Developing the web contents so as to meet the guidelines specified in the WCAG2.0 makes the content accessible to more audience.

…more about WCAG.

Demo:

• http://demo.dmwtechnologies.com/PHP/PhpKeywordAnalyser/

Download:

• http://www.phpclasses.org/browse/package/5209.html
  
• http://phpclasses.dmwtechnologies.com/browse/package/5209.html (mirror)

If you want a new function added or face any difficulty, feel free to contact me.

• Initialize:
  • Just include it at the very top of all the JavaScript file as:

    <script src="rochak.js" type="text/javascript">

• Usage:
  • For example to trim a string:

    rochak.Function_Name(Parameter);    eg:
    var str=rochak.trim(str);

• Complete JavaScript Function List:
  1. lTrim(string):
     • Function to trim all the white spacing from the left side of any string.
  2. rTrim(string):
     • Function to trim all the white spacing from the right side of any string.
  3. trim(string):
     • Function to trim all the white spacing from left and right side of the string.
  4. isValidEmail(string):
     • Function to validate a typical email pattern.
  5. getType(variable_name):
     • Function to find the type of the variable. A Clone of PHP\’s “var_dump()” function.
  6. inArray(array, string):
     • Function to find if the string is in the array. Clone of PHP\’s “in_array()” function.
  7. inArrayI(array, string):
     • Function to find if the string is in the array. Clone of PHP\’s “in_array()” function. (its case insensitive)
  8. getMouseX(event):
     • Function to find the current X position of the mouse/cursor.
  9. getMouseY(event):
     • Function to find the current Y position of the mouse/cursor.
  10. getMouseXY(event):
      • Function to find the current X and Y positions of the mouse/cursor as an array.
  11. getBrowserName():
      • Function to return the name of the web browser.
  12. isBrowserIe():
      • Function to return “true” if the browser is “Microsoft Internet Explorer” else return “false“.
  13. isBrowserOpera():
      • Function to return “true” if the browser is “Opera” else return “false“.
  14. isBrowserNetscape():
      • Function to return “true” if the browser is “Firefox” or “Netscape” else return “false“.
  15. getTotalImages():
      • Function to return the number of images used in the current page.
  16. explode(delimiter, string):
      • Function to Split a string by a specified delimiter. A Clone of PHP\’s “explode” function.
  17. end(string / array):
      • Function to return the last character of a string or the last element of the array. A Clone of PHP\’s “end” function.

Change log (1.1)

1. isBrowserFirefox():
   • Function to return “true” if the browser is “Firefox” else return “false“.
2. isBrowserSafari():
   • Function to return “true” if the browser is “Safari” else return “false“.
3. isBrowserChrome():
   • Function to return “true” if the browser is “Chrome” else return “false“.
4. $$(idName):
   • Function to similar to “document.getElementById(‘idName’)”.

To download the latest code, right click here and click on “Save link as” or “Save target as”.

• rochak-1.0.js
• rochak-1.1.js

Or visit:   http://www.phpclasse.org

In my opinion, developing a Web based application in JSP (Java) is more or less like killing a housefly with a bazooka. Of course you will hit your target, no one is denying that, but you will also have collateral damage along with it. This damage ranges from Cost of hardware, hosting, servers and development. Not to mention the time taken to develop, edit or modify the application.

But, that’s just me, I’ll let you to decide and let me know after going through these factors.

Sample Codes for comparison

_{1. Hello World}

_{2. Print Date as DD/MM/YYYY}

_{3. Read / Write session variable}

_4.

_{a. File Uploading – Form}

_4.

_{b. File Uploading – Backend Code}

_{5. Connect to the Database (MySql)}

In my opinion followings are the most common errors/mistakes made during JavaScript implementation.

