E-Commerce Tools For Students, What's Required?

profBill asks: "I'll be directing the "senior development project" this year for the Computer Science students in our department. The senior design project is supposed to give students a chance to bring together all their skills on a group project for some "practical" application. My overall goal this year is to have each group develop an e-commerce solution for local businesses near the university. I'd like them all to use open source software for various reasons (they're interested in it, it is easier to get hold of the software, just to show it can be done, to give them broader experience, etc.). The businesses are very interested and I think it will be a great experience all around. So the basic tools are things like PHP, MySQL, Perl and Apache but what else would be helpful? Note I don't want turnkey solutions, I want the students to develop the entire solution, from loading the OS to the final working system. What about Web page development? What about interfaces for end users? What have you used? What other issues? Opinions of the Slashdot community would be greatly appreciated." Now this sounds like an extremely cool project. I wish more colleges would look to do practical things like this with their students.

What we have done at my University

[SpaFF]

We've designed several database apps similar to what you are talking about for the lab on campus that I work at.
Basically we installed a barebones RedHat setup on a machine, locked it down, then compiled and configured Perl, Apache, PHP, and PostgreSQL.
They should be able to do the actual code writing from anywhere via ssh or ftping it over.
Be sure though that you teach them not only how to do the application part, but how to compile and configure the tools. You should also be sure to teach them how to secure the development machine properly, something thats usually left out in a class like that.

-Lee

Check out Lutris' Enhydra!

[Jules Agee]

Enhydra [enhydra.org] is an open-source Java application server. It provides a graphical database design tool, a site management console, load balancing, database connection pooling, and session management which automatically chooses between using cookies and url rewriting. Plus it's free. :)

It also has a great tool called XMLC which IMHO is a far better solution for embedding dynamic content in HTML than ASP or JSP. It lets you create dynamic HTML pages which a graphic artist can then edit in Dreamweaver or whatever tools they want to use - they can change the look and feel of the site without bothering the programmers, and there are no non-standard tags for their tools to choke on.

The students will still have to do needs-analysis, design the database structure (if necessary), design the interface, write the servlets, integrate with existing legacy systems, integrate with any credit-card processing software they might need, etc... Enhydra just provides a fantastic set of tools to let their applications include advanced features which they might not otherwise have the time or inclination to implement. It also provides a supported platform that the businesses can grow on, add functions to, and scale up if their on-line requirements increase in the future... and you know they will. ;)

http://www.enhydra.org

Do practical things with students

[Louis_Wu]

Cliff, when you said I wish more colleges would look to do practical things like this with their students, I started to write in indignant response. Then Yoda told me: "Breathe in, breathe out. Calm. The force flows through you."

There are some schools which have students do practical, hands-on work. Mine: Cal Poly, San Luis Obispo. [calpoly.edu] I'm a graduating Mechanical Engineering student, and in the ME department, our capstone design [calpoly.edu] class is doing a project for a company (Disney, Raytheon, Applied Materials, and a host of small companies). We have eight weeks from receipt of project to presentation, and our four person teams typically do more or better than similar industry teams with more time. Disney asked 5 students to make a life-size robot hand for their rides, because they couldn't. The students did pretty well (I think they had problems with life cycles), and they only had 8 weeks to think, design, calculate, build, test, and present. While taking a full load of senior level classes. (Hmm, I dropped into bragging mode.)

Yes, there are practical schools. I know that practical is important, but I don't want us to forget that there is also a very necessary theoretical aspect to school, which is hard to get outside of school.

End Rant. :)

Louis Wu

Thinking is one of hardest types of work.

look at Philip and Alex's guide

[woggo]

Philip and Alex's guide to Web Publishing [photo.net] is a handy reference for these sorts of things. They even describe how to get e-commerce "working" in a general way, all the way down to credit card processing (i.e. getting a merchant bank account + more) in Chapter 14 [arsdigita.com]

You'll want to use a "real" RDBMS. I'm not trying to flame here, but MySQL is inadequate for storing your customers' data because it doesn't support transactions. If one of your scripts accidentally breaks (due to bad user data), you do not want to bill them or store their order accidentally. Likewise, you want to update "stock/availablility information" atomically. There are probably some parts of your site that you could use MySQL for (i.e. authentication), but since you will need transactions for a critical part of your product anyway, you may as well go with Sybase, Oracle, PostgreSQL or SOLID. The MySQL developers have made it pretty clear that even if they implement something "called" transactions, it will fail the ACID test. (see the links from http://openacs.org for more objective info.) In any case, don't run the db server on the same machine as the WWW server -- remember the example set by CDUniverse.com, who lost many credit card numbers to a cracker.

If you have any db/php beginners on your team, you might want to show them this article I wrote [linuxjournal.com] for the Linux Journal -- it features a (cursory) overview of some of the topics you'll need to teach them.

