multi-language systems up and running in ColdFusion.]]>http://www.cftopper.com/index.cfm?blogpostid=215Backup Software RecommendationsThu, 14 Aug 2008 02:52:00 GMT About 3 weeks ago on a quiet Tuesday evening I installed the latest version of subversion client TortoiseSVN on one of our website hosting servers in Dublin - I had to reboot the server after the install. This is when it all went wrong...

I usually wait maybe 2 minutes and the server is backup serving a plethora of client websites and a few small web apps. I waited and waited, repeatedly pinging the server, searching for the first sign of life.

The server was apparently lifeless. Nada. Nothing. Zip. "No reply from server"...

We called our hosting company. No I lied ... we didn't. We actually had to use their brutal support chat program and bludgeon English into a pigeon-English speaking Polish guy to request that the server be manually restarted.

I guessed that I had hit the "shutdown" option instead of the "restart" option and that the technicians would reboot the server in a jiffy and that all would be well.. so I tottered off home.

Some time later I got a frantic phone call from Dan informing me that the technicians said the server's hard drive was fried. I turned visibly white and raced back to the office for damage assessment.

Hours later, the technicians in Dublin had managed to salvage some data by plugging the hard drive into another PC and running a Linux program to do a sector by sector copy where possible. We recovered a lot of data but we had still lost a fair amount. Luckily we had most, but not all, of the website databases backed up to a PC in my office thanks to Navicat and scheduled tasks.

The technicians reinstalled a blank Windows 2003 server installation along with the data they managed to recover and Dan and I spent the entire night working feverishly to get all the websites and applications working before our clients got to work and started screaming.

In the end, the only thing we lost was a very small website. We recovered the page content from Google page cache (isn't Google great) and then gave the client a new, much better website for free to make up for the down time which was 1 day while Dan knocked the new site out.

And here's my point: disasters will happen, so plan for them.

Our New Backup Plan


We have since installed Carbonite Backup on all our servers. Everywhere. It's an absolutely bargain for only $30 a year per server for unlimited data. I thought there must be a catch at first, but no, it's a steal, easy-to-setup and works great.

That's the files sorted. But what about the databases. Well, we use MySQL on all our servers (if you use anything else you are a stupid Microsoft whore or Oracle slut, sorry) and it's difficult to restore MySQL from just the raw data files. I wanted something that could backup an entire server of MySQL databases automatically including new databases without any additional configuration - the reason we lost that one website was because each website had to be manually configured with our old database backup system and we had missed a few.

Eventually, after a serous amount of poking about ye olde internet, I found exactly what I was looking for in Auto Backup for MySQL from Swordsky SoftWare. This is the only program I could find that would run as a service and backup multiple entire servers reliably without needing additional configuration as each new website is added.

It also has a thoughtful array of options such as automatic removal of old backups after so-many days - something that I used to have to do manually in the past. The SwordSky team, whoever they are, have done a fantastic job here and I encourage you to give it a go. It's a bargain at only $100 or so too.

So there you have it, two cheap, easy-to-setup products that may one day save your ass.]]>http://www.cftopper.com/index.cfm?blogpostid=214CF_Desk action="upgrade"Fri, 04 Jul 2008 03:00:00 GMT
My new desk


New desk in use]]>http://www.cftopper.com/index.cfm?blogpostid=213Tip: Easily protect your include filesWed, 30 Apr 2008 12:38:00 GMT
I just thought I'd share this quick and useful tip:

Put the following code in all your Application.cfm or Application.cfc fles to automatically protect your include files such like "inc_test.cfm" or "act_deleteUser.cfm" from being called directly.