1. Calling JavaScript Code without any event:This is the first error any JavaScript developer is bound to make. Allow me to illustrate it with a real life example. Suppose, we need to alert the content inside a div with id “content”. The novice developer would write:

   <html>
   <head>
   <title>Invalid JavaScript Code</title>
       <script type="text/javascript" language="javascript">
           var content=document.getElementById('content').innerHTML;
           alert(content);
       </script>
   </head>
   <body>
   <div id="content">This is the sample content</div>
   </body>
   </html>

   Needless to say, the above code will throw an error. The technical explanation of the error is as follows. As JavaScript is an interpreted scripting language, it would try to read the content on the line 6. However, at that moment, the HTML had not been rendered and hence JavaScript will find no div. Its solution is very simple and elementary. All you have to do is to call this code on some event, like onload , onclick etc. Following is the correct way to do it:

   <html>
   <head>
   <title>Valid JavaScript Code</title>
       <script type="text/javascript" language="javascript">
           function init(){
               var content=document.getElementById('content').innerHTML;
               alert(content);
           }
       </script>
   </head>
   <body onload="init()">
   <div id="content">This is the sample content</div>
   </body>
   </html>

2. Reading string as array:Well, once I committed this mistake and spent over 2 days to find this issue from 102 lines of JavaScript. Suppose you need to read and display the 3rd character of a string. any C or PHP developer is bound to write the code like this:

   <html>
   <head>
   <title>Invalid JavaScript Code</title>
       <script type="text/javascript" language="javascript">
           function readString(){
               var str="JavaScript";
               alert(str[2]);
           }
       </script>
   </head>
   <body>
   <input type="button" onclick="readString();" />
   </body>
   </html>

   Quite interestingly, the above code if alert “v” in Firefox or Mozilla. On few Internet Explorers it will throw an error. The reason is that reading string as an array (str[2]) is not an cross browser compatible. The correct way code is as follows:

   <html>
   <head>
   <title>Valid JavaScript Code</title>
       <script type="text/javascript" language="javascript">
           function readString(){
               var str="JavaScript";
               alert(str.charAt(2));
           }
       </script>
   </head>
   <body>
   <input type="button" onclick="readString();" />
   </body>
   </html>

3. Validating for an blank field in JavaScript:This is one of the most common bug your quality analyst or client would let you know. When you are validating a blank field (say username). Most of the JavaScript developers would write the following code to validate it:

   <html>
   <head>
   <title>Valid JavaScript Code</title>
       <script type="text/javascript" language="javascript">
           function validate(){
               var value=document.getElementById('uname').value;
               if(value.length<1) {
                    alert("ERROR: Username cannot be left blank");
                    return false;
                }
           }
       </script>
   </head>
   <body onload="init()">
   Username: <input type="text" id="uname">
   <input type="button" onclick="validate()" />
   </body>
   </html>

Although the above code may seems to work, but it fails as soon as you enter any invisible character like space, newline/enter or a tab. The check is that the length of the string entered should not be less than 1 (in this case). What the developer has failed to negotiate that three invisible characters like spaces would count 3 but would be invalid. The solution is simple. Trim (similar to one in PHP) the value before applying this check. Unfortunately, there is no inbuilt function to trim a string. However you can use it from my free library rochak.js as used in the following example.

<html>
<head>
<title>Valid JavaScript Code</title>
    <script type="text/javascript" language="javascript" src="http://rochakchauhan.com/rochak.js"></script>
    <script type="text/javascript" language="javascript">
        function validate(){
            var value=document.getElementById('uname').value;
            value=rochak.trim(value);
            if(value.length<1) {
                 alert("ERROR: Username cannot be left blank");
                 return false;
             }
        }
    </script>
</head>
<body onload="init()">
Username: <input type="text" id="uname">
<input type="button" onclick="validate()" />
</body>
</html>

Zend To Collaborate With Adobe To Accelerate Rich Web Application Development Using PHP and Open Source Flex Framework

New Collaboration Combines the Flexibility, Reliability and Productivity of PHP Technology with the Powerful User Experience of Adobe Flex and Flash Technology

Zend/PHP Conference and Expo, SANTA CLARA, Calif. — September 16, 2008 — Zend Technologies today announced a collaboration with Adobe Systems Incorporated to bring together the flexibility, productivity and enterprise reliability of Zend’s PHP technologies with the user experience benefits of Adobe Flex. The two companies will deliver technologies, content and services to make it easy for enterprise developers to build rich Internet applications (RIAs) using Flex on the client and PHP on the server. These RIAs are easier to use, speed real-time decision-making and increase employee productivity.

