Perhaps, when attempting to convince users your browser is rock solid haxor-proof, it’d be advisable to demonstrate to them that your sites can detect which browser they’re currently running?

One workaround would be to save details to a db where they could be retrieved for analysis at a later time. This makes the data persistent but normally for debugging this is overkill. Log frameworks exist but sometimes incorporating third party software in is just bloat, especially in single developer projects.

The simplest alternative solution I can think of is to grab the request info needed and send it out to a mail address using PHP’s built in mail object:

$to = 'me@example.com';
$subj = 'Request variables';
$msg = 'Requested:\n';
foreach ( $_REQUEST as $k => $v )
 $msg .= "\t$k = $v\n";
mail( $to, $subj, $msg );

Mailing debug output to a free mail provider such as gmail means you have a persistent copy of the data (in chronological order) in a few lines of code without needing to start building up sql or think about clogging up your host with yet more logs. Is there a better way?

No ordinary decent virus this one though. It cleverly disabled my default browser – Chrome – coercing me into a specific set of steps that would ultimately place a rootkit on my OS. As my browser seemingly inexplicably was rendered useless, even after multiple uninstall/reinstalls, something else was up. Internet Explorer was attempting to connect to a “tolule.net” which on lookup resolved to a Chinese IP. So a quick entry into my Sygate advanced rules and I had a large swathe of Chinese IPs blocked. So I was safe for the time being giving me a chance to think about what was going on. (The Trojan was quite busy – attempting to connect every 10 mins or so and to multiple domains – initially always tolule.net but also gusmon.net and somemon.net – each time resolving to an address in China).

I ran a full AVG scan and two files were suspect – both resident in System Volume Information – the area where System Restore settings reside. Delete wouldn’t work (looking into it further if system restore is turned on these files cannot be manipulated) so I went for seemingly the next best option – system restore to a point before Chrome stopped working. Looking back this was a stupid thing to do but at the time seemed logical enough. A thought process that no doubt the hackers had already wargamed out in their heads prior to deployment. User sees app not working, reinstall doesn’t work, anti-virus identifies but can’t clear the Trojan, proceeds to system restore hence running the virus the hackers managed to plant somehow in Sys Vol Info.

Needless to say, the system restore failed, but now a plethora of hacked files had now successfully and relatively silently installed themselves on my OS. The rig included their own embedded db instance of Sql Anywhere, the a.exe worm that amongst other things engages in Process Hijacking described above, a bunch of reg keys that pointed device drivers and startup configs to the original hacked Macromedia directory, a hidden rootkit type process that ensured these keys and the directory were not tampered with and the actual downloader Trojan itself, W32/Agent.GBS!tr.dldr.

The process hijacking was something else. It would wait until I’d start an application and use the app’s virtual memory for it’s own devices. Hence why I was getting the Sygate reports of IE getting a life of it’s own. Wasn’t just browsers that were vulnerable, even MalwareBytes Anti-Malware software’s memory was hijacked. Each time the stolen app tried unsuccessfully to phone home to China.

By now it was obvious to me I had been infected with a particularly nasty virus and ran AVG a 2nd time. But now the Trojan was so well embedded AVG didn’t pick up anything more than a few measly HTTP cookies. I did wonder about Sygate at this stage but it still seemed to be successfully blocking all malicious packets so I was still just interested in removal. Spybot Search and Destroy was my next bet but it returned nothing. What’s more that TeaTimer process monitor it installs is a real resource hog – 128meg of virtual memory. That’s a bit more than a mere heartbeat in my book. Especially on my netbook! Got rid of that then was pointed to the MalwareBytes app by Matt @ BleepingComputer.com. The hackers obviously see it as a threat – after I installed it I tried to update it’s malware db but was prevented from doing so, presumably by the a.exe worm. It instead forced MBAM to attempt another connection to tolule.net. Proceeded with the scan anyway. Result? Every malicious file was identified.

