Search

Water is an important, but often ignored element in sustainable development by now it has been clear that urgent action is needed to avoid global water crisis. Water resource management is the activity of planning, developing, distributing and managing the optimum use of water resources. Successful management of water resources requires accurate knowledge of their resource distribution to meet up the competing demands and mechanisms to make good decisions using advanced recent technologies.Towards evolving comprehensive management plan in suitable conservation and utilization of water resources space technology plays a crucial role in managing country’s available water resources. Systematic approaches involving judicious combination of conventional server side scripting programming and remote sensing techniques pave way for achieving optimum planning and operational of water resources projects. new methodologies and 24/7 accessible system need to be built, these by reducing the dependency on complex infrastructure an specialist domain Open source web GIS systems have proven their rich in application of server side scripting and easy to use client application tools. Present study and implementation aims to provide wizard based or easily driven tools online for command area management practices. In this large endeavour modules for handling remote sensing data, online raster processing, statistics and indices generation will be developed.

Obtaining medical images require high speed and mobility in receiving and analyzing patient medical information, a portable device is the solution. However, the medical image format that is commonly used is an image with the DICOM format that cannot be accessed directly by portable devices because of the limitations of portable devices to access DICOM images and the size of the DICOM image format which will eat up the memory of portable devices so a system is needed to help solve this issue. In this case study is a system capable of performing the conversion and an application that can access the results. This system works by processing medical data in the form of DICOM image files with the denoising method to reduce noise in medical images on a local computer so that the converted images have better quality, then convert the files into PNG file format. The result of those stage are PNG and CSV which will be uploaded into database and with PHP server side programming, then from the conversion image and patient data can be obtained and accessed through an application on a portable device.

now a day’s people desire to travel from one city to another city in a convenient way, that save the time and according to their budget. Everyone wants to acquire the best solution within lesseffort. Traditionally, whenever people want to buy bus ticket they have to visit the bus terminal of different passenger carrier and for their turn in a long queue. There are also websites and apps of different passenger carrier for online ticket booking that are running separately people get confused to acquire the best one. Searching ticket from a different websites and apps is time taken. For this argumentation a pro efficient eBus Services System (EBS) is to be proposed in this paper to overcome these issues faced by passengers during transport reservation inside the nation. The system provides web and android application based structure that allows the guest to check eBus accessibility, make reservation and pay charges through online payment gateway. Which is stylish now a days. EBS will help population to reserve tickets of journeys and it also allows passengers to compare estimate fares, services of different service providers. Development of system is based on agile software development approach and Unified Modeling Language(UML). The idea is to gather all conveyor & agent and their services on one platform. So, the tourist can easily appoint and lined up according to them decide on. This entity will also present the functionality of tracking the bus, you can track the bus if your agnate, relatives makes a journey. This paper proposed eBus Services system. eBus Services was developed by using Bootstrap, server side scripting by using PHP, MYSQL, JQuery and JavaScript to make client end responsive and user friendly and AJAX to reduce load from server.

KBIH as government partners in order to realize and Umrah pilgrims are independent and have coaching institute rituals of Hajj are very attractive to pilgrims and Umrah. One of the emerging KBIH is KBIH Al-Manafiyah North Cikarang Bekasi. However, knowledge of media used for training rituals of Hajj in KBIH uses contextual media in the form of guide books and leaflets paper. It is not yet effective and efficient because there is a guide book that is sometimes difficult to understand and the limited time to study it more deeply. Based on the problems, We wants to build a mobile application on the Android platform. It hoped able to provide guidance information Hajj and Umrah. It are not only comprehensive but also practical. Methodology application development using Rapid Application Development, which consists of three phases: planning, design and implementation workshop to design the UML (Unified Models Language) and developed using Android Framework SDK, the Java programming language, PHP is a server side programming language, MySQL as database, Google Maps. Based on these results with the application of the congregation can easily obtain information about the Hajj and Umrah guide practical.

Voice-based systems allow users access to information on the internet over a voice interface. Prior studies on Open and Distance Learning (ODL) e-examination systems that make use of voice interface do not sufficiently exhibit intelligent form of assessment, which diminishes the rigor of examination. The objective of this paper is to improve on the achievements of previous studies by providing a framework that will guide the development of a voice-based e-examination expert system for the visually impaired students in ODL. The study employs a combination of technologies such as system design, server side scripting, voice-based system development, data management and rule-based reasoning in developing the system. The system was evaluated to determine the level of usability. The results of the usability evaluation showed that the developed application has an ‘average usability’ rating of 3.48 out of 5 scales. The findings show that the voice-based e-examination system will not only be of immense benefit to the visually impaired students in ODL in respective of distance, but will also complement the existing web-based method for online examination.

