Is this a secure solution?

[Anatoli]

Mariano Peterson said:

Oh boy, here we go again!

No comment

Yes, Lasso has some very useful tags built in. However, PHP is much more robust and extensible. Further, PHP supports object oriented programming which can *greatly* simplify the code behind a complex web site, and greatly reduce development time as well. Further, PHP is free. While you can optionally purchase the Zend optimizer (which costs slightly more than Lasso), it is outright unnecessary for most sites.

Lasso is fully customizable. I don't think PHP has any edge over Lasso. That is why plenty of people are happily paying for the Lasso.

Lasso is Objects oriented and it is using much less code, than PHP. That is why I will pay again the Lasso price.

If I want to protect the middleware/HTML code, Lasso is much cheaper. I didn't check lately, but it was 999 for Lasso and 2500 for Zend.

Further, PHP is much easier to learn than Lasso (imho) because there are hundreds of excellent books out there on PHP. Lasso on the other hand only has a few books, none of which are worth their weight in salt. From what I hear Lasso has a good list-serve and supportive online community. So does PHP - in fact more so because PHP is soooo many more users/programmers than does Lasso.

PHP is much more difficult if you start with CDML knowledge than Lasso. Even without CDML base Lasso (IMHO) is still easier and simpler. The price of Lasso probably reflects this.

PHP is also optimized for MySQL, since they the development of those technologies was tightly knit together. MySQL is also free, unless you build it into a product the user cannot choose which database to use. However, MySQL is free for database driven web sites, even if you're making money from the web site via subscriptions. I've personally verified this with the MySQL AB team through email correspondence. PHP is also well optimized for Apache, which is a *free* world class web server.

PHP doesn't come integrated with MySQL; Lasso is integrated with MySQL. Actually all Lasso processes and permissions are stored in LassoMySQL.

And Lasso integrates FM and MySQL "of the shelf". With full commercial license of MySQL in the price.

Lasso is integrated in Apache and IIS and Web* etc.

Another *extremely* good reason (imho) to use PHP over Lasso is that there is much more demand for PHP programmers than Lasso programmers. If you can acheive the same (or even reasonably similar) results from PHP or Lasso, why not choose the technology that will open up a world of new job opportunities for you? Just go on craigslist.com, hotjobs.com, dice.com or monster.com or any other and search for Lasso jobs, then search for PHP. The difference is tremendous.

That is probably true. But larger supply = more "competitive" price I do not like to "compete" with thousands students for the job.

Also, most web hosting services provide PHP and MySQL... how many provide Lasso?

That is not an issue in US, there are many Lasso and FM hosting companies. Personally I would like to host everything myself, because of full control and nice income.

ASP is also a good technology, and offers far more pre-canned functionality than Lasso (thereby making it a more production tool). I don't think ASP is quite as fast as Lasso or PHP, but the difference is not much. The only thing is, ASP doesn't yet have a free code package that abstracts the http/xml layer it uses to communicate with FileMaker.

I don't think any of us are supporting E-Bay type traffic with FileMaker on the back end, anyway - so the speed differences are not too noticeable.

----

Re: security.

Any middleware is a HUGE improvement over FileMaker's native web scripting. First, these all offer increased security by removing FileMaker's web vulnerabilities - any client communication to FilerMaker must be filtered through the middleware, which can be built to provide as tight a security model as you like. Any of the aforementioned scripting languages will also vastly boost your productivity by allowing you to approach standard programming problems in standard ways - instead of looking for brittle and obscure work arounds in CDML.

Read the White papers. Lasso means much less code, than ASP. Lasso runs on Windows, MacOS, MacX and Linux. ASP is not serious competitor for Lasso.

I do not know if you can hide completely database from users in PHP, like Lasso is doing with properly constructed InLines.

My resume is, that if I have to start with zero budget, I'll go the MySQL PHP way.

If there is budget, then it is Lasso all the way. BTW new Lasso 7 has many improvements over Lasso 6.

[Leb i Sol]

crazy Eastern Europeans.....

hm.....ASP u say....it will run on Win and Linux.......there is ASP/VB connector that seems be popular

http://www.fmcdn.com/downloadForm.cfm

but how good it is I wouldn't know. ODBC ways to FM DBs through ASP are not worth the time...

If FM would make a better ODBC ASP would most definelty be my choice over Lasso tags ....from the "ease of codeing" point of view. But this will not happen....one hands washes the other....Lasso stays, FM ignores the buggy ODBC.

There, my little support of ASP

All the best!

[Mariano Peterson]

PHP doesn't come integrated with MySQL

How can you say that? PHP has low-level hooks for native connectivity to MySQL at a lower level (more efficient) than ODBC and JDBC.

