eMusic relaunched on WordPress a couple of months ago, and it’s great to get Scott’s perspective on a key component of their setup.

Here is a quick blurb, and be sure to go read the full post for all the details:

One of the most bizarre critiques of WordPress that I often hear is “it doesn’t come with caching” – which makes no sense because Cache is one of the best features of WordPress out of the box. That’s kind of like saying: “my iPod sucks because it doesn’t have any songs in it” – when you first buy it. Your iPod can’t predict the future and come pre-loaded with songs you love, and your WordPress environment can’t come already-installed without knowing a minimal number of things. You have to pick a username / password, you have to point at a database, and if you want to cache, you have to pick how you want to cache (you don’t HAVE to cache – but really, you HAVE to cache).

…

Memcached (pronounced: Mem-cash-dee), or Memcache-daemon, is a process that listens by default on port 11211. Like httpd (H-T-T-P-daemon), it runs in the background, often started automatically on server load. A lot of huge websites use Memcached – at least: Facebook, YouTube, and Twitter.

[Read the full post]

PandoDaily

PandoDaily is a brand new tech site started by Sarah Lacy, former senior editor at TechCrunch. From her announcement post:

We have one goal here at PandoDaily: To be the site-of-record for that startup root-system and everything that springs up from it, cycle-after-cycle. That sounds simple but it’ll be incredibly hard to pull off. It’s not something we accomplish on day one or even day 300. It’s something we accomplish by waking up every single day and writing the best stuff we can, and continually adding like-minded staffers who have the passion, drive and talent to do the same.

Grist

Grist, a non-profit environmental news publication:

Grist has been dishing out environmental news and commentary with a wry twist since 1999 — which, to be frank, was way before most people cared about such things. Now that green is in every headline and on every store shelf (bamboo hair gel, anyone?), Grist is the one site you can count on to help you make sense of it all

Welcome to the VIP family, Pando Daily & Grist! 

Ready to become a VIP Services Client? Some of the world’s biggest brands rely on WordPress.com VIP Services.

The WordPress Intensive VIP Developer Workshop will take place in March 2012, and this three-day event will include a packed curriculum for VIP developers with some special guests, like Matt Mullenweg, the co-founder of WordPress and founder of Automattic, and Barry Abrahamson, Systems Team Lead for WordPress.com.

The training will be very hands-on and topics will include: WordPress coding standards, security, caching, optimizing themes and plugins, implementing new core WordPress features, and we’ll be further tailoring the curriculum based on registered participants’ input for their preferred sessions. Register now!

We’re going to keep the event small, with preference being given to VIP developers and select VIP partners, but if you’d like to attend the event, please fill out this form and we’ll put you on the waiting list if any spots open up.

Here are more details about the event:
March 26: Arrival in the afternoon with a special keynote from Matt Mullenweg, co-founder of WordPress, on the future of WordPress for developers. Reception & dinner.
March 27 & 28: Full days of training with VIP instructors.
March 29: Wrap-up, farewell breakfast and morning departures.
Pricing: $3250 per person, excluding airfare. Airport transfers, meals and lodging (3 nights) included.
Location: The Carneros Inn, Napa, California

Welcome to the WordPress.com VIP family!

Ready to become a VIP Services Client? Some of the world’s biggest brands rely on WordPress.com VIP Services.

Tell us about the site:
Mac Miller is yet another successful artist hailing from Pittsburgh’s Rostrum Records.  Rostrum chose 6Degrees to build a community site that would be a great destination for fans interested in staying up on news, tour, photos, videos and much more.

What were the reasons you chose WordPress to build the site?
Mac’s fan base is huge but also active.  We needed an established content management system that would be able to handle the traffic while also having the functionality a music artist requires.  After we discovered BuddyPress there was no question that the WordPress / BuddyPress combination was the right direction to go.  We’re also pleased with WordPress’s admin system as we find it very user-friendly for any content managers that me assisting the site.  Bottom line, WordPress is stable, user-friendly and has an incredible developer community supporting it.  All these resources made WordPress the answer.

What are your team’s favorite WordPress features?

Custom post types are very impressive and flexible, and the huge library of plugins for almost any feature you could want.

Are you a publisher working with WordPress? We want to hear from you. 

Want WordPress for your site? Get.WP.com

1. Tell us what your blog and book are about.

DAVID: You Are Not So Smart is a celebration of self delusion. One topic at a time, it explores how silly and irrational we all are through the lens of fascinating psychological studies. It started out as a blog just pointing out interesting things around that theme, but once I started gaining fans and saw my hits growing, I made the effort to write longer, more in-depth pieces about cognitive biases and other fun things. The book is an expanded version of the blog, similar in format.

2. What encouraged you to create a blog that celebrates self delusion? How has your life changed as a result of learning so much about psychology and irrational thinking?

DAVID: I tried a lot of different blog ideas before You Are Not So Smart. My first real attempt at keeping a blog about interesting things in psychology and neuroscience began around 2003. I gave up on that a few years later and tried a blog about feature writing. It wasn’t until I saw a video demonstration of inattentional blindness that blew my mind and prompted me to launch You Are Not So Smart in late 2009.

