“Enter correct CAPTCHA, get error, reenter chosen password, recheck checkboxes, reenter correct CAPTCHA, wash, rinse, repeat.”

Ugly. Glitchy. Problematic from a readability and accessibility standpoint. I think CAPTCHAs are horrible and I won’t be adding them to my applications.

A simple question/answer spam challenge – as on Building Findable Websites – is a far more elegant solution. This is definitely *on* the roadmap.

simpleContact Pro is made for the professional, or indeed anyone building a website that wants a bespoke contact form and mailing list opt-in. No programming is needed and you can be up and running in just a few minutes.

I always intended to build ‘Pro, even when I started working on simpleContact Lite. ‘Lite is used by individuals and companies of all sorts and the response has been wonderful. Now features including custom fields, a double opt-in mailing list and CSV export are available to anyone. ‘Lite users can upgrade easily, migrating their settings and data with just a click.

My highest priority has always been a polished, user friendly interface. I do not work to implement a laundry list of functionality. I am a web designer / developer by day – this is what I do. I understand which features are important and that time is money.

To be able to deliver a sophisticated result with a minimum of fuss is key. Even the most skilled programmer knows that the easy solution is often the smart choice. With simpleContact Pro you can dispense with one of the trickiest, most time consuming development tasks and focus on your content.

Head over to my updated downloads section to find out about simpleContact Pro!

I issued a beta version this morning to a group of volunteers. I am very grateful that these people, several of whom I am fortunate enough to have worked with and call friends, are willing to give their time to help me deliver a great product.

I’ve also enlisted the help of some smart people that I’ve met on my internet travels: simpleContact users, designers, developers, bloggers and marketeers. I look forward to receiving everyone’s feedback.

Key features of simpleContact Pro

• Automagical installation – enter your database info and upload
• One-click upgrade for simpleContact users transfers settings and data
• Smart default settings to save you time
• Browser-based admin with messages inbox
• New form builder which supports custom fields
• Client-side and server-side form validation
• Multiple email recipients
• Email autoresponder with personalisation
• Single or double opt-in mailing list
• CSV mailing list export, ready to use with mailers like Campaign Monitor
• Built with web standards and integrates easily with your website

simpleContact Pro will be a commercial product, with a price of $25. The free version will be rebranded simpleContact Lite, and maintained alongside it.

The test period closes at the end of September. I am aiming for an October release.

Progress

As you can see from my downloads page, work has continued on the application. simpleContact currently stands at version 1.2, which I released in December 2007. The details of each version can be found in the release notes.

I’ve tweaked the design of the downloads page and the site in general, and I’m keeping a visual log of those changes in my Flickr account. When I release the “Pro” version it will be re-branded simpleContact “Lite”.

I added a support forum to this website. It’s very early days, but I hope to build a valuable resource. Publishing an application (even a vigorously tested one) is rather like releasing a domesticated animal into the wild – you have no idea where it will find itself and how well it will fare. It seems to be coping well in the big bad world of unpredictable server configurations and usage scenarios.

I’ve also made a personal discovery. To focus on something that’s your own, improving it bit by bit appeals to the perfectionist in me. I find it very satisfying.

Reception

The response from users has been overwhelmingly positive. I don’t mind revealing that I currently average 180 downloads a month, so you don’t need to be a maths whizz to know that I am getting close to a milestone that I will comment on soon.

In version 1.1 I added a rating form to the log out page to help users express their opinions and to promote the application on The PHP Resource Index, a leading script directory. The reaction was great, and it has a solid front-page position in its category. With the release of ‘Pro the attack on its rivals really begins!

Users have been generous, with comments such as these:

“I’m always looking for ways to make my clients’ projects useful and sophisticated, but still affordable. simpleContact makes it easy to deliver an advanced product easily.” Kim D.

“Being a web developer/designer but not a script author, this is an asset. This application, in my opinion, rivals most of the ones designed by other companies that charge a premium.” Alan J.

There’s still a long way to go. I’ve had lots of requests, some of which I definitely plan to include in future releases. “Subject” and “US state” fields in particular have been in demand. I hope to satisfy the need for bespoke options with ‘Pro.