Lasso means much less code, than ASP

This really depends on what you're trying to accomplish. For a windows based intranet, ASP has tons of windows hooks that other products can't compete with. Also, ASP has many built-in objects for manipulating windows domain stuff very easily. If Lasso can even do that at all, I think it would require much more code and be much less efficient.

I do not know if you can hide completely database from users in PHP, like Lasso is doing with properly constructed InLines

With PHP, you don't expose anything about the database on the web form. You just write a standard form and name the input fields what ever you want - completely independent of the database structure. The page that you submit the form to has all the database code; but that code is never sent downstream to the client - it is only evaluated and executed on the server side.

Lasso runs on Windows, MacOS, MacX and Linux

So does PHP and ASP (for ASP, you have to use Chili(?) ASP).

But larger supply = more "competitive" price

Yeah, but in my experience, the more technology you know, the better you get paid. PHP or ASP open the door to tons of other technologies; where as Lasso limits you to an unorthodox paradigm. In my experience, I've noticed PHP coders tend to get paid better than Lasso coders.

PHP is much more difficult if you start with CDML knowledge than Lasso. Even without CDML base Lasso (IMHO) is still easier and simpler. The price of Lasso probably reflects this.

I don't understand... because Lasso is more expensive, it must be easier to learn? When I started web programming, I tried to start with Lasso. ZERO luck, mostly because there just weren't any good books on the subject. I tried to follow examples from online stuff, but nothing worked. And more importantly, I didn't understand what was going on in the bigger picture, and nothing Lasso related helped me figure that out. When I switched to PHP, all of a sudden there were tons of excellent books on the subject, and I was able to learn it in no time. Also, since the PHP syntax and paradigm are similar to C, Java, JavaScript, etc, I was able to pick it up quite easily. Only after I'd learned PHP was I able to (sort of) grasp Lasso.

That is why plenty of people are happily paying for the Lasso.

I think many people are paying for Lasso because they don't know that there are other options for web-enabling FileMaker. Besides, these other options for web-enabling FileMaker didn't really come about until FMP 6.0, so they haven't been around long enough to be well known. People that had to web publish before that didn't really have a choice other than Lasso, and now they're stuck with it.

Lasso is Objects oriented

Lasso supports some object oriented programming, but not as nicely as PHP. Also, the Lasso paradigm for writing OO is kind of weird, where as the PHP method is very standard/common.

If I want to protect the middleware/HTML code, Lasso is much cheaper

Yes, Lasso is cheaper if you need to scramble your code so that other people can't read it. However, as most web developers sell services and not products, scrambling the code is rarely useful.

---

Hi Leb i Sol! if you want to use ASP, you can use the MSXML object to send HTTP requests to FileMaker and get back XML responses. Then you can load the XML response into an XMLDOM object (or, I think you can even load it into an ADO recordset object) and you should be good to go from there. That is much, much faster than ODBC!

[Anatoli]

Mariano Peterson said:

How can you say that? PHP has low-level hooks for native connectivity to MySQL at a lower level (more efficient) than ODBC and JDBC.

So when you install PHP, you will get automatically MySQL with all functionality and Access level security etc?

Lasso means much less code, than ASP

This really depends on what you're trying to accomplish. For a windows based intranet, ASP has tons of windows hooks that other products can't compete with. Also, ASP has many built-in objects for manipulating windows domain stuff very easily. If Lasso can even do that at all, I think it would require much more code and be much less efficient.

I am talking only about generic Web stuff and not Windows only solutions.

I do not know if you can hide completely database from users in PHP, like Lasso is doing with properly constructed InLines

With PHP, you don't expose anything about the database on the web form. You just write a standard form and name the input fields what ever you want - completely independent of the database structure. The page that you submit the form to has all the database code; but that code is never sent downstream to the client - it is only evaluated and executed on the server side.

OK, so it is the same.

Lasso runs on Windows, MacOS, MacX and Linux

So does PHP and ASP (for ASP, you have to use Chili(?) ASP).

That is OK, but still nogo on MacOS. No big deal.

PHP is much more difficult if you start with CDML knowledge than Lasso. Even without CDML base Lasso (IMHO) is still easier and simpler. The price of Lasso probably reflects this.

I don't understand... because Lasso is more expensive, it must be easier to learn? When I started web programming, I tried to start with Lasso. ZERO luck, mostly because there just weren't any good books on the subject. I tried to follow examples from online stuff, but nothing worked. And more importantly, I didn't understand what was going on in the bigger picture, and nothing Lasso related helped me figure that out. When I switched to PHP, all of a sudden there were tons of excellent books on the subject, and I was able to learn it in no time. Also, since the PHP syntax and paradigm are similar to C, Java, JavaScript, etc, I was able to pick it up quite easily. Only after I'd learned PHP was I able to (sort of) grasp Lasso.

