1. Enable the PHP5 module in Apache:

   LoadModule php5_module libexec/apache2/libphp5.so

   This will normally involve simply removing the hash symbol (#) at the beginning of the line.

2. Restart Apache via the command line:

   sudo apachectl restart -t

   The -t is used to run a syntax check on the Apache file, to ensure you haven’t broken anything.

3. Locate the php.ini.default file in the /etc/ directory and rename it to simply php.ini by running the following commands:

   cd /etc
   sudo cp php.ini.default php.ini
   sudo chmod 666 php.ini

4. Create a file in the web server’s document root, in this case an index.php file, with the following text included:

   <?php phpinfo() ?>

   When you browse to that file, it will display information regarding your PHP installation. (Be sure to remove this after use and certainly don’t include it in a production environment.)

That is all you need to do. Easy huh?

As a point to note, if you need to make changes to either the http.conf file or php.ini, you will need administrative access and will need to restart the Apache server for the chances to take effect.

Eclipse started out as a Java IDE and has continually grown from there. Plugins now include, amongst a plethora of others, the venerable Aptana, CFEclipse, SQL Explorer, Subclipse and, more recently, the Adobe-developed Flex Builder and ColdFusion-equivalent codenamed Bolt.

Apache Ant is a software tool for automating software build processes. It is implemented using the Java language, requires the Java platform, and was originally developed to automate the build of Java projects. However, since Ant was created as a simple, platform-independent tool, it can really be used to automate the build of anything you choose.

Ant uses XML to describe the build process and its dependencies, using a file commonly called build.xml. Using this file, Ant makes it trivial to integrate unit testing frameworks with the build process and has made it easy for web developers to adopt test-driven development, and even Extreme Programming.

Fortunately for us, if you download and run Eclipse, you already have Ant installed and so do not have any complex configuration to concern yourself with; well, at least initially.

Setting Up Eclipse

For the most part, Eclipse has all you need to get up and running with Ant pre-installed. However, most projects will include a release target which uses FTP to upload the files to a live server. The FTP ant task requires some extra libraries (.jar files):

commons-net-*.jar
jakarta-oro-*.jar

(The library files can be downloaded from here).

Copy the files into the ant lib folder of your Eclipse install. The folder is commonly located here:

C:\Program Files\Eclipse\plugins\org.apache.ant_*\lib

(The asterix * refers to the Ant version).

Next, go to Window > Preferences and select Ant > Runtime. In the Classpath tab, select Ant Home Entries, click Add External JARs… and select the 2 files you copied to the ant lib folder.

A Typical Ant Project Setup

A project with ant build scripts should have the following within the repository:

• build.xml (the actual ant build script)
• build.properties.template (a template for individual build.properties files)
• an optional top level lib folder (containing jar files for external ant tasks)

Examples of the build.xml and build.properties.template files can be downloaded from here.

Create Your Own build.properties File

Make a copy of the build.properties.template file (name it build.properties) and set the values to fit your local setup (in most cases, the only property you may want to change is deploy.dir.local which is the path to the site on your local machine).

This file should never be committed to the repository (the repository should be set to ignore it anyway).

Basic Build Tasks

The build file should have a deploy.local task. This task builds the project and copies it to your local webserver (the path to the web server folder will be defined in the build.properties file).

Most projects should also have a deploy.dev task to copy the latest work to the dev server so that other people can view it.

Setting Up an Automatic Build

To make things easy, you can set deploy.local to run every time you save a file. This is called an automatic build.

The process for setting up automatic build is quite convoluted. I’m not sure why but this is the best way I’ve found to make it work.

Step 1: Add the build file to your ant view

Click the add button and select the build.xml file from the project. You can also drag the build.xml file onto the ant view (To add the ant view to your perpective, go to Window > Show View > Other…)

Step 2: Run as Ant Build

In your ant view, right click the newly added build file and select Run As > Ant Build… In the dialog window, select the ‘Hide internal targets not selected for execution’ option in the Targets tab. You can rename the builder in the box at the top of the window if you wish (I usually remove the trailing ‘build.xml’. Click Apply and Close.

Step 3: Setup automatic build

Right click on the project, select Properties, then Builders. Click Import. Before closing the screen, highlight the imported build and select edit. Go to the Targets tab select clean for ‘After a clean’ and deploy.local for ‘Auto build’. Apply the changes and close.

Step 4: Enable Auto Build

Go to Project > Build Automatically

Acknowledgment: Thanks should go to Martin Laine for his help and guidance which resulted in this article.

Why should you be worried about security?