UPDATE: This code had a bug which was fixed 30th April 2008
<!--- Any script such as inc_file.cfm or dsp_file.cfm can not be called directly --->
<cfif mid( ListLast( cgi.script_name, "/" ), 4, 1 ) IS "_">
    <cflocation url="#APPLICATION.siteURL#" addtoken="no" />
</cfif>

There is some code in fusebox that prevents calling files other than index.cfm but we have found this too limiting.]]>http://www.cftopper.com/index.cfm?blogpostid=212CFUnited Europe 2008Sun, 16 Mar 2008 12:01:00 GMT
Charlie Arehart was nice enough to give me some tips and help me rearrange and improve my Powerpoint presentation for the 2 hours before my talk.

With minutes to go, I saved my Powerpoint and suspended my laptop, then headed upstairs to the conference room. Now this was my first time speaking in front of more than 6 people and I was extremely nervous.

I get to the conference room and there are a few people in there already. I head up to the stage, laptop in hand and start setting up... I hit the power button to restore my laptop and.... what the hell... my laptop is rebooting, not restoring.

OK, not too bad, I'll just have to start ColdFusion, open the presentation and Firefox windows again. My laptop takes an age to start up.

So I am 3 minutes into the presentation and still waiting for my laptop to warm up. Fortunately there are still a few stragglers filing into the small conference room.

I double click to open the presentation and wait. And wait. It is taking ages to open. My laptop is being projected onto the 8 foot screen; everybody in the room feels my pain when Powerpoint reports that the file is corrupt and asks if I would like to restore it. Hell yes, restore that thing and fast.

I start the presentation. My freyed nerves are shattered but the show must go on. I start into the slides and notice something strange on the "About Me" slide. It's not exactly right.

Then I get to the "Contents" slide and notice that all the changes Charlie helped me make have been lost. Now this is a major curveball - there were entire topics that I had dropped, new sections I added and the whole thing had been rearranged.

Next disaster. The first section in my presentation should have been the last - it's all about "Source Control". I ask for a show of hands to make a point - "How many people in this room use source control". I had expected about 4 hands. I am dismayed to see that of the room of maybe 35 people, only 1 does not have his hand up.

Anyhow, I persevered and bluffed my way through the rest of the presentation. I'd like to thank everybody who was in the audience for their support. As promised here is the real presentation. Hopefully you all got something from the rest of the presentation. Topics covered:
  • Quick Tip: AJAX debugging
  • Supporting Different Timezones
  • Foreign Language Support
  • Advanced File Uploading
  • Quick Tip: CSS Hacking for IE6
  • Working with Multiple Domains
  • Database “Sharding”
  • Source Control.
I also gave a demo of our content management system, TeamworkCMS, and it's powerful plug-in architecture. As promised this will be released in May 2008. Stayed tuned.

I learned a lot from this experience and i'm sure that next time, i'll be more prepared and much more confident. It was a great experience all-in-all. 
This is the latest CF9 prototype (codename MoHawk):
CF9 (foot) at CFUnited 2008
]]>http://www.cftopper.com/index.cfm?blogpostid=210I'm speaking at CF-United Europe!Tue, 11 Dec 2007 03:01:00 GMTThe topic is:
How we made it: Teamwork Project Manager - tips for development of highly-scalable web2.0 apps in ColdFusion.

We developed Teamwork Project Manager over the last 7 months. There aren't many web2.0 CF apps taking on the Ruby crowd these days and I think my speech will be interesting.

Some items would include:

  • Industry Analysis
  • Ajax & ColdFusion
    • Debugging techniques
    • Processing the response
    • Using JSON with CF
  • Handling Multiple Domains with one application
  • Advanced file uploading - hundreds of files in one go
  • Database design
  • Scalability
  • Support
  • Sales & marketing

]]>http://www.cftopper.com/index.cfm?blogpostid=208Another reason to hate IESun, 25 Nov 2007 02:11:00 GMT Like we need another reason to hate IE. But here it is.

I recently implemented rounded edges throughout Teamwork Project Manager and it's a painful process involving nested divs and workarounds for IE6 glitches.

Today I was procrastinating on Digg.com and I stopped to admire the rounded edges on their notification bar.

