Fortunately, DROC’s customer server service allowed me to renew the dot com and gave me a price discount for the trouble. Ironically, the lowered yearly fee for the domain is still more expensive than Go Daddy’s (without including the Diggnation code). However, I’m just happy I didn’t lose The Music Tank’s branding which I have already worked 9 years on (no matter how successful it has been).

While registering on Go Daddy, I also purchased Francois Faubert.com as my portfolio’s domain name. It’s so cheap that it would be crazy for someone working full time in the web design business not to do it.

I guess it means I’m old enough now to assume my real name and not leave my online presence exclusively behind my accustomed “Fake” nickname.

While most of it is my fault because I overrode the templates and migrated the database manually, the update caused the following error to occur each time you submit a post :
The submitted form was invalid. Try submitting again.

On phpBB’s official support forums, there were mentions of about a gazillion manually performed changes to the board’s templates. I didn’t do any of them because I knew better and the side effects weren’t exactly the same as theirs.

Finally, all I had to do was to reset the “user_form_salt” from the “users” table to a valid hash value (ex: the one the Anonymous user has). It may not be the most secure thing to do though, for obvious reasons.

Learning what not to do

On TMT, I used to handle sessions manually by storing the encrypted value of the user’s id in a cookie. That’s is highly unrecommended for security reasons as its fairly easy to hack your way around using an id that isn’t yours (and which might be the administrator’s!).

I experimented by storing so-called ‘unique’ values I generated and stored in MySQL to have better validation when decrypting the cookie, but since you can spoof most $_SERVER values (which provides the user’s IP), it really wasn’t good enough.

Hardcore PHP-ing

You can override the whole session object using PHP’s session_set_save_handler() function. Basically, you re-program what the object does when it reads and writes session values or when it destroys itself.

Instead of writing the session values to a file on the server like the default behavior is set to do, you can redirect the data handling to an insert or update query in your favorite database.

Advantages

The most obvious advantage is that you can keep the sessions alive as long as your server is live, more or less. You can also change the condition of how session expiration are done. For instance, through a simple MySQL query, TMT sessions can be kept for one week before being destroyed if no activity is logged.

I’ve read it’s safer to store session values that way too, as a possible hacker would need the database’s password to access it. While I’m not sure how harder this method actually makes it for hackers in reality, I really feel safer to use PHP’s native object rather than a shaky class I would have written.

Fully using PHP’s native session object allows more flexibility as you are very close to Apache. You can therefore validate with confidence (not blind confidence though) that the user is indeed human and not a spam bot, save the user’s preferred language or do whatever else your website offers as possible features without fear. In my previous horrible system, it wasn’t even a possibility.

Examples

Apart from stalker at ruun dot de’s very good comment on PHP.net’s documentation page, I found Tony Marston’s version of the object. The latter is harder to grasp as he uses his own object-oriented system to get database data — that’s good practice, but a bit harder to learn from. You can also see TMT’s class in our SVN repository.

The important thing is just to understand what you’re trying to do rather than copy pasting each of our codes. TMT’s only started working once I grasped the concept.

There weren’t any validation to make sure the user was a valid poster or registrant nor was it that easy to perform relatively simple tasks in the administration area (to edit a user’s access rights for instance).

That’s why I didn’t reinstall phpBB version 2 on The Music Tank. However, I’ve been reading cool stuff on the upcoming third version as it promised to have all of what I thought was missing from the second version. Instead of moving to another board script I finally gave in and installed the fifth beta release of the third version. Besides, I’m willing to tolerate some faux-pas to support open-source software.

The installation experience, as a user that doesn’t know that much on hardware-ish issues, was incredible. It may have taken a lot of time, but things went very smoothly and required limited effort on my part. There were informatial text blurbs on every step I needed to perform. No guessing around.

Visually, the default design has been given a more up-to-date look. Most important for me as an admin, a massive overhaul of everything related to the administration has been done. It makes management incredibly more structured, though there are about ten sections with seven subsections each. That many different menus to go through which can grow a bit confusing.

Only time will tell how efficient the new version of the board is on The Music Tank. Keeping in mind the current release is not even a Release Candidate, one should expect that features are bound to blow up from times to times, but nothing did come up in the short period I’ve been using it. For the moment, I can only say good things about the third release of phpBB.

What made it nebulous was that instead of having a message from PHP describing a known error like ” ‘)’ expected on line 64 “, I was triggering an Internal Server Error on Apache when loading the website and the parser was outputting unicode garbage when I tried to load the class directly from the browser (instead of nothing at all because I don’t print data right from the class).

I have to admit I could have been a bit keener on the issue just by looking a the garbage the file was making. It turns out that my code editor, TextWrangler, had changed the encoding type of the file from UTF-8 to the Macintosh charset when I inserted the © character straight in the document without using it’s HTML counterpart &copy.

The change of charset and/or the use of special characters in the source code stopped the PHP parser. I can’t explain why as I don’t have much access to the configuration files to my server’s PHP version nor do I know how PHP reads the .php files, but I think it was due to the use of multiple charsets in the same rendering call. For instance the main class was using the Mac charset while the subclasses it was importing used UTF-8 encoding.

The frustrating part is really how this whole deal was created out of laziness. Apple offers a wide selection of special characters by doing a [alt + most keys] combination. I thought I’d save some time by using their copyright sign instead of sticking with &copy.

At least, this episode forced me into cleaning the quote quite a lot by splitting my pages into modules which reflect the content’s architecture. The Tank should show a light performance boost now. Very light though, hehehe.

However, all the tables and database structure I had built stayed with Abnormis. Hopefully my old server will come back online and I will be able to get some of the file content back, but I am really just interested in how I had built my tables — which I don’t think I’ll be able to access. I don’t even remember most lengths and data types of the columns. Even my PHP source code can’t give me much hints at the moment.

At least this morning I was able to reconnect the user table. This means future posters and tankers can already join the Tank… and do nothing afterwards. Hopefully I’ll have the news working by early afternoon.

The moral of the story is that a backup, when you are developing, is always too old.

And damn do I need to fix the transparent issues with IE 6 as soon as possible!

I intend to describe how great Media Temple’s service is, how it’s the best shared-hosting package I have experienced yet, and how happy I am with the transfer in another post. Right now, I mainly want to warn you all that lost content will be popping back as I regain access to more recent backups from the old server.

These delayed recoveries will have an impact on both this blog and The Music Tank.