In this paper, the development of a web based spatial information system for selected urban management services in Akwa Ibom state is presented. The selected urban management services include; disaster management, waste management, land administration and land transportation information hub. Participatory evolutionary software development methodology was used in the system development and the system was implemented using Hyper Text Markup Language (HTML) for the web interface, PHP Hypertext preprocessor (PHP) for the server side scripting , MySQL for the database, Google map API (Application Programming Interface) for the maps and Apache as the web server. The web application was hosted locally using WAMP server and tested with some dataset obtained in the case study area. Relevant screenshots of the webpages are also presented. The web application presented in this paper can be used to facilitate participatory urban service in any given city or state.

Nowadays, web applications play a significant role in the success of the business. Web applications have grown very fast in the current market. They bring new challenges for the researchers in the area of testing, such as heterogeneous representation, dynamic behavior, data flow mechanism, control flow mechanism and some more issues relevant to web applications. This paper presents an approach for model-based dynamic web application testing. This approach considers server side scripting language to test the functional requirements of the web applications. In this approach, first the implicit class object tags are extracted from JSP pages, and the JSP Flow Graph (JFG) is constructed for tracing the requirements using the proposed algorithm JTSG. Then, the test scenarios and concrete test cases are generated for the given web application.

Ovaj rad se bavi arhitekturama koje se mogu koristiti za izradu internet trgovine te usporedbom njihovih performansi. Kreirana je internet trgovina na WordPress platformi s WooCommerce dodatkom kao primjer arhitekture skripti kreiranih na poslužitelju. Nakon toga je na tom sustavu izloženo REST i GraphQL sučelje koje se koristi kao izvor podataka na jednostraničnoj aplikaciji kreiranoj u React razvojnom okviru kako bi se prikazala arhitektura skripti na klijentu. Iskušana je i hibridna arhitektura koja koristi REST i GraphQL sučelja, ali tako da WordPress upravlja stranicama. Svim navedenim pristupima su mjerena vremena učitavanja te količina mrežnog prometa. Zatim su ti podaci uspoređeni međusobno te s vremenom utrošenim u razvoj pojedine arhitekture. This work is about different architectures that are available for developing web shops and measuring their performances. We created one web shop on WordPress platform with WooCommerce plugin like a test case for server-side scripting architecture. After that we created REST and GraphQL interfaces which we use like data source for single-page application made with React Framework used as test case for client-side scripting. We also created one hybrid approach where we use REST and GraphQL interfaces but on a way where we use WordPress platform as a routing manager. We measured load times and network traffic for all approaches. After that we compared the results with each other and with time we used to develop each of the architectures.

In this paper, we present a combinatorial testing methodology for testing web applications in regards to SQL injection vulnerabilities. We describe three attack grammars that were developed and used to generate concrete attack vectors. Furthermore, we present and evaluate two different oracles used to observe the application's behavior when subjected to such attack vectors. We also present a prototype tool called SQLInjector capable of automated SQL injection vulnerability testing for web applications. The developed methodology can be applied to any web application that uses server side scripting and HTML for handling user input and has a SQL database backend. Our approach relies on the use of a database proxy, making this a gray-box testing method. We establish the effectiveness of the proposed tool with the WAVSEP verification framework and conduct a case study on real-world web applications, where we are able to discover both known vulnerabilities and additional previously undiscovered flaws.

Over the years the North-eastern states of India are gaining popularity for its flora. Such a rich flora means a better environment. But there is no information of the flora of North-east available in the internet for information seekers like school children. Understanding its importance, we have developed this e-Learning system on Flora of North East India aiming at the young learners. The proposed online Plant Directory of North-east India is based on web server, which can be implemented on any computer. In this application, PHP is server side language, MySQL and PHP is used as back-end design. HTML, CSS and JavaScript are used as front-end tools. The system communicates with database residing on a remote server. The system facilitates the end users with interactive design and information on the flora found in North East India. An user can search a plant by its scientific or local name. Other attractive modules like quiz, game playing, group discussion, puzzle solving are also incorporated within it.

