Quote: I've tried VIM... didn't like it *shrug*.I also don't like it too much. Though it does have some advantages. Unlike XED or NetBeans, it actually highlights PHP mixed with HTML correctly. EMACS seems easier to use than VIM at first, but after a while you see it isn't. And EMACS is no more useful than Notepad when editing CSS and it always incorrectly highlights JavaScript as if it were Java. One quirky problem with VIM is that, while it highlights short pieces of JavaScript and CSS embedded in HTML correctly, it fails to correctly highlight longer ones, such as in the source-code of my web-app. I realize that it's done for speed (one can't attempt to parse the whole file to see which programming language is used where on slower computers), but it can be quite annoying. Honestly, of all the text editors I've tried to edit HTML5 with, I like the features of NetBeans the most. However, there is an annoying bug preventing it from being called from Finder with "Open With..." or similarly from Terminal on MacOS, which is why I mostly use XED.
Quote: Regarding your password algorithm, I'd simply do it all in the backend.If I do it in the back-end, I'd either need to do a large number of AJAX-es (each of which takes seconds to finish, and it's almost impossible to make them work in older browsers), or refresh the page each time (which would, because of the free web-host that I use, quite often cause the "connection timed out" error). And how is it easy to turn off JavaScript? It's easy to turn off JavaScript in Android Stock, Internet Explorer 6 or NetSurf (in NetSurf, it's disabled by default to not cause the servers to send it something Duktape, its terrible JavaScript engine, can't take). It takes you more than half an hour to find out how to disable JavaScript in some particular modern browser, even if you have some experience with the developer tools. That's not something that can be done by accident. Even in the case it's done, I've included some "noscript" that will cover the page with a message about it.
Quote: Something like bcrypt.I am not sure that would help. Even if somebody manages to get to the hash hard-coded into the PHP on the server and the hashing algorithm I've used (which is, for all practical purposes, impossible), all he can do is a brute-force attack trying tens of thousands of possibilities (Because almost none of the "passwords" that would satisfy the hash are made of characters you can actually type in the web-app using the standard keyboard). The problem is that my algorithm uses the same key for both encrypting and decrypting. So, if somebody intercepts the connection on both AJAX-es (I wouldn't know how to do it, but I'd imagine it's possible), he knows both the cyphered password and the key to decipher it.
Quote: Keep getting "server not found."Ah, what can I do. The back-end of 000webhost is obviously very buggy (the control panel stops working every now and then, file manager even more often, the FTP more often refuses to connect than not...). Now they are allegedly also getting denial-of-service attacks, which is why nearly all the websites created in the last few months are down. I am quite sure it's not my fault, because the Arithmetic Expression Compiler is an HTML file, not a PHP file, so the web-server should deliver it no matter what I programmed to it. Anyway, the link works for me right now.
By the way, I believe I've managed to tweak the mobile-theme-related JavaScript on my homepage to work in Safari on iPhone, not just in Mobile Chrome. The layout doesn't break any longer in Safari on Mac when I set the user-agent to iPhone. Unfortunately, I don't have an actual iPhone to test it on it.
