Fake drug scam hijacks UK college websites

The BBC recently reported that “UK academic institutions have unwittingly become the accomplices of criminals selling fake drugs online.” The article went on to state that this had happened because spammers had “exploited vulnerabilities” in the PHP scripting language. As a PHP programmer I take exception to this claim, as should website owners and web design agencies, for reasons that I will explain later.

The article reported how academic websites with the .ac.uk domain extension were unwittingly forwarding visitors to websites selling fake drugs online. Without going into much detail it was explained that spammers had injected code into the web pages, seemingly exploiting vulnerabilities in PHP, that would make Google and other search engines believe that the pages were relevant for searches related to prescription drugs such as Viagra. When a user searched for those terms and visited the website via the link on the search engine results page (SERP), the injected code would detect this and redirect them to the online pharmacy. When a user visited the website by typing in the URL directly or via a non drug0related search, the normal page is displayed.

Deliberately Targeted

This is not a random attack; the websites had been specifically targeted. Academic institutions rank very well in search engines because, put simply, they are inherently trusted and as such, the .ac.uk domain extension carries a lot of weight.

An attack like this is also clever because it doesn’t place visible links to spammers’ websites or make any obvious changes to the web page that has been compromised. Visitors only get redirected to the online pharmacies if they are actually searching for specific terms. This way the website administrator may never know that their scripts have been compromised and remove the spammers’ code!

One such website that has been affected is Ravensbourne College of Design and Communication. Amazingly, four days after the BBC reported that their website had been compromised (and presumably even longer since they found out), the injection in still in place! If you visit www.rave.ac.uk you will see the college’s official website. If you search for the college and follow the link in the SERP you will also see the college’s official website. However, if you search for Viagra and follow the link in the SERP you will not end up on the college’s website at all, but at a “Canadian online pharmacy”!

What Cost?

This is all very unfortunate for the college. The negative publicity alone would be bad enough, but they will also have to spend time and money removing the injected code and then plugging the holes that allowed an exploit of this type to happen in the first place.

I mentioned earlier that I would object to the reporting of this a PHP exploit. I believe that this is inaccurate and could lead people to believe that PHP is inherently less secure than other scripting languages. In fact I would not call this a PHP exploit at all – it’s slack coding that could have resulted in the same thing happening no matter what scripting language the website was developed in.

From the scant technical details offered in the original article it would appear that the affected websites do not properly validate and filter user input. Of course a website developed in PHP would be vulnerable to rogue code injection attacks if user input is not validated correctly. But for that matter so would any other scripting language!

Aside from my personal objections to the labelling of this incident as a vulnerability within PHP, website owners and web design agencies should also consider the effects of the media when reporting stories like this. If a potential client reads the article and takes from it that “PHP is not secure” or “PHP websites get hacked easily” and then you pitch a PHP-based website to them, how will that affect your chances of winning the contract? And to a lesser extent, how do stories like this affect the public’s perception of your current website? Would they feel safe buying from you online when such high-profile PHP websites fall victim to hacking?

Conclusion

But what can we in the IT community do? It’s not realistic to expect journalists to understand that this was poor coding rather than an insecure scripting language. The best that we can do is be aware of what stories are floating around in the news and be sure that we understand and can explain the real issues!

Comparing your site to others in your industry

Although nobody wants their website to be a carbon copy of a competitor’s, it is important to check your competitors to make sure you’re offering at least as much information on your site as they offer on theirs.

Things customers might expect from your site, especially if your competitors provide it:

• Do you clearly display opening hours (if applicable) and contact details?
• Do you offer an e-mail address or a contact form?
• Do you show prices, a menu, services or a stock list if applicable?
• Do you show what payment options you accept, either on your site or in your store?
• Do you provide directions or a map?

What your potential customers might be saying about you

Social media – forums, blogs and networking sites – can also have a significant effect on your business. In the case of this particular shop, the majority of their online advertising has been done by word of mouth and user recommendations – and this has been a factor in their growth as a business.

