Sid Sidberry Reads

From: http://buddypress.org/about/#profiles-box

BuddyPress will extend WordPress MU and bring social networking features to a new or existing installation.

BuddyPress is essentially a set of WordPress MU specific plugins. Each plugin component adds a distinct feature to BuddyPress and only handles functionality for that specific component (for example, private messaging). BuddyPress also has a core plugin that all other plugins require, it contains shared functions and performs the basic modifications to the WordPress MU interface.

Each BuddyPress component is independent. This means you can pick and choose which features you’d like.

It also means BuddyPress can be used in two different ways. You could use BuddyPress to create a complete social network from scratch, or you could use it to add desirable features to your existing blog network.

Check It Out:
BuddyPress » About BuddyPress

After thinking I was merely going crazy I’ve found out why php doesn’t seem to support all image functions. Ubuntu’s php5-gd package uses an older version of gd. So uninstall php, and build from source

More on this issue: https://bugs.launchpad.net/ubuntu/+source/php5/+bug/74647

Jim Plush has written a pretty decent overview of php’s bitwise functions. My only complaint is I wish he’d also used even numbers so readers could understand flag systems, but you can’t win them all

As an added bonus, he’s included a comic that explains binary counting in a way you’ll never forget ( If only all teachers taught this method )

PHP Bitwise Tutorial by Jim Plush

Wordpress checks to make sure your running on from the proper site location. Problem is sometimes you just need it to run.

ex: wordpress runs at elsid.net, admin runs at admin.iamsid.net

Or you run both your development and production version of wordpress from the same db

edit the get_option function in the functions.php file in the wordpress includes folder

replace :

function get_option($setting){
global $wpdb;

with

function get_option($setting){
global $wpdb,$_SERVER;
if(strpos(“siteurl|home”,$setting)!==false){
return “http://”.$_SERVER['HTTP_HOST'];
}

you could use the update option function, but it adds unneeded overhead

I have a friend I’m teaching foundation security to. This post is for him, but also as a protest to some of the materials I’ve found when looking for reference material for him.

Security at it’s simplest form is common sense. ask yourself, how can I make sure I get exactly what I want? How do I make sure I only give what I want. One article mentions xss attacks, and only says prevent them. Why? Thats the question alot of people have when starting why? So why not teach them how to do it first?

How to avoid sql injection / xss, and other misc attacks.

As mentioned this is part rant, part helpful. I’ll explain the following tips and why / how you do it.

• always use require_once, or include_once. why? it keeps someone from getting your files stuck in loops.
• clean everything that calls, enters, looks at your db.
• typecast whenever you expect a certain type of variable.
• control access and check permissions
• use your own sessions
• track everything in some form
• setup php correctly
• hide whats not to be seen / accessed

first off let me say I’m by no means a security god. Actually I’m not even an advanced user. Sad as it is maybe to say: I’ve never used pear. that said, the majority of attacks / exploits can be easily avoided. Why? because the majority of attacks on the web don’t come from hackers they come from script kiddies. We can be lax with our own stuff ( like this blog ), but any application you build for a client should at least have the basics.

Enough ranting now to the meat and tators…. I’ll keep everything short and sweet. fyi – this is pretty much a brain dump, so prob not in “good form”.

why do we use the _once functions?

if you have a file that loads another file, say index.php?get=/calender.php

what happens if someone changes get to /index.php? yeap your suck in a loop, unless you use require_once / include_once

simple huh?