Best of luck! ~wog

Re:look at Philip and Alex's guide

[cowbutt]

According to the MySQL manual [mysql.com] it DOES support transactions now.

Can anyone provide references to show that MySQL's implementation of transactions IS inadequate/incomplete?

(that's not just rhetoric; I really would like to know why!)

Re:look at Philip and Alex's guide

[myconid]

'In any case, don't run the db server on the same machine as the WWW server -- remember the example set by CDUniverse.com, who lost many credit card numbers to a cracker.'

Or the fact that thats how Apache.org was hacked/cracked/smacked.. Misconfigured mysql deamon running as root (iirc) on the same box as their httpd deamon (IIS4 iirc... ;)

security

[banbeans]

teach security first last and always
everything from ssl to storing the data encyrpted
on a secure server with a tight firewall
for example it will allow only connections in
from one machine in one format on the proper port
all other traffic is blocked and logged
and the secure machine must be on a non routable
switched network with the transaction server
also need a file checking settup for your
transaction server and remote logging
Id do it this way firewall---transaction machine(s)---firewall---database machine

Re:Do practical things with students

[nullset]

Setting up an ecommerce site is a weak senior design project... At my school, the senior project for CmpE's is: 1) Design a CPU 2) Design an OS for it that's all the details i have of it, b/c i'm not a senior just yet and haven't looked into it :) For CS, here's one a friend of mine had to do: 1) Load a .avi file containing videos of various objects 2) Be able to identify the objects (ie distinguish which one is which) now, how does that compare to 'implementing an ecommerce site'? MUCH more difficult. try something more challenging for the seniors. After all, you're telling the world that they know what they're doing. Oh well i guess now i'll need to get a masters b/c a bachelors degree is SO watered down....

Re:look at Philip and Alex's guide

[a2800276]

You should also take a look at the problem set / course description he makes available. They describe a curiculum that's close to what you want to teach:

http://philip.greenspun.com/teaching/one-term-web [greenspun.com]

and

http://philip.greenspun.com/teaching/psets/ [greenspun.com]

Re:look at Philip and Alex's guide

[dragonfly_blue]

Yeah, they shoulda been running on OpenBSD, where the default MySQL install runs as its own user. I was pleasantly surprised when I didn't have to lock MySQL down...as much as before, at least. ;-)

Myself, I am using a combination of Perl, Apache, Apache mod_include, PHP3, and MySQL on OpenBSD for my web database. It was slightly more difficult to get them to interoperate on OpenBSD, but the added security acts as a soothing balm on my (possibly paranoid) mind.

Er... perhaps that's not quite the right sounding phrase...

Re:look at Philip and Alex's guide

[nullset]

Or the fact that thats how Apache.org was hacked/cracked/smacked.. Misconfigured mysql deamon running as
root (iirc) on the same box as their httpd deamon (IIS4 iirc... ;)

it wasn't a mySQL related problem...it had nothing to do with apache. it was a misconfigured FTP server. next time READ before you post

Re:look at Philip and Alex's guide

[woggo]

You should look at this article: openacs.org/why-not-mysql.html [openacs.org]. Here is a relevant quote:

The OpenACS team is happy to take a closer look at MySQL as it matures. However, it doesn't seem that the MySQL team understands the concepts and importance of true ACID capabilities: The MySQL Todo mentions "transactions" in a long list that includes questions such as "do sleeping threads take CPU." Furthermore, the MySQL manual claims that MySQL will soon implement "atomic operations" through the use of table locks, but without rollback. This is a blatant misuse of the term "atomic," which implies that either none or all operations will complete. A hardware or power failure in the middle of a set of statements will break the atomicity of the block if there is no rollback capability.

I'd suggest reading the rest of the article -- it reveals many other caveats and limitations, including the fact that MySQL uses only table-level locking. Basically, it seems like MySQL is a great alternative to using a filesystem to store structured data, but it is not a substitute for a relational database.

By the way, PostgreSQL has supported transactions for at least the last two years.

~wog

Look to the Future

[dingbat_hp]

RedHat, PHP and mySQL is a great way to teach eCommerce '99-style.

If you want to be really up on the game, look towards XML and Java Servlet / SOAP architectures too. Single box PHP sites are fine for getting the "Bob's Doughnuts" catalogue site on-line, but the industry is screaming for ways to build bigger sites; secure connections to back-office servers, maybe even servers in other server rooms (or continents). Think about scalable multi-server soolutions, and choose protocols that work in this environment.

This year's Next Big Thing is mobile; using protocols like WAP & WML. These are a very good scenario for using content generation in XML and redirection to different presentations by using XSL transforms.

I'd second the Enhydra recommendation. I don't like XMLC, but many of the other bits (the esp. Servlet engine and good XML support) are just where you want to be. Works with WAP too (unlike many).

Anyone who uses Flash should be sent down instantly 8-)