5 comments about Pro PHP Security.

1. PHP applications written without a concern for security risk cross-site scripting, SQL injection, session hijacking, and a multitude of other potential problems. This book examines how to setup a secure environment including encryption, hashing, SSL and using PHP to connect to SSL servers. The authors also examine how to install and configure OpenSSH and using it with PHP applications. Of course they also deal with the usual concerns of user authentication, permissions, restrictions, validating input, preventing SQL injection, preventing cross-site scripting, preventing remote execution (including PHP code injection and embedding), security for temporary files, and preventing session hijacking. The Pro PHP Security is written specifically for PHP programmers working in the Apache, MySQL, and PHP 5 environment and is highly recommended



2. Unless you're already very well-versed in the subject matter, ( sql injection, cross-site scripting, session hijacking, remote execution, sanitizing user data/input, ssh, encryption, ssl, dangers of shared-host scenarios, bulletproofing db installations, user verification, captchas, remote procedure calls ) this material is relatively comprehensive and valuable. Well-organized, well thought out, I won't hesitate to recommend this one.



3. The book is entitled PHP security. But the actual content covers very little PHP at
   all: less than 20 percent. It tries to cover everything from UNIX permission,SSH
   and all other security issues, but really doesn't have much to do with PHP. So I
   think the title is highly misleading. For someone interested in the general
   security issues, it might be a fine book. But not for programmers want to know
   the security about PHP.



4. Like the title states this book tells you about a lot of security issues you should be aware of, but doesn't go in depth for many solutions. Especially xss which is the only reason i bought the book. For how much the book costs i figured it would include some really good php solutions. I mean the thing is in black and white, what's with the price tag that doesn't tell me anything that i can't find on the web.



5. I found Pro PHP Security a very informative book. I received this book around the same time that I began developing online financial software. This book lived up to the name and answered a lot of my questions.
   
   I found the chapter on encryption and hashing very interesting. I knew what each system of protection accomplished but not how. Next the authors proceeded to discuss Secure Sockets Layer (SSL) and how certificates are created. It was fun to be able to create my own certificate and keys, and gain a better understanding of how the whole process works.
   
   After covering server security and connection security, the authors moved onto secure programming. The first chapter covers user input validation. This is one area that many programmers, myself included, do not devote much time. If you can sanitize the data you get from the user, you have overcome one of the largest hurdles of securing your code.
   
   After that chapter, each following chapter begins with the presentation of an exploit and how it works, followed by discussions of sites affected by these exploits, and concluding with how to prevent it. SQL injection, cross-site scripting, remote execution and session hijacking are some of the exploits discussed. This section of the book gave me plenty to think about and more than enough to work on implementing.
   
   If anyone is a PHP programmer and deals with any kind of sensitive data, then this book is a must read. The authors attempt to provide all the best practices because one method may not work in a given situation, but they also let you know the disadvantages of each method. As Snyder and Southwell discuss in the first chapter, as developers we cannot eliminate risk but we can do our best to mitigate it.

1 comments about Expert Visual C++/CLI: .NET for Visual C++ Programmers (Expert's Voice in .Net).

1. This book pretty much assumes you have some basic C++/CLI knowledge.
   But, if you are like me, you will pick that basic knowledge on your own from the web and then you will probably buy this book :)
   This book has just the right piece of advice for all the coders who can learn the basics on their own but at the same time need to make sure they are doing things right.
   This book will give you that extra confidence and will take you to the next level.

3 comments about The Developing Child, 10th Edition.

1. Now in its 10th edition, this book (in order to stay in print so long) does what many other textbook series fail to do: change as the discipline changes.
   
   Child Development (along with early childhood education) continues to accelerate in advances with each passing year...and Brisbane's book stays right with it.
   
   As always, their sections and chapters on parenting rival the very best sources(Ellen Galinksy, Jane Brooks, E.H. Berger, Janet Gonzalez-Mena, Kevin Swick, Chandler & Nita Barbour, and Donna Couchenour).