Employability and Unemployment continues to be dire issues that Nigerian youth are faced with daily in a saturated employment market. Whereas, the use of work-integrated learning can help bridge the gap by increasing employability skills among students. The study examined the benefits of having a work-integrated learning (WIL) program for students in the construction field. Therefore, the study developed a framework for improving employability skills through a web-based work integrated learning database for construction students. Using a system block diagram, use case diagram and activity diagram, the study illustrated the functional requirement needed for the development of the WIL platform. The WIL platform is a web-based system pooling submission of available WIL positions from employers in construction businesses and former WIL students in order for prospective WIL students to access possible openings where they can learn in a workplace environment. The methodology of this research includes using the combination of HTML, CSS and the C-Sharp programming language for the interface design and server side scripting while MySQL was the database platform used for storing and retrieving the data used for the application. In conclusion, the study designed a WIL platform for construction students. The use of the WIL platform is intended to encourage employability of construction students by ensuring that they are adequately engaged in a work place training.

CityGML is considered as an optimal standard for representing 3D city models. However, international experience has shown that visualization of the latter is quite difficult to be implemented on the web, due to the large size of data and the complexity of CityGML. As a result, in the context of this paper, a 3D WebGIS application is developed in order to successfully retrieve and visualize CityGML data in accordance with their respective geometric and semantic characteristics. Furthermore, the available web technologies and the architecture of WebGIS systems are investigated, as provided by international experience, in order to be utilized in the most appropriate way for the purposes of this paper. Specifically, a PostgreSQL/ PostGIS Database is used, in compliance with the 3DCityDB schema. At Server tier, Apache HTTP Server and GeoServer are utilized, while a Server Side programming language PHP is used. At Client tier, which implemented the interface of the application, the following technologies were used: JQuery, AJAX, JavaScript, HTML5, WebGL and Ol3-Cesium. Finally, it is worth mentioning that the application’s primary objectives are a user-friendly interface and a fully open source development.

This research aims to implement the semantic web learning resource domain. Application of semantic web by utilizing RAP library is a RDF Api, SPARQL as a query to access RDF, and PHP as server side scripting language. Steps being taken in this research include analysis of system requirements, data collection, design, coding, testing. The results of this research is a semantic web that helps in the search for learning resource. General Terms Semantic web, ontology, semantic search.

A content security policy (CSP) can help Web application developers and server administrators better control website content and avoid vulnerabilities to cross-site scripting (XSS). In experiments with a prototype website, the authors' CSP implementation successfully mitigated all XSS attack types in four popular browsers.

Scripting is a widely-used way to automate the execution of tasks. Despite the popularity of scripting, it remains difficult to use for both beginners and experts: because of the cryptic commands for the first group, and incompatible syntaxes across different systems, for the latter group. The authors introduce Natural Shell, an assistant for enabling end-users to generate commands and scripts for various purposes. Natural Shell automatically synthesizes scripts for different shell systems based on natural language descriptions. By interacting with Natural Shell, new users can learn the basics of scripting languages without the obstacles from the incomprehensible syntaxes. On the other hand, the authors' tool frees more advanced users from manuals when they switch shell systems. The authors have developed a prototype system and demonstrate its effectiveness with a benchmark of 50 examples of popular shell commands collected from online forums. In addition, the authors analyzed the usage of Natural Shell in a lab study that involves 10 participants with different scripting skill levels. Natural Shell effectively assists the users to generate commands in assigned syntaxes and greatly streamlines their learning and using experience.

These days, the internet has turned into the favoured stage for clients to complete many activities of their everyday lives, including activities that include delicate data, for example, e-trade, e-administration, e-saving money, shopping portals and that is only the tip of the iceberg. Web applications have turned out to be unavoidable in all parts of life in view of the simplicity of remote availability for its clients. Yet, as the use of web builds each day, it has likewise brought into light the perilous side of HTML. Security has, along these lines end up noticeably one of the significant concerns with respect to the internet. In this paper, we concentrate on the particular issue of cross site scripting (XSS) assaults. We exhibit a scientific categorisation think about on cross site scripting assaults. We have additionally examined different sorts of vulnerabilities present and dangers delivered for this assault. We have also proposed a static analysis-based system for the detection and removal of the XSS vulnerabilities.

Typically, unlike in a compiled programming language, the source code (called a script) in a scripting language is not compiled, but is interpreted at runtime. However, scripts written in some scripting languages may be compiled into Java bytecode that can be run by the JVM.