The Web is changing many of the assumptions that people have historically made about computer security and publishing. As the Internet makes it possible for web servers to publish information to millions of users, it also makes it possible for computer hackers, crackers, criminals, vandals, and other “bad guys” to break into the very computers on which the web servers are running. Once subverted, web servers can be used by attackers as a launching point for conducting further attacks against users and organisations.

It is considerably more expensive and more time-consuming to recover from a security incident than to take preventative measures ahead of time.

This blog post started on the premise of protecting your website from a SQL Injection Attack. However, it is also appropriate to discuss, at a relatively high level, how to secure your server architecture and applications.

Server-Level Security

• Separate web- and database-servers on to different physical machines.
• Secure the web- and database-servers with traditional techniques. Only authorised accounts should have the capabilities to run tasks on the machine. That means not giving admin-rights to the user account.
• Keep servers up-to-date with the latest patches and software releases.
• Minimise the number of services running on the server. This means limiting the services to only those required for the web- or database-servers to function.
• Secure information in transit between servers. This may mean physically securing the network to prevent evesdropping via encryption or obfuscating the data amongst innocuous ‘noise’.
• Secure the database server behind a firewall.

Application-Level Security

• Separate ColdFusion, the webserver and database server user accounts. They should never be under the same system account.
• Create a database user specifically for your ColdFusion datasource and restrict it to only the activities required for the application. The user should not have database-owner rights, access to databases not relating to the application or access to the system tables.
• Revoke privileges in the ColdFusion datasource definition to prevent the SQL commands CREATE, DROP, GRANT, REVOKE and ALTER.
• General settings in the ColdFusion Administrator:
  • Check the Disable access to internal ColdFusion Java components option.
  • Check the Enable Global Script Protection option.
  • Add a Missing Template Handler.
  • Add a Site-wide Error Handler.
  • Reduce the Maximum size of post data from 100MB.
  • Enable Timeout Requests, and set to 60 seconds or less.
  • Disable Robust Exception Handling on production servers.

Code-Level Security

• Application.cfc – Set the scriptProtect Application variable to true to enable application-wide cross-site script protection.
• CFQueryParam – This tag, importantly, verifies the data type of a query parameter and, for RDBMSs that support bind variables, enables ColdFusion to use bind variables in the SQL statement. Bind variable usage enhances performance when executing a cfquery statement multiple times.

  <cfquery name="qry" datasource="#APPLICATION.dsn#">
  SELECT column1, column2, column3
  FROM tableName
  WHERE column4 = <cfqueryparam value="#variable1#" cfsqltype="cf_sql_bit" />
  AND column5 LIKE <cfqueryparam value="%#variable2#%" cfsqltype="cf_sql_varchar" maxlength="200" />
  AND column6 IN (<cfqueryparam value="#variable3#" cfsqltype="cf_sql_integer" list="true" />)
  </cfquery>

  There are limitations to the use of the cfqueryparam tag. In ColdFusion 7 for example, you cannot use them in queries using the cachedWithin attribute. Similarly, they cannot be used in ORDER BY clauses, although the use of conditional logic should resolve the need for order by variables.

• Functions – As a rule of thumb, validate all the data being passed into a query prior to it being used. ColdFusion MX 7 saw the introduction of the isValid() function. This function tests whether a value meets a validation or data type rule and can be used to replace a large number of type-specific functions such as isArray(), isBinary(), isBoolean(), isDate(), isNumeric() and isSimpleValue() etc.
• Stored Procedures – I often favour the use of stored procedures over standard queries. Not only do they add an additional level of performance, they provide an additional level of security; ColdFusion does not do any raw processing of queries in the web code, it simply passes variables down the wire to the database server.

Additional Resources

• Web Security, Privacy and Commerce
• O’Reilly’s The Web Application Hacker’s Handbook
• Adobe’s whitepaper – ColdFusion 8 Developer Security Guidlines (PDF, 281k)
• Adobe’s whitepaper – ColdFusion 7 Developer Security Guidlines (PDF, 217k)
• Adobe DevNet – Learning Stored Procedure Basics in ColdFusion 8
• 0×000000 # The Hacker Webzine’s article on Attacking ColdFusion
• Three part series from Mark Kruger (ColdFusion Muse) – Part 1, Part 2, Part 3
• Brad Wood’s article on CFQueryParam is not just for security.

Installing Apache under Windows XP was relatively trivial. This is not the case under Windows Vista. The creation of the Apache service fails, but not overtly. Furthermore, the all-important conf directory can™t be set up by the installer, probably due to user permission problems.

I finally got it working with the following procedure. I used the latest version of Apache (2.2.4) and Windows Vista Business Edition.