State changes

Your first question is prob, what the hell is a state change? a state change is simply any change, anytime you change something, whether in the db, a file, an upload: it should always use post. why? Post can be hacked yes, but it’s harder to hack post.

imagine we’re using an online game
ex: update=1&user=87897&add_money=8.

so any user who can add will know: hey i can change add_money to 100 and gain 100 points. On top of that any user can now see all your get vars. Why does that matter? The less they know about your vars, the harder it is for a kiddie / developer to exploit it?

why else? It makes it easier to validate changes. Why? Honestly I don’t even remember why right now, but hopefully you won’t hold that against me

all users are evil

I know kinda overzealous, but you need to have this mindset, why? users will accidentally mess up your system every chance they get. And script kiddies love telling you how l33t they are if they do something as simple as figure out how to make a game page display a different page.

as for making a game page display a different page, honestly: who cares ( yes that was me venting). But in order to prevent accidents, or worst kiddie hacks, control everything! I’m not saying make your app so restrictive that users hate it, but – actually an example would fit best.

today the team made a new flash widget that requires user data.
ex1: pass user data as flash vars, then use loadvars to pass update to server

or more secure
ex2: use loadvars to recieve user data from server, and then pass update to server with loadvars.

in this example we could have honestly used either way as the update script validates all data and any real changes are driven off the database, not the state change, but you get the point. Its one less thing worry about if a user decides to try and change the vars passed, and also one less file to update if we change something.

Users will enter strings when numbers should be entered, upload swf’s when you only want images – you get the point. And the point is validate, and whenever possible take the control from the frontend and move it to the backend.

Be as lazy as possible

I say I am a smart lazy person. building 30 different files takes more time than building one file, and using includes, or a template structure. Pretty lazy huh? but also easier to update and more secure. The more files you have that each have their own independent / copy + pasted code, the more opportunities you have for a slip up. Make one file, and let it handle the logic. You’ll have more freetime, and get more sleep. Or maybe you’ll just spend that time working on more projects. See being lazy is a good thing, but only if done correctly.

we can take this a step further and say why even ftp into the server, it’s so time consuming. why not just build a backend that not only manages your files, but controls access to them – Thats more of a teaser than anything, but try it out, you’ll like the results.

typecast whenever possible

imagine we’re using an online game
ex: update=1&user=87897&add_money=8

ok so what if someone changes add_money to a delete statement, or attempts some form of sql injection. whats the simplest way to defeat it? $money=(integer) $_GET[' add_money'];

Yeap one simple change is all it took to defeat the sql injection. why? Typecasting is basically a way of forcing something to be something. huh? if i want a value to always be an integer, i use (integer). If I want a double i use (double), string (string).

Yeah it’s that simple. the only issue i’ve run into is that you can’t use typecasting in defining function / method params. huh?

ex: function foo((integer)$f=0)

that will cause an error, but you can do

ex: function foo($f=0){

$f=(integer)$f;
}

Make sense? of course I can’t force something to (mocha frap with extra mocha) $coffee, but thats life. good now on to more, or learn more about typecasting

Validate, validate, validate

using typecasting is great for numbers, but theres other ways to validate your data. the best and most powerful being regular expressions

ex: preg_replace(‘/[^a-z0-9]/i’,”,$value);

The above regex replaces any non alpha numeric characters in value. spend sometime getting comfortable with regex as its an extremely powerful and useful feature. Not just for validating data, but regex has many other uses as well.

Be a neat freak, or cleaning your sql

By now you understand sql injection, if not

ok so now we all understand it. basically its a cool way of saying, someones trying to make my query do bad things, but saying it like that would make me should like a user, so we say sql injection and confuse the heck out of clients :p

we just saw how to prevent one form of sql attack. now lets see how we can handle preventing them at the query level.

Whenever data is sent to your db it should always be cleaned. Me I like to make sure both the table, columns are cleaned using a function that makes sure tables / column names follow a standard, and a cleaning function for actual data. Why? When developing an app from scratch you normally have freedom over how tables, columns are named. I prefer to keep all tables and columns lower case, and only allow _ as a special char (non alpha numeric character). what does it look like?

ex: //convert name to proper db format
function dbProperObjectName($objectName){
//if you want to use caps is table / column names then please uncomment this
$objectName=strtolower($objectName);
return @preg_replace(“/([\\x00-\\x2d\\x3a-\\x40\\x5b-\\x60\\x7b-\\xff{$this->mSystemDatabase['restricted_chars']}\\x2f])/e”, ‘_’, $objectName);
}

You can ignore the {$this->mSystemDatabase['restricted_chars']} thats some carry over from the db class. If you don’t understand what heck that says I’ll explain. first I’m changing $objectName to all lowercase, if it’s not already. then we’re using a regular expression (regex) to clean our string of anything thats is not a letter or number and replacing it with _. why does this matter? because if for any reason our table name contains a sql injection, when ran it will only return nothing. why? because if $objectName was SELECT * FROM HOME, it will now be select___from_home. which will return nothing because select___from_home isn’t a valid table. See and you thought cleaning wasn’t fun.