Nowadays, Web applications are considered to be one of the most ubiquitous platforms for providing the information and service release over the World Wide Web, particularly those deployed in health care, banking, e-commerce operations, etc. Boom of social networking sites and modern Web applications that transfer dynamic information to the client-side Web browsers has increased the user-generated and feature-rich HTML content on the Internet. This enhanced HTML content includes a malicious attack vector for Web-related attacks. Cross-site scripting (XSS) attacks are presently the most exploited security problems in modern Web applications and activated by an attacker to utilize the vulnerabilities of the poorly written Web application source code. Users across all over the popular social networking Web sites are exposed to XSS attacks. These attacks are generally caused by the malicious scripts, which do not validate the user-injected input appropriately and exploit the vulnerabilities in the source code of the Web applications. It results in the loss of confidential information such as stealing of cookies, theft of passwords, and other private credentials. In this paper, we propose a robust framework known as XSS-SAFE (Cross-Site Scripting Secure Web Application FramEwork), which is a server-side automated framework for the detection and mitigation of XSS attacks. XSS-SAFE is designed based on the idea of injecting the features of JavaScript and introduced an idea of injecting the sanitization routines in the source code of JavaScript to detect and mitigate the malicious injected XSS attack vectors. We repeatedly inject the feature content, generate rules, and insert sanitization routines for the discovery of XSS attacks. We have evaluated our approach on five real-world JavaServer Pages (JSP) programs. The results indicate that XSS-SAFE detects and mitigates most of the previously known and unknown XSS attacks with minimum false positives, zero false-negative rate, and low runtime overhead.

In present-day time, securing the web application against hacking is a big challenge. One of the common types of hacking technique to attack the web application is Cross-Site Scripting (XSS). Cross-Site Scripting (XSS) vulnerabilities are being exploited by the attackers to steal web browser’s resources such as cookies, credentials etc. by injecting the malicious JavaScript code on the victim’s web applications. Since Web browsers support the execution of commands embedded in Web pages to enable dynamic Web pages attackers can make use of this feature to enforce the execution of malicious code in a user’s Web browser. The analysis of detection and prevention of Cross-Site Scripting (XSS) help to avoid this type of attack. We describe a technique to detect and prevent this ki nd of manipulation and hence eliminate Cross-Site Scripting attack.

With the increase in technology, Internet has provided set of tools and technologies which has enabled web programmers to develop effective websites. PHP is most widely used server side scripting language and more than twenty million of web sites are designed through PHP. It has used as a core script in Web Content Management System (WCMS), such as Joomla, WordPress, Drupal, SilverStripe etc. PHP has also security flaws due to the certain vulnerabilities such as PHP injection, remote file inclusion and unauthorized file creation. PHP injection is a variant of code injection attacks in which PHP script may be exploited to execute remote commands. The contribution of this paper is twofold: First, it presents a unifying view of PHP injection vulnerability, which causes alteration in the "hosts file"; Second, It introduces an investigation process against alteration in "hosts file" through PHP injection. This attack has been introduced as a type of DNS pharming. In this investigation process a chain of evidence has been created and an algebraic signature has been developed to detect explained attack.

Due to the impact of high performance customer service, many organizations attempt to improve customer support services using helpdesk systems. The objective of this study is to develop a Central Trouble Ticketing (CTT) system for effective information dissemination, efficient management of operations and to resolve challenges of Center of Training and Learning (CTL) through using e-learning website at a University. As for implementation phase, the Hypertext Preprocessor (PHP) was used as the server side programming tool and MySQL database as backend. The benefits of the Central Trouble Ticketing system include creation of a medium for lecturers to pass their complaints or messages to the technical department for speedy attention; and provision of better and faster operational processes which will reduce time spent on documentation. The system is more reliable, effective and convenient than the manual method in reporting cases of complain within the university technical community.

Voice-based systems allow users access to information on the internet over a voice interface. Prior studies on Open and Distance Learning (ODL) e-examination systems that make use of voice interface do not sufficiently exhibit intelligent form of assessment, which diminishes the rigour of examination. The objective of this paper is to improve on the achievements of previous studies by providing a framework that will guide the development of a voice-based e-examination expert system for the visually impaired students in ODL. The study employs a combination of technologies such as system design, server side scripting, voice-based system development, data management and rule-based reasoning in developing the system. The system was evaluated to determine the level of usability. The results of the usability evaluation showed that the developed application has an ‘average usability’ rating of 3.48 out of 5 scales. The findings show that the voice-based e-examination system will not only be of immense benefit to the visually impaired students in ODL in respective of distance, but will also complement the existing web-based method for online examination.