2. Please be aware that despite the editorial review describing "mydevelopmentlab," a multimedia program that is meant to accompany this textbook, the edition offered here does not come either with the CD-ROM version of the program or with access to the online version. My rating of 1 star has nothing to do with the content of the textbook, only with the misleading nature of the editorial review.



3. Well-written and unique among child development books.
   
   Bee & Roberts do it again by updating this text with information (i.e. the Theories of the Mind section) that you won't find in many other competitors.
   
   Rosiland Childworth's CHILD DEVELOPMENT and Jeffrey Trawick-Smith's EARLY CHILD DEVELOPMENT are excellent texts if you can't get this one...but this one does a more thorough job of injecting many little details and nuances that stem straight from the primary literary sources of many of the theories.
   
   Great!

5 comments about Perl in A Nutshell: A Desktop Quick Reference (2nd Edition).

1. This book is full of alphabetical high level descriptions (which are always ambiguous) of Perl language statements with few or no illustrative examples (which always help clear up ambiguity).
   It is a waste of money.



2. I am not a beginning programmer nor am I what you would call an expert. Having a background in PHP made Perl easy to learn, so I didn't need a book that would "teach" Perl. All I needed was a good reference to figure out the differences between PHP and Perl. This book did exactly that! I was able to start programming within a day and I have referenced this book more times than I can count during my most recent development efforts. The binding is nearly worn out! I recommend this book to intermediate programmers that only need a small boost to get to work. If you're a beginner, buy this book to use after you learn the basics and you'll find it to be one of the most valuable tools on your desk!



3. This is a handy reference, but if you have a limited budget you should probably go with Programming Perl and the Perl Cookbook before this one. This is a fine reference but it doesn't have the depth that the other books have and the information on the modules is available online through CPAN. I have the entire Perl library on my bookshelf and I hardly ever pick this one up.



4. Exactly as advertised, "Perl in a Nutshell: A Desktop Quick Reference" is a great reference book if you already have a basic understanding of Perl. Although it does have a section that it refers to as an "Introduction to Perl" it is actually a pretty cursory introduction and there are better books for learning the basics of Perl.

   The book does have an excellent section on installing Perl including installation on both the Unix and Windows platforms. I've worked with both platforms and the installation process is well documented including how to install modules. This brings us to the large chapter on getting and installing Perl modules. I have spent hours sometimes trying to find an appropriate module for a special situation. This chapter lists all the most common modules and includes descriptions of what they do. This alone makes it a valuable resource for anyone involved in Perl.

   The authors also include a lot of technical information including command line options and environment variables as well as a section on program structure, data types, special variables, operators, expressions, subroutines, filehandles, and just about anything else that you might need a quick refresher on.

   Functions are listed both by category and by alphabetical order with descriptions and syntax information. I had a couple of problems on a large project recently and it took three days to get an answer through the forums on the Internet. The answers to all of them are right here and I could have saved myself a lot of trouble if I had had this book then.

   A lot of other information is available in the book including CGI programming, Webserver programming, database programming, SOAP, Network modules including Net, Mail, NNTP, FTP, and LDAP, Perl/Tk, Win32 Modules and Extensions, OLE Automation, and ODBC Extensions. This book will be the one I keep close at hand when working with Perl and deserves its location on my desktop instead of in the library. "Perl in a Nutshell" is highly recommended for Perl programmers from basic to advanced level.




5. I have a shelf of Perl books from O'Reilly, from the Quick Reference to Advanced Perl Programming. This tends to be my first grab when I am looking for something. A bit thick when I am on the road, so I fall back to the Quick Reference, and whenever I do, I find I miss having the Nutshell book (with all my notes in the margins :) If I can't find it in this book, I jump to the Perl Reference most often.

5 comments about SAP NetWeaver For Dummies.