Ok you do windows, but what else?

As much fun as cleaning a table name maybe, we really need to make sure our data is safe. why? ummm because I say so. There are many reasons, ranging from controlling content, preventing xss, sql injection. But I like to think you’ll do it because users are evil

ex: //strip bad things from a string you plan to use in a query
function dbFriendlyValue($value=false,$fixNewlines=true,$allowedTags=[pass your list of allowed tags here]){
//if no value then just return 0, use this because empty returns false if $value =0
if($value===false) return 0;

//convert to string for checking, this is fine for text / numeric values
$value=(string)$value;

//strip slashes if magic quotes enabled
if( get_magic_quotes_gpc() ) $value = stripslashes( $value );

//clear white space
$value=trim($value);

//fix \r\n
$value=str_replace(“\r\n”, “\n”, $value);

//clear tags (except allowed) or just use html entities
$value=(!empty($allowedTags)) ? strip_tags($value,$allowedTags) : htmlentities($value, ENT_QUOTES);

//change newlines to <br>
if($fixNewlines) $value=nl2br($value);

//clear any bad sql we might find untested regex
$value=@preg_replace(‘/(insert(\s?)into|\).(\s?)values.(\s?)\(|DELETE.(\s?)FROM|CREATE.(\s?)[datbsetl]{5,8}|alter.(\s?)[datbsetlcoumn]{5,8}|drop.(\s?)[datbsetlcoumn]{5,8}|update.\s?(.*?).\s?set|alter.(\s?)[datbsetlcoumn]{5,8})/i’,”,$value);

//add slashes
$value=(@mysql_real_escape_string($value)) ? @mysql_real_escape_string($value) : addslashes($value);

return $value;
}

woah what the hell was that? it was me doing the windows and the oven. lets break it down

when calling the function we pass the value, whether to fix newlines ( default : true) , and the string containing allowed tags if any.
next we make sure we have a value to clean, if not return 0, just in case the function is being used to create a sql statement. we check for magic quotes because if this value came from a submitted variable and magic quotes is on, it will add slashes. if its on the strip those slashes so we can continue.

i’ll skip trim and str_replace, now we’re at strip tags. php is pretty good at striping tags, but you want another option use htmlentities( $value, ENT_QUOTES)

and now on to our regex. this is untested ( sorry still building the class ), but points you in the right direction. the regex searches the value for any sql statements and strips them. lastly we add slashes to our value to make its sql / db safe.

woah – we’ve covered alot. almost done

setup php right

TURN OF REGISTER GLOBALS! yes thats all caps for a reason. Also disable magic quotes and change the headers sent my apache to hide version / software information. Can’t turn of register globals? try this function:

function clearRegisteredGlobals(){
global $_GET,$_REQUEST,$_POST,$_SESSION,$_COOKIE,$_FILES;

//check if register globals is on – register globals check taken fron drupal installed patch : http://drupal.org/files/issues/register_globals_check-D6_3.patch
//get php ini setting
$register_globals = trim(ini_get(‘register_globals’));
//check ini value
if(!empty($register_globals) && strtolower($register_globals) != ‘off’){
//ok now lets clear the variables set with register globals

//make array of superglobals
$registered=$_REQUEST;
$registered=(!empty($_POST)) ? array_merge($registered,$_POST) : $registered;
$registered=(!empty($_GET)) ? array_merge($registered,$_GET) : $registered;
$registered=(!empty($_SESSION)) ? array_merge($registered,$_SESSION) : $registered;
$registered=(!empty($_COOKIE)) ? array_merge($registered,$_COOKIE) : $registered;

foreach($registered as $var=>$void){
@unset($GLOBALS[$var]);
}
}
}

Hide everything

hide everything – that simple. if a folder, file, etc doesn’t / should be seen hide it. How? well if you use the .inc file extension like me, configure apache to handle .inc files with php. another option, or added protection: use htaccess to prevent access to .inc files, this will not effect your scripts, just web browsing.