Although still not out of the woods – MBAM would freeze when attempting to quarantine the audio driver reg keys whose values had been changed from wdmaud.drv to a dll file in the fake Macromedia directory. After I deleted a.exe and ran MBAM again, this time it succeeded in changing the reg keys after a restart. I had tried manual deletion of the reg keys and fake Macromedia directory prior to this but as soon as I closed regedit the keys and files would reappear. MBAM must have required the restart to remove whatever in-memory process had been running to protect the hacked data.

So that’s pretty much it. Quite an organised payload that, and a very well thought out attack vector relying on unwitting end user participation as much as the original web vulnerability.

Ok so really I’m just a petty net troll who completely overreacts to criticism online. That aside, I still cannot understand how the answering army at stackoverflow come to the collective conclusion that every question on a close-to-the-bone programming issue requires some inane form of rephrasing or just outright blanking.

I get over the former as SO is a lightning quick method of accessing really knowledgeable people on demand – but I had to endure a case of the later a while back when someone obviously thought the answer to the question I asked was too blase and proceded to provide a solution for a completely separate issue. And this despite me explaining exactly why I didn’t want his solution in the preamble. So I went and got a workable answer myself, posted it and accepted it as the solution. Job done.

Except this caused numbnuts to vote down my answer without explanation. So I voted his down, and told him why. Despite this, he questioned why I’d want to know what I wanted to know in the first place and voted down the question. It was at that moment that I realised SO, while largely self-moderating, is still missing the last 20%^TM required to remove the clinically insane from the process. It gives me no pleasure to disclose the most efficient solution currently is to multiply your web leverage in traditional fashion; create multiple accounts and hit back with a bewildering array of counter-comments and down votes…

It is embarrassing though when apparently throwaway questions asked on your secondary accounts are rated higher than your allegedly thought-provoking and succinct real persona *whistles*

In true Bileblog style, programmers appear to be sarky contemptible bastards who like nothing more than jumping on the inaccuracies of accepted thought; hence phrasing a question along the lines of ‘My colleague says x is no longer a good way to do things…’ will likely stir the hornet’s nest of pedantry as each contributor seeks to provide a more arcane answer as to why x sucks than the previous response. Recurse until someone mentions lambda.

App Engine is generally a new paradigm for webapp developers; replacing sessions with memcache and a schemaless datastore just two elements requiring new thinking for old problems. Unfortunately there are a few more hidden nuisances which have the potential to waste programming time relatively early on. Here’s four of my personal head-bangers:

1. the datastore doesn’t always store Properties
I’ve had trouble with it refusing to store arbitrary entity props unless I assign them in the entity constructor itself (these fields were optional btw). Just setting prop values after initialisation then put() on the ds didn’t write them.

2. fussy filter parsing

.filter("prop= ",propValue).fetch(1))

returns a NoneType error

.filter("prop=",propValue).fetch(1))

silently fails to find expected.

.filter("prop =",propValue).fetch(1))

Only the above will return the expected result.

3. Only possible to execute inequality filters on one property per query
This is a pain in the arse if you want to query whether an input date is between two dates stored in a particular entity – officially there was a workaround whereby the date range is stored in a ListProperty (instead of two fields of type DateProperty) and you do the normal check if input is more than the list (greater than at least one element in the list) and less than the list (less than at least one element in the list).

However the App Engine team has now changed the behaviour in the cloud whereby both the ‘>=’ and ‘<=’ filters are operated on each individual list element and not a lazy test over the whole series i.e. where the existence of two list elements that bounded the input date would have been sufficient the following query now only returns the entity if one of the ListProperty elements is an exact match for it:

WHERE date_range >= :1 AND date_range <= :1

Unfortunately this has not been removed from the dev_server datastore, hence it runs perfectly well locally.

4. And hopefully the 1000 record query limit is well-known by this point.

On a more general note, why is it newfangled tech doesn’t build on top of the old stuff? Re-use would get us to where we want to be a lot sooner. I bitched about this on Twitter at the time and I’ll repeat the message here too because it’s worth doing so frankly, I expect new stuff to do the same things old stuff does as well as any “hey that’s cool” new fandangomatrons it bolts on.