1. I got this book to get myself more educated on what SAP Netweaver is all about. I've been doing SAP consulting for over ten years but, like others, feel like I'm not up-to-date with the latest SAP Technologies and products.
   After carrying this book around with me for over two months, I'm still not done with it. This is because I keep on getting irritated when I read this book and then I put it down. And I'm not easily irritated. I think I'm at the point where I'm going to put it in a box (with many other books that I DID read) and read something else instead. This book is just wasting my time.
   
   Here's my problems with this book:
   1. The writers try to be funny/entertaining all the time. I do like humor, but they do it way, way too much and they are not funny at all.
   2. Some of the things they discuss are simple, basic, worthless information that any IT person knows.
   3. They make Netweaver seem easy, all-good and the future of IT. I love SAP and I think Netweaver is probably a good platform. But I think this book is overselling it and making unproven claims that may mislead less-experienced people.
   
   This book could have been good if the (useful) content was offered in a different way. Some suggestions if a second edition materializes.
   1. Don't try to be funny. Just present the material.
   2. Leave out all the unnecessary, useless information. You're not obligated to go over 400 pages. I'd prefer to read a thinner book with just the relevant information.
   
   I don't always give the lowest rating for things I don't like. And this book does have some useful information here and there. But the presentation is just so terrible to me that it makes whatever good it has worthless.



2. While the book's attempt at humor irritates me, I still manage to find good information. The author covers a lot of material. Some of it is way too simplistic. Some of it is not deep enough in my opinion. I've picked it up a few times and put it back down, but won't toss it. That being said, I'm still looking for seomthing better (SAP Press doesn't have anything actually good either, despite some new titles).



3. 1)I might have sat with the book if not for their jokes
   2)The terminolgy used in definitions and in examples is different.
   3)Repeating stuff that is not at all useful.
   4)The paragraghs of repition wont work but i dont understand how the pictures also dont work
   5)I sincerely request the authors to stop writing text books.



4. This is the first "for Dummies" book I have read and I was very pleased. The authors did an excellent job explaining all of the elements of SAP NetWeaver and how they inter-relate. As a business executive trying to get my arms around the technology, this was exactly what I needed. It will be valuable reference for the future, as well.



5. Buy the book if you like, but for me an ABAP programmer w/10+ years experience it was just fluff. A couple hundred pages of hearing how great Netweaver is and what it could do, w/o actual hands-on is not IMO what a 'Dummies' book is meant to be. The included CD was even less.

No comments about Build Your Own Security Lab: A Field Guide for Network Testing.

5 comments about Use Case Driven Object Modeling with UMLTheory and Practice.

1. This book does everything it promises and more. While reading this book you will learn a design methodology that will help you in every project you work on. What you won't learn is a framework that does all the work for you. You also won't learn to rely on someone else's code. Instead you will learn how to really think about your project from the initial design to the final solution. You will learn how to properly document the requirements and the user interaction with the system. You will learn how to be a Software "Developer" not just a Software "Programmer". Some will say there is no difference, but others that have read this book will understand the work and thought process that goes into real development of a software solution.



2. This book was extremely helpful because it takes the reader from Use Cases to code development using a real-life "sample" system (an internet book store) to describe the steps. The ICONIX Process is used in this book and the goal of the book is to get from Analysis to Code using a minimal, yet sufficient core subset of UML. Each step is broken down into detail and examples of how to do each step are provided and explained. Built into the "sample" project are mistakes (ones that are commonly made in real life) and the book shows those mistakes as well as the corrected versions. In addition, the book discusses the Enterprise Architect (EA) tool, which our company is evaluating, making the examples provided even more pertinent. The only thing that would have made this book more useful would have been appendices or detailed examples of using the EA tool with the "sample" project. It would be great if one could obtain the sample project in a *.EAP file where folks that have the EA tool could load the sample project to understand how the project was actually laid out in the EA tool. This book is very well-written and, as a bonus, has some decent humor throughout keeping the reader's interest. If you are using EA and Use Case Driven development, this is an excellent book for you.



3. Since 2001 I had a lot of courses on UML modelling at the university and in inhouse company workshops. But none of them gave me the real power to write use cases so that I can easilly extract an object model from it. I always had problems to bridge the use cases to sequence diagrams and class models.
   
