Rob's Ramblings

So my blog has gotten a little dusty, this is going to happen from time to time. This is beginning the my busiest time of the year annually at work, and I also had some elective surgeries done in January to repair some longstanding issues finally fixed. While being doped up on Vicodin would make for some interesting blogging, I felt discretion was the bestter path to take...

But today Viviotech gave me a late Christmas present and upgraded my VPS to ColdFusion 9 (woo hoo!) and my old Mango Blog bit the big one because of it (boo!). I'm not sure why this happened, I had not altered the code in any meaningful way that shold have caused it to bomb. And to be frank, Mango Blog's error handling is... less than informative - even with Coldfire running I couldn't find much in the way of meaningful error messages to work on.

So, I backed up the database (God love MySQL for making this task a cinch compared to MSSQL), and nuked my old blog code and installed the latest (v1.4.3). Then after a little trial and error with the database, I got it all back running. In doing so, I had lost the mods I had made to the old design, so I am using this one as a starting point. I like the layout, but not a big fan of the blue, so on my to-do list now is a revaming of the color scheme.

Now that I have CF9 on here, I'm looking forward to some big things in 2010. It will get even better when my day job finally gets out of the Stone Age and gets up up from CFMX7 to CF9 in a few months! It feels like being caged when there's so much that you either cannot do, or have to jump through so many hoops that it's more cost-effective to wait for the CF9 cavalry to arrive.

I wanted to pass along my experiences from my Flex Training for ColdFusion Developers that I took yesterday in Chicago.
 
This was a course from Adobe that was along the lines of an "intro to..." kind of course regarding Flex. Flex is the bridge that connects Flash to a backend (in this case CF9 but it can connect to any backend). It was aimed at people with my skill sets, but it was clear within the first hour that if you had some Flash and Actionscript background you were going to get a lot more out of it. I had neither, but I was able to follow along well enough.
 
Our trainer was Jeff Tapper, a senior Flex developer who has worked on some high profile projects, most recently working with Major League Baseball on their MLB.tv video feeds (I hope I got that right). He took a good amount of time in trying to make sure that we did not fall behind much.
 
On the Flex/Flash end they laid out some interesting (albeit very basic) usages. A lot of using Flash as a front end for basic forms and having it call CF9 to do some processing and returning data to the front end without a page reload. They did show that Flex can do form validation natively, and since it is not tied to a feature that can be disabled like JavaScript, it lessens the need for writing both front end and back end code for data input validation to a nice-to-have instead of a must-have. With a standard HTML front-end, if a user disabled JavaScript they could still submit the form and therefore having server side backend validation is an absolute must. Here, they either have Flash enabled and get it all, or they don't and don't see the form. There is no in-between.
 
Using Flash Builder you could set the Flash compiler to make the flash application accessible with a single checkbox in the options. I would be curious to see what our 508 team would think after taking a look at some of the demos we did, to determine if it truly is 508-compatible or not.
 
I did like the Flash Builder tool a lot, it has a nice GUI interface for creating the Flash front-ends and allowed you to manage some of the actions for the form objects as well. If I was going to build a Flex application, I would choose to use Flash Builder (which is built on the Eclipse IDE). But it costs at least $250 for the standard copy, and can get up to $700 for the Premium (which includes network monitoring to test the efficiency of your Flex application).
 
What I would need though is a lot more training on the Flex language itself. This I can self-teach given time I believe, but there's a lot still to be learned on that front.
 
What I ended up walking away most impressed with though was the new CF9 server and the ColdFusion Builder application. CF Builder is currently in Beta 2 phase, and is also an Eclipse-based IDE. It did have a couple of bugs but nothing major, and I really liked how it could be integrated with your CF server, either a local one or a remote one, to give you some control over the server, and through RDS get a lot of quick access to the database.
 