Wave’s another case in point. Not ‘email invented today’, far from it – it’s left so much cutting-edge crowd-sourced participatory stuff out (as well as how to do IM, namely the KISS principle) – that it actually feels like a retrograde step in many ways. Most in fact.

Bottom line – Google needs to make stuff better.

Let me begin by saying I don’t want this blog infected with politics.

Notwithstanding this fact I wish to proceed momentarily by injecting a healthy dose of the political clap.

We want entrepreneurs vs we want more of the same.

Approximate equal sums for both – but where is the greater need? Embed another 30 political idealists in sufficient exposure to a narrow minded zero-sum status quo in order to espouse a continued malaise of divided nationalism or 15 entrepreneurs potentially showing more of the ambition and smarts that will begin redirecting the global capital flow home to NI?

Don’t feed the trolls – don’t give politics students money for watching how not to do things!

Giving them what amounts to a minimum wage would create more economic benefit if they were told to operate a car wash for the monies. At least you’d have 30 skilled workers at the end of it.

This was a party political broadcast from the Politics-Is-Not-An-Industry Party

First the good one. I didn’t really know what to expect from Barcamp Derry and from the spiel delivered online was hoping that was the correct way to approach it. Half hour sessions organised in 3 concurrent ’streams’ meant the first 5 minutes of each was largely spent loitering in the doorway of each until one grabbed enough attention take a pew.

Although I missed the morning sessions the later half still produced a nice variety of topics – web media, drupal, startup and a few more. It was refreshing to see stuff happening locally that you usually only read about in front of a screen. Effectively it takes the form of a ’show & tell’ so you get to see stuff that is happening right now in NI. It is accessible and because of that you get an urge to participate and interact in a way you don’t get from say a lecture for example. You get the sense when people are talking they are thinking aloud and the wide variety of topics really gets you thinking.

The whole experience just seems more realtime.

I’m no expert on the philosophy of BarCamp but maybe it’d be an idea to have stream themes so less frantic checking of the timetable matrix would ensue between show & tells. So I could sit down in a room for the day and know I’d be learning about e.g. bootstrapping, but without necessarily needing to know who is going to speak on it until they begin. It’d make for a more open minded audience I reckon since they would have little time to research a speakers angle.

Anyway I found the whole thing an engaging and unique experience and am very much looking forward to the next one on 6th November.

Now the bad one. Facebook Dev Garages are as I understand them a chance for people using/thinking about using the platform to tap into the phenomenol viral power of FB’s network. If you’re not into developing apps solely for the Facebook platform, you’re looking to shoehorn the power of the ‘tell your friends’ social tsunami into your existing application.

The first point is it works. My 1st FB app was a simple little gamer gimic that reached 2k MAU (Monthly Active Users – the standard metric for FB app popularity) within a month, just by adding ‘invite your friends’ and ‘publish to stream’ components. This would not happen via say Google Gadget directory or dare I say it any of the current appstores. On Facebook, your app is actively pushed through your network by its users. Virality.

It’s a relatively new paradigm but unfortunately Facebook Inc has turned themselves into another M$, another cathedral: What we got at yesterday’s Garage was a staid marketing promo. It was a great disappointment – there is a rich dev ecosystem surrounding the FB platform – fbFund, the f8 conference and the Dev Garages elsewhere seem to have got the backing they deserved.

So the conversation began at a bird’s eye view and never really returned to earth.

It could have been so different: At the last minute James Leszczenski, one of the platform dev guys, was roped in. He provided an overview of FB’s crowdsourced translate app and how it could be used by developers to localise their own FB content. Good talk but again he skipped over the FBML and coding (aka the useful bits) I’m guessing to avoid glazing half the audience’s eyes over.

Also maybe it was the travel or whatever but I was expecting him to at least stand for some q’s at the end of his presentation. He just slunked into his seat. So with the other guys demo not coming off this was basically the end of the Belfast Dev Garage. Some marketing guy and a dev who didn’t really talk shop & wasn’t too interested in engaging the audience.