A key deliverable of this collaboration is the integration of Action Message Format (AMF) support into Zend Framework. AMF is an open, binary, high-speed format enabling Adobe® Flash® Player and Flex-based client applications to easily and rapidly exchange rich media and other data with servers. Flex is a highly productive, free open source framework for building and maintaining expressive web applications that deploy consistently across all major browsers and operating systems using Adobe® Flash® Player and to the desktop via Adobe® AIR™. Zend Framework is an open source PHP application framework best known for its support for flexible, efficient creation of web applications. AMF support in Zend Framework delivers optimized communication between server-side Zend Framework components and client-side Adobe Flex components. Now PHP developers will be able to leverage the fast, reliable transfer of data between the server and client tiers of their web applications. More information about AMF support is available at http://framework.zend.com and http://developer.adobe.com/flex/

In addition, Zend and Adobe plan to optimize the experience for developers using their respective development environments. Zend Studio and Adobe® Flex® Builder™, both built on the open source Eclipse platform, provide robust coding, debugging, and testing tools for professional developers. Today, the two environments enable greater productivity, simplified deployment and end-to-end debugging of applications. Moving forward, Zend and Adobe plan to identify and implement cross-product integration points that optimize developer workflow and reduce development time.

“Since bringing Flex to market, we’ve seen strong uptake among PHP developers, and we’re pleased to be collaborating with Zend and the PHP community to deliver deeper integration and increased productivity,” said David Wadhwani, General Manager, Platform Business Unit at Adobe. “The collaboration with Zend furthers Adobe’s commitment to open technology initiatives. Together, we will enable developers using Flex and Zend Framework to rapidly deliver highly engaging applications to both the browser and the desktop.”

“Zend’s mission is to enable companies investing in PHP technology to deliver world-class experiences using internet-standard technologies,” said Andi Gutmans, chief technical officer and co-founder of Zend. “By working more closely with Adobe, we believe our customers will be more equipped to deliver the performance, reliability, and engaging user experience that will differentiate their products and services.”

Customers Improve Enterprise Applications With Open Source Flex, Zend Framework, and PHP

Automotive Computer Services, Inc. (ACS) provides solutions that manage data needs for automotive dealerships throughout the United States:

“By moving our dealer management system from a desktop application to a web based service, we are able to drastically cut the costs of real-time data integration, while expanding our feature set and ability to integrate third party providers,” said John Coggeshall, chief technical officer at ACS. “With this radical change to a more centralized web application for our customers, desktop-like user experience and responsiveness is a key factor for success. The AMF and Flex integration into Zend Framework enables us to more cost-effectively meet these requirements by dramatically reducing latency of service requests, giving our customers the highly responsive application they demand and the rich user experience we expect.”

Stream Energy delivers multiple energy commodities like electricity and natural gas to over 300,000 customers throughout Texas and Georgia and they are rapidly expanding into other states:

“Our need to engage and provide relevant real-time information to our customers continually accelerates in the fast-moving deregulated consumer energy markets. Our web-based customer portal provides customer account information on our services and drives revenue collections that now number over $1.2 Billion dollars over the four year life of these systems,” said Jason Forgey, Senior Director of Information Technology at Dallas-based Stream Energy. “We built our new system with PHP middleware and an API gateway using web services with an Adobe Flex/Flash front-end and an Oracle database back-end, all using Zend Solutions. The time-to-market and performance of PHP is one reason we have chosen to build with a Zend Solution that includes Zend Platform application server to manage our applications and queue up asynchronous jobs when under load, Zend Core managed PHP environment, Zend Studio in conjunction with Adobe Flex Builder for our development environment, and a Zend Framework and Adobe Flex based application portal.”

