Archive for February, 2007

nikto - test your apache for security holes

Tuesday, February 27th, 2007

A neat tool to scan you apache server for “some” (more than 3.000) known security problems including general configuration problems (directory indexing) and wide spread scripts vulnerabilities.

Remember to verify each problem reported though!

Visit the Homepage for further information.

Where to start mysql performance tuning?

Thursday, February 22nd, 2007

I recently found a great article on mysql performance blog giving you a short and precise description of what to tune in the first place.

This is a must!

wordpress-mu strips any unknown html entity

Wednesday, February 21st, 2007

After migrating from wordpress 2.1 to wordpress-mu 1.0 I was not able to write source code like XML inside <code> tags. I searched the web and tried some plugins - to no avail :(

Finally I decided to go the brute force way by editing wp-includes/kses.php and removing the whole code. Therefor I changed the wp_kses method to:

function wp_kses($string, $allowed_html, $allowed_protocols = array (‘http’, ‘https’, ‘ftp’, ‘news’, ‘nntp’, ‘telnet’, ‘feed’, ‘gopher’, ‘mailto’))

    # Don’t do anything
    # just return the string untouched
    return $string;
}

It is really ugly though…

CDATA Section within a CDATA (or “How to escape ]]> in CDATA?”)

Tuesday, February 20th, 2007

Using CDATA to embed raw data within XML is a quite convinient feature. But the XML spec lacks the possibility to have a CDATA containing another CDATA or even the string ]]>.
So what happens if you put content like this within a CDATA section?

<![CDATA[
Just a ]]>
test
]]>

Your XML writer or at least any descent parser will complain it is not valid XML! Even the color coding on this page reveals that ;)

What to do?

The easiest (and IMHO most compatible) way of handling this is to build multiple CDATA sections, like this:

<![CDATA[
Just a ]]>
]]&gt;<![CDATA[test
]]>

DOH! IE displays white page after switching to JSPX

Saturday, February 17th, 2007

I guess almost everybody has been hit by the “IE shows only a blank page” issue while experimenting with XHTML back then. It is because IE requires a closing tag. The following fragment will not work in IE:

<script type="text/javascript" src="…" />

But this works:

<script type="text/javascript" src="…"></script/>

Ok, we learned that.

Today I had a hard time with IE showing a white page and all I had done was converting an old .jsp into a .jspx file.

What happened?

After hitting google with every type of phrase I could imagine describing my problem, I finally found it out: The servlet container (Tomcat 5.5.12) removed the closing script tag because the content of the script tag was empty. DOH!

What did the trick?

For now I do the following:

<script type="text/javascript" src="…"><– –></script/>

Wow. If you love surprises - do web development. ;)