[I asked the InvestNI girl afterwards if there'd be another one in future, maybe with a bit more to it and the response didn't sound too promising. Maybe there isn't the demand currently but surely it's up to the marketing people to get engaging content. Not come here to give a talk on the history of the company and how to create a FB page for your business. There's a tendency for tech firms opening up in Dublin to adopt the shrinkwrapped M$ model of dev engagement. There is very little understanding of what makes a dev ecosystem tick.]

Anyways fair play to the audience at this point, questions were inevitably pointed in his direction and although a percentage of them were irrelevant in a dev context at least it was interaction.

Not of much value though. His answer to the unreliability of the MAU stat availability was publicly “I’m sure there’s a thread on it on the forum” and privately “There’s no reason why you can’t do your own”. Which is a load of balls: I could invent the Rutherford Active User tomorrow and you know who would be interested? Nobody that’s who. Why would they take the time to discover this brand new metric when MAU exists as a platform standard in every app out there? Just fix your own buggy stats thankyouverymuch.

I’ll admit to getting it wrong on the photos api not being open. Since 2007 to make things worse. But I’m also going to shift the blame on platform dev docs being an absolute maze to work through. I’ll stop digging right there. And I was more just pissed off at all the marketing chatter of open this connected that. hmph.

Although Leszczenski did seem a nice guy in person and at least laughed & agreed with my take on Google Wave still being ‘the app Google released the day Microsoft launched Bing’. Not the first time that’s happened he said, in his best FB disciple knowing look of indignation.

Cathedrals are everywhere.

You can still view the Googlezon-inspired vision here. I left the bank a year later, but kept an eye on the Revolution platform. It failed miserably. The trouble was they were providing a great integrated digital service that no one in the city knew they wanted yet. Banking is a notoriously fickle industry, and change only happens when trusted relationships introduce it. Revolution’s newly recruited marketing team was manned with former developers, admin staff & inexperienced hires from other banks.

The Digital Markets idea was sold to IT, but it wasn’t sold to the business. So no one from the business sold it to clients. It died a death and now the only evidence I have left is the promo mousemat. Morgan Stanley jumped on the same RIA-powered capital markets bandwagon again, only it was 4 years down the line. Sean Park and his team were ahead of the demand curve, offering something clients would want, but the disconnect between the two prevented the success Revolution should have been.

Looking Around Today
I see a similar scenario developing in a nascent Northern Irish startup culture. A myriad of new media outlets encouraging the growth of chatter about chatter. Strong characters at the helm driving rapid policy creation around buzzwords. The usual presence of the me-tooers and their on-message signal/noise, and as this is Northern Ireland, an avalanche of support structures all offering their wares to the potential idea industry (for those familiar with the Province and it’s current systemic faults, see the rise of the victims industry, where everyone needs help with their troubles and no one is to blame for causing it). A packed diary of events fills out the days and weeks. The blogosphere is alive with what seems at times self-referential posts about this thought leader and that movement. It all seems so ‘go’. But is it?

So Far, So Revolution
I think it is fair to say today’s NI does not have an outstanding reputation for entrepreneurship. Recession notwithstanding, we are still relatively over-dependent on civil service jobs and require a grant culture to encourage business development whether it is for blue chips locating their service centres here or local companies making a go of it. Like hawking web 2.0 to the investment banking industry, encouraging entrepreneurship here in the midst of a recession is a tough sell.

After a while the traditional bank hierarchy in Dresdner closed ranks on the would-be usurpers in it’s Digital Markets division. InvestNI & the rest of the NI statutory bodies could well do the same to local efforts to establish a VC culture. Or they could try to shoehorn their own corporate objectives into the series of funding initiatives underway aimed at ideas (as opposed to companies).

Such a move would be a mistake, but within corporate strategy meetings it could be construed as synergistic. At Dresdner Park railed against the numbers men who “didn’t get it” at the time in internal blog postings. I detect the same hostility against traditional avenues in NI’s would-be VC community. More thoughtful criticism of the traditionalists is also online. Either way, they highlight a problem that isn’t going to be removed unless success, measured in figures, is found.

