You have access to your own ecommerce web site with its own Password-protected Control Panel .  This allows you to manage various aspects and functionality of your web site such as:

Allow and configure the charge rate for tax and or delivery charges.

Add new items with or without images.

Upload  new images amd graphics or replace old ones.

Edit or delete an existing item;  Pricing or description.

Sort the whole database with a click, Alphabetically or otherwise.

Create more pages or delete or even rename your HTML pages as you see fit.

Edit your HTML pages (page contents) no HTML knowledge required.

Password manager allows you to change your password as often as you like.

Edit or create options drop down or radio buttons for customers to choose products by size and colour

Edit inventory.

Retrieve orders securely.

Is your website form turning you into a spammer?

© Tracy Brandt
http://www.Gryphynmedia.com

Those forms work using a form-to-email script (a script is a program), usually in Perl or PHP. They are also often called "form processors." Often one of the first scripts webmasters learn to install, they can be pesky for a novice to configure. A number of things can make them behave oddly, so forms are a big source of helpdesk questions.

Spammers can hijack your form through a number of vulnerabilities, using your email server to send out thousands of spam messages per minute, that all look like they came from you. They *did* come from you, which can result in you having your web hosting account shut down without warning.

Bad forms allow all of the fields to be filled with fake info, so the real spammer may be invisible. Even if you are not "really" the spammer, you are still the owner of spam generator.

Don't wait to fix this, thinking the spammers will miss your little site. FormMail exploits are the #3 source of attacks on websites.

Matt's FormMail from ScriptArchive.com is one of the most popular scripts on the Internet. Versions of it are in use on major websites and web servers, and in hosting management packages. In fact, it's so popular that people use "FormMail" to refer to all form-to-mail scripts, like they call all paper tissues "Kleenex."

But the tech news is just stuffed with security alerts. Last year, "secure" FormMail version 1.92 and an alternate called FormMail-clone were widely installed, making hosts and webmasters feel safe. But not for long.

Professional spammers quickly found new exploits. NO version of Matt's FormMail is now secure (and neither is CGIemail, another popular form script). Many of the form-to-email scripts on HotScripts and other script collections are insecure.

What can you do?

Whether you are replacing an insecure form script, or installing one for the first time, make sure you do some research. There's a list of "more secure" scripts below, but always look for the most recent version, since those spammers are a clever bunch.

Here are a few things you can do with any form-to-email script to make it more secure:

• Change the name of the script file. Don't use the words "form" or "mail." Rename it to "bobsyouruncle.pl" or randomize it to "dkju785hngu.cgi". Spam bots search code for the string "formmail" in tags to test for exploitable forms...like looking for an unlocked car to steal.
  
  
• Make a wacky path and cgi-bin location. Most form-to-mail scripts are in: "/cgi-bin/formmail.cgi" so put yours elsewhere: "/articles/fishbait/cgi-bin/bobsyouruncle.pl"
  
  
• Go check out these recommended scripts:
  
  nms formmail http://nms-cgi.sourceforge.net/scripts.shtml
  Steve's http://www.b-link.co.uk/stevedawson/scripts.htm
  Jack's http://www.dtheatre.com/scripts/formmail.php
  PHPformmail http://www.boaddrink.com/
  
  
• Developers looking for fun can install FormMail-Trap, which detects attempted FormMail probes and reports the spammer's IP address to their ISP.

If you want a form, but your host does not allow the you to install scripts (or if you don't feel you have skills to deal this stuff), try running a Google search for "remotely hosted formmail" to find services that will host a form that does not live on your site.

"I hate forms. They never have the right boxes. They often fail. The usual thing is you get an error message so you hit the back button and then you find all your inquiry has been wiped out and you have to start again, often repeating this cycle several times before giving up.

Unlike an email, you have no automatic record of what you've written. If you really must ignore this and use a form, include an email as well. Never never never build a business website without a straight forward email address."

--frustrated user Jonathan Webb

More Form Fun

Style Web Forms with CSS
CSS makes forms prettier

Building Web Forms in Flash
Movie + script = data movement

Forms, usability, and the W3C DOM
Improving usability of complex forms

About.com Forms Tutorials
Useful info made annoying with ads

Having trouble getting your form script to work?
Check the Gryphyn Media FAQ and find help with installing scripts.

Tip:
Never use the ugly default "thank you" page. Redirect the user to a custom thank you page with a real message and some choices of places to go from there... like your FAQ, search page, or discussion forum.

_______
Copyright 2003 Tracy Brant at Gryphyn Media, Inc.
Reprint permission: reprint@gryphynmedia.com

Pennsylvania Business Links

Pictures of Pennsylvania

Thanks as well to Gary Hayes of Gary's Photography for his pictures which feature Luzerne, Lycoming and Montour scenes.

We are actively seeking Pennsylvania scenes from local photographers - and would appreciate your contacting manager@pabizz.com if you would like to contribute.