   This book gave me the clues (with red and bold highlighted) such
   "You can't drive object-oriented designs from use-cases unless you tie your use cases to objects."
   
   Now I have to say, I write use cases more confidetially, knowing that they build a real basis for futher object modelling. 5 stars!!



4. The Rosenbert & Stephens's Book is a great example of doing by practice, but highly supported by foundations about what is important in UML.
   The book offers a great discussion not only how use UML effectively, but how can you go through practice and coding. That's essencial if you want coding in a right way, but explore the UML notation.
   The approach with ICONIX was fantastic. You develop a e-Commerce system completely using UML, Iconix process and coding with JAVA. I coudn't found books that offer this path.
   Fantastic. Excelent aquisition.



5. I am still working my way through the book but so far I am impressed by the authors direct no nonsense views on design and test. I am a software tester and my new project uses UML which I have not worked with before. This book has given me a good overview and explains the terms and diagrams used in UML design very clearly.
   Keep up the good work guys.

5 comments about Innovation Games: Creating Breakthrough Products Through Collaborative Play.

1. The process of eliciting requirements suffers from some of the same problems as the process of collecting information for expert systems. A person does not really know how much he or she knows about a subject. Each of us knows something so well, that much of what we know is not part of our conscious awareness. It is hard to bring that information to the conscious mind to share with another person.
   
   What this tells me is when I am in the role of eliciting requirements from another person, I need many different ways of getting information, because different means will achieve different results. I can take an analytical approach (tell me about...), a physical approach (show me ...), and a creative approach (let's play a game ...). The more approaches I use, the more information I will get.
   
   What I love about Innovation Games is that games use a part of the brain that we tend to ignore when "at work", bypassing the analytical parts and tapping into the fun, creative areas. This is a great way to find new information about the requirements of a product or service. I think it works especially well because most people I interview are expecting an analytical approach, and using games brings a fresh perspective.
   
   Luke Hohmann has really captured a great set of games. He explains the games very clearly, and gives detailed instructions for how to organize an Innovation Games session so that everyone can make effective use of his techniques.
   
   Thanks so much Luke for bringing us another great book.



2. Most of the content of this book belongs in sales brochure not a book. A large proportion of this book is a long, overblown ad for the author's services.
   
   Some of the ideas, while creative, are just repackaging of many well-known and established techniques.
   
   In addition, there is one reality the author ignores. The exercises are not going to work well with "average," everyday people. They require a degree of creativity and acumen that quite honestly, most people (including very well-educated ones) just do not possess. I work in this industry everyday and if there is one thing I've learned it is most individuals are much better reacting to ideas than creating them.



3. Luke Hohmann's Innovation Games bring an extension to the complex areas of software requirements. The games bring out the essence of requirement gathering, namely the importance of the users' feedback to the requirement gatherers and close relationship between the user and the requirements gatherers. Two thumb up for this book!



4. Luke Hohmann's Innovation Games makes current paradigm obsolete.
   What if the decay in the learning rate from kindergarten to high school is not only related to wrong educational policies and practices?
   What if adolescent are treated "seriously", when being serious is a barrier to learning?
   Hohmann's exported the "learning by playing" environment from kindergarten to market research and other fields.
   The panoply of games he proposed support an ample variety of opportunities.
   I'm glad I dedicated the time to read Innovation Games, and organized to use them.
   Let life be fun!



5. We had been using Innovation Games to find the real market of hundred of ideas that companies in our program are developing. It is amazing, how a simple game can be a powerful tool to develop marketing strategies. Our companies had learned the magic of seating with their customers and play games, and then new products are developed. The cost of doing this learning is very low and the results are so big that reading this book has the highest ROI that you can image. Never less, playing the games are very valuable when you read from the book, the real learning experience is when you play them several times or you are able to bring an expert consultant that gave you the insights of the experience.
   
   Reading the book is half of the story, you must play several of these games to take the best experience. I highly suggest trying it.