Publisher Summary PHP is rich and full-featured, with capabilities ranging from databases, to sockets, and file system manipulations. PHP can be used for scripting tasks in place of bash or other host-based scripting languages. It is an open source scripting language designed primarily for Web development. PHP pages are typically HTML pages with PHP code intermixed in order to merge the functionality of the Web site with the HTML code. PHP variables are prefixed by a dollar sign to indicate that they should be interpreted as variables. These variables can be included in strings for printing without conversion, with the exception of arrays, which need to be encased in curly braces, in order to be interpreted correctly. Booleans also have some special consideration for printing as they will not print true or false, but rather either 1 or an empty string, respectively. Knowledge of file handling in PHP gives the ability to interact with the file system through a Web page, allowing taking Web vulnerability and leverage it to get higher levels of server access. There are three basic ways to access files. One is to include another PHP file in order to execute additional commands. The other two deal with either fetching or putting data into a file in the file system.

Many of the programmers move towards object oriented programming languages due to its reusability nature, whereas in procedural programming languages reusability is not allowed, which may contribute to the high cost of development. Most of web browsers make use of JavaScript as a user interactive program that is a client side program due to its active nature. In the client side programming it is practiced to enable user interaction, control browser activities and alters the content changes made by user dynamically. On the server side programming language, it is used for desktop and mobile application growth. JavaScript is mainly applied for maturation of object oriented web application development because of its supportability of inheritance via prototyping and also properties and methods. In this work the various object oriented concepts are discussed. The methods and operation supported by the object oriented JavaScript language is likewise talked about. Its nature of operating methods, type refinement of JavaScript language, various access control mechanisms over JavaScript language is discussed. The enabling of transaction control over JavaScript language is also elaborated.

With the rapid development of online social networks, various Web application programming interfaces (APIs) on social platforms are released to share profitable social data with all kinds of third-party online services. However, it also brings new risks to social networks once Web APIs are insecurely designed, implemented, and invoked. The focused topic in this paper is security analysis of a new type of cross-site scripting (XSS) which is based on Web APIs in new complicated social ecosystems which consist of social networks, third-party apps, and other online services. In this paper, we refer to Web API-based XSS as cross-API scripting (XAS). For the first time, we take typical XAS attacks in diversified context as cases to demonstrate the new exploiting opportunities and threats in social ecosystems. Also, we design a tool to identify the design and implementation flaws of Web APIs in 11 popular social networks. We discover several security flaws of API via our experiment. According to the results, we conclude causes of XAS flaws in depth. We also examined 143 Web-based apps and verified the prevalence of XAS flaws. Finally, we proposed preliminary measures both in social networks and third-party applications to alleviate XAS.

This paper proposed an automatic transformation technical solution for behavior control scripting languages. The solution automatically converts VBA scripting language into JavaScript scripting language. It implements automatic transformation by analyzing and comparing differences in the use of different grammatical of VBA scripts and JavaScript scripts such as data types, control structures, form controls and add-ins Etc. To ensure the accuracy and completeness of conversion the solution generates an abstract syntax tree which represents call and transitive relation between functions. Compared with the conversion tools the solution can reduce repeated manpower and improve productivity.

SQL injection is the most common web application vulnerability. The vulnerability can be generated unintentionally by software developer during the development phase. To ensure that all secure coding practices are adopted to prevent the vulnerability. The framework of SQL injection prevention using compiler platform and machine learning is proposed. The machine learning part will be described primarily since it is the core of this framework to support SQL injection prediction by conducting 1,100 datasets of vulnerabilities to train machine learning model. The results indicated that decision tree is the best model in term of processing time, highest efficiency in prediction.

The research and commerce communities have a need to understand and use the Single-Page Application (SPA) framework written in JavaScript for knowledge discovery and global sharing of information. It is important to develop user-friendly web-based tools which efficiently process, analyze, and visualize scientific data. The efficient use of languages and tools such as HTML5, CSS3, and JavaScript Libraries is important. The need to asynchronously fetch new data and update the web page, without refreshing the entire page is essential to better visualize the data in real-time. Without any scientific methodology for comparing SPA frameworks written in JavaScript, it is troublesome to choose which one to use. Our work studies a method to better understand the web client technology with an interactive application. We build upon an existing open source web application JavaScript framework tool to measure the time distribution of client components. We study interactive web-based activity.

We are developing a real-time, wearable, Open-source Speech-Processing platform (OSP) that can be configured by audiologists and Hearing Aid (HA) researchers for lab and field studies. This contribution describes OSP tools to (i) control the HA state, such as amplification parameters in each subband, (ii) provide stimuli to the user, and (iii) get feedback from the user. The system is based on a web server with interfaces to the HA state, the environment state (e.g., background noise characteristics, reverberation conditions, GPS location, etc.) and the user state (as inferred from ecological momentary assessments). We describe Application Programmer’s Interfaces (APIs) used in Hypertext Markup Language (HTML) and server side scripting language (e.g., PHP) to create web applications aimed at assessing efficacy of various Hearing Loss (HL) compensation approaches. HTML and PHP are versatile tools and lot easier to develop functional skills compared with software tools used in the OSP. We provide example sc...

