Advanced Web Development/WEB 407

Introduction Kudler Fine Foods is a specialty food store offering imported and domestic fare including baked goods, meats & seafood, produce, cheese & dairy, and wine. With three locations in the San Diego metropolitan area (La Jolla, Del Mar and Encinitas), Kudler’s mission is to provide their customers with, “…the finest in selected foodstuffs, wines, and related needs in an unparalleled consumer environment” (Apollo Group Inc. 2009).
In an effort to increase customer convenience and business revenue, Kudler Fine Foods wants to sell their products on the internet. By adding both item inventory and online ordering pages to their current site, Kudler Fine Foods can accomplish this goal. There are, however, additional systems necessary on the back-end to make this system possible.
According to TheConsumerCollective website (2010), “E-commerce spending continues to outpace analyst’s predictions… spending will reach $259 billion in 2014, and $278.8 billion by 2015” (Suetos, 2010). Over the past few years, customer confidence with online shopping has increased significantly. Customers feel more at ease with purchasing their products from online retailers than they did just years ago.
This proposal will demonstrate the major components necessary for Kudler Fine Foods to begin offering their products online. It will discuss the database design, how the scripting language PHP will be set up to provide a “shopping cart” for ease of use, and illustrate a mockup of the online ordering pages. In addition, it will overview the use of data validations, and web standards.

Database Design
For Kudler to achieve success through the Internet, the company must choose a database created with MySQL. MySQL is an open source format that provides several benefits to a business entering the online retail world. First, the code is free. Since Kudler is accepting bids for its web design, cost is a legitimate introductory consideration. The choice to use an open source product is a choice to save money. MySQL is the most common database service in the world and it is operated by the well-known organization Oracle. Another benefit is the enormous support the Kudler IT team receives from the community of MySQL users. This also means the code is regularly modified and improved. Kudler can expect a state of the art database. If technical problems persist, Oracle offers many versions of its tutorials. Contract workers are also available for hire outside the company. MySQL is also flexible. It is available for a construction to Kudler’s unique needs and it can produce almost any outcome. Kudler will have input on design, which allows your business to modify usage to match your marketing strategy. Our organizations will work together with MySQL to create a dynamic site to achieve Kudler’s vision. The characteristics Kudler needs for its database include general settings, file systems, logs, and performance (Mckoi SQL Database, 2004). The general settings allow Kudler to have access to simple items such as turning the read only feature on and off. The database keeps universal functions here. The file systems settings are the folders that control the path of each characteristic. This is how the functions interact with the program. Next, the log settings are the place the database stores logged information. This includes queries, debugs, and the log path. The performance settings determine how the database cache behaves. This includes functions such as cache size, page buffering, and safety levels. The collection of these settings helps manage data flow. The choice to use MySQL and format the characteristics logically ensures a smooth database creation.
PHP
Kudler should integrate a third party software package for the shopping cart portion of the site. The best designs use PHP, or PHP: Hypertext Preprocessor, for a scripting language. It is the most common code used in web development with over 20 million domains already in place throughout the Internet (PHP, 2011). PHP is embedded within HTML documents. It allows the visual portion of the web to translate through individual browsers. Essentially, PHP is needed for your server to translate the visual portion of your site. “The best things in using PHP are that it is extremely simple for a newcomer, but offers many advanced features for a professional programmer” (PHP, 2011). The commonality of the script and the simplicity of the programming allow the Kudler IT team to take control with plentiful support. In addition, PHP works with many types of documents beyond HTML including Flash and PDF (PHP, 2011). This makes the language highly flexible for all Kudler’s future requirements. Three shopping cart systems separate themselves based on customer feedback. These include Avactis, Squirrelcart, and Ecommerce Templates (Hot Scripts, 2011). Avactis is a simple program that installs into existing sites. The program touts features including coupon capability, wish lists, and order tracking. This makes the cart program flexible for Kudler and provides opportunities to give discounts, hold products for future perusal, and have back end operations. Squirrelcart has an unlimited amount of categories and sub categories. This allows Kudler to break up its shopping experience into sections. Squirrelcart also has the ability to integrate pop up boxes that show a brief description of the merchandise. The Squirrelcart investment starts at $369 with a likely $295 in additional features. Ecommerce Templates offers more complex design capabilities that work with a variety of visual programs including Dreamweaver and CSS. The Ecommerce price is also only $159. Their program is functional with most services but structure is limited if the site already exists. The best choice for shopping cart software is Avactis. The white glove version, which deletes all visual Avactis logos, is only $399. This presents a tremendous value in comparison to similar services. In addition, the customer response is dramatically superior to other products. According to Hot Scripts, Avactis rates the highest satisfaction including 5% over its next closest rival, Ecommerce Templates. Choosing the Avactis shopping cart is a decision to add simplicity, flexibility, and value.
Web Page
The following illustrations are the mock-ups of the proposed online ordering system.

Illustration 1. Product inventory page.

