I've created an easy-to-install tool for older stores to use to help block the recent SQL injection attacks, as well as future attacks that may be more specifically targeted or use other methods (hackers are very good at switching tactics as people fix their sites!) I will be releasing an update to version 6 shortly that will include this as well, just as a precaution against attacks (and to prevent error messages being generated by them) but if you don't tend to update your stores, you can use this tool on version 6 sites as well (or any other CF site you wish to use it with). This tool replaces the code changes listed in the earlier blog article, and can be found on my Downloads page.

Those of you on my email list may know that I've been working to make CFWebstore fully compatible with Railo, and the latest version 6.30 release contained a number of tweaks and updates so that it works well on it, and I've also been passing on feedback to the guys that write Railo on things that could be adjusted on the server to make CF applications run with a minimal amount of changes. Now we have an even more exciting reason to be looking at Railo! It was announced at Scotch on the Rocks that Railo is going to be open sourced and they are actually partnering with JBoss.org, which gives it a whole new user community to attract and some additional possibilities for tags that can tap into the JBoss core functions. The open source license to be used is the LGPL which is more all-encompassing than the one used for Open Source Blue Dragon, and allows for better commercial use and also for code done for Railo to make its way into the other CFML engines as well.

They also have released Railo 3.0 which has some really exciting new features, including a lot of CF8 tags and functions, some exciting clustering capabilities, Amazon S3 resource, and new tags for doing multimedia (cfvideo, cfvideoplayer). Railo has really become a mature product and one that a lot of us are taking a really close look at. I've been particularly impressed with the excellent support the Railo team has provided while I've been working with their product and look forward to running even more sites on them in the future (perhaps even my own!)

A great way to learn more about ColdFusion is to join a local ColdFusion User Group (CFUG). I've belonged to a number of these over the years and recently we are seeing even more CFUGs starting up. It's a great way to get free training and live presentations on ColdFusion, learn about upcoming and new releases, see demos of technologies like Flex and AIR in action, and even a great source for finding or advertising for jobs. Many groups often get freebies to give away as well from T-shirts and mugs to full versions of software, so it's well worth your while to check them out. Visit the Adobe User Groups site to look for a group in your area.

If there's no group in your area (or even if there is!) you should also check out the ColdFusion Meetup group which does online presentations on a regular basis. You can view recording of past meetings and subscribe to get notifications of future events.

Here's some exciting news for CFWebstore users that want to run their own servers, be it VPS or dedicated. New Atlanta has announced that later this year they will be making the BlueDragon/J2EE version of their server open source. The latest versions of CFWebstore are fully compatible with this server, and should run flawlessly on it. What does this mean for you? Well, it means that you can purchase a VPS or dedicated server from any hosting company that you want to use, install a J2EE server like JBoss, install the open source BlueDragon server on it, along with a database server (like MySQL which is also open source), unzip CFWebstore and setup your datasource, etc. and away you go! Considering the licensing change with CF8 that made a VPS even more expensive than before, and the availability of other free web application scripting languages like PHP, Ruby, JSP, ASP.Net, etc. this is a really exciting advancement for the ColdFusion platform, and will certainly have a lot more people looking at NewAtlanta's offerings as well. Read more about it here:

New Atlanta News

and here:

Vince Bonfanti's Weblog

Once in awhile I hear from someone who is having problems with customers receiving their emails. Usually it's just a configuration problem and easily fixed. But sometimes it seems like once in awhile an email gets lost for no apparent reason. This is typically not a CFWebstore problem, but rather a ColdFusion issue.

If you send yourself an email from your site (or any function on the same server that uses a cfmail tag) you can take a look at the headers and see what the Message-ID is coming through as. If you see something like "xxx.xxx.JavaMail.SYSTEM@serverName" instead of "xxx.xxx.JavaMail.SYSTEM@serverName.domainname.com" then there's a good chance that your emails may be getting blocked or lost as possible spam. What you want is to correct the Message-ID so it has a proper mail server domain on it.

CFWebstore attempts to do this by setting the Message-ID with a cfmailparam tag. Unfortunately, some versions of ColdFusion ignore this and override the setting. So you may have to take further action, or ask your host to look into it, if you are on shared hosting. One option is to upgrade to CF8, which now always uses the mail server as set in the CF Admin for the Message-ID. If you are on an older version, your best option is to update the JVM arguments in ColdFusion, and include the mail domain there. Here's a link to a post on the Adobe Forums which outlines how to do this:

CFMail and Message-ID

After making the change and restarting ColdFusion, send yourself another test email and now your Message-ID should be properly formatted.

There are of course all kinds of good sources for ColdFusion information and tutorials online, but did you know there are also a lot of online user group meetings? Probably the most popular is the Cold Fusion Meetup Group. Just sign up to get email notifications of online conferences which you can attend for free. A great way to stay up on what's new with ColdFusion without having to leave home. And even if you can't make the meeting at the scheduled time, most of the conferences are recorded for members to view at their leisure (although you of course don't get to ask questions, etc. as you do live).

Version 6 is the first version of CFWebstore to drop support for ColdFusion 5 and exclusively support CFMX and up. This allowed for use of many of the new CFMX features, most notably ColdFusion Components (CFCs). Most of the core shopping and checkout functions are now run through CFCs. To improve site performance even more, these are loaded into application memory and cached so that they only have to be initialized once. For a typical busy store, this will be the case: they are loaded into application memory on the first hit and each subsequent hit will retrieve the saved components. Likewise with the template and query caching that ColdFusion does.

If you don't have a busy store though, and only a few visitors drop in per day, these stored components may actually expire from memory between visits. The result of this is an initial page load that is quite long. Wouldn't it be nice to avoid this long page load and make sure your site loads quickly for each and every visitor? Well, actually this is a very easy thing to do! It's accomplished by setting up a simple scheduled task in ColdFusion. We just need to call the homepage of the site once an hour to prevent it from expiring and to keep all the components initialized.

If you have access to the CF Admin or your host provides a control panel for creating schedules, this is a fairly easy thing to do. Even if you don't have access though, you can create the task using a bit of CF code. What we want to do is just make sure that the store frontpage gets hit at least once every hour. This will keep all our components in stored memory and ensure that they don't timeout. Here's an example of how to create a scheduled task that will hit the CFWebstore homepage once an hour:

So how do we run this code? Well, the current version 6 release of CFWebstore actually includes a page that can be used as a "scratchpad" for testing or running code one time. This page is 'test.cfm' in the top-level store directory. Just drop this code into that page, modify for your own site, and then run the page by calling 'index.cfm?fuseaction=home.test'. You won't see anything on the resulting page(unless you typed something incorrectly and got an error) but the scheduled task should have been created. Now your store should stay initialized and load quickly on every visit!

It seems more and more common for me these days to get questions about which hosts are best to use for CFWebstore sites. In the past, I commonly recommended popular CF hosts like Crystaltech and HostMySite. But it seems over the years its gotten harder and harder to find a ColdFusion host that really makes sure their shared servers run perfectly all the time and don't have issues. It's fairly common when running stores on these hosts to experiences errors from time to time such as query timeouts, low memory errors, session failures, etc. all tracing back to resources just stretched too thin. Sometimes the host will try and see if moving the site to a new server will help and sometimes that can indeed be enough to at least minimize the problems....for awhile. Eventually they will start loading more sites on the box and the problems will start creeping in again.

[More]