Digg.com - nice rounded edges

I decided to look at the page source to to see their nested divs - are they using 4 nested divs for maximum flexibility bar with rounded edges - 1 div for each corner, or, where they using just 2 divs - one for each side with a height limitation?

The answer perplexed me - They just had something like <div id="announce"><p>Check out...</p></div>.

I thought "they must be using the <P> tag as a container with a background image" so I download their CSS source code and was confounded to see this:

     -moz-border-radius: 1em;
     border-radius: 1em;

What in the blazes is that? CSS supports rounded edges? My pain was for nought? Could I have just shoved these 2 lines of code in and saved myself hours of work?

In a perfect world, a world without Internet Explorer, then yes, I could. If you are using FireFox, this entire post will have rounded edges. If you are using IE, you'll just see a plain box.

Here you see the same announcement banner in IE - notice anything different?

Digg.com - no rounded edges in IE

Here is another example.

Rounded edges browser comparison
I hereby confirm, IE sucks.
]]>http://www.cftopper.com/index.cfm?blogpostid=206Announcing CF Debug Live Link (free tool for CF Developers)Wed, 07 Nov 2007 12:45:00 GMTCF Debug Live Link.

It changes the links in the standard ColdFusion MX 7 debugging output so that when the file names are clicked, they open for editing instantly.

CF Debug Live Link - turns file names into clickable links to quickly edit files

It does this by registering a protocol handler with Windows, which in turn calls a small .net application which tells your editor of choice to edit the file.
It's Windows / CFMX7 Only. Tested on both Vista & XP.

I made a simple installer so you can install this in seconds.


NOTE: By default, CF Debug Live Link is configured for Homesite+ but you can change this to any editor by editing C:\Program Files\CF Debug Live Link\cfdebugfilelink.exe.config]]>http://www.cftopper.com/index.cfm?blogpostid=204Teamwork Project Manager - The SstoryTue, 30 Oct 2007 09:59:00 GMTWe hear a lot about people building web2.0 apps like Twitter using Ruby on rails. Rarely do we hear a mention of ColdFusion being use to build a scalable high-availability ajax enabled application. But at Digital Crew we recently launched Teamwork Project Manager - an application that as the name suggests, allows organisations to manage their internal and external projects and get productive.

The whole thing is built on our own 'SiteEngine' framework using ColdFusion and MySQL.

Here is the story so far.

The Teamwork Project Manager Story

January 2007


Peter Coppinger & Dan Mackey founded their company Digital Crew almost 8 years earlier and have made a living building websites, intranets and custom web-based solutions for clients in Cork, Ireland. At this point their company has a good reputation internationally and they sell website components online.

However they found themselves up to their eyeballs in client projects.
Peter Coppinger says, "Every Monday we held a meeting and discussed the current projects - reassigned tasks and set milestones. We maintained a large whiteboard separated into 5 segments - Active Projects. Upcoming Projects, Sales, Meetings and Billing.

The whiteboard was neatly organised and gave us a sense that we were organised.... but we weren't.

The meetings were taking longer and longer. We knew we needed a better system.".

March 2007


Peter and Dan spent some time reviewing and using project management software. Many are very expensive and all are overly complex. They wanted something intuitive that doesn't take time to learn and maintain. Something everybody in the company can use - not just the project manager.

Peter dreams of a software system that would basically manage a company. Call it a project management system, if you will - something extremely easy-to-use and generic enough that it could be used by all sorts of companies. He starts scribbling ideas on paper. In the morning he returns to work and the confused whiteboard overlord.

May 2007


Peter and Dan discuss the software they want to make almost daily now. And they have a name - Teamwork Project Manager (styled after TeamworkCMS - Digital Crew's bespoke website content management system).

A credos is set - "Project Management Made Easy!"