5 comments about Applied Mathematics for Database Professionals (Expert's Voice).

1. Writing a book is no easy task. Completing a book when your co-author and friend passes away early in the process, must be a monumental task, this is what Toon Koppelaars achieved with this work.
   
   I ordered this book expecting it to contain examples of using statistics, probability and data mining algorithms as applied to databases. In retrospect, I am not sure why I made that assumption. It is actually about formally specifying database designs using logic and set theory. This book is reviewed and endorsed by C. J. Date and features a foreword by him, which would be high praise for any book on the subject of databases.
   
   It is split into 3 parts and 12 chapters as follows:
   1. Logic: Introduction
   2. Set Theory: Introduction
   3. Some More Logic
   4. Relations and Functions
   5. Tables and Database States
   6. Tuple, Table, and Database Predicates
   7. Specifying Database Designs
   8. Specifying State Transition Constraints
   9. Data Retrieval
   10. Data Manipulation
   11. Implementing Database Designs in Oracle
   12. Summary and Conclusions
   
   If you've studied mathematics (or a tertiary subject with a mathematics element to it) you will most probably be familiar with the sections on set theory and logic. If you have not then they provide an as excellent introduction to these topics that you are likely to find anywhere.
   
   This book makes the following claims and I have made my comments against each one:
   
   "This book will help you":
   * "Become a better database designer. You'll make fewer mistakes, and your designs will be more flexible in response to changing data needs." I agree 100% that having a good, if not intuitive, grasp of logic and basic set theory will help you to create better DB schemas.
   * "Use the expressive power of mathematics to precisely specify designs and business rules." I am not sure how useful this is, and I have a mathematics background. I personally feel that having another notation to express the database design seems to break the DRY (Don't Repeat Yourself) principle.
   * "Communicate effectively about design using the universal language of mathematics." Personally, I do not think this applies unless you are at the top of your game and/or have a theoretical bias and you are communicating with someone similar.
   * "Develop and write complex SQL statements with confidence." Absolutely agree. I am often surprised at the number of software developers that do not have a thorough grasp of logic.
   * "Avoid pitfalls and problems from common relational bugaboos such as null values and duplicate rows". Probably, but then 3NF will go a long way to achieving that.
   I would be the first to agree that a good, basic mathematics grounding is desirable if you want to confidently design databases that scale well and are modelled correctly.
   The mathematics that you learn in this book will certainly put you above the level of understanding of most database professionals. But I am not convinced that alone will enable you to better understand the technology and be able to apply it more effectively. It will help you to avoid data anomalies like redundancy and inconsistency, which are not uncommon problems in the world of databases!
   On the whole, I enjoyed reading this book, but I'm not sure if I learnt anything I could immediately put to use when designing and refactoring databases. I did not put a great deal of effort into learning and understanding the formal database specification language described in this book purely because I could not see an immediate benefit when balanced against the effort required to learn a new notation, and I may well have overlooked something crucial that would indeed enable me to create better database designs.
   
   http://mitch-wheat.blogspot.com
   
   Disclosure: The Perth .NET User Group is a member of the Apress User Group Program. Apress make copies of their books available for user group libraries, and the copy reviewed here was kindly donated by them.



2. Finally, a book has come along that is not a simple restating of the manual. This is not a book that will tell you how to install a database or how to write RMAN scripts.
   
   This book deconstructs all of what it is to be a database. This book is like a vivsection on the "brain" of an RDBMS (specifically, but not exclusively, Oracle).
   
   Why this book succeeds is because it walks you, step-by-step, through the simple (yes simple) and well defined (yes, you don't really have to guess) logic that the database uses for EVERY request made of it.
   
   It is a must-have for anyone serious about truly understanding why databases work the way they do. Have you sat in any of those meetings where people guessed or even voted on how they thought the database worked? It's so silly.
   
   This book will not help you get certified with any database. Certifications are vendor specific and cover a lot more than the narrow focus of this book. So you'll be disappointed if you expect a broad database education.
   