A lot depends on the type of idea the monies will flow to. On the 24th of this month the 1st round of potential startups will be announced. It may be a watershed moment for tech culture here. Interesting times.

Addendum: What was Dresdner’s failure, became Sean Park’s success. And maybe a man who could help NI out.

I had hoped to discuss some numbers taking both leading Facebook & App Store games as a jumping off point. But one look at my Twitter homepage this morning aroused some angst.

To their credit the realtime stream networks have opened up their far-reaching update networks to 3rd party developers without holding much back. Photos on facebook and throttling search on twitter are by and large minor holdups which would presumably have grave performance issues to overcome first anyway.

But this power in the hands of developers doesn’t come without responsibilities.

Unfortunately there has already been what I would call a serious breach of both the twitter and facebook reason d’etre – communication amongst the network. Check out this post from back in 2007 for a critique of what makes a good facebook app – and this from a marketeer of all things. Now fast forward to today’s Twitter and check out one of the trending topics – ‘pirates’. Not because of the ongoing web meme – no this Pirates refers to Zynga’s social network app available on FB & MySpace.

The lead graphic shows the gorey details – users are now encouraged to cross post their in-game achievements onto their twitter accounts. And because a bazillion of us play these games (& are willing to do anything to get special items, including filling out marketing forms on anything from insurance to mobile phones) this created enough buzz through either direct postings or the predictable but similarly idiotic “why is pirates trending?” postings now proping up numerous worthless ‘trends’ on Twitter these days.

But the value of trending topics once they have got onto the user’s twitter homepage is for another day. As is the dubious lengths some social gaming apps will go to in supplying advert networks with Facebook user data. These automated updates from gaming platforms need to be nipped in the bud right now.

One such tweet on the left here. When I think of why I have a Twitter account – to connect with interesting individuals whom I have nor might ever physically meet and to follow breaking news in near-realtime – this guff frankly does not appeal to me. It’s polluting twitter no doubt about it. As you can see Zynga have created their own special client to deliver inane bs direct to your homepage.

Personally I have a policy of immediately unfollowing anyone who feels it necessary to add such content to their account. Dealing with manual spam especially connected around trending topics is a more nuanced problem.

But mass auto distribution by gaming platforms can be nipped in the bud right now.

Prereqs:
What you’ll need – an account on Facebook and a web hosting provider who will run php scripts and allows you to set up a database. I use mysql in this guide, but you can safely leave out the db steps if all you want to learn is the facebook-specific work flow stuff.

Step 1: Setting things up on Facebook.com
A Few things here -
1) Add the Facebook Developer Application to your profile if not done so already.
2) Set up new app, give it a name. Enter in the following details:
Canvas Callback URL – the full url of the canvas page to be stored on your server.
Canvas Url – the unique name for your app @http://apps.facebook.com/. You can flesh it out with icons, descriptions, etc too.
3) Once you get the hang of things it becomes obvious two app instances are needed for each separate application you create – one live and one test. However for the sake of brevity I’ll continue with a single instance.

Now it’s time to create your viral hit. Download the client libs of your choice and we’ll look at how to create a setup page for users that wish to add your app. For this demo I’ll be using the official PHP client.What we’ll be doing is showing a simple image. We’ll go through all use cases a user will walk through over the lifetime of a facebook app together with the main social networking elements that make the facebook platform such a powerful medium for app developers.

Step 2: Config on your side
Now for the config in your php script. Go to the file you entered in as the Canvas Callback URL – this is the jump-off point for all calls from Facebook to your application.

// Include the Facebook client library
require_once ('facebook.php');
// Set authentication variables
$appapikey = '<yourkeyhere>';
$appsecret = '<yoursecrethere>';
$facebook = new Facebook($appapikey, $appsecret);
// I also will be accessing my own database on almost every call so will set db up here
$username="<yourusername>";
$password="<yourpassword>";
$database="<yourdb>";
mysql_connect(localhost,$username,$password);
@mysql_select_db($database) or die( "Unable to select database");

You are now ready to interact with the Facebook api.