Illustration 2. Billing Information page

Illustration 3. Order Confirmation page A very important aspect of the order handling process has to do with what is happening on the server side. This section addresses how the server handles the orders that are taken online. Based on the mock up pages provided in this proposal, the user will be shown product choices on a product page. The customer will be able to click on any product they want to order and the values of the line below the ‘Go To Checkout’ button will dynamically update using AJAX (Asynchronous Java Script and XML). The customer will then be able to see how many items they have in their cart as well as the order total. Using a button click as the event handler, when the user clicks the ‘Buy Now’ button the product item number is sent to the server. JavaScript prepares the item number and sends it to a page on the server that handles AJAX requests using the POST method. Once the item number is validated by PHP that the item number is in fact a valid product item number, the item number is written to a new row in a temporary database table called ‘Session Orders’. The important part of this process that is worth noting is that each customer order will operate on a session ID. The key for the ‘Session Orders’ table will be the Session ID. Session ID’s will be created using a session tracking function that tracks information about the session. “Rather than using one or more cookies, a single session array can be used to store information about the previous requests of a client during a session.” (Sebesta, 2011) Once the customer has clicked the ‘Go To Checkout’ button, multiple SQL query statements will be used to query the information from the ‘Session Orders’ table using the session ID as the key. The server can then respond back to the AJAX request using JSON (JavaScript Object Notation) with the number of cart items as well as the cart total. JSON is a text-based data format that is language independent and familiar to the ‘C’ programming language family. JSON is easy for humans as well as machines to read and write. (JSON.org, n.d.) Once the customer arrives at the order submission or ‘Checkout’ page, PHP will check to see if a session exists. If a session does not exist, the customer will be redirected to the product page. If a session does exist PHP searches the database and retrieves all items purchased correlating with the current Session ID. PHP then displays all items that are currently in the shopping cart as illustrated in the mock-up of the order submission page. Of course, instead of a listing of “sample products”, there will be a listing of the customer’s order summary. A form will also be displayed to collect customer payment and billing information to complete the transaction. Finally, an acknowledgement page of some sort is recommended. As illustrated in the mock-up of the order confirmation page, the customer will see a confirmation that their order was processed. This page can easily be printed by the customer. Similar to the order submission page, the order confirmation page is processed through PHP as well. PHP checks to see that the order was successfully processed and looks for a valid result. If not, the customer is re-directed to the order submission page to re-submit. PHP then finds information associated with the customer’s unique session file. If the order history information is successfully obtained, PHP deletes all item information from the ‘Session Orders’ table with the respective session id. This assists with database maintenance in that it ‘cleans’ old data from the ‘Session Orders’ table and avoids stale or unused data from accumulating unnecessarily.