Why to pay for Lasso, when it has all the disadvantages? I am no coder and I never want to be. It is like playing music from score Lasso is maximum what I've allowed to myself, not a bit more. I hate all code-writing Only if I must and for good money

That is why plenty of people are happily paying for the Lasso.

I think many people are paying for Lasso because they don't know that there are other options for web-enabling FileMaker. Besides, these other options for web-enabling FileMaker didn't really come about until FMP 6.0, so they haven't been around long enough to be well known. People that had to web publish before that didn't really have a choice other than Lasso, and now they're stuck with it.

Not me But all other options are just horrible. I've asked for simple PHP code which is doing the simple CDML/Lasso "NEXT" and it was couple of lines, maybe 8. That was 3 years ago. No thanks! Not for me!

BTW, the Lasso List has hundreds experts much better that me and they select Lasso above all. I am just beginner. You are just speculating in this point. Ask them why they pick Lasso. Mostly the do use MySQL and only on client request FileMaker.

Lasso is Objects oriented

Lasso supports some object oriented programming, but not as nicely as PHP. Also, the Lasso paradigm for writing OO is kind of weird, where as the PHP method is very standard/common.

I do not know about that. My simple custom tags are piece of cake and debugging is 100 times easier, that in ASP and probably PHP as well.

If I want to protect the middleware/HTML code, Lasso is much cheaper

Yes, Lasso is cheaper if you need to scramble your code so that other people can't read it. However, as most web developers sell services and not products, scrambling the code is rarely useful.

I like it and I will not release my code until is paid in full.

[Mariano Peterson]

PHP rules!

So when you install PHP, you will get automatically MySQL with all functionality and Access level security etc?

PHP is only PHP - so strictly speaking PHP does not install MySQL. BUT, PHP is specifically optimized to work with MySQL. MySQL is installed seperately. The two are designed to work together, so its very easy. And yes, PHP sessions and web security are designed so that it can be run with MySQL on the back end (or any other database or even the file system for that matter).

Also, there are several free installation packages available that install PHP, MySQL, and even Apache for you, and configure everything like you described (merlin and foxserve are two that come to mind). Most of these also install Perl.

I've asked for simple PHP code which is doing the simple CDML/Lasso "NEXT" and it was couple of lines, maybe 8

If you're using the FX class, the following code is all you need:

$myData['linkNext']

My simple custom tags are piece of cake and debugging is 100 times easier

Well, that's the whole idea behind OO. If you write your code the right way, PHP and ASP are also very easy to debug -- you never have to look at pages and pages of code; just the paragraph (or in extreme cases page) of code for your class.

I will not release my code until is paid in full.

Since all PHP, ASP, and Perl code resides on the server, you don't have to release anything until its paid for. Just host the solution on your test server until the client pay and the code is ready to be delivered and deployed.

[Anatoli]

RE: PHP is only PHP - so strictly speaking PHP does not install MySQL.

So Lasso *is* fully integrated with MySQL. It couldn't function without MySQL. PHP not. All management tools are Lasso/MySQL integrated. The cost of all this in PHP will be much more, than Lasso's price.

RE: If you're using the FX class, the following code is all you need:

$myData['linkNext']

Yeah, but I do not want to chase various classes. I want compact syntax working of the shell for all databases. Lasso.

RE: Well, that's the whole idea behind OO. If you write your code the right way, PHP and ASP are also very easy to debug -- you never have to look at pages and pages of code; just the paragraph (or in extreme cases page) of code for your class.

In another words -- no nice debugger for ASP and PHP like in Lasso I guess. What will happen, if you'll forget simple character like comma?

RE: Since all PHP, ASP, and Perl code resides on the server, you don't have to release anything until its paid for. Just host the solution on your test server until the client pay and the code is ready to be delivered and deployed.

Not flexible enough. I like to sell application and have code in my property until someone will pay for that code as well. How can I install working application at client without releasing the code -- know-how?

Only with much more expenses in PHP case, than with Lasso. Lasso is cheap!

What I know about PHP is putting me off. Next project will be again Lasso based, because regardless of the price -- it is the best for me. And when I am carefully counting, it is much cheaper than PHP.

[Mariano Peterson]

The cost of all this in PHP will be much more, than Lasso's price.

No. PHP is free. Most PHP tools are free. phpMyAdmin is free. MySQLManager is free. MySQL Control Center is free. There are numerous free tools for PHP and MySQL on the web. The bottom line: PHP is free, Lasso is not.