Step 3: Where to begin?
This was the first – and most dogged – question I asked myself when creating my first Facebook application. As it turns out the workflow is quite like any other web app, with a few bells and whistles tacked on.

Let’s imagine for a second that user A already has our completed app installed. User Bthen comes across it on User A’s profile, so they click through to the app’s canvas screen.

$url = '';
if(!($_GET['user']==NULL||$_GET['user']=='')){
//user wants to see someone elses profile
$user = $_GET['user'];
if(preg_match('/^[0-9]+z/', $user)){
//use id to retrieve img url from db
$query = 'select * from turl where userid = '.$user;
$result=mysql_query($query) or die("Couldn't execute query");
$url=mysql_result($result,0,"url");}?><img src="<?=$url?>" />

The above code looks for a ‘user’ variable in the http query. If it finds it (i.e. not null) it looks up the image url stored for the user sought (User A in this case) and displays.

I should also tell you a bit about the database at this stage. It is simply a single table (turl) holding two fields url and userid (as in facebook userid).

So we have one use case. But what if it’s user A who is clicking through to their own canvas page? Should we make any additions? Yes – we should give them the option of adding the image to their profile if they haven’t done already. Fortunately interactions like this that deal with Facebook UI and concepts such as profile can be easily taken care of declaratively through Facebook Markup Langauge (FBML). Here we add:

if($user==$facebook->api_client->users_getLoggedInUser()){
//user is looking at their own profile
?> <p class="section_button"><fb:add-section-button section="profile"></fb:add-section-button></p>}
else{
?>api_client->users_getLoggedInUser()?><a href="http://apps.facebook.com/<yourappname>">Add your web image</a>, if you haven't already!}

If the user is looking at their own web image but hasn’t yet displayed it on their profile (either in the boxes tab or on the left hand strip on their wall tab) they will see the add to profile image below:

The else statement checks if it’s another users image page and if so a rudimentary viral feature appears – asking the viewer if they want to try the app out too.

Step 4: Allowing a new user to preview
OK so back to User B. Having clicked through to User A’s web image they like what they see – now they want to try things out for themselves. At this stage some FB devs like to force the user to install the app – with a call to $facebook->require_login() – before they can try it out for themselves. I don’t know about you but personally I find this a very annoying feature of 99% of FB apps so as a developer I want to give my users the option to preview their app first.

There is a drawback though.

$user = $facebook->require_login() is a really simple way of getting the user id, something you will need for virtually all meaningful interactions with the platform API. Otherwise there are all sorts of possible ways a user can land on your canvas page without their user id being specified in the various Facebook ID fields sent with each request. For example a user could enter the app url directly into the browser address bar or open from an email link.

Because the platform isn’t an exact science as such, with features, availability, etc changing quite a bit I’ve hacked around something that appears to work for me, i.e. it gets user ids in most situations without forcing an install on the user:

}else{
if(!(($_GET["fb_sig_canvas_user"]==NULL) ||($_GET["fb_sig_canvas_user"]==''))){
$user = $_GET["fb_sig_canvas_user"];}
elseif(!(($_REQUEST["fb_sig_user"]==NULL) ||($_REQUEST["fb_sig_user"]==''))){
$user = $_REQUEST["fb_sig_user"];}
else{
$user = $facebook->api_client->canvas_user;}
if(($user==NULL)||($user=='')){
//if not already, try redirect
if (!isset($_REQUEST['reload'])){
$facebook->redirect($app_base_url.'?reload');}
else{?><span>You must be logged into Facebook to access web image</span><?die();}}