But the negative reviews of the company’s newly launched website on a well-used forum with high natural rankings may have a long term effect – particularly when comparisons have been made and links provided to other industry standard websites that do contain the information that the site users want to see.

What could this company do?

A competitor analysis would provide an overview of other sites in the industry, either UK-wide or targeted to their region. This could provide an insight into the expectations of users based on their experience of other companies’ websites.

Performing a WebScan on their site would help ensure that the site is optimised, search-engine friendly and compliant with W3C standards.

And lastly, social media monitoring would highlight issues like the discussion of the current website, so that appropriate action – whether that be revising the website to meet expectations or responding to the discussion to explain the reasoning behind the current site’s design – can be taken.

PHP’s MySQL Extension

PHP’s mysql extension is the original extension that was designed to allow you to develop PHP applications that interact with your MySQL database. The mysql extension was introduced prior to PHP version 3 and provides a procedural interface only. This extension is intended for use only with MySQL versions older than 4.1.3. It can be used with newer versions of MySQL, but not all of the latest MySQL server features will be available.

PHP’s mysqli Extension

PHP also offers a more recent mysqli extension, sometimes known as the MySQL improved extension. The mysqli extension is included with PHP versions 5 and later and was developed to take advantage of new features found in MySQL versions 4.1.3 and newer. mysqli provides both an object-oriented and a procedural interface.

Why to Use the mysqli Extension

The PHP development team strongly recommends that if you are using MySQL versions 4.1.3 or later you should use the mysqli extension rather than the original mysql extension. The key reasons for using mysqli over mysql are:

• Object-oriented interface
• Support for Prepared Statements
• Support for Stored Procedures
• Support for Multiple Statements
• Support for Transactions
• Enhanced debugging capabilities
• Embedded server support

Additionally the mysql extension is no longer being actively developed by the MySQL development team, whilst the mysqli extension under active development. It also supports multiple statements and character sets, whereas the mysql extension does not.

But…

Although the PHP development team strongly recommend that you use the mysqli extension if you’re using MySQL versions 4.1.3 or later, there is a debate about speeds differences between the two extensions. There is evidence (example) to suggest that although under certain circumstances mysqli is faster, for everyday use mysql actually performs better in terms of speed than its more modern counterpart!

However, the tiny speed advantage to using mysql rather than mysqli is probably outweighed by the newer extension’s benefits.

Conclusion

Although it might be true that mysql is ever so slightly faster than mysqli, it’s still worth following the PHP development team’s advice and using the newer extension. mysqli gives you access to the features available in MySQL versions 4.1.3 or later and it’s more flexible than the mysql extension. In addition to that, as the mysql extension is no longer under active development by the MySQL team there is no guarantee that it will be included in future PHP releases.

Hold on just one moment… how much does your client know about CSS – and how long is the site content going to retain the look and feel they’re so pleased with if they’re not confident with HTML?

Clients aren’t coders.

Most of them, anyway – most clients know how to use Microsoft Word, but that might well be the extent of their design knowledge. And, if you’ve worked with Content Management Systems, you know that copying text from a Microsoft Word document into the CMS can cause some unexpected design complications, and can result in accessibility issues, including loss of W3C compliance. Inserting plain text into the editor helps, but what happens to the formatting?

Using inline formatting is certainly an option, and many clients will opt for this. It’s quite easy to highlight a segment of text, apply a font size and colour, then set the text alignment. This has the advantage of being truly WYSIWYG, as all changes will show up exactly as the user wants them to in the CMS editor window. There’s just one small problem.

If your client doesn’t know exactly what font sizes, colours and alignments are used in the content you set up for them – not to mention image spacing, table cell padding and other more advanced settings – it will be very difficult for them to replicate this when they upload their own content. An area of text that looks just about right in the content editor might not look like the rest of the page content when it’s saved and viewed on the front end.

But they can apply CSS styles and classes, right?

