Archive for the ‘Web Development’ Category

Using PayPal for digital download sales, Paypal Dropbox

Thursday, January 4th, 2007

There is a significant problem in using Paypal for the sale of digital downloads. On the surface it seems handy and convenient for both parties, the buyer and the seller. Integration with Paypal’s IPN or PDT can allow the buyer immediate access to the download after a completed purchase without the seller doing anything. The problem is the buyer can request Paypal to reverse the transaction right after they download the software. Since Paypal will only accept the shipping tracking number as proof that the seller sent the goods to the buyer, the seller is left without recourse on purchase of digital downloads from a dishonest buyer. Any amount of data provided to Paypal in the case of digital downloads is not enough, not the IP address of the purchaser, the IP address used to download the software, the applicable dates/times, the software license code…. nothing.

In essence the buyer is a thief and the scenario equates to writing a check for goods then going to the bank to cancel the check and keeping the goods. With this scenario, the seller can at least take the case to court and win. However with Paypal, often all the seller has is the buyers name and email address.

Apparently Paypal is aware of this problem and is working on a new feature called Paypal dropbox. Currently I can see the only workaround would be to not allow digital downloads and instead mail the buyer a CD of the software so that a tracking number is available should the buyer decide to reverse the transaction. Then again, if the buyer reverses the transaction, the seller is out even more with the shipping fees and time involved. Hopefully, when implimented the Paypal dropbox feature will have Paypal as sort of an escrow company so that when the digital files in the dropbox are retrieved, Paypal can be assurred that the buyer received the goods and the seller will have some amount of recourse should the buyer reverse the transaction.

MySQL Injection Attacks

Monday, November 27th, 2006

MySQL injection attacks occur when the code of a MySQL query can be altered by the user due to improper escaping of variables.

See http://us3.php.net/mysql_real_escape_string for a  great example of an SQL injection attack.

MySQL injection attacks can be prevented by using mysql_real_escape_string($mystring) for each variable inputted into a MySQL query.

Find and Replace with MySQL

Monday, November 27th, 2006

If you’re just trying to find a replace a string in a MySQL table, you don’t need to write a script to do it. You can simply use the following syntax with MySQL (e.g. phpMyAdmin, MySQL shell access)

UPDATE TABLENAME SET COLUMNNAME = replace(COLUMNNAME,”FINDWHAT”,”REPLACEWITHWHAT”);Note that this method is case-sensitive. This is a great timesaver over doing it with a scripting language such as PHP. With PHP, you’d have to write a script to select the row, do the replacement, and update the table.

Instant DNS Change

Monday, November 27th, 2006

Recently I was working on a site having some DNS issues. I could only view the site at the old DNS address and did not want to wait and could not access it by IP address due to the circumstances. I had to view the site in order to complete the project. Because the database was large installing on a local system to test was out of the question due to time constraints.

Here’s what I ended up doing to view that site at the url before the DNS had propagated.

In Windows XP, I went to C:\windows\system32\drivers\etc\hosts
I opened the host file, typed in the URL and IP address in the format of the localhost example given:

127.0.0.1        localhost 

Saved the file, closed my browser window, opened a new browser window and went to the URL. It worked.

When I was done I removed the entry and it went back to the old DNS again.

Great time saving tip for working with a site before the DNS has propagated.