1. Uninstall any previous installations of Apache Web server (Start > Control Panel > Programs and Features).
   Make sure that all old Apache folders are also removed (e.g. like C:\Program Files\Apache Software Foundation\…).
2. Turn off your firewall via the Control Panel.
3. Stop User Account Control (UAC).
4. Get the most recent version of Apache from http://httpd.apache.org/ and put it on your desktop, or folder of your choosing. The file I used was called apache_2.2.4-win32-x86-no_ssl.msi, but for ease, it is a good idea to rename the install file to apache.msi.
5. Start > All Programs > Accessories Right-Click Command Prompt and choose œRun as Administrator.
6. Via the command prompt, navigate to the folder in which the apache.msi install file is located.
7. Type msiexec /i apache.msi on the command prompt.

   

8. Run through the Apache installer.

   

   

   

   

   

   

   

   

   

9. I™m running it as a development server, so I left the domain as “localhost”.
10. Choose the default server on port 80 for all users option.
11. The default installation directory is C:\Program Files\Apache Software Foundation\Apache2.2\, but again for ease, you could change the installation directory to C:\Apache.
12. Reboot your computer.
13. The little Apache feather icon won™t appear on the task bar under Vista with the present version of Apache (2.2.4). To remove the œerror box that says blank or “the operation completed successfully on startup, go to All Programs > Startup, and remove the “Monitor Apache Servers” item there.
14. Browse to http://localhost. It should say “It works!” If it doesn’t, panick, or check your httpd.conf file by going to All Programs > Apache HTTP Server 2.2.x > Configure Apache Server > Test Configuration. Follow the directions for fixing the configuration file.
15. Turn your firewall back on.
16. Turn UAC back on too, if you like to be constantly bugged by control messages!

Good luck!

Performance refers to the response time of requests to CFML pages and Components (CFCs), whilst scalability refers to how the performance results change when the load on the server increases.

Factors Affecting Performance

• Hardware and software configuration
• Database and other external system requests
• Web server performance
• CFML application

Macromedia

• JRun 4.0: Configuring individual JVM settings for each JRun Server
• The Moment of Truth: Tuning Performance in JRun Apps and Environment
• JRun 4: General troubleshooting techniques for an unresponsive JRun server
• ColdFusion MX: Explanation of Request Timeout and threadWaitTimeout settings
• Server settings: the jrun.xml file
• ColdFusion MX: Tips for performance and scalability

Sun

• Frequently Asked Questions about Garbage Collection in the HotspotTM JavaTM Virtual Machine
• Tuning Garbage Collection with the 1.4.2 Java[tm] Virtual Machine
• Java Tuning White Paper
• jvmstat 3.0

Brandon Purcell

• ColdFusion Peformance Tuning Presentation
• Obtaining a Thread Dump with ColdFusion or JRun running as a Windows Service
• JRun Connection Closed Errors
• Performance Tuning and Monitoring Coldfusion or JRun
• Java Thread and How does it work?
• Advanced Debugging In JRun 4

Steven Erat

• Steven Erat’s blog: activeHandlerThreads or Simultaneous Requests: Less is More
• Simultaneous Requests in CFMX 7
• Keep Library Loaded – Check this box to retain the library in RAM
• SeeStack – Parse ColdFusion Thread Dumps Like a Pro!
• Request timed out waiting for an available thread to run
• Troubleshooting Tips For ColdFusion MX
• Help! My ColdFusion MX Server is Slow!!!!

Peter Freitag

• Peter Freitag’s blog: Tuning Garbage Collection Outline
• ColdFusion Garbage
• ColdFusion Memory Usage Stats
• Getting ColdFusion Server Metrics
• Have you tuned your JVM on ColdFusion MX yet?

Daemon

• Daemonite blog: Maximum JVM heap size for CFMX
• Enhancing CFMX logging

Others

• CFMX JVM Tuning – The difference between MaxPermSize and Heap Size
• Sarge’s blog: CFMX Performance Settings (JRun 50% CPU thread)
• Robi Sen’s blog: Hung Servers, Java.lang.OutOFMemory errors and Tuning CF JVM
• Misc: Java Garbage Collection Tuning
• Java Performance Tuning
• SeeFusion :: ColdFusion Server Monitoring

ColdFusion originated as proprietary technology based on Web technology industry standards. However, it is becoming a less closed technology through the availability of competing products. In fact, one could now make the argument that ColdFusion is even less platform bound than say raw J2EE or .NET, simply because ColdFusion will run on top of a .NET app server (New Atlanta), or on top of any J2EE app server (Websphere, JRun, Tomcat, etc.) In theory, you could move a ColdFusion app unchanged from a J2EE app server to a .NET app server.