The result of writing about self-delusion all the time? It’s been great. My wife and I are always saying things like, “Hold on, that’s just the anchoring effect,” or “I think you are confabulating right now.” We’ve found that the articles can be a vehicle for self improvement, but always when you least expect it. Also, I don’t argue online anymore because I’ve learned through the research how futile and fruitless it is. It’s a wonderful thing to delete from your life.

3. So how’d you score the book deal?

DAVID: I got into a heated online argument with two friends over which was better, the PS3 or the Xbox 360. The argument went on for days, and I think we all crossed the line, insulting each other and getting legitimately angry – and we’re friends in real life! I thought it would make a great blog post, so I researched why I was so brand loyal and silly.

That became my post on brand loyalty and fanboyism, which I published that post at about the same time an iPhone prototype was stolen. With the buzz around fanboyism at an all-time high, someone at Gizmodo saw my post and asked if they could republish it with links back. I agreed, and all of a sudden my hits went through the roof. I kept writing and posting and soon emails arrived from the publishing world asking if I was interested in turning the blog into a book. I said hell yes.

4. Why did you choose WordPress.com, and what do you like most about it?

DAVID: I’ve tried every other service out there, but WordPress.com is the most robust. I wanted something clean and elegant and easy, but with enough features to allow for scaling up my blog if it ever caught on with a larger audience. It was the right move.

This is an amazing and revolutionary time for writers. The barriers to entry are so low, and the platforms like WordPress.com so well-made, anyone with a voice can start shouting and be heard. Instead of writing a book and hoping a publisher won’t throw it into the slush pile, writers can start a blog and build a fan base. They can prove to publishers there is a market for their work and their voice.

A generation ago, a writer like me would never be discovered, never get a shot at the big time. Blogging platforms like WordPress.com are changing the lives of all manner of artists and activists. I think that’s fantastic.

Congratulations, David!

Want WordPress for your site? Get.WP.com

Ready to become a VIP Services Client? Some of the world’s biggest brands rely on WordPress.com VIP Services.

Your code works, but is it safe? When writing code for a high-profile environment, you’ll need to be extra cautious of how you handle data coming into WordPress and how it’s presented to the end user. This commonly comes up when building a settings page for your theme, creating and manipulating shortcodes, or saving and rendering extra data associated with a post.

There’s a distinction between how input and output are managed, however.

Validation: Checking User Input

To validate is to ensure the data you’ve requested of the user matches what they’ve submitted. There are several core methods you can use for input validation; usage obviously depends on the type of fields you’d like to validate. Let’s take a look at an example.

Say we have an input area in our form like this:

<input type="text" id="my-zipcode" name="my-zipcode" maxlength="5" />

Just like that, we’ve limited my user to five characters of input, but there’s no limitation on what they can input. They could enter “11221″ or “eval(“. If we’re saving to the database, there’s no way we want to give the user unrestricted write access.

This is where validation plays a role. When processing the form, we’ll write code to check each field for its proper data type. If it’s not of the proper data type, we’ll discard it. For instance, to check “my-zipcode” field, we might do something like this:

$safe_zipcode = intval( $_POST['my-zipcode'] );
if ( ! $safe_zipcode )
$safe_zipcode = '';
update_post_meta( $post->ID, 'my_zipcode', $safe_zipcode );

The intval() function casts user input as an integer, and defaults to zero if the input was a non-numeric value. We then check to see if the value ended up as zero. If it did, we’ll save an empty value to the database. Otherwise, we’ll save the properly validated zipcode.

This style of validation most closely follows WordPress’ whitelist philosophy: only allow the user to input what you’re expecting. Luckily, there’s a number of handy helper functions you can use for most every data type.

Sanitization: Escaping Output

For security on the other end of the spectrum, we have sanitization. To sanitize is to take the data you may already have and help secure it prior to rendering it for the end user. WordPress thankfully has a few helper functions we can use for most of what we’ll commonly need to do:

esc_html() we should use anytime our HTML element encloses a section of data we’re outputting.

<h4><?php echo esc_html( $title ); ?></h4>

esc_url() should be used on all URLs, including those in the ‘src’ and ‘href’ attributes of an HTML element.

<img src="<?php echo esc_url( $great_user_picture_url ); ?>" />

esc_js() is intended for inline Javascript.

<a href="#" onclick="<?php echo esc_js( $custom_js ); ?>">Click me</a>

esc_attr() can be used on everything else that’s printed into an HTML element’s attribute.

<ul class="<?php echo esc_attr( $stored_class ); ?>">

It’s important to note that most WordPress functions properly prepare the data for output, and you don’t need to escape again.

<h4><?php the_title(); ?></h4>

Also, as there are always exceptions to the rule, there are a selection of user-submitted data that needs to be validated and sanitized. Freeform text areas would fall into this category. For this, you can run user data through sanitize_text_field() or any of the wp_kses_*() functions.

To recap: follow the whitelist philosophy with data validation, and only allow the user to input data of your expected type. If it’s not the proper type, discard it. Sanitize data as much as possible on output, and a selection needs to be sanitized on input too.

Hit us with your questions or tips in the comments.

In English, Brighterlife.ca:

And Simplementbrilliant.ca in French:

Ready to become a VIP Services Client? Some of the world’s biggest brands rely on WordPress.com VIP Services.