Of course, you could supply them with a list of the correct inline style codes or even classes to add for each formatted segment of text… it adds another page or two in the user manual, but it would ensure that they could produce new pages that look like the content you uploaded for them.  Some clients are quite happy to click on that little HTML button and enter an instruction like class=”blah” in the correct part of the page for the content they’re uploading.

But many content managers don’t have any web design experience – they’re working with the content editor on the basis of a “Microsoft Word-like” interface. Looking at the HTML version of a page can be daunting. Those <p> and </tr> and <a class=”sausage” style=”margin: 5px; float: left; clear: both;” href=”/overthere.htm”> tags don’t make sense to anyone who doesn’t know that they’re looking at the start of a paragraph, the close of a table row or a styled link to a page.  In that respect, it may not be reasonable to expect your clients to be able to add classes or inline styling.

What’s the solution?

I use a combination of two approaches.

First,  in every CMS user guide that WSI Huddersfield produces, we include any applicable inline styling, particularly where <div> sections have been used to create columns or floating text areas, as standard CMS software doesn’t include an insert-DIV option. This is done by providing a block of code in the user manual with “your text goes here” sections in it.

Secondly, in the site creation process, we use CSS to define the appearance of a number of basic functions on the site, like paragraphs, headings and lists. Once this is done the customer can then use your styles with just a click or two to format their text and retain the same look and feel as the content you have uploaded.

For example, you may need a specific format for a Call-to-Action button. Trying to show a client how to do the Call-to-Action buttons with standard text and inline scripting could be quite problematic, even if you explain to your client exactly where to paste the appropriate styling text. But if you have set up the CSS so that using the Heading 5 option in the CMS will automatically make the text appear as a button with a fixed width, floated right and showing a background image and border, it simplifies things considerably.  A client could then enter their normal text, highlight it, and click “Heading 5″ in the settings.

Style test pages

There is one down side to using the CSS styling in this way – the CMS is no longer quite so WYSIWYG if you’re using external style sheets, which do not show in the editor window. That formatted H5 wouldn’t have the styling applied to it, so it would simply appear as plain bold text in the CMS. This is why creating a Style Test page is important, so that a client can refer to what something looks like on the front end of the site, and click the right option in the CMS. This test page should show:

• Headings 1 –  6
• Standard paragraph text
• Links
• Bullet and numbered lists
• Any other formats applied to standard functions

This way, your client can see what they need to do to replicate the style of pages already on the site. And helping your client to do that will also help you – so that the site you are so pleased about will remain a showcase piece once your clients are maintaining their content themselves.

Five Website Tips for Engaging Consumers Today
The web is not a static medium: as technologies improve, user expectations increase. As they do, meeting customers’ expectations will mean developing your marketing to be more appropriate, timely and relevant to what consumers want.

Here are five steps to develop your website to engage more effectively with your customers:

1. Study Customers’ Online Behaviour
Use your website analytics to learn from your intended audience – your customers – and give them what they want. Identify website hot spots that attract the most attention; understand when your email marketing messages will be best received; discover which social platforms are leading them to you.

If used well, your web analytics are a key component in understanding and fulfilling your customers’ expectations.

2. Consider Your Content Presentation
The first step in engaging customers is not only the quality of your content, but also the ease with which it can be read and its user-friendliness. A professional web design and carefully thought out content arrangement will help you make a great first impression – and draw your website visitors in.

3. Creative Content Formats
The web is no longer a text-based medium, and hasn’t been for a while. Even the less frequent web user will be used to animated imagery and video content. Be creative with your content to engage your visitors’ senses and get your message across dynamically, but ensure the technology doesn’t distract visitors from your pitch.

4. Emphasise Social Media Connections
Make it easy to share your content across multiple social networks, such as Digg, StumbleUpon, Twitter, Reddit, Facebook and many more. Including an easy-to-use ‘Share’ widget with your content makes content sharing a breeze and demonstrates your intention to be engaging.

5. Make it Easy to Correspond – No Jumping Through Hoops
If you want to encourage correspondence, show it. Make it a simple process for site visitors to leave comments or get in touch to take ’social conversation’ to the next level. Streamline your forms and have multiple points of contact through which visitors can leave comments.