This paper presents the RMatlab-app2web tool which enables the use of R or MATLAB scripts as CGI programs for generating dynamic web content. RMatlab-app2web is highly adjustable. It can be run on both, Windows and Unix-like systems. CGI scripts written in PHP take information entered on web-based forms on the client browser, pass it to R or MATLAB on the server and display the output on the client browser. Adjustable to the server’s requirements, the data transfer procedure can use either the GET or the POST routine. The application allows to call R or MATLAB to run previously written scripts. It does not allow to run completely flexible user code. We run a multivariate OLS regression to demonstrate the use of the RMatlab-app2web tool.

Cross site scripting (XSS) is a common security problem of web applications where an attacker can inject scripting code into the output of the application that is then sent to a user's web browser. In the web browser, this scripting code is executed and used to transfer sensitive data to a third-party. Today's solutions attempt to prevent XSS on the server side, for example, by inspecting and modifying the data sent to and from the web application. The presented solution, on the other hand, stops XSS attacks on the browser/ client side by tracking the use of sensitive information in the JavaScript engine of the web browser. If sensitive information is about to be transferred to a third party, the user can decide if this should be allowed or not. The existing client- side solutions degrade the performance of client's system resulting in a poor web surfing experience. In this project provides a client side solution that uses a step by step approach to protect cross site scripting, without degrading much the user's web browsing experience.

As one HTML embedded scripting language, PHP (Hypertext Preprocessor) is a powerful computer programming language which is a remarkable tool to enhance the expression of webpage. JavaScript is a client-side technology that is processed by the client-side software. But PHP is completely the server-side scripting language. It is a critical issue that how to effectively complete the clients request and transfer the information between two languages. The form is adopted in this paper. And based on that, the information transfer between two languages is tested. The result proves that in web project the interaction via form is an effective and reliable method.

The rapid development of Web 2.0 leads scripting language such as JavaScript to be ubiquitous in web pages; however the dynamic nature and flexibility of JavaScript make its development, debugging, maintenance, and reuse difficult. To improve the efficiency and accuracy of JavaSript security analysis, we propose a new JavaScript analysis method based on program slicing, together with a prototype-implemented JavaScript slicing tool, named JSSlicer. We also present a proof-of-concept application example of JSSlicer where an example of the common mode failure problem is tackled.

A large number of web applications are written using server-side scripting languages. Although web browsers allow clients to run these applications, it is often cumbersome to depend on desktops for the services provided by the applications. Given the popularity and convenience of mobile devices, there is a clear need to have native mobile apps driving the applications along with web browsers. In this paper, we present a solution to re-engineer web applications developed using server-side scripting languages, into native mobile apps. The solution takes source code of the web application along with its test suite as input and produces corresponding cross-platform mobile apps. The entire re-engineering process is fully automatic requiring no manual intervention at any stage. Our solution is generic enough not only to handle popular server-side scripting languages, but also to output mobile apps that support diverse popular platforms including Android, iOS, and Windows Mobile. To showcase the capability and generality of our solution, we have developed a prototype tool KIRKE to handle applications developed using JSP, PHP, and ASP.NET. We present three case studies based on real-life codebases to evaluate the correctness, coverage, usability, and performance of our solution. The results indicate that KIRKE is capable of generating a mobile app that preserves the functionality of original web application and uses resources more efficiently when compared to the web application running on a mobile browser.

JSPChecker is a static analysis tool that detects context-sensitive cross-site scripting vulnerabilities in legacy web applications. While cross-site scripting flaws can be mitigated through sanitisation, a process that removes dangerous characters from input values, proper sanitisation requires knowledge about the output context of input values. Indeed, web pages are built using a mix of different languages (e.g. HTML, CSS, JavaScript and others) that call for different sanitisation routines. Context-sensitive cross-site scripting vulnerabilities occur when there is a mismatch between sanitisation routines and output contexts.JSPChecker uses data-flow analysis to track the sanitisation routines that are applied to an input value, a combination of string analysis and fault-tolerant parsing to approximate the output context of sanitised values, and uses this information to detect context-sensitive cross-site scripting vulnerabilities. We demonstrate the effectiveness of our approach by analysing five open-source applications and showing how JSPChecker can identify several context-sensitive XSS flaws in real world applications with a precision ranging from 96% to 100%.

