my [work in progress] website Options

[Magik5]

just after opinions really... and to get a cheeky lil link to it heh

^ must have flash installed, probs need flash player 10 due to me using vector arrays....

anyway, general design of it is done, yes it took me like 5mins to come up with...

only thing thats working atm is the photography page, all xml driven which make it easy to add/take away images as i please.
im aware clicking the photogrpahy btn relaunches the gallery again so for now just deal with and only click it once =]

3d page gna be renders of 3d models etc, flash page gna be more games as/when they get created...

programming page is gna start out to be the source code for my site, when i cba to upload it - kinda wana get it a little neater before i do tho, as potentially this website will go on my c.v.
then evolve into whatever, custom as3 classes, perhaps a bit of c# etc


views opinions on what can be made better/improved/changed would be nice, criticism welcome blah blah the usual =]

any errors u get would be nice to know as well...

glhf?

[MonkeyFiend]

There's a good guide here: http://www.javascriptkit.com/howto/htaccess.shtml

the htaccess file can be used to specify users/passwords, hostlinking prevention, blocked IP addresses, MIME type changes and most basicaly preventing users listing directory contents when no index is present.

The single largest web security flaw I come across is with directories with 777 permissions - a lot of forums and content managemt systems require a directory like this for file uploads (like the SM imagehost or avatar upload)

putting in a htaccess file with something like this:

<Files ^(*.jpeg|*.jpg|*.png|*.gif)>
order deny,allow
deny from all
</Files>

means a person can only upload the above file types. Without this a user could upload a script. then with the 777 execute the script. (typically installing an IRC control client, a bunch of malware and chowning the legit files/direcotires to 99:99 so that the user would have to contact their webhost to get it fixed.

Not that I've done this, of course.