In addition to hiding your inc files, don’t allow access to directories that aren’t needed to view your site. so you images directory should allow access, but your lib, class, or inc folder shouldn’t.

Important files (db config) should be in a directory outside of your hosting directory, but if you name it .inc, or .php and follow these directions you should be ok.

Lastly – turn off directory browsing.

Control access

ever part of your site should have an access level. So areas like your home page, public areas would a level 0. areas a users settings page would be a 1 (making sure only the user can access it of course), and your admin area – thats another story. Your admin area is the heart / backbone / investors dream of your site. That said protect it! all users in your admin should have an access level, and different parts of admin should have different access requirements.

ex: moderator – login, see’s flagged post area, does not see links to other areas, can not access other areas. manager: login, sees users, can add or remove users, but can not access critical site areas, and can not add a user >= his level. Admin can do almost everything, and lastly: rot – your root account can be named anything, but only allow one account full control over the system.

so quick review: users should only be able to see and access areas within their permissions scope, users should never be add / give users permissions >= their permissions.

Lastly, track everything your admin users do. You can go as far as adding an approval system for changes, tying your backend to svn to undo / redo changes, it’s pretty much up to you and the project / budget.

using sessions

sessions are like raymond, everybody loves them. But if your depending fully on php sessions you should make some changes. There should only be 1-2 cookie and session variables sent ( you can also send session id with get ), everything else should be handled internally in your application. Which means session / user validation, tracking, and variables.

misc

• using isset only tells you if a var is set, not if it contains a value, use empty instead.
• instead of adding more columns to your db for certain options, you can build a flag system. this allows you to add new options, without always adding a new column.
• encrypt sensitive data (ssn’s, sin’s, cc data, phone taps, next weeks lotto numbers)
• aes is your safest bet if your using encryption
• if your using encryption, you need to spec out an information access process, permissions system (more than just roles)
• kiss, the simpler it is to the end user, the less likely they are to break, figure out how to exploit it.
• Variable names shouldn’t match table column names
• separate code from design. not so much security a being smart and lazy – saves alot of work in the future

Read the php manual, you’ll find lots of good advice / functions in the classes.

Are we done?

Yes, hopefully someone gets something out of this, and I kept my promise of short and sweet. a quick google is all you’ll need to learn more about a subject. so right click -> search google

Gotta question, feedback, or recommendation? leave a comment

Cheers Sid / Greg

I realized I left out alot while reading part1, so i’m covering more here, an possibly in additional posts

disable plugins if not in wordpress 

You’ll need to use wordpress on the backend from time to time, mostly for login / logout functionality. You should build a connector class to handle this. When using wordpress via your class outside of your actual wordpress install you should disable you wordpress plugins. why? less to load, and i’ve found some plugins have issues when loaded by wordpress outside of the actual wordpress installation.

 in wp-settings.php near line 231 replace

if ( get_option(‘active_plugins’) ) {
$current_plugins = get_option(‘active_plugins’);
if ( is_array($current_plugins) ) {
foreach ($current_plugins as $plugin) {
if (” != $plugin && file_exists(ABSPATH . PLUGINDIR . ‘/’ . $plugin))
include_once(ABSPATH . PLUGINDIR . ‘/’ . $plugin);
}
}
}

with

if(!defined(‘NO_PLUGINS’)){

if ( get_option(‘active_plugins’) ) {
$current_plugins = get_option(‘active_plugins’);
if ( is_array($current_plugins) ) {
foreach ($current_plugins as $plugin) {
if (” != $plugin && file_exists(ABSPATH . PLUGINDIR . ‘/’ . $plugin))
include_once(ABSPATH . PLUGINDIR . ‘/’ . $plugin);
}
}
}
}

What we just did was change the plugin loading portion of wordpress to not load plugins if we define the NO_PLUGINS flag.