   The narrow focus of this book is laying out the internal rules of the database's "thought process." If you understand the power of that narrow focus, this book is for you. If not, keep it on your wish list and I'll bet you'll come back to it someday.
   
   I have made this book mandatory reading for my Oracle and SQL Server DBA's (the only databases I currently have DBA's for).
   
   While it is in no way a complete database education, I think no database education can be complete without it.



3. This book from Lex de Haan (RIP) and Toon Koppelaars is a very welcome addition to those relatively few technical volumes to date that attempt to apply the rigours of a sound theoretical mathematical framework to the Relational Model, and the varied and various manifestations thereof.
   
   This well written and well structured book takes the reader gently through rudimentary relations and sets in Part I, to the more complex database-related aspects in Part II, and finally culminating in Part III where the theoretical is applied to the practical - in this case through Oracle, but will equally apply to any of the major Database Management System (DBMS) vendors.
   
   Although the reader is taken `gently' through the learning process, I believe that any experience in Formal System Specification would be a great help to the reader, similarly with any degree of knowledge of relations and sets. With no knowledge of either of these then the curve may not be so `gentle', but what can be assured, however, is that the exercises are well enough designed to bring the knowledge levels up appropriately as the book progresses.
   
   Conversely, what probably isn't of great assistance is a high degree of proficiency with SQL, with its manifold attendant shortcomings and deficiencies. The difficulty here arises where the reader will tend to approach it logically from an SQL perspective (with the perhaps now instinctive mental workarounds), where this book approaches from a much more logically complete, theoretically sound, and neutral angle.
   
   That said, however, there is much of value in this book for the seasoned SQL practitioner, if only to alert as to how incomplete the current DBMS offerings are, how this (potentially) compromises data integrity on several levels (tuple, table, database), how to avoid those same shortcomings, and on how to exploit the maximum declarative constraining from those same DBMSes in their current incarnations. For the not so seasoned, it will lay a solid, sound theoretical basis that will serve very well throughout a career with databases.



4. This book definitely isn't for those who dabble in writing SQL code. However, if your job requires interacting with SQL, that is, set-based language, this book should be on your shelf. It certainly is on mine.
   
   You won't find any simple list of instructions, or pithy "best practices", but more a fairly complete explanation of set-based mathematics and logic, and how this applies to the SQL (generic SQL) language. There's also an excellent discussion of 3 and 4 state logic and the universally misunderstood concept of NULL.
   
   I can't recommend the book enough. It may take you years to really work through it and absorb the content, but it is worth it if databases are your career.



5. This book is no easy read. Yet, or even because of this fact, it is unrestrictedly recommendable for everyone who professionally deals with databases. It offers a thorough introduction into the basic mathematics on which the relational database model is based. The committed reader is put into the position to base his database design on a well founded level and effectively describe and communicate design questions and business rules.
   
   In any case should the reader take his time to work his way through the whole book. It is well worth it!

5 comments about GoldMine 6 for Dummies.

1. Terrific, common-sense writing. As the Midwest's oldest public GoldMine training center, Publish or Perish, Inc. wouldn't be without it as a supplement for our professional training. If you want understandable how-to that's technically correct, and you're not a propeller-head, you really need this book!



2. I was thinking this was going to be better than the manual or the help files. I thought wrong. I was hoping to get some insight to the technical side of GM. This is not that. Typically good dummies book - my low-ish rating is more my frustration in finding a technical GM reference.



3. The steps are easy to follow and now using more features on GoldMine. Has help simplify my records.



4. Used the product for years, and had nothing but database corruption and Goldsync synchronization problems. I like and use salesforce dot com. Goldmine is a company that has milked the database and not kept up with the times. Act! is also a stronger product. Goldmine's days are numbered, the database is still contact centric rather than account centric which makes it difficult to use in a business to business selling environment.



5. Buy Goldmine 7 for Dummies if available. This will cover most of what 7 offers if your on a budget. The Dummies version is often easier to understand than the help menu offered by Front Range themselves in the actual software.