Step 5: how to track your user base
Users.isAppUser has come under a lot of criticism. Well, from me at least. Because it only records if a user has previously authorised an app, and not if the app is currently authorised, facebook platform currently has no sure way of knowing if it is installed by a user right now. So we create our own solution with the previously mentioned db table turl. Turl’s two fields userid & url tell us if the user has authorised the app (userid is present) and what web image they have displayed (url). So now that we have the user id, we check for authorisation:

  else{
//set isAppUser
$query = 'select * from turl where userid = '.$user;$result = mysql_query($query) or die("Couldn't execute query");
if(mysql_num_rows($result)==1)
$isAppUser=true;
else
$isAppUser=false;
}

if authorised we get the image url and show it on the canvas:

if($isAppUser){
//display gfx, webform
$user = $facebook->require_login();
$query = 'select * from turl where userid = '.$user;
$result=mysql_query($query) or die("Couldn't execute query");
$url=mysql_result($result,0,"url");?><img src="<?=$url?>" /><p class="section_button"><fb:add-section-button section="profile"></fb:add-section-button></p> }

Step 6: Adding a user proper
We’re on our 6th step so lets take stock of where we are. We’ve taken into account a user viewing another users canvas page and also a user viewing their own page. We’ve also got the user’s id and, assuming a user’s been added to the database successfully, can tell if they have installed the app. Now we can begin to comtemplate how a user is added to our database.

First we should deal with the preview:

 else{
?><span>Want to display a web image of your choice on Facebook?  Enter the url here:</span><form action="." method="get"> <input name="url" type="text" /> <input value="Preview" type="submit" /></form><?}}
mysql_close();
?>

And so we have the above catchall statement added if the user is not currently using the app, inviting them to preview it. Once this form is submitted by the user we need to show the preview, so we include the following case before the form:

 elseif(!($_GET['url']==NULL||$_GET['url']=='')){
$url=$_GET['url'];?><img src="<?=$url?>" /><span>Happy with this?  Click to install app</span><form action="." method="get"> <input value="<?=$url?>" name="url" type="hidden" /><input name="add" type="hidden" /> <input value="Add Web Image" type="submit" /></form><?}

Now we also have the preview step. If the user wants to install at this stage we go ahead with the obligatory warning page and then we can perform the main installation tasks. So another case goes in above the previous one:

 elseif(isset($_GET['add'])){
$user=$facebook->require_login();
//once authorised FB forwards the user with all existing request variables - back to this page, so we can continue installation on our side
$url=$_GET[url];
$query = "insert into turl values ('$user','$url')";
mysql_query($query);
$fbml_profile = '<a href="http://apps.facebook.com/<yourappname>/?user='.$user.'"><img src="'.$url.'" width="182" height="182" /></a>';$fbml_boxes = '<a href="http://apps.facebook.com/<yourappname>/?user='.$user.'"><img src="'.$url.'" width="360" height="100" /></a>';
$facebook->api_client->profile_setFBML(null, $user, $fbml_boxes, null, null, $fbml_profile);

After the user authorises the application we add the user to our db and also set the fbml markup for displaying the chosen web image on their profile wall or boxes tab.

Step 7: Adding Viral Features
Along with maybe the application directory, this is the most powerful aspect of the Facebook platform for developers. Given the right incentives/marketing/branding/whatever you wish to call it, apps on facebook can spread like wildfire. We will implement two features commonly used by FB developers to reach the tipping point – app invites and newsfeed stories.

Both are normally done at app sign up time and are used to inform members of the users personal network. But they differ in that an invite is an explicit question targeted at friends of the user’s choice while adding it to a users newsfeed merely passively notifies people that they are using your application. It’s harder to get a user to send out invites because they aren’t always welcome but if a user does target them successfully it may lead to a higher sign up rate amongst their friends.