I do not want to chase various classes. I want compact syntax working of the shell for all databases

You don't have to chase classes; FX is _THE_ class for connecting FileMaker and PHP, and offers all the functionality you need. But what's wrong with chasing classes anyway? If somebody else has already done it and packaged it in a class, why re-invent the wheel?

no nice debugger for ASP and PHP

ASP and PHP both have very descriptive error messaging. If you forget a comma somewhere, you'll get an error page that tells you you're missing a comma and the location of the error (line and column). Further, MS Visual Interdev has a powerful debugger that can step through the code. There are also several others for PHP, but I've never had to rely on a debugger for either PHP or ASP; the error message they automatically generate have always been enough for me.

I like to sell application and have code in my property until someone will pay for that code as well

In this case, you'll need to scramble your code, and yes, you would have to purchase the full Zend package which costs more than Lasso. However; selling the code to a web application is kind of unusual. People typically sell client access licenses (cals) for online applications they host themselves. This way, you generate a recurring revenue stream that increases as your client's business grows. With the ASP business model (application service provider, not MS active server pages), the client cannot "steal" your code because its on your production server and they don't have access to the file system on that machine.

And when I am carefully counting, it is much cheaper than PHP

I don't agree. At last check $0 < $1000.

Anyway, I like PHP and I'm sticking with that. Besides, I don't want to shell out the bucks for Lasso.

---

Hey by the way Anatoli, I'm just giving you a tough time about Lasso. Its a perfectly fine technology, I just like PHP better - but I can see perfectly well why you prefer Lasso. So, no hard feelings, its all in good fun buddy.

Its nice to have a good debate about middleware every now and then

[Leb i Sol]

oooooooo I would love to have a cup of coffee with you guys and chat about web/DBs....these are some great posts

Mariano, thanx for the XML apporach...I knew about it, I just never ventured in that direction since XML was not my thing. But, I have started to respect/leran it..

...and still have to say that ASP/PHP even JSP* is EASY to debug and quick and safe Server Side Executed language-hence no need to "chrome" your code - regradless of the web server platfrom or DB......after all....IT ALL gets executed based on Standard Querry Language only tags get changed.

IMHO it is not that hard to "tag the tags" much like words WHERE or UPDATE or INSERT strand out in this post and any Inline action does not even come close in comparison to dynamic SQL querry strings that can include as many logical cobmos as u can think of.....honestly, FM was never my 1st. choice (for the web) but is a great "workgroup DB" that was "forced" on the web. Access lovers lucked out only because core of Access is on SQL and connection engines were forcefully evolved over the years due to power of Micro$oft.

anyway, where is my cup of coffee....

All the best!

By the way in MySQL V5 "stored procedures" will be supported....

[Anatoli]

RE: The bottom line: PHP is free, Lasso is not.

My point is -- Lasso cost me 999 and a bit of learning. PHP will cost me thousands of $$$ just to be on the same level. It is the same with cars -- any idiot can repair them, but I never did that, I am happily paying garage bills!

RE: However; selling the code to a web application is kind of unusual.

I do both, hosting and supplying something for someone else and it makes no difference if it is desktop or web based solution.

RE: Its nice to have a good debate about middleware every now and then

Sure, 50% of readers will go your way and 50% my way but that doesn't matter. The nice point is to exchange views.

RE: Inline action does not even come close in comparison to dynamic SQL querry strings that can include as many logical cobmos as u can think of.....honestly

Inline in Lasso is absolutely generic and not relevant to database. The same way something works with FM, it will be with MySQL or Oracle. In SQL databases are differences. And to allow SQL syntax is always some kind of security risk.

[Garry Claridge]

I don't think 50% can afford to go your way Anatoli

Even the clients don't want to have to pay for Lasso when they can use PHP.

I'm not knocking Lasso, however a need exists for a lot of small web-applications. For example, the handling of file-uploads and concurrently updating an FM database. This is where PHP can be deployed effectively and economically.

All the best.

Garry

[Anatoli]

In this angle you are right.

But then I can just provide hosting service and pick CDML or Lasso and not mention cost to client. Or charge just partial cost.

And to develop something in PHP will be more expensive because of labor cost. In my case for sure

Expensive Lasso plus coding = $10,000.

Free PHP plus coding = $15,000.

This is my calculation.

[Leb i Sol]

ahaaaa....ur an expensive coder Anatoli

"And to allow SQL syntax is always some kind of security risk"

- yes and NO, user management and rights to execute SQL can be easily managed ( and YES even on MySQL despite what some of u might argue)....and if u ever "loose=get hacked" on your admin account to the SQL server...well in that case it is time to get religious and hope you backups were runnung or hire a network admin hint hint hint LOL

"The nice point is to exchange views"

-[tux]{

one more cup of coffee please ... and whatever these nice people are having

[Anatoli]

It isn't my hour rate Anyway, if you allow executing SQL, then someone will try that.

I am not yet experienced in this and maybe I will never allow SQL because of "SQL injection" risk.