What is a SQL inject?

A SQL Inject is akin to the worst kind of tagging and is yet another way that hackers make all our lives uncomfortable for no apparent gain to themselves!

A SQL injection attack - and I say attack because it is essentially an attack - consists of injecting (or inserting) an SQL query into the input field on a web application. An attacker can inject SQL commands into input fields, which may then execute against a database leading to database corruption or code execution on the server. These attacks are usually automated.

SQL injection is very common with PHP and ASP applications due to the prevalence of older functional interfaces. The newer programmatic interfaces available, such as J2EE and ASP.NET applications are less likely to have easily exploited SQL injections.

We consider SQL injection attacks to have a high impact on our clients websites and treat them seriously.

How we avoid SQL injection vulnerabilities
All our second generation Nautilus websites have been developed using .NET 2.0 and we avoid SQL inject attacks through the careful use of parameterised stored procedures.

Our older Nautilus websites are vulnerable and we are in the process of retrofitting these websites to repel attacks.

Microsoft Security Advisory article (954462) reported on June 25th 2008 that Microsoft is aware of the recent escalation in these attacks targeting websites that use Microsoft ASP and ASP.NET.

We are currently looking at further ways to secure our server with outside software that may
1. Scan for vulnerabilities
2. Provide protection for all websiteson our server

We'll let you know how we get on.

Advice for people planning their first web presence

The single most important question you can ask and answer before you begin your web project is

Why are we doing this is?

If you can answer this question and be clear on what outcomes you expect from the website then you can measure the success of your website. Ultimitely the success of your website comes down to the bottom line, however you measure it.

I was in a time warp

Yesterday I had the privilege of meeting a gentleman with an extensive stock of weird and interesting items for sale.

In a solidly build warehouse , the company has been accumulating items since it was formed in the 1930's. Founded on old fashioned principles such as value, customer service and providing items to customers that would endure rather than what is cheapest on the day, this company has items that are no longer manufactured. These items are the last of their kind available in New Zealand and I wonder if they are the only remaining ones in the world?

How does one even begin to sell from this type of stock list?
Firstly not all the items are ancient. There is a huge stock of speciality items that there would be a small demand for, the trick is to reach a larger market to increase that demand and so voilà a website becomes the perfect tool to reach that market, especially coupled with extensive optimisation or an adwords programme.

What about the oddities?
The one-offs, the end of lines that are never to be repeated, the items so old and so unique as to almost be classed as antiques? An online auction site would seem to be the answer here. What will the market bear? An auction is the ideal place to sell speciality items and to test the market on everyday items.

I hope we get the job of helping this gentleman move his stock. I'm sure there will never be a dull day exploring in that warehouse!

My 2007 Top 10 list of lists

At the beginning of 2008 and what do we obsessively do? Some of us look at the last years top 10 lists. Here are some lists I like.

1. Google 2007 Zeitgeist
2. The New York Times 10 Best Books of 2007 - you need to sign in to see these but its free.
3. 100 Best Songs of 2007
4. Rolling Stones 2007 Best Music Videos
5. NZ Heralds Best of 2007
6. Top 10 Baby Names for 2007
7. Trev's Top 10 List of Amazing Women
8. Top 10 Political Themes for 2007
9. New Zealand's Top 20 websites according to Hitwise
10. The 10 Greatest Motorcycles of all time - this links to the #1 motorcycle on YouTube, from there you can see the other 9.

Upgrade for ROI

Whats the best reason for upgrading your website?
For a business, it's got to be to improve the return on your website investment (ROWI). Non-profit organisations can also measure this in terms of non-profit indicators, such as members or donations.

So, with the goal of improving our ROWI we embark on the journey with our own website. To help us reach our destination/goal we need to be clear on what it is we want to acheive, otherwise we may have the wrong maps/indicators.

We get a lot of visitors to our website via our clever search engine marketing and website optimisation. After our visitors arrive on our website they drop off in droves and as we have an amazing record off keeping customers once they get to know us, my goal is to increase that retention rate and pursuade people to contact us.
Next Actions:
1. Quantify lost and retained visitors
2. Specify goal. Quantity, quality and timeframes.

Did you notice the upgrade?

Our website received an upgrade last week. Has anyone noticed? Actually, I hope no-one has and the reason is that if we have done our job correctly then the upgraded website should look like the old one.

So why did we do it?
We upgraded the site in preparation for whats to come, a visual upgrade later in 2007 and we wanted to take avantage of the smarter technology on our new server.

3 day listing

3 days after submitting the XML siteMap the site of this story is listed. The site was cached at midnight the evening after we sumitted the sitemap. Nothing showed up on the organic search results over the next two days - very early Friday morning and the site is listed at the top of the search results.

Yesterday was one of those days where your list just gets longer as the day! Then last night I collapsed into bed exhaused and didn't do any of my usual catch-ups. Question is - when did the site actually list? - I checked at 4:30pm and it hadn't listed - Michelle checked at 8:25 and YES! it was there. Howzat!

Page Listed but not site

36 hours on and we find that "the" site is still not indexed by Google.

Of some consolation to us is our client page is listed when we type the name of the product - wondercap - into Google. Interestingly enough the cached version of the page from last week does not show the new updates. Still not good enough for our client. We continue to monitor and do what we can.

