Web 2.0 means different things according to who you speak to, but one ubiquitous part of the definition is User Created Content (UCC). UCC essentially means giving the tools to create html on your website to someone other than the webmaster. And as soon as you give the keys to the castle to the great unwashed, then the great unwashed are going to try to crap in the moat.

Typically in blogs or discussion boards you will see a form that will allow people to post their comments, which will then be displayed on the page, below the main article. Sometimes you will want people to insert links into their comments, which immediately opens up potential Cross Site Scripting (XSS) vulnerabilities, usually in the form on inline javascript. XSS attacks are usually based around attaching javascript onto an html tag, so that when the visitor clicks on the link, it does something expected. For example redirects them to a phishing site, steals their cookies, or opens a load of pop-up windows.

A very crude attack would go something like this:

<a href="http://www.google.com" onclick="window.open('http://www.yahoo.com', '_self'); return false;">Click me</a>

Defending against this can be very problematic unless you strip out all tags… However there are a number of libraries that should help , foremost amongst them is HTML Purifier. As an alternative you can allow the use of BBCode to be inserted. BBCode is a simplified markup that lets you insert a basic tag like syntax that is parsed on the server into html tags. TinyMCE has plugin to enable the easy use of BBCodes, so it may be that for applications that let the general public create content, this is the safest route.

So you’ve probably heard of Dreamweaver and you might think it’s the best tool for producing websites, and in many respects it’s great. The multi-line search and replace is almost worth the price along. But if you’re doing serious coding in a language other than HTML and CSS, it really sucks quite badly. Why? Simply put, Dreamweaver’s code-completion in JavaScript and PHP is pretty non-existant. Why does this matter? Code-completion means the developer spends less time wondering what the hell a particular Method is named in a Class, and just get on with the important bit of thinking what he want’s the code to do. If you’re writing your own custom Classes, NetBeans has excellent support for PHPDocumenter, so as long as you make sure to document your Methods correctly, you can just pull up a nice list of all the Methods an object supports, with all the arguments nicely explained on the Method.

It also integrated nicely with XDebug, so you can do proper line by line debugging, rather than just echoing statements back to the screen, proper project support, the ability to define time-saving macros, plus excellent HTML and CSS code completion tools as well. And in my experience it’s much much quicker compared to Eclipse based tools like Zend Studio or PDT. It’s the closest I’ve found to Microsoft’s Visual Studio IDE that runs on the LAMP development stack.

So why should a little ol’ Web Developer near Bath need such things? Why not stick with Dreamweaver? Well, it’s free, it’s cross-platform and it lets me create Web-sites more quickly and easily for my clients. And they like cheap, effective web sites.