Peter and Dan are too busy with 'real work' to dedicate time to developing the product idea. But fate intercedes and a manager from a multinational client calls Peter to ask if he would have time to do a "simple" project management system. They want something extremely easy-to-use that would list upcoming and late milestones. This is the opportunity Peter has been waiting for. He eagerly tells the client about the software he has been thinking about making for a while and the client agrees that it is exactly what they need.

Peter first reviews other popular project management systems to find out what they are doing right and what they are doing wrong. Although other Project Management solutions exist, they are all too slow, clunky and badly designed. None are what the client wants and Peter has in his head. He makes a list what he likes and dislikes and puts pen to paper designing the software.

While on holiday to visit his sister in Boston for 3 weeks, Peter shamelessly neglects holidaying to stay up night-and-day working on the 'Project Management System'. Dan, busy with other client work back in Cork, checks in every morning. Screenshots fly back and fourth but Peter is reluctant to show the software running "until it's ready". Dan, also passionate about the development of their first "real" product, provides a steady steam of encouragement and suggestions.


June 2007


The software is installed for the client. Peter nervously waits for their feedback. Will they love it or loath it? Peter checks back an hour later and the client manager has already set-up several projects, added staff, assigned tasks and milestones. Just then, the phone rings. The client manager tells Peter that this is exactly what he was looking for. He was able to use it right off-the-bat with no instruction manual. Software, the way it should be.


August 2007


Dan works post-haste on TeamworkPM adding his fair share of sleepless-nights to the tally. The software is lovingly sculpted bit-by-bit with sometimes heated 'discussions' over items such as the color of a link. Their mission is simple - to make the worlds most easy-to-use, fastest and best Project Management System.


September 2007


Weeks of preparation. Servers are set-up. Database is optimized. Software continually improved. The promotional website is made. And finally the launched date is set.


October 2007


Everything is ready and has been tested a hundred times.
Teamwork Project Manager is launched on October 4th 2007.

Almost immediately, through their respective software development blogs, curious users start browsing the website and Teamwork Project Manager receives it first sign up within a hour of launch!

It's only been 3 weeks so far and the feedback has been great. We didn't expect the sales to start until at least the 30-day mark but we things are going better than expected. We believe we have a great product and we are now working hard on the marketing side of things.
Stay tuned to the blog. I look forward to updating this story.

Thanks for reading the story. So far we have had a great response and we are continually improving the software. We believe that our software lives up to our credos - "Project Management Made Easy". We want the software to be so easy-to-use, our own computer-shy mothers could use it (and indeed they do).

We are working extremely hard to deliver more features and continually improve TeamworkPM. Please try Teamwork Project Manager for free.
]]>http://www.cftopper.com/index.cfm?blogpostid=203Teamwork Project Manager - Password stored securelySun, 07 Oct 2007 05:39:00 GMTTeamwork Project Manager - Project Management made Easy!

That feedback feature I added has worked out great so far. We've got some great suggestions and enquiries in.

One customer used to feedback option to contact us. He had used the option to retrieve a lost password and wondered why the password we emailed him was different to the password he originally provided.

The answer, I replied, is security.
We do not store your passwords!

Instead we store a HASH of the passwords.
A HASH is a one-way transform. For example in the database, the password "tulsar256" might have been transformed to a string like "DDC3954CB4BC3AFE4A278BE8D7A1662" using hashing. And there is no way to determine what the original password is from this string.

So when you login, we convert the password your have entered into another hash and then compare it to the hash we have stored in the database.

This is all great and gives our customers that extra little piece of mind - knowing that even if we wanted to, we couldn't see what passwords you are using. However we can't just email you with your password now when you forget it - we simply don't know it.  Instead we email you a hash of a your password hash.

So we have absolutely no idea what our customer passwords are (and we shouldn't know!).  Many people use the same password on several sites and all IMHO all sites that care about their customers security should use hashing for storing all passwords.

Teamwork Project Manager - Project Management made Easy!

]]>http://www.cftopper.com/index.cfm?blogpostid=202