Currently, alternative server platforms generally support Coldfusion MX 6.1 functionality, with minor changes or feature enhancements.

I have listed some of the alternatives in order of maturity/populrity. However, I will leave it up to you to decide which one is the best and easiest to implement. Please tell me your experiences.

BlueDragon

The BlueDragon Server family of Java-based servers (Server and Server JX) enables the stand-alone deployment of CFML. Both BlueDragon Server versions contain a built-in web server for development and testing, and each integrates with Microsoft IIS, Sun ONE/Netscape/iPlanet (JX only), and Apache web servers for deployment.

BlueDragon offers flexibility for the deployment of ColdFusion Markup Language (CFML) pages with native technology platform integration on the operating system, web server and database of your choice.

Visit the New Atlanta website at http://www.newatlanta.com to download the latest version of BlueDragon.

Railo

Railo is a ColdFusion Compiler for translating and executing of ColdFusion based websites. The Compiler translates the ColdFusion code into Java classes which can be executed on a Java server. Railo also comes with a runtime engine, which contains all necessary libraries for the translated code. Railo automatically detects wether to translate a ColdFusion file or when to use the runtime engine. You can compare Railo at best with JSP interfaces. JSP uses an other syntax but the main functionality is almost the same. Because Railo implements most of the JSP interfaces, it is highly compatible to JSP interfaces.

Visit the Railo website at http://www.railo.ch

IgniteFusion

IgniteFusion is a ColdFusion compatible script engine that runs ColdFusion scripts. In addition to Coldfusion CFML compatibility IgniteFusion has functionality that extends Coldfusion. Although in Beta, it is approaching release.

Visit the IgniteFusion website at http://www.ignitefusion.com to download the scripting engine.

BlueDragon offers flexibility for the deployment of ColdFusion Markup Language (CFML) pages with native technology platform integration on the operating system, web server and database of your choice.

http://www.newatlanta.com

BlueDragon is an alternative CFML engine comparable to Macromedia’s ColdFusion. It is exclusively licensed and distributed by New Atlanta from TagServlet Ltd based out of Scotland. ColdFusion is a proprietary technology based on Web technology industry standards, however, it is becoming a less closed technology through the availability of potentially competing products.

New Atlanta’s BlueDragon product, released in 2002, provides a ColdFusion MX 6.x-compatible platform to run CFML-based applications on a variety of platforms ( Windows, Linux, Mac OS, and more). While ColdFusion MX 7 offers new features not available in BlueDragon, some new features in CFMX 7 have long been in BlueDragon (such as sourceless deployment, server-based deployment on OS X, and more.)

BlueDragon 6.2 is available in four editions: BlueDragon Server and Server JX (similar to ColdFusion Standalone editions), BlueDragon for J2EE Application Servers (BD/J2EE), and BlueDragon for the Microsoft .NET Framework (BD.NET).

The first two editions are standalone servers which run on Windows, Linux, and OS X. With BD/J2EE, CFML applications can be deployed on any J2EE server, enabling integration of CFML and J2EE as enabled in CFMX. BD.NET uniquely extends the .NET framework and IIS to permit deployment of CFML applications as native .NET web applications, offering integration between CFML and ASP.NET that’s not possible with CFMX.

The Server JX, J2EE, and .NET editions of BlueDragon are commercial products which are available as 30 day unlimited trials which convert to a single-IP developer edition with no expiration. Purchase and licensing information is available on the BlueDragon site.

The Server edition, on the other hand, is free for deployment (though not for hosting, redeployment, or (as of the 6.2 release) commercial use. Intended to gain favor with those comparing to other free web application platforms, there are no differences in CFML tags supported in the free Server edition, but it supports only ODBC drivers on Windows (and only MySQL or PostgreSQL on Linux and OS X), it supports only IIS on Windows or Apache on Linux/OS X, and does not support secured (SSL) connections.

None of the limitations of the free Server edition exist in the commercial Server JX, J2EE, or .NET editions.

BlueDragon offers several advantages (tags, functions, and other functionality) not found in ColdFusion. Similarly, there are a few tags and functions found in ColdFusion that are not supported currently in BlueDragon. New Atlanta maintains a complete list of incompatibilities with Macromedia ColdFusion MX in the documentation.

The .NET edition of BlueDragon may indeed be the most compelling edition for many, since it’s something that ColdFusion MX does not support. Designed to run on Microsoft’s .NET platform, BD.NET not only enables CFML applications to leverage the powerful benefits of the .NET platform, it also opens the door to integration between CFML and ASP.NET as well as .NET objects.