hmmm, intersting...
i`m starting to think the best option would just be to make a long html page with most of it commented out that gives the owner instructions on where to paste the name and feedback they want to appear. that will allow for proof reading, etc.

it`s a bit more involved than they`d probably like to get, but safetly is more important i think. the only reason i`m trying to make is so easy is that i can`t guarantee i`ll still be living here as and when they need more stuff doing and i don`t want to leave them with a site that they can`t do anything with unless i do so.

thanks for the suggestions everyone!

As Hmmm... has said you're better off removing the public contact form from the process, its easier to secure things and less hassle in long run.  Even ignoring spammers, its a huge leap to think people submitting "positive feedback" are going to manage to be able to spell and/or string 2 words together in a legible sentence.

Security wise, make sure you validate all input.  Strip out all tags, convert special characters to html entities.  In the case of form to mail, you can also check all your fields for strings like to: cc: bcc: content-type: Content-Transfer-Encoding: and so on.  You could also throw in a few common spam words into that list like porn, viagra etc.

I'm not sure allowing comments to 'go live' on a site (guess it does depend on what the site is) is a good idea - I'm afraid even if you are using captcha type code you will always end up with some daft ****** turning up eventually, and I don't think your script allows comments to be easily removed, so that could be embarrassing!

How about you let people submit the feedback which comes in as normal formmail and then someone chooses which comments to use before manually running your script to add them to the marquee.

Your form/script could be protected using .htaccess to make it secure - so the 'admin' person would log in to update things.


Not so instant, but might work out better in the long run...


^{Search Freeola Chat}

ah curses!

ok, how do i go about securing the form then? any tips?

would something as simple as having an "are you sure?" alert on submission help?

or perhaps one of those "enter the same code as this one" boxes? or is that still vulnerable because even though the combination would be random, it`ll still be held in a variable.

can i disable html from being allowed?

Most sites get picked up by bots trawling through domain records and ip addresses looking for exploitable forms.   What they are looking for is access to server and ability to send spam or install dubious code on your site.  The business size or site traffic is totally irrelevant really.

So you're probably better sorting any security vulnerabilities now rather than having to explain to your client why his marquee is advertising porn or his/her domain has been blacklisted etc..

right, i`ve got this working in the following way:

i`ve got an html "leave feedback" form that the customer fills in, they select whether their feedback is positive, negative or neutral feedback. leaving any kind of feedback will send an email containing said feedback to the owner of the business, but if it`s POSITIVE feedback then it gets added to an "open" html file (as in, there are no closing </html> tags.

feedback form -> php script - email (and html file if feedback is positive)

the html "positive feedback list" page contains the marquee command (parameters defined in css) and the contents to be scrolled; each time positive feedback is added, the php script adds it to the end of this file in a new paragraph.

so there we go, i`m sure it`s quite a clunky way of doing it, but i`m still very much a novice to scripting and things, but it`s up and working. i`ve got the html page with the marquee to appear in a <div> so i can easily place it anywhere on the site and it`ll automatically have up-to-date feedback.

it`s probably a security laughing stock, but i`m going with the notion that it`s quite a specialised site for a small business so the odds of it being hack-worthy are about 1%

.. i`m still not telling you lot the url though :P

Hmmm... wrote:
> Also, If you get it working please update this post with some
> code tips as this could be a useful script...

Maybe I have a go at writing one too.

Hmmm... wrote:
> Very_Metal wrote:
> can anyone see any potential catastrophes that may arise from
> that method?
>
> Hi Very_Metal,
> Make sure your form is secure!!!
>
> Not a 'catastrophe' but how are you intending on getting the old
> messages removed?
>
> Also, If you get it working please update this post with some
> code tips as this could be a useful script...

the old entries will probably stay put i`d imagine. it`d be brief customer feedback so more content means more customers and therefore - more confidence from potential clients.

good point about the security as well, it`s not the kind of place people will stumble across by accident, but i`ll definitely keep an eye on it. any tips on what to look for?

if i get the script working i`ll post it up here in future :)

pb wrote:
> Somehow, I knew you'd get that in somewhere.  Well done on the
> advertising, at least you're trying! :D


One day I'll get a GAD for helping others here or for promoting Freeola ;¬)





^{Search Freeola Chat}

Very_Metal wrote:
> can anyone see any potential catastrophes that may arise from
> that method?

