SoftwareEngineering

Least privilege connections

Always use accounts with the

Preventing SQL Injection in Java

inject (or execute) SQL commands within an application

Defense Strategy

SQL Injection

"injection" of a SQL query via the input data from the client to the application

exploit can

comment for a column

up to 1024 characters long

255 characters before MySQL 5.5.3

AMFParser plugin for Fiddler2 web debugger

parsing and displaying AMF data inside HTTP's POST requests and responses

Set break points in my Java code Start up the Java application server with the appropriate debug JVM properties set (e.g. -Xdebug -Xrunjdwp:transport=dt_socket,address=8000,server=y,suspend=n) From Eclipse, I attach a remote debugger to the app server on the default port 8000. The Java Debugger will open up when a break point is hit. Set breakpoints in my Flex application (or one of its modules). From Eclipse (with Flash Builder) I launch a debug configuration for my Flex app. The Flex Debugger will open up when a break point is hit. At this point I have two debuggers open and everything work great. Two other things I do: a) extend the transaction system timeout, so it doesn't get trigger while I am sitting there think for a few minutes b) use Charles Proxy (in reverse proxy mode) inbetween the client and server to watch the AMF traffic and view payloads, etc.

GraniteDS & Asynchronous Servlets

to handle many thousands concurrent users, you can even

endpoints externally configured

allows me to switch between different endpoints - different test or production servers for instance - just by specifying the ip and port in an external properties file

don't have to specify any compiler arguments that point to the services-config.xml or messaging-config.xml files.

RemoteObject

*when* the configuration of your services is being read.

Session Management

Servlet Container Sessions

BlazeDS client architecture

message-based framework

message-based framework

Flex integration with Shiro

integrate Shiro with Flex AMF

CDI Extensions Project

best mature features of

DeltaSpike will consist of a number of portable CDI extensions that provide useful features for Java application developers

de-facto standard of CDI-Extensions

Project-Configuration (with Maven)

public class ClassHolderDTO<T> {    private Class<T> classToTransfer;// get/set boilerplate}

Resource

Class<Resource> entityClass