Adobe and Zend will undertake multiple initiatives to deliver product interoperability and integration, and define best practices for customers. The two companies have created dedicated areas within their respective developer portals where they will deliver a series of articles, white papers, and online seminars educating developers on best practices for delivering enterprise-ready solutions using PHP, Zend Framework, and Zend Platform, together with Adobe Flex, Adobe Flash Player, and Adobe AIR. Future product integration plans and technical documentation will be made available there. For more information, please visit Zend Developer Zone at http://devzone.zend.com/tag/Flex and Adobe Developer Connection at http://www.adobe.com/devnet/flex/

In technical terms “Tag cloud” can be defined as visual depiction of user-generated tags (words), used typically to describe the content of that page or the website. Not so long ago, we used “meta” tags to describe and define the html page and its contents. In the current time, tag clouds have replaced “meta” tags more than one reason.

Why use Tag Clouds?

The number one reason is SEO (Search engine optimization). Modern day search engines like Google do not bank only on the “Meta” tags to index a web page. They index pages based on its content as well as the links on that page. Apart from SEO, it helps providing a better user experience and each tag (word) is a link to that actual content.

How to generate Tag Clouds?

The idea is to automate the process of Tag Cloud generation as soon as user writes a post or content on a page. It can be divided into two steps:

1. Generate Tag Clouds from the content.

Ideally, we would like PHP code to extract relevant tags (keywords) from the content. We do not want common words like “is”, “this”, “the” to be keywords. We can set up our own set of rules depending on the requirement.

Sample PHP code:

function generateTagCloud($content){
    $minTagLength=5;
    $maxTagLength=14;
    $baseFont=16;
    $returnArray=array(); 

    $content=str_replace("\r\n"," ",$content);
    $content=strip_tags($content);
    $tagArray=explode(" ",$content);
    for($i=0;$i=$minTagLength && $len< =$maxTagLength) {
            $returnArray[]=$tag;
        }
    }
    $returnArray=array_count_values($returnArray);
    arsort($returnArray);
    ksort($returnArray);
    return $returnArray;
}

1. Display Tags according to their occurrence.

After we have all the tags (keywords) we need to display then according their occurrence or presence in the content. In other words, the tag which is present more times in the content will be displayed in bigger fonts as the rest.

Sample PHP code to achieve this is as follows:

function displayTagCloud($tagCloudArray){
    $buffer="";
    foreach($tagCloudArray as $tags=>$key) {
        $font=($baseFont+($key*10));
        $font=$font."px";
        $buffer.="  $tags  ";
}$buffer.="";
        return $buffer;
 }

Screenshot of final output:

Whatever the motivation to offer multiple operating systems, it looks like Sun is focusing on working with rather than excluding other platforms, just like Canonical’s Mark Shuttleworth encouraged Linux developers to do when working on Linux desktop.

Most importantly, turn off register_globals. This configuration setting defaults to off in PHP 4.2.0 and later. Access values from URLs, forms, and cookies through the superglobal arrays $_GET, $_POST, and $_COOKIE.

Before you use values from the superglobal arrays, validate them to make sure they don’t contain unexpected input. If you know what type of value you are expecting, make sure what you’ve got conforms to an expected format. For example, if you’re expecting a US ZIP Code, make sure your value is either five digits or five digits, a hyphen, and four more digits (ZIP+4). Often, regular expressions are the easiest way to validate data:

if (preg_match('/^\d{5}(-\d{4})?$/',$_GET['zip'])) {
    $zip = $_GET['zip'];
} else {
    die('Invalid ZIP Code format.');
}

If you’re expecting to receive data in a cookie or a hidden form field that you’ve previously sent to a client, make sure it hasn’t been tampered with by sending a hash of the data and a secret word along with the data. Put the hash in a hidden form field (or in the cookie) along with the data. When you receive the data and the hash, re-hash the data and make sure the new hash matches the old one:

// sending the cookie
$secret_word = 'gargamel';
$id = 123745323;
$hash = md5($secret_word.$id);
setcookie('id',$id.'-'.$hash);

// receiving and verifying the cookie
list($cookie_id,$cookie_hash) = explode('-',$_COOKIE['id']);
if (md5($secret_word.$cookie_id) == $cookie_hash) {
    $id = $cookie_id;
} else {
    die('Invalid cookie.');
}

If a user has changed the ID value in the cookie, the hashes won’t match. The success of this method obviously depends on keeping $secret_word secret, so put it in a file that can’t be read by just anybody and change it periodically. (But remember, when you change it, old hashes that might be lying around in cookies will no longer be valid.)