Loading wordpress for your connector class 
In your class file you should load the required wordpress files before your class. Something like:

if(!defined(‘DB_NAME’)) {
define(‘NO_PLUGINS’,true);
require_once(FS_WORDPRESS.’/wp-config.php’);

}

 I’m checking for wordpress by looking to see if the DB_NAME is defined. This check will tell if we’re already in wordpress, its not rocket scienece just a check for a wordpress only varibale. If it’s not defined then plugins are disabled. simple right?

 login user to wordpress at site login.

When a user logs into your site, they should automaticly be logged into wordpress. this is of course assuming that your not trying to actually keep wordpress seprated, but then again that defeats the purpose of this thing that somehow turned into a tut (pardon me i seriously need some sleep)

 wordpress was loaded via the previous code, now we’ll still need to load the specific files that contain our required wordpress functions.

require_once( ABSPATH . WPINC . ‘/registration.php’);
require_once(FS_LIBRARY.’/User.inc’);

By loading the registration.php file we’ll now have all the functions needed for handling wordpress login, logout, and registration functions. Why do we want to register a user? simple new users (or old users if you don’t want to write an import script.

the following is of course assuming that your site is setup correctly.  when a new or current user attempts to login we’ll check to see if that user can in fact login or exists. if the user exists its safe to assume that they have updated their password on the main site, so we’ll update their password, and attempt to login again. for users who aren’t already in the wordpress db, we’ll run the wordpress registration functions ( removing their validation requirement of course ). because wordpress is running as an addon to your current saite, your actual site should be handling user checking etc, and only allow valid users access to this area, and only if their username matches the user session ( sorry not covering all that right now).

heres some sample code, please note your passwords shouldn’t be in plain text format, but this sampleuses plain text passcodes to show how. you can remove the md5 functions and do your own thing from there

    /*this function adds a user to wordpress, their is no error checking as users are checked, updated, created at login*/
function register($username, $password, $email){
global $wpdb;
//make sure we have a user

if(!empty($username) && !username_exists( $username )){
/*create user and update their wordpress account to not require activation*/
@create_user($username, $password, $email);
$wpdb->query(“UPDATE $wpdb->users SET user_pass = MD5(‘$password’), user_activation_key = ” WHERE user_login = ‘$username’”);
}
}

/*this function is only called from the login function in your  site user class
at the point its called we have a valid user, so we need to make sure the user can access wordpress*/
function login($user_login, $user_pass){
global $wpdb, $_SERVER;

//attempt login
$logged_in=@wp_login($user_login, $user_pass);
/*if login fails but user name exist
then user was created by an admin
so we’ll reset their wordpress password and update their email address, just in case they changed it*/
if(!$logged_in && username_exists( $user_login )){
$user    =&new YourUserClass($user_login);

$wpdb->query(“UPDATE $wpdb->users SET user_pass = MD5(‘$user_pass’), user_email=’”.$user->emailAddress().”‘ WHERE user_login = ‘$user_login’”);
}else{
/*the user hasn’t been added to wordpress, add them */
$user    =&new YourUserClass($user_login);

WordPressConnector::register($user->userName(), $user->password(), $user->emailAddress());

}
do_action_ref_array(‘wp_authenticate’, array(&$user_login, &$user_pass));

//ok we now have a valid wordpress user
//if not logged in then login user
$logged_in=(!$logged_in) ? @wp_login($user_login, $user_pass) : $logged_in;

if($logged_in){
wp_setcookie($user_login, $user_pass, false, ”, ”, true);
do_action(‘wp_login’, $user_login);

}

return $logged_in;
}

function logout(){
global $_SERVER;
wp_clearcookie();
do_action(‘wp_logout’);  

your_site_redirect_function();
}

If you have any questions, leave a comment, or just leave a comment if this was helpful.