Promotion

I’ve not engaged in any advertising so far, although that will come. I’ve relied solely on word of mouth, directory listings and links in relevant places. Thanks to Andy Prevost, the PHPMailer website in particular has been a strong source of visitors.

I’ll write my first newsletter in a couple of months. A fringe benefit of this project has been that it constantly yields new opportunities to learn and interact with people. To write better, more compatible code, manage versions, user expectations and support requests, stats analysis, PPC, email marketing – all things that you learn best on the job.

I can’t wait to see what I have to say in May 2009!

simpleContact Pro

Development of simpleContact Pro is well underway. I’m currently working on the form builder itself, which is coming along nicely. It would however be premature to announce a release date other than a May/June window. I plan to write a substantial blog post at the start of May that will preview the app (with interface screengrabs).

StumbleUpon

I have got the StumbleUpon bug. I’ve been using it since January, and it is quite addictive to keep a blog of webpages that you like. It has also become a steady driver of traffic to my website. In time I’ll integrate my StumbleUpon blog with this website, since referencing other sites can be valuable, but rarely merits a full post.

Manchester Great Run

I start my overdue training programme tonight, newly bought iPod Shuffle in hand. My fundraising page is set up and I am seeking sponsorship between now and May 18th. I am running for Barnado’s in this, my third Great Run.

I’ll be getting back into regular posts soon, apologies for the brief hiatus.

• I want as many people as possible to use and benefit from my software
• If many people profit from my work and few buy it, I’d call that “getting ripped off”
• Per-domain licensing seems a little bit too strict
• Usage of an app where the code is not compiled would be impossible to police
• My resources are too limited to invest significant time and effort in the above

On reflection, the licensing model I’d like to adopt is as follows:

• Application costs x, for a personal use license (not restricted to one domain)
• Installation for a third party (e.g. a web designer working for a client) dictates a transference of ownership and requires a new purchase
• A user is not permitted to re-sell the software
• They may however charge for installation as a service at their discretion
• Charities or non-profit organisations may request a free copy of the application
• Users are trusted to act in a professional manner – no active policing
• Support will be denied to users who do not have a license

So what do you think?

My reasons for this are simple:

• I wanted to add a forum to help support current users of simpleContact 1.2
• To get it live before releasing simpleContact 2.0 Pro, so I can document it
• I didn’t want to be sidetracked from building ‘Pro to make the forums purdy

You’ll find sections for FAQs, installation, troubleshooting, requests, miscellaneous and a section that I’ve called “Out and About”. This is where you can earn yourself some link-love by posting about your simpleContact powered website.

Let’s get a discussion going

UPDATE: Added a link to the contact page.

Users will be swift to report bugs and incompatibilities for you. This isn’t negligent; it’s natural. A developer can’t anticipate all possible configurations and behaviour. Your response is what matters. You may be equally swift to issue a fix, but issues may sometimes go unaddressed because the effort outweighs the benefit.

Issues with simpleContact have been rare, but a self-started forum thread caught my attention last week. A member commented that they hadn’t been able to submit their name properly. I’ve researched the matter and in the interests of transparency I’m going to present what I found and what I plan to do.

Character encoding is a thorny issue that few bother to understand and implement in a considered way. There are articles on the web that cover the subject in detail, so rather than re-hash their points I’ll add some relevant links at the end.

The issue

simpleContact uses MySQL’s default collation, which is latin1_swedish_ci – fine for English and most Western European languages, but other languages (e.g. Greek, Japanese, Russian etc) will not be stored or represented properly. This is a matter I wish to address because I want as many people as possible to use my software.

The ideal course of action would be to process and store data in UTF-8 encoding. UTF-8 is a multi-byte character encoding that supports the characters of just about every language in the world.

Advice abounds for how to reconfigure your server and scripts to use UTF-8, but matters are more complicated when users will host an application on their own site. As developers of apps like WordPress and Mint know, ideal configurations in shared hosting services and availability of non-default PHP extensions like mbstring can’t be guaranteed. Some of the servers I have access to lack the necessary functions.