24 hours on

No progress 24 hours after submitting the sitemap to Google. Unfortunately an old page from Trade Me in April, with an out of date price, continues to show on Google when searching for wondercap.
Of course the site we are looking to list is wondercap.co.nz
I have one more trick up my sleeve to try tomorrow.

Search Engine Sprint

"Help" says the client, "my website is not listed on Google, I'm going to be on television in 3 days time - is there some way I can get listed so I can catch all those people who will be looking for my product after the show?"

So much for planning! I know it's common for Google to take 3 weeks to 3 months (or more) to list a website. We can usually get them listed within three weeks just by adding a link on our website. Of course adding links to our website has the potential to lower our ranking so I need to be a bit careful with this.

We love a challenge so we have jumped right in - if we get the site listed within 3 days then our client will pay our SEO bill - otherwise theres no charge.

Over the next few days I'll report on whats happening and what we are doing.

How to grow your business web site

Clear content, simple navigation, and answers to customer questions have the biggest impact on business value. Advanced technology matters much less.

Read more on this in Jakob Nielsen's latest Alertbox

'Skinning' your Blog

Today we decided to 'skin' the spiral Blog to make it fit in with the rest of our site.

There are three great reasons for this:

1) To keep the spiral branding when people are reading the Blog. Having invested in a custom built web site with a look and feel to represent your company it seems silly not to carry this look and feel through to your Blog.

2) Bringing the main navigation from the website into the Blog so users can efficiently access your site.

3) SEO (search engine optimisation). Modern search engines rely heavily on two things content and links. The content on your Blog although not as keyword rich as say a well-designed homepage is likely to contain many of the key words and phrases relevant to your business. Links between your Blog and your site will help improve the ranking of both as they are indexed.

Once it has been 'skinned' and linked the Blog can be treated as part of the companies' web site rather than a separate entity.

Something else worth mentioning is a feed from your Blog can be used to add some dynamic content to your home page which will keep the interest of both users and search engines. See the right hand column of www.spiral.co.nz/ for and example of this.

Can't see your web site changes?

Sometimes clients phone us and say they can't see any changes to their web site. This is easy fixed and relates to the settings you have in your web browser. Your web browser caches (or saves) files, pages, images etc on your computer, in a temporary internet files folder, while you are browsing the internet. We make the changes and your browser, thinking its doing you a favour, displays the old page, which it has cached on your computer.

To fix this and see the new page immediately, you need to clear or delete your temporary internet files. If you are using Internet Explorer simply click on the Tools button at the top of the screen then Internet Options then on the General tab half way down you will see, under the Temporary Internet Files heading, a button -> Delete Files - click this then go back and look at the web site - you should see the changes in place.

2 tips for Google Ad-words

Results from our Google Adwords had been stunning for the year. Then wamo! over three days our entire marketing budget for the month was gobbled up by someone clicking on our ad and eating up the money.

And so 2 tips for running your Google Adwords campaign are to keep your daily budget capped to a low rate and review your campaigns regularly.

We've moved

The weekend move went very smoothly. You can find us at 240 Jackson Street, Petone - directly opposite the clock tower and upstairs above the chemist shop. The phone number stays the same.

We're moving

Yes, we are moving after just 12 months in our office in Gracefield. The lack of coffee shops nearby is too much - so Jackson Street here we come. We are hoping to keep our existing phone number, but Telecom will not commit to guaranteeing it. If you have trouble getting hold of us please, please phone me on my cell phone. The move happens this weekend - Labour weekend - should be business as usual on Tuesday 25th.

Taking my medicine

It seems I must take my own medicine and write more often to our blog. The subject of our next newsletter - which is in the final stages of beta testing - is once again - blogs. Now my natural inclination is to go off and talk about the wonderful technology around our new e-Newsletter but I should keep to one topic per blog (thats a tip for you!).

There is lots coming up for us at Spiral and much of it impacts, positively, on our clients. So first up is my committment to write, at least weekly to our blog and share with anyone interested what's happening. BTW (thats By The Way) the Dominion Post Mon 10 Oct has an article on blogs - go read.

e-Newsletter Upgrade just days away

Yes - after much discussion, programming, tweaking and tuning we are just days away from launching the Beta version of our new e-Newsletter software.

It has a much improved editor. My turn at sending newsletters comes tomorrow and I'll keep you posted.

-Audrey

e-Newsletter upgrade is on the way

Spiral's e-newsletter is getting an overhaul.

At our first project meeting today, Cain, Mary and Audrey defined our deliverables for Stage 1 of the project (and 'parked' a few readyfor stage 2!) and developed the first cut of our new and improved site menu.

The main outcome for users of Spiral's e-newsletter manager will be:

Refinement of the existing system to make managing your e-newsletters and mailing lists more intuitive.

Our project goals are to

• ensure a smooth transition for users of Spiral's e-newsletter by maintaining the overall navigation structure
• improve acccess to key functions by rationalising some menu items
• enhance the usefulness of the main console - currently called 'home'
• improve system help documentation

A targetted e-newsletter is a powerful marketing tool, delivering your message direct to your clients inbox. We'll be keeping you posted on our project to make Spiral's e-newsletter manager an even better solution for you to manage your e-newsletters and mailing lists.

New Web Site Developer joins Spiral

Welcome to Cain our new developer.
He is already powering through any work we throw his way.