Validation
Most types of e-commerce websites usually have a very robust set of tools and uses. Unfortunately, this also means that they have to process a significant amount of data. Most of the time, this data is provided by the end user through a series of posts or get transactions. It is in these transactions that most errors occur. Since these errors can lead to security issues with the website, it is very important that they are properly handled and that the data is properly sanitized and evaluated before it is submitted to the server. The safest way to do this is to evaluate the data in three different places. First of all, the data should be evaluated on the client side before ever being submitted to the server. Second, the data should be evaluated upon receipt by the server. Finally, the data should be evaluated by the interpreter (in this case PHP) in order to ensure that the data is not only correct, but also to ensure that the data does not contain any malicious elements such as cross site scripting code or a database injection.
The first level of data verification always occurs on the client side. The sole purpose of this type of data verification is to make sure that the types of data are correct. For example, it is at this level that the application should check to make sure all fields are properly filled in, and to look for basic errors such as putting letters in a phone number or numbers in the name. It is also important to ensure that the data is actually filled out. An e-commerce website has to ensure that the end user has entered a credit card, or some other form of payment and it matches the basic requirements (such as having a 15 or 16 digit number for the credit card and a valid expiration date.) This is usually achieved using a JavaScript on the checkout page, because then the data would actually be validated without the page being submitted to the server. This allows for two things. First of all, less data is transmitted to the server unless it has been confirmed to be correct, and secondly, the end user does not lose any of the stored data or any additional time waiting for the system to process. If, for example, the end user accidentally enters letters in the credit card number, the JavaScript code would simply return an error telling the end user that he or she has to update the credit card number and make sure that it contains only numbers. This first level of validation is primarily designed to ensure that the end user has not accidentally submitted something wrong. It does not, however, prevent malicious users from sending bad data on purpose.
Unfortunately, there is no good way from preventing malicious data being sent to the server. There is, however, a very good way to clean up the data before it gets processed on the server side. Most Web server applications, such as Apache, have specific security modules (in the case of Apache is called mod_security) and the security modules are designed to block the data before it gets to the processor or interpreter. With mod_security for example, if someone were to attempt a cross site scripting attack the module would read the data, find the snippet of code, log the error, and deny access to the user that attempted the attack. This means that the interpreter was never even called, and therefore, there was no chance of that data affecting the server anyway. Unfortunately, with modules such as mod_security there are sometimes false positives. As a result, it is absolutely necessary to properly train the tool and to modify the settings depending on the applications installed on the server. For example, mod_security has a specific rule that checks the link for credit card numbers as well. If the website does not use credit card numbers, then there is no point in keeping such a rule active, since it will create memory overhead and will make the website slower. If it is an e-commerce store, such is the case we are dealing with right now, then this rule would be very important as it can provide protection from malicious users. Once properly configured, these modules provide essential protection to all Web server applications; however, there should still be a third step in data validation.
The third level of data validation should occur within the actual code of the application. By now, the data has been checked once for sanity, and it has been checked once more for malicious content. This, however, does not ensure that the data is clean and sane at this point. In the event of a false negative at the second level (mod security) is still possible for malformed data to be injected into the database and cause issues. The best way to prevent this is to properly escape all variables that are imported from the end user. This means that every single Get and Post variable needs to be escaped in a way that removes all forms of punctuation encoding syntax. If the coding syntax is not removed, then there is a high possibility that the application will interpret the posted data as code, and attempt to execute. This is how both cross site scripting and data injections occur. If all three methods are properly used, then the e-commerce website would be as secure as possible. Clearly, there is still the possibility of a malicious attack, but validating data in three different points is the best way to make this possibility remote.
Web Standards
When dealing with e-commerce websites, there is always the unfortunate possibility that certain users will have issues with their transaction. These issues can range from an improper order, to multiple charges on their credit card. A large percentage of these issues are actually caused by scripts and applications that are not fully compatible with all browsers. In the past, most end-users used Internet Explorer, and as a result, browser compatibility with less of an issue. Nowadays, there are numerous browsers being used and as a result it is very important to find an e-commerce application is compatible with the latest web standards. Since Kudler Fine Foods will be using an integrated design and e-commerce solution, is essential to ensure that the template used for the e-commerce store has been properly validated through the W3C validator. This will ensure the best possible compatibility with all known browsers, since the browsers are also required to be compliant with W3C standards. This, however, is not the only standard that needs to be followed when running an e-commerce store.
The application used will have to be PCI compliant. This means that the application has passed PCI compliance standards for both coding and security. The server that the e-commerce application is hosted on will also have to be PCI compliant. What this means is that the server has been tested and it has been confirmed that is using the latest versions of all applications, and that any and all security vulnerabilities have been patched order removed. This also means that only Kudler Fine Foods as physical access to the server. Hosting companies lock PCI compliant servers in special cages and even the employees of the hosting company are not able to access them. PCI compliance is so important, that most merchant account providers will not issue a merchant account to a business that does not have a PCI compliant server running PCI compliant applications. There are other factors regarding PCI compliance that will have to be considered as well. Some PCI certifications required at the employees that can access the server pass background checks. As a result, all current employees who have not passed the background check will have to pass one. This will ensure the topmost level of security and data integrity.
Finally, the e-commerce Web store will have to be in compliance with Web security standards and legal standards. This means that the website needs to have an SSL certificate which not only protects the end-users data, and encrypts it during the transmission, but also provides a form of insurance for the end user. Most high-end SSL certificates offer insurance up to $100,000 in the event of data loss or financial loss caused by issuing the security certificate. Without an SSL certificate, the website will not be able to be PCI compliant. A valid terms of service document and privacy policy will also have to be on the website. This will prevent any potential legal issues in the event of security, systems, or merchant account failure. In an e-commerce environment, these three Web standards are the most important ones and any issue with compliance can cause serious legal issues and may end with a forceful termination of the e-commerce platform.
Conclusion
This concludes the proposal for the online ordering system for Kudler Fine Foods. In the previous articles, the web development team illustrated how the Kudler online ordering system would be set up. The proposal includes an outline for database design, server set up with PHP, site mock ups, validation strategies, and conformity to industry web standards. It has successfully outlined an affordable and efficient way of offering Kudler’s fine line of goods in a manner that is convenient for the consumers and profitable for the company. Implementing the methods and ideas presented here, Kudler Fine Foods will be able to reap the benefits of the e-commerce era. We hope Kudler Fine Foods will seriously consider this proposal.

References
Apollo Group Inc. (2009). Kudler Fine Foods. Retrieved from https://ecampus.phoenix.edu/secure/aapd/CIST/VOP/Business/Kudler2/intranet/index.htm
HotScripts (2011). PHP Shopping Carts Scripts. Retrieved Mar. 21, 2011 from http://www.hotscripts.com/category/php/scripts-programs/e-commerce/shopping-carts/
JSON.org. (n.d.). Introducing JSON. Retrieved March 20, 2011 from http://www.json.org/
Mckoi SQL Database (2004, Aug. 16). Database configuration reference. Retrieved Mar. 21, 2011 from http://www.mckoi.com/database/ConfigurationOptions.html
PHP (2011, Mar. 4). What is PHP? Retrieved Mar. 21, 2011 from http://us2.php.net/manual/en/intro-whatcando.php
Sebesta, R. (2011). Programming the world wide web. (6th ed.). Addison Wesley. Pearson Education, Inc.
Suetos, S. (2010). Brick and mortars, it's time to think about e-commerce. TheCustomerCollective. Retrieved from http://thecustomercollective.com/resource-nation/49555/brick-and-mortars-it-s-time-think-about-e-commerce