Step 7a: Application Invite
First the app invite. It takes the form of more FBML and presents itself in a separate page pretty much like the authorisation page, before redirecting the user back to our page again. You don’t want the user to send out any to friends who already have the application, so here’s the code to display only those who don’t yet have them:

  $fql = 'SELECT uid FROM user WHERE uid IN (SELECT uid2 FROM friend WHERE uid1='.$user.') AND has_added_app=1';$_friends = $facebook->api_client->fql_query($fql);
// Extract the user ID's returned in the FQL request into a new array.
$friends = array();
if (is_array($_friends) && count($_friends)) {
foreach ($_friends as $friend) {$friends[] = $friend['uid'];}}
// Convert the array of friends into a comma-delimeted string.
$friends = implode(',', $friends);
// Prepare the invitation text that all invited users will receive.
$content = <<<fbml><fb:name shownetwork="false" firstnameonly="true" uid="{$user}"> wants to see your web image!<fb:req-choice label="Add Your web image to your profile" url="{$facebook->get_add_url()}">FBML;?><fb:multi-friend-selector exclude_ids="<?php echo $friends;?>" rows="5" showborder="true" actiontext="Invite your friends not yet displaying their web image" max="20"></fb:multi-friend-selector></fb:req-choice></fb:name></fbml>

Step 7b: Wall Story
The Wall story request feature is implemented as a popup using FBJS – the subset of javascript allowed on Facebook canvas pages. It is slightly more complex than that unfortunately – you need to create a feed template first to describe the format of the story that will appear on users newsfeeds.

Go to the template editor tool to begin. We’ll create a simple feed that shows your application logo and invites people to try it or view their friends web image. First choose your application then create a one liner, note the special markup involved to allow personalisation. 3 main bits to note in this:

Short story template title & body:
Add in your message -> “{*actor*} added their web image”

Sample template data: very important for ensuring your story appears how you wish. Use it to experiment.

Action Link URL:To give friends a way of viewing the user’s own web image, enter the following -> “http://apps.facebook.com//?user={userid}”

Click through next, Register Template Bundle and note down the ID generated. It can get more powerful than this but it’s quite error prone for a beginner so lets keep things simple. We’re halfway there – now back to your php code:

 <script type="text/javascript">
var tpl_data={"status":"status","images":[{"src":"<yourapplogo>", "href":"http://apps.facebook.com/<yourapppage>"}],"userid":"<?=user?>"};
var user_msg = {"value":""};
var share_msg = "share with your friends";
Facebook.showFeedDialog(<feeddialogid>, tpl_data, "", "", null, share_msg, user_msg);</script><fb:request-form content="<?php echo htmlentities($content);?>" type="web image" invite="true" method="POST" action="http://apps.facebook.com/<youapppage>/"></fb:request-form>} </yourapplogo>

Enter your feed dialog ID in the code above, together with your app logo url, etc. As you can maybe workout, we substitute the the real data needed in tpl_data in place of the sample template data you seen in the feed templating tool. Note we pass in our own user variable, necessary to know which users image the friend wants to view.

Step 8: Deleting user records
Almost done. A user now can view other users web images & install one on their own profile. But what happens when a user deletes the app? To avoid our database potentially filling up with duplicate user accounts (and if we want to keep an accurate record of the total number of installed users), we must create a 2nd php script that Facebook can call when a user deletes our app.

To do this, create a 2nd script on your web host then go back into the FB dev application, click on the ‘more’ tab of our app then ‘edit settings’ -> ‘authentication’ -> ‘Post-Remove Callback URL’. Enter in the full URL of this script. All we need to do is delete the user from our db:

// Include the Facebook client library
require_once ('facebook.php');
// Set authentication variables
$appapikey = '<yourkeyhere>';
$appsecret = '<yoursecrethere>';
$facebook = new Facebook($appapikey, $appsecret);
$user = $facebook->get_loggedin_user();
if ($user != NULL && $facebook->fb_params['uninstall'] == 1) {
//The user has removed your app
$username="<yourusername>";
$password="<yourpassword>";
$database="<yourdb>";
mysql_connect(localhost,$username,$password);
@mysql_select_db($database) or die( "Unable to select database");
$query = 'delete from turl where userid = '.$user;mysql_query($query) or die("Couldn't execute query");}?>

And that’s that! A working Facebook application from the ground up with several important features explained.

For a complete listing of the code check out google docs add.php & remove.php

Need a more in-depth explanation?  In my opinion the book that offers the most clarity on the subject is Facebook Cookbook: Building Applications to Grow Your Facebook Empire