See Also:

• PHP Manual: Using Register Globals
• PHP Cookbook: Recipe 9.7 (“Securing PHP’s Form Processing”), Recipe 14.3 (“Verifying Data with Hashes”)

2. Broken Access Control

Instead of rolling your own access control solution, use PEAR modules. Auth does cookie-based authentication for you and Auth_HTTP does browser-based authentication.

See Also:

• PEAR Packages: Auth, Auth_HTTP.

3. Broken Account and Session Management

Use PHP’s built-in session management functions for secure, standardized session management. However, be careful how your server is configured to store session information. For example, if session contents are stored as world-readable files in /tmp, then any user that logs into the server can see the contents of all the sessions. Store the sessions in a database or in a part of the file system that only trusted users can access.

To prevent network sniffers from scooping up session IDs, session-specific traffic should be sent over SSL. You don’t need to do anything special to PHP when you’re using an SSL connection, but you do need to specially configure your webserver.

See Also:

• PHP Manual: Session handling functions
• PHP Cookbook: Recipe 8.5 (“Using Session Tracking”), Recipe 8.6 (“Storing Sessions in a Database”)

4. Cross-Site Scripting (XSS) Flaws

Never display any information coming from outside your program without filtering it first. Filter variables before including them in hidden form fields, in query strings, or just plain page output.

PHP gives you plenty of tools to filter untrusted data:

• htmlspecialchars() turns & > " < into their HTML-entity equivalents and can also convert single quotes by passing ENT_QUOTES as a second argument.
• strtr() filters any characters you’d like. Pass strtr() an array of characters and their replacements. To change ( and ) into their entity equivalents, which is recommended to prevent XSS attacks, do:
  $safer = strtr($untrusted, array('(' => '(', ')' => ')'));
• strip_tags() removes HTML and PHP tags from a string.
• utf8_decode() converts the ISO-8859-1 characters in a string encoded with the Unicode UTF-8 encoding to single-byte ASCII characters. Sometimes cross-site scripting attackers attempt to hide their attacks in Unicode encoding. You can use utf8_decode() to peel off that encoding.

See Also:

• PHP Manual: htmlspecialchars(), strtr(), strip_tags(), utf8_decode()
• PHP Cookbook: Recipe 8.8 (“Building a GET Query String”), Recipe 9.8 (“Escaping Control Characters from User Data”)

5. Buffer Overflows

You can’t allocate memory at runtime in PHP and their are no pointers like in C so your PHP code, however sloppy it may be, won’t have any buffer overflows. What you do have to watch out for, however, are buffer overflows in PHP itself (and its extensions.) Subscribe to the php-announce mailing list to keep abreast of patches and new releases.

See Also:

• PHP Mailing Lists: http://www.php.net/mailing-lists.php

6. Command Injection Flaws

Cross-site scripting flaws happen when you display unfiltered, unescaped malicious content to a user’s browser. Command injection flaws happen when you pass unfiltered, unescaped malicious commands to an external process or database. To prevent command injection flaws, in addition to validating input, always escape user input before passing it to an external process or database.

If you’re passing user input to a shell (via a command like exec(), system(), or the backtick operator), first, ask yourself if you really need to. Most file operations can be performed with native PHP functions. If you absolutely, positively need to run an external program whose name or arguments come from untrusted input, escape program names with escapeshellcmd() and arguments with escapeshellarg().

Before executing an external program or opening an external file, you should also canonicalize its pathname with realpath(). This expands all symbolic links, translates . (current directory) .. (parent directory), and removes duplicate directory separators. Once a pathname is canonicalized you can test it to make sure it meets certain criteria, like being beneath the web server document root or in a user’s home directory.