Hi Very_Metal,
Make sure your form is secure!!!

Not a 'catastrophe' but how are you intending on getting the old messages removed?

Also, If you get it working please update this post with some code tips as this could be a useful script...



^{Search Freeola Chat}

Garin wrote:
> So it may well
> be worth the extra effort now to get something in place they can
> update themselves.

definitely.
i`m looking into something similar for a site i`m building, except that i`ll need information from a form to be put into the marquee.

my theory is to use a script to add the info from the form into file, then use php include to put the file inside a marquee.

can anyone see any potential catastrophes that may arise from that method?

Try freewebs.com or even http://geocities.yahoo.com/v/pb.html
I mean look at the url on that one, pb.html, its a sign!!

Hmmm... wrote:
>> A
> "Freeola
> Instant Site" which anyone can create and update
> could be an option for £3 a month!
>
> ^{Search Freeola
> Chat}
> ^{My Freeola Instant
> Site}

Somehow, I knew you'd get that in somewhere.  Well done on the advertising, at least you're trying! :D

If it was up to me, then yes, but I don't think the church will pay as they want to use the space they have with BT.

If I think of something to build a site for myself, though, I'll be right there.

I'd agree with that...
I've recently done a mental illness charity site as a favour thinking it was a one-off, but they keep on coming back for more!

The problem with Content Management Systems(CMS) is that apart from the application itself (free/open source/paid) you may need to have MySQL as many require a database.

If you want more information just let us know. For example there are simple free non-database(SQL) CMS applications available...

A "Freeola Instant Site" which anyone can create and update could be an option for £3 a month!

^{Search Freeola Chat     My Freeola Instant Site}

Well one thing I would add is be wary of maintenance.  I've maintained a homeless charity's website for several years now.  And its fair to say I've spent many many hours updating it for them (which of course I've never been paid for).  So it may well be worth the extra effort now to get something in place they can update themselves.

Thanks, both of you.

The marquee thing doesn't look so bad.  The FTP idea sounds the best, I can always do without pictures if it makes things easier, though it probably relies on me doing any uploads.

The site is actually for the local church.  They've asked me to do it as a favour, so I'm not in any hurry, but I'm using it as a learning experience for building a website.

Of course, if they paid me I'd do it all properly and get a freeola site with a decent domain name!  ;)

As Hmmm... already stated very possible but perhaps a bit trickier than you'd like.

For the Marquee, just had a quick search, best I can find that does most of what you wanted is this.

As far as updating content, the easiest way might not be the most pleasant.  You could have a simple script that just includes a file thats been FTPed onto the server.  And the file can be simply your word document saved as a webpage.  However one thing to remember, if your word document contains images then things get more complicated.  Images wont be part of any copy/pasting you do and would need to be handled manually.
The more complicated options include installing a CMS, plenty of them have user management that allow you to configure what people can update.  Some even come with WYSIWYG editors that let you copy/paste directly from Word (still the image problem though).  The barrier with that option is probably creating a template for it so it looks like your existing site. 
There are other options (mostly lesser CMS) but it depends on how much formatting you need as to whether they are appropriate.

Hi pb, don't often see you over here ;¬)

What you are after is all possible but if may be more complicated than you were hoping for...

I manually update my 'news ticker' to keep things simple, here a demo:
www.hmmm.ip3.co.uk/ticker


All for now, I'm late...!
^{Search Freeola Chat}

I'd like to write a bit of code that will create a scrolling message which changes depending on the date.

So I need to:
Get the current date
Find out if there is a specific message for that date (or between 2 dates) such as "Happy Christmas"
If not, display the default message, such as "Welcome to this site".

Is that possible?

I also need to find the easiest way to include a big box of formatted text that can be altered by anyone who has a password.  This is for a weekly newsletter which is in word format that needs to be pasted on to a website every week.