Finally, with all the above, adapt your marketing mix to incorporate a coordinated, consistent approach. Developing a coherent online marketing campaign can be done very effectively at a fraction of the cost of traditional promotional activities.

Think of your website as an additional member of your sales team – always available and ready to win new sales. Just as you might invest in training for such an employee to hone his or her skills, your website can be a great instrument for converting more online leads by putting the right tools in place together with some tried-and-tested lead conversion techniques.

Simple but Clever Lead Conversion Tactics
Influencing your website visitors to take the next step in becoming your customers can take many forms. It could be to:

• Fill in an online form in return for a free White Paper, industry report or discount coupon.
• Sign up to a newsletter or stay updated with your blog via RSS feed.
• Follow your social media updates on sites such as Facebook or Twitter, for example.
• Register to gain access to exclusive areas of your website, such as video tutorials or a webcast.
  Buy a product, request a meeting or make a booking.

Once you are clear on what the desired outcome should be, you can start crafting an appropriate online conversion strategy. While the desired end results may vary, the following key conversion techniques will mostly apply.

1. Attract the Right Audience
Consider this your foundation. It may take longer to get up and running in order to research the market and identify the best ways to attract targeted web traffic, but your conversion rate and advertising budget will thank you for it. The scatter-gun approach may get you started quicker, but it will also drain your resources, with little return.

2. Create a Great First Impression
Once you have attracted your audience, presenting them with a well-designed website that offers a first- class user experience will be a great start. But don’t stop there, use dedicated landing pages which relate specifically to your ads and which funnel your visitors into the direction of your conversion process.

3. It’s Time to KISS
Keeping it straight and simple is key to channelling your customers’ attention. Remove distractions and make the next step – your conversion goal – blindingly obvious. Other ideas for giving your most important message some focus would be:

Keep your copy short and to the point.
Try to keep your content readable without too much scrolling.
Present your strongest selling points towards the top of your page so visitors see it immediately.
If you are using an online form, make it easy to fill in. No jumping through hoops.
Use a mixture of text and images to help break up the copy and complement your message.
A well-prepared landing page will make a big difference to the effectiveness of your advertising campaign and help you gain favour with search engines that emphasize more relevant content.

4. Give a Great Incentive
Whether you are offering an industry White Paper in exchange for contact data, or selling state-of-the-art golfing attire, the starting point for completing the conversion is the same question all customers will ask: “What’s in it for me?”

Creating value-added offers not only provides potential buyers with incentives, but it also fosters loyalty and can act as a gatekeeper to qualify your customers.

5. Respond Swiftly
Research shows that customers are most responsive immediately after initiating correspondence. An automated email function will allow you to send an immediate message – perhaps with an offer – upon your visitors filling in a form, signing up to a newsletter or making an enquiry.

In conclusion, don’t leave it to chance, it may take a little testing and tweaking before you optimise your conversion process – but it is worth the effort.

Google Caffeine – Cause for Concern?
Google engineer and Quality Control Team leader Matt Cutts has described the Caffeine update as being the most fundamental change to the Google search system since its Big Daddy update of 2005. When a search engine changes its algorithm, it usually leads to a shake up of search engine rankings (as many businesses experienced in 2005). So is there reason to be concerned about the Google Caffeine update?

What is Behind Caffeine?
When asked why Google has made this update, Matt Cutts explained it as improvements being made ‘under the hood’ – with most searchers not even noticing the difference. The upgrades have been made to the way Google indexes content, by rewriting its indexing system to crawl faster, index more efficiently, and serve up fewer results much more quickly.

The huge popularity of real-time, content-sharing platforms, such as the micro-blogging website Twitter, indicates how internet users’ surfing habits are changing, demanding a more immediate web experience that includes search capabilities.

As the nickname implies, the update is about injecting more speed and a sharper focus. At the end of the day, Google, like any search engine, wants – and needs – to quickly serve up fresh, relevant and focused search results to maintain and improve its market share.