Today's cyber-physical (CP) electronic system design includes hardware and software with intelligent sensing and controls. Those CP future applications use high definition images, videos and context information with interactions to the physical world through sensors and actuators. Senior level courses including embedded controls, FPGA design, and server side programming have been developed and tested in senior and undergraduate courses and senior design projects. The project based courses were designed and motivated by the Urban Information Systems, project for emerging Smart Cities. This paper reviews specific curricula, lab organization, hardware and software platforms, and preliminary results of offered courses in 2015--2016.

Cross site scripting (XSS) is a type of scripting attack on web pages and account as one of the unsafe vulnerability existed in web applications. Once the vulnerability is oppressed, an intruder advances intended access of the authenticate user's web-browser and may perform session-hijacking, cookie-stealing, malicious redirection and malware-spreading. As prevention against such attacks, it is essential to implement security measures that certainly block the third party intrusion. Recently the most dangerous attacks are reflected and DOM based cross-site scripting attacks because in both cases attacker attack using server side scripting and do forgery over the network, it is hard to detect and therefore it must be prevented. Vulnerabilities of websites are exploited over the network through web request using GET and POST method. In this paper, we are focusing on injection, detection, and prevention of stored based XSS reflected XSS and DOM based XSS.

Netscape first provided a grand unification of sorts by offering a single, uniform interface to resources spread across the globe. Simple HTML interfaces to CGI (and later PHP) scripts provided the second grand unification-as suddenly software developers did not need to worry about client software distribution any more. Both Java and Javascript attempted (in their own ways) to enhance the degree of sophistication of the end-user experience. Protocols and technologies came and went (xml-rpc, SOAP, Java RMI, OpenLaszlo, etc.) while the typical web development solution slowly converged towards a (now traditional) LAMP stack architecture. As web development projects became more demanding, frameworks like Spring and Rails (for Ruby) demonstrated the viability of the MVC pattern and helped spawn replicas (CakePHP, Django, Grails, etc.) into other communities. Today it's fair to say that the move towards the MVC architectures was just another (spontaneous, unplanned) attempt to unify development over the web. Simplicity often tends to be a great focal point of evolution. In the last 5-6 years another type of unification became possible due to the surprising resurgence of a most unlikely candidate: Javascript. First Javascript was the glue that made possible the ideas behind HTML5 (as an entirely new set of APIs, and not just a new set of tags). Then in 2009 with the first release of Node.js (relying on Google's Javascript V8 engine) the creation of web servers and networking tools using JavaScript became not just possible, but also extremely efficient. These days, using MongoDB as the document database, Node.js as the server platform (with Express as a flexible and robust server-side web application framework) along with AngularJS (by Google) for the GUIs on the client side, developers are finally capable of creating more agile software by using a single language across all layers of application development. This has the potential to drastically change how we teach web programming. Bring your own laptop and join us for a workshop as we explore in tutorial fashion all major aspects, stages and components of web development with the MEAN stack.

Analyzing real-world JavaScript web applications is a challenging task. On top of understanding the semantics of JavaScript, it requires modeling of web documents, platform objects, and interactions between them. Not only the JavaScript language itself but also its usage patterns are extremely dynamic. JavaScript can generate code and run it during evaluation, and most web applications load JavaScript code dynamically. Such dynamic characteristics of JavaScript web applications make pure static analysis approaches inapplicable. In this talk, we present our attempts to analyze JavaScript web applications in the wild mostly statically using various approaches. From pure JavaScript programs to JavaScript web applications using platform-specific libraries and dynamic code loading, we explain technical challenges in analyzing each of them and how we built an open-source analysis framework for JavaScript, SAFE, that addresses the challenges incrementally. In spite of active research accomplishments in analysis of JavaScript web applications, many issues still remain to be resolved such as events, callback functions, and hybrid web applications. We discuss possible future research directions and open challenges.

Now let’s discuss the tag in HTML5. It allows you to use the JavaScript programming language with your HTML5 content creation pipeline (markup, design, programming, and publishing). The JavaScript language is based on ECMAScript 262.

