Ping box from Yahoo!

It had been a long time since I had used Yahoo Messenger; however, I needed to install it and use it the other day, after doing so I found something which I found cool enough to blog about: Yahoo Ping Box!

With a couple clicks I was able to embed a yahoo messenger client right inside my blog. Or on any of my other sites / social networks. It was even easier then setting up AdSense. When you enter a nickname, my yahoo client is notified that so and so user has logged in. This is a negative in my opinion, as it pops up a little toast and it doesn't indicate it's from an anonymous source.

However it does warn you when you have an open chat window that it is from an anonymous pingbox user.

Get with the times!

I was checking my google analytics today (which I haven't done in ages), and I noticed something that was profoundly disturbing. In the last month, roughly 3% of the readers of this blog were using IE6.

Now I have nothing against Microsoft, (obviously since if you read my blog you would realize I develop using their tools), nor am I Microsoft hater; however, as web application developer, I strongly despise everything about IE6.

If your using IE6 or IE7 go upgrade already! Or go use FireFox.

Skinning a User Control

It's been a while since my last post, and while I have many ideas for posts, I have opted to spend my hours either working or enjoying my family; however, I came across a case today which will take only a second to blog about.

ASP.Net supports skinning and themes. If you don't know what that is I suggest you go search on it. In a site I am working on we have a User Controls, which are being used as Web Parts. A new requirement came up that depending on the theme we are using we will want to change the Title of the web part. So I fire up Visual Studio, and first thing was to add a new item to my skin file:

Navigating to the page resulted in the YSD (Yellow Screen of Death) with an error indicating that myControl couldn't be themed. The next step was to go and add a Themable attribute on the properties in the control I want to skin. You also need to add Themable to the class as well so you end up with:

[Themable(true)]
public class myControl : System.Web.UI.UserControl
{
     [Themable(true)]
     public string Title {get;set;}
}

At this point you can not skin your user controls. One thing I did skip is to make sure the skin knows about the user control. You can do this by registering it in the web.config by adding a record to the Pages\Controls section as follows:
 

You can also register it on the skin using the following declaration:

<%@ Register TagPrefix="myComp" TagName="myControl" src="~/Controls/MyControl.ascx" %>

Google & MVPs

For those who don't know who Jon Skeet is, he is an excellent contributor to the C# community, through his daily answering of questions on Stack Overflow, to his many excellent articles and books. Jon recently posted that his employer has asked him to turn down the MVP reward for this year.

What employer wouldn't want their employees to be recognized as community leaders in Microsoft Technologies? Google for one, as they are Jon's current employer. Jon won't comment on why this is so it leaves us to speculate what the reasons might be. Even if there is a sensible reason for this the silence lets myself feel that this is due to the competition between the two companies. That has definitely soured my opinion about Google and its Management team.

Just trust me!!

Today I was working with my intern, we are using DotNetNuke to run a marketing site so that our product team can go in and tweak some things. We have custom workflow in there, and a requirement that we want to save the results of the workflow into our own table so we can report on it latter.

The workflow component has some facilities to do this, so he creates a table and a stored proc, and gives it a shot. He is instantly greated with a lovely error in the front end Invalid Syntax Near xyz

I tell him that's not good, as it indicates a potential for a Sql injection attack. Fast forward three hours, and he is arguing with me that its safe, that it can't be injected, and demands I prove to him it can be done.

Not wanting to take the time or effort to figure out the magic sequence, as this isn't something I do everyday (Contrary to popular belief, I don't sit around trying to hack). I tell him to trust me, parsing errors are easy to inject into. He doesn't buy it, and I can see he is going to be stubborn until I prove him wrong.

Fast forward ten minutes, and I found that injecting with this forms component was as simple as entering a string like the following for the last field:

injectComing' select * from aspnet_users--

Watching with profiler, we quickly saw three key events. First was a Batch Starting which looked something like this:

exec myProc '','','','injectComing' select*from aspnet_users--';

Second was SQL Stmt Starting Event:

exec myProc '','','','injectComing'

Third was another Sql Stmt Starting Event:

select*from aspnet_users--';

Needless to say now he is working on a costume module so we can execute the Sql as a parameterized query and avoid all this ass ache. Moral of the story? While you shouldn't always trust everyone, you should trust your boss who has 10 more years of experience. And if you don't you try and prove him wrong, don't demand your boss to prove himself.


Gahh Interns!