As far as CF9, the single biggest thing I walked away from this was the introduction I got to CF9's ORM (Object Relational Mapping) feature. After a first introduction to it, and watching a couple of other presentations on it since, this could be a tool that changes how we interact with databases. It enables you to write fairly generic code, and use functions instead of queries for accessing the database (and supports all parts of a CRUD interaction). Because of this, you could write CF code that would work the same with a database no matter what server it's on - be it MSSQL, MySQL, or Oracle (to name the three most common ones). It also takes a lot less code to interact with the database, which will save us time in coding. ColdFusion Builder has extensions that can speed this up even more, by connecting to your database via RDS, reading the configuration of a table, and auto-generating the components needed for you. CF9 also natively handles a lot of this communication as well. If you couldn't tell, I'm pretty excited about trying this out.

Thanks to Ray Camden's blog post that told me about this offering, I am going to be taking a full day of Flex training from Adobe in Chicago on November 19th. The last time I took Adobe-sponsored training was from the folks at Figleaf a few years back, and it was a great experience. I am really looking forward to doing this. Oh and a night in the Hyatt Regency Chicago should be pretty sweet too.

Those following the PHP vs. CF drama may wonder why I am doing this - or more specifically, why this would be covered under my company's training budget - is that the fight for CF is not close to being lost it seems. Turns out that due to contractual stuff, we should be able soon to upgrade from CFMX7 to CF9. That's good news for me as well!

A couple of things have struck me so far as I have been trying out basic tasks in PHP to get a feel for how they work. One immediate concern I have right now is database security in PHP.

The first red flag I have is PHP's insistence that you type in a username and password for the database user in the clear in your database connection code. To me this is just asking for potential trouble. Let's toss out this scenario - disgruntled PHP developer gets the boot. You now have to go and change the database username and/or password on the server in order to make sure things are secure, because that coder has the information he or she needs to get in and screw with the database, not just via PHP code, but with any client tool (assuming they have access inside your network, and let's be honest rarely is there a time when a disgruntled employee isn't that way while still being employed). Even if you code smart and just include your database connection strings in a function so you only have to make the change in one place, it's still a change that shouldn't have to be made.

Compare this to CF, which sets the database access information in the datasource creation in the CF admin. This allows a lot more internal security, as the only people that really need to know that access information are the DBA and the CF administrator (in many cases I imagine this may be the same person). The point is that you can really compartmentalize this information a lot better in CF than you can in PHP. The developers need only know the datasource name, nothing about usernames or passwords are passed along in that. In the case of the disgruntled employee, their access to teh database comes in a totally separate login that can be more quickly locked down without affect to other accounts and applications in the case you need to do so.

The other thing that so far has struck me (and I am sure that this is a pure lack of PHP knowledge on my part, but...) is that there does not seem to be a PHP answer to CFQUERYPARAM in terms of speed and simplicity for locking down your SQL queries from injection attacks. It looks like I need to dig into the mysqli() functions from what I can tell, but they don't seem as clean as CFQUERYPARAM is. File this one not so much under "PHP can't do this", but under the growing list of "PHP takes a lot longer to do this than CF".

Thoughts are appreciated on how or why this impression is incorrect.

In keeping with a time-honored tradition of mine, I finally got around to getting my certification for ColdFusion 8 just as ColdFusion 9 comes out. I did this for CF5 and CFMX7 as well. Mainly this is for me to check that box off my to-do list, but it's also a resume padder for my employer to use on proposals.

I admittedly did very little studying for this exam relative to what I've done in the past, and as a result I did not hit the 80% score needed to get Advanced Developer status. I got a 79%, which I guess means I'm the best of the rest or something like that. But this exam, unlike the other ones I've taken, spent a lot more time into some real niche areas of CF that I personally haven't used too much.

That being said, for those that do want certifications in CF, I highly recommend using CentraSoft's CF Exam Buster software. I've used it as my sole training tool in addition to my years of experience, and I think it's the best. Just next time, I'll use it for more than 2 days in advance of the the CF9 exam...