In modeling and simulation it is often necessary to simulate a model with a variety of settings and evaluate the simulation results with measured data or previously acquired results. As doing this manually is error-prone and ineffective, scripting languages are often used to automate this process. In general a simulation description is tool and model dependent. Therefore, simulating the same model with the same simulation description in different simulation tools or comparing two different models with the same settings is often not easily achieved. We propose an object-oriented, tool-independent, easy-to-use, domain-specific scripting language to describe simulations in an exchangeable and uniform manner. Through this simulation description the simulation settings and the simulation environment can easily be changed while syntax and sequence of commands remain the same. The language is Python based and is designed to be simple, well-readable and intuitive even with marginal programming experience while maintaining Pythons’ strength. The language uses an in-house Python library which provides interfaces to different simulation environments (so far Dymola, OpenModelica, Simulink). This library can also be used directly in Python, enabling experienced Python users to keep describing their simulations in Python but benefiting from our efforts to achieve tool-independence.

The Internet and web applications are playing very important role in our today’s modern day life. Several activities of our daily life like browsing, online shopping and booking of travel tickets are becoming easier by the use of web applications. As the volumes of the web applications are increasing the security of web applications becomes a major concern. Most of the web applications use the database as a back end to store critical information such as user credentials, financial and payment information, company statistics etc. These websites are continuously targeted by highly motivated malicious users to acquire monetary gain. Multiple client side and server side vulnerabilities like SQL injection and cross site scripting are discovered and exploited by malicious users. SQL injection attacks and cross site scripting vulnerabilities are top ranked in the open web application security project top ten vulnerabilities list. A number of security approaches are proposed and used like secure coding practices, encryption, static and dynamic analysis of code to secure the web applications but statistics shows that these vulnerabilities are still transpiring at the top. In this paper, we present an integrated model to prevent SQL injection attacks and reflected cross site scripting attack in PHP based implementation. This model is more effective to prevent SQL injection attack and reflected cross site scripting attack in production web environment. Our mechanism is divided into two modes, a safe mode and a production mode environment. In the safe mode we construct a security query model for SQL injection and sanitizer model for reflected cross site scripting attack for each identified SQL queries for SQL injection attacks and input entry points for reflected cross site scripting attacks. In the production environment, input entries which create dynamic SQL queries are validated against security query model generated in safe mode and normal input text entered by the user is validated by sanitizer model instrumented in the code at safe mode. The results and analysis shows that the proposed approach is simple and effective to prevent common SQL injection vulnerabilities and reflected cross site scripting vulnerabilities.

peer-reviewed Although scripting languages have become very popular, even mature scripting language implementations remain interpreted. Several compilers and reimplementations have been attempted, generally focusing on performance. Based on our survey of these reimplementations, we determine that there are three important features of scripting languages that are difficult to compile or reimplement. Since scripting languages are defined primarily through the semantics of their original implementations, they often change semantics between releases. They provide C APIs, used both for foreign-function interfaces and to write third-party extensions. These APIs typically have tight integration with the original implementation, and are used to provide large standard libraries, which are difficult to re-use, and costly to reimplement. Finally, they support run-time code generation. These features make it difficult to design a fully compatible compiler. We present a technique to support these features in an ahead-of-time compiler for PHP. Our technique uses the original PHP implementation through the provided C API, both in our compiler and in our generated code. We support all of these important scripting language features. Additionally, our approach allows us to automatically support limited future language changes. We present a discussion and performance evaluation of this technique.

Cross-site scripting (XSS) vulnerabilities are among the most common and serious web application vulnerabilities. It is challenging to eliminate XSS vulnerabilities because it is difficult for web applications to sanitize all user input appropriately. We present Noncespaces, a technique that enables web clients to distinguish between trusted and untrusted content to prevent exploitation of XSS vulnerabilities. Using Noncespaces, a web application randomizes the the (X)HTML tags and attributes in each document before delivering it to the client. As long as the attacker is unable to guess the random mapping, the client can distinguish between trusted content created by the web application and untrusted content provided by an attacker. To implement Noncespaces with minimal changes to web applications, we leverage a popular web application architecture to automatically apply Noncespaces to static content processed through a popular PHP template engine. We design a policy language for Noncespaces, implement a training mode to assist policy development, and conduct extensive security testing of a generated policy for two large web applications to show the effectiveness of our technique.

Cross-Site Scripting is one of the main problems of any Web-based service. Since Web browsers support the execution of commands embedded in Web pages to enable dynamic Web pages attackers can make use of this feature to enforce the execution of malicious code in a user’s Web browser. To augment the users’ experience many web applications are using client side scripting languages such as JavaScript but this growing of JavaScript is increasing serious security vulnerabilities in web application too, such as cross-site scripting (XSS). In this paper, I survey all the techniques those have been used to detect XSS and arrange a number of analyses to evaluate performances of those methodologies.