The easiest thing would be to put up a wall and say “If you don’t have x, you need to get a better host”. Meanwhile back in the real world, users are far more likely to reject an app than swap hosts. A middle ground has to be reached.

The solution

UTF-8 support must be added, but not without respecting a user’s situation. I plan to keep Latin-1 encoding and collation as a baseline standard for compatibility. It is better to support a subset of commonly spoken languages than not to work at all. For users whose server supports mult-byte string functions, the database will be silently upgraded to UTF-8 and appropriate methods will be used in PHP.

Beyond that, there isn’t much else. If you want a truly international solution and your host won’t support mbstring then you really do need to choose another host.

So what next?

I have fixed the feature-set for simpleContact 2.0 Pro and don’t intend to add UTF-8 support to it. When 2.0 is done, it will become a high priority feature in version 2.1, which will be a free upgrade. I will add it to simpleContact Lite in due course.

Useful links

• Joel Spolsky – The Absolute Minimum Every Software Developer Absolutely, Positively Must Know About Unicode and Character Sets (No Excuses!)
• Nick Nettleton – PHP UTF-8 cheatsheet
• Gabriel Walt – StumbleUpon PHP: [Tutorial] Character encoding
• Wikipedia – ISO 8859-1 (Latin-1) and UTF-8

• Custom form fields. My most requested feature, which was always planned.
• Double opt-in mailing list. Services like Campaign Monitor insist on this.
• CSV export. This acts as a bridge to other software and services.
• Client-side validation. Powered by jQuery, a nice-to-have that I want to add.
• Easy upgrade. simpleContact 1.2 users can migrate settings and data easily.

I’ve gone back to good old fashioned paper because design comes first. I want to use my experience as a web designer to build an elegant solution to real needs. There will be no comparison tick list. I won’t add useless features for their own sake. I’ll be adding some over time however, that I’ve seen nowhere else…

I want to make something that’s remarkable because it makes a difficult thing easy. One user was kind enough to share that he’d tried seven other products without success before simpleContact 1.2. It is very rewarding to get feedback like that.

I’m not going to commit to a release date because of my schedule, but I’m going to aim for May/June. Version 2.0 Pro will cost $25, and the existing free version will remain, re-branded simpleContact Lite. Version 1.3 Lite will follow thereafter.

Recipient addresses in database

It’s not unusual for a developer to add the recipient email address(es) to an HTML form as hidden fields. It is a simple matter for a spambot to uncover these addresses. I do not do that – your email addresses are safely stored in the MySQL database.

This also prevents spammers exploiting your website to send emails through your server by overriding the recipients on your contact form.

Server-side validation

Instead of client-side validation that can be bypassed easily by turning off JavaScript in your browser, simpleContact has server-side validation. Form submissions are checked for the following:

• Required fields are completed
• Email addresses are valid
• Character limits are not exceeded

The last point is important. A field’s “maxlength” attribute can be deactivated by tools such as the Firefox web developer toolbar (a legitimate tool that I use myself).

One thing you notice about spammers though is that they tend to submit a lot of text – mostly nonsense. The character limits on fields are enforced in the server-side validation, where they can’t be bypassed. A spambot is likely to fail here.

Escapes submissions to prevent SQL injection attacks

This is more of a database security measure than an anti-spam thing. If submitted data is not processed for certain characters (e.g. ” ) then a hacker could post SQL code through a form to either damage its database or expose data. Wikipedia has a more thorough description of SQL injection attacks.

Suffice it to say, my app is protected from this.

Your password is stored as a salted hash

Simply put, this means that even if your database was compromised, a hacker would not be able to retrieve usable passwords because they are encrypted (rather than stored as plain text).

At the end of the day, noone – not even Google – can honestly claim to have built a 100% spam-proof system. Since last May my WordPress comments form has had about 2,000 spam submissions (thankfully most of which were blocked by Akismet).

What I can tell you is that over that same period I have received one spam email through simpleContact. My clients have reported none at all.

I find that a tolerable amount