How Caffeine Might Affect You
The simple answer is: if you adhere to search engine optimisation best practices, then Caffeine will affect you very little, if at all. In fact, to genuine search marketers Caffeine is more likely to be a benefit than a disadvantage. The reason for this is that one of the update’s aims is to weed out less relevant, older content that may be in the way of better search results being served on the first few pages.

Google says the changes in search results will be subtle because it will be introducing the changes over a period of months from one data centre to another. So, as mentioned, while it may be a significant change to the way the Google engine works, it is unlikely most users will notice it.

What Can You Do?
If you already employ a well-prepared search marketing strategy, then you already have a head start on a lot of people – and probably won’t need to do an awful lot different. But without resting on your laurels, it could help to consider the following points:

Make your content easy to crawl. Help Google identify your content quickly by keeping your website code uncluttered (boring techy points), fast loading and well structured.
Is your website easy to navigate? Keep your best content easy to find, not buried under layers of unnecessary hierarchical layers.

Make sure you regularly update your content. As mentioned, searchers want fresh content – what’s being said today, yesterday, last week or month, not last year.

If you are already doing these things, then keep on keeping on. The Google Caffeine update will then be very unlikely to affect you.

In conclusion then, while the Google Caffeine update is significant, it’s not something to be unduly concerned about if you already have a good search marketing strategy in place.

Get Social Media Marketing Working for You
The choice of social media platforms continues to grow – with a plethora of social networking websites to choose from. While hugely successful sites such as Facebook, Twitter, LinkedIn and YouTube may be taking all the plaudits, there are many more social networking websites to consider. Your first goal is to establish where your target audience is active, and then ‘get on board that bus’.

A final word of warning before we move on to review the 20 social networking tactics for business. Don’t dive in too soon. Take some time to monitor and learn from your customers’ existing activity. This will enable you to participate in a similar fashion, rather than sticking out like a sore thumb.

20 Ways to Use Social Media to Promote Your Business
The following 20 social media marketing tactics will enable you to genuinely participate within social networks while simultaneously promoting your business successfully.

1. Highlight – and link out to – industry news or world news relevant to your field.
2. Share your own thoughts on topics related to your business.
3. Feature links to insightful articles and include an explanation as to why they are valuable.
4. Be helpful; share some of your expertise to help build a positive reputation.
5. Ask questions to get feedback and invite discussion on industry topics.
6. Recommend other social media users –they will usually reciprocate your recommendation.
7. Hold a contest and publicise it across your social media profiles. Competitions can spread like wildfire across social networks.
8. Announce business updates, including links to new products or special features.
9. Link to your website content occasionally; too often might seem pushy, but this doesn’t mean to say you cannot do it at all.
10. Link to rich media content, such as webcast presentations or videos that enhance your message.
11. Announce – and link to – the publication of your latest email newsletter.
12. Similarly, link to your latest blog post with a brief summary.
13. Post discount coupons and other deals exclusive to your social media audience.
14. Personalise your profile with your company logo and colours, and maybe even an image of yourself.
15. Think quality, not quantity. You don’t need to be the most prolific participant to impress.
16. Don’t be afraid to share some personality.
17. Pick up tips and tricks from other experts in your field.
18. Share links to your social media profile, or profiles from your website, newsletter and regular email signature.
19. Combine your content across multiple web platforms, including your website and social media profiles.
20. Identify the best times of day to engage with your target audience

In conclusion, remember that whether you are tweeting, poking or tagging, be yourself and enjoy participating in the social conversation.

The definition of bounce rate is the percentage of visitors to a site who leave the site without viewing any more pages. Bounce rate is calculated using the bounce rate is: bounce rate = total number of visitors who view one page / total number of visits. A visitor can bounce by:

• Clicking the “Back” button to leave the site
• Clicking a link to a page on a different web site
• Closing the window or tab the page is being viewed in
• Typing and navigating to a new URL
• Session timeout: commonly 30 minutes

Bounce rate can vary between different data sources depending on the session timeout value. A session timeout out is where a visitors views a page, doesn’t navigate or bounce and leave the browser idle for longer than the timeout period. If after the session timeout period the visitor resumes activity and navigates on the site, it will be recorded as a new session. Bounce rate data in Google Analytics uses the period of 30 minutes.