Sid

Ok so to add to an already awesome day I ran across the javascript version port of the tweener actionscript class.

If you don’t know about tweener they link to it on the page,

JSTweener – CodeRepos::Share – Trac

JSTweener’s transitions is Tweener’s easing functions (Penner’s Easing Equations) porting to JavaScript?.

Powered by ScribeFire.

I’ve been up all night working on a project ( and watching mythbusters – add at its best) and i ran into a head scratcher, in one of my classes i processes xml, but i’m unable to access any class functions or properies when the load function ” checkXml() ” is called. a quick double check confirms its a scope issue, but what do you do?

Kristopher Schultz has the answer, I felt stupid once I found the answer and I’m sure some of you will have a duh moment to.

Kristopher Schultz » Handling XML.onLoad events within classes

Powered by ScribeFire.

this is more for my reference than anything, but I cover the areas i modified to integrate wordpress in to a clients current site. I’m posting this, mainly to keep me from having to compare files everytime i do a wp upgrade. its by no means a solid tut as there are additional site classes / templates I’ve made to integrate the look / site functionality / security that are also used and not mentioned / documented here. as i said it’s written for myself, so i’m assuming you understand php / wordpress

wp-config.php

on the very first line of config.php include either the db config file, or the site wide control include (file that handles all of the general includes, etc)

set wordpress db config to use the globally defined vars. ex: define(‘DB_NAME’,SITE_DB_NAME);

any additional wordpress only includes should be included at the end of this file.

i also added in a secondary check to see if the current site user is logged in to wordpress, you can gt the current user as follows :
$the_user= wp_get_current_user();
$user_ego=$the_user->user_login;

if the current user is logged in to the actual site, but not into wordpress, i attempt to log them in using a login function in my custom site to wordpress connector class.

wp-db

bottom of file change :
if ( ! isset($wpdb) )
$wpdb = new wpdb(DB_USER, DB_PASSWORD, DB_NAME, DB_HOST);

to
if ( ! isset($wpdb) ){
global $wpdb;

$wpdb = new wpdb(DB_USER, DB_PASSWORD, DB_NAME, DB_HOST);
}

this will fix issues you run into when including the wordpress connections into a site / custom class.

Admin Area

open wp-admin/admin.php, setup any globals that are needed to require a vliad user for an area. ex: define(‘REQ_VALID_USER’,true)

wp-config will be included immediately after this. look for the line that says $posts_per_page, and add the something like following to limit access to the actual admin area:

global $current_user;

wp_get_current_user();

if(!empty($current_user)){
if(intval($current_user->user_level)< =WORDPRESS_LIMIT_ACCESS){//this var should be defined in your site wide define file
global $_SERVER;
$url=$_SERVER['REQUEST_URI'];
if(strpos($url,”?”)!==false){
$url=substr($url,0,strpos($url,”?”));
}
if(strpos($url,WORDPRESS_ADMIN)!==false && strpos($url,WORDPRESS_LIMIT_ADMIN_STR)===false){
header(‘location: ‘.WORDPRESS_LIMIT_PAGE) ;
exit;
}
}

}

the above code will check the curent url against the allowed urls for general users in admin, as well as redirect them to they limit page (write post) if they aren’t at the proper level. everyone else will be able to use the admin according to their level.

limiting post categories
either wp-admin/admin-functions.php or wp-admin/include/template.php

look for : function write_nested_categories( $categories ) {

limit categories as needed for general users, but be sure to leave an unmodified version for admin users.

remove nav for general users
replace : require(ABSPATH . ‘wp-admin/menu.php’); with
if(intval($current_user->user_level)>WORDPRESS_LIMIT_ACCESS){
require(ABSPATH . ‘/wp-admin/menu.php’);
}

customise nav header
wp-admin/admin-header.php

peace, sid

THIS PROJECT HAS BEEN SHUTDOWN, CEASED, SHOT, STABBED, ETC

Why?