Why is bounce rate important

The importance of bounce rate is very much dependant on the natures of the website and the “bounces.” The way bounce rate is interpreted is different for ecommerce websites, blogs, news websites, affiliate sites, social networking sites and so on. Below are some examples of the how the importance of bounce rate can vary between different websites.

Ecommerce and Bounce Rate

The goal of ecommerce websites is to convert visitors into sales. To complete a sale it is necessary to navigate through the purchase process. A high bounce rate on ecommerce websites indicates that there is an issue with traffic relevancy (visitors weren’t looking to buy the products and/or services offered) or the websites persuasion architecture (web page design, prices, content and calls to action). Bounce rate is important on ecommerce websites because it is one of the metrics that can be used to determine the performance of web pages.

Blogs, News Sites and Bounce Rate

Blogs and new websites etc provide articles about all manner of subjects. If you’re looking for information about a sports event, brewing beer, world politics, whatever is may be a good article on a news website or blog site should provide you with the information you were looking for. In which case you will bounce but the website will have achieved its primary goal. Many blogs are monetized using affiliate banners and Google Adsense, clicking on adverts is also counted as a bounce. Visitors clicking on adverts would also be one of the goals of a blog site or news website. Another reason why high bounce rate isn’t necessarily a bad thing.

Affiliate and Adsense Sites and Bounce Rate

Some websites use search engine optimisation or paid search marketing to drive traffic to pages with an extensive amount of advertising. The intended goal of these websites is to get as many visitors to click on adverts as possible. Because clicking on adverts is counted as a bounce a high bounce rate may be a good thing. The web statistics analyst would compare bounce rate with clicks to determine what percentage of the bounce rate is from activities other than clicking on adverts. So bounce rate is also important on these websites but with clicks taken into account.

Bounce Rate: A Summary

With the knowledge of what bounce rate is and an understanding of the implications of bounce rate data for your website it’s possible to use it alongside other metrics to monitor, test and improve performance based and your websites goals. Using bounce rate it’s possible to streamline SEO, improve return on investment on PPC advertising and more!

WSI has franchises worldwide, and franchise members have been donating to the fund. WSI Home Office matched the donations from the entire IC network, which means that WSI collectively raised $8,000 toward the Haiti relief efforts!

WSI Home Office immediately sent this contribution to their contacts at World Vision to further their efforts in providing food, water, medical suppliers and shelter to the estimated 3 million people who were affected by the disaster.

Here is a statement received from World Vision:
“WSI has been a generous contributor to World Vision’s humanitarian efforts for years. With the recent crisis in Haiti, we needed immediate financial assistance to get much needed aid to those children and their families impacted by the earthquake. Without hesitation, WSI rallied up its franchise network and partners to raise funds for this purpose. I am so impressed with WSI’s dedication, commitment and hard work with their fundraising efforts. World Vision is thankful to have such faithful and committed partners like WSI.” – Richard Chapman, Development Advisor, World Vision Canada

Update from World Vision as of February 9:
February 9, 2010, Port-au-Prince – Nearly a month after the catastrophic quake, Haiti’s survivors face more than just staggering physical needs such as food and shelter. More than 9 out of 10 people World Vision staff members spoke to had lost loved ones — including friends, extended family, or close family — and need to make time for grieving and establish normal routines in order to recover. Access to the basics of life and some sense of control is also an essential part of coping with loss.

World Vision spoke to 150 people across three sites in Port-au-Prince, where our teams are providing emergency supplies and services to children and families. More than 40 percent of people asked had lost an immediate family member, while 14 percent said multiple members of their immediate family had been killed by the quake.

WSI is proud to be a strategic alliance partner of the Make Child Poverty History foundation.