I’m shutting down this project due to spam concerns, lack of time, and because it can be done a lot better.

Next Steps

http://myspaceapi.info It’s not live, and i have no idea when i’ll start or finish it, but i’m aiming for an end of the year launch. I’ve realized a lot of flaws in both the execution and direction of this project, and will release a web based service / api that i hope better meets the actual needs of users vs a class of functions i toss together as time permits i hope to release a full fledged api for myspace. a big thanx to Design Is Fuel. They’ve pointed me into a much better direction and i think everyone will be happy with the results.

the class as it stands is open source – basically that means everything you can download from this page is yours and the web’s.

To everyone that contributed : Don’t worry i’m axing the entire class and working from the ground up. but please send me your info if it’s not listed so i can add it. once the api gets up i’ll release a developers resource.

—–here’s the old page

This version is released as is.

After trying to play catch up with myspace i’ve chosen to rewrite the entire class. this should hopefully allow for a better application. this version was released on june 18, 2007, and is the last version to be released before the rewrite.

You’ll notice this version includes what is the start of documentation. from this date forward i’ll include the entire documentation site as part of the zip.

Project Page

This will be the permanent page for this project from now on.
http://elsid.net/myspace-access-class/

What is the MySpace Access Class?
The access class is a php4/php5 class to allow anyone to access myspace remotely. It is not a proxy service.

Requirements?
php4/php5, curl

Demo / Documentation : http://myspacedemo.elsid.net

File : http://myspacedemo.elsid.net/accessClass.zip

Features

• blog posting
• comment posting
• friendslist navigation
• myspace navigation
• music player extraction
• functions to pull data from user page
• error support (includes php errors)
• friend adding
• settings for debugging mode, error displaying and recovery
• logs out of myspace at close
• functions for collecting hashes, hidden fields, etc.
• url tokens are automatically extracted / included
• captha functions (needs testing)
• bulletin posting

Who makes this?

Primary Developer :
Myself – Greg Sidberry – poetics5 [ at ] yahoo.com

Contributers :
Brad Turcotte – brad [at] bradsucks.net
initial development, feedback, getMyspaceFriends()

FB ( still no idea what his name is) – thegreatfb [ at ] gmail.com
extractText(), extractMyspacePlayer()

Contributing

I love it when other people make functions, keeps me from having to. If your trying to write a function and it doesn’t work – contact me.

Please send any code as a php file. I try to fix any broken functions that are sent to me, and include or update all functions sent to me.

Common Questions

is this an extension? no this is a php4 class. It will work with wordpress, drupal, pretty much anything running php.

whats new? friend requests, bulletin posting

do you plan on ever fixing your site? one day

Do you offer support? yeap, actually about 4 of the functions in the class come from people trying to make new functions and contacting me for help.

i’m adding a function, do i need to let you know? yeap, send it over so i can add it.

why are you so damn sexy? genetics

will you always offer support? yeap, as long as there is a page there is support

umm i’d like to hire you. yippie money, you can contact me directly at poetics5 [ at ] yahoo.com, or contact the guys that feed me http://designisfuel.com

why are you writing a class you don’t even use? i like to help my friends, and by friends i mean people i don’t know.

i’d like to give you money! yippie paypal : greg [ at ] sidneyblack.net

umm i can’t make this work? see the support question, i’d say rtfm – but there isn’t one.

Licensing, usage, and restrictions

If you use this in a commercial project – please make a donation.
If you add a function – Send it to me.
Do Not Use This Class To Spam!!!!

Other than that I love linkage love, comments, and suggestions…

This Class is provided as is, and is in a constant state of development. all versions are released as alpha.

Future Tasks

I’d like to put together proper documentation for this project, svn access, and trac.

Development

If you’d like to contribute, or would like to help with the development process please contact me.

at the moment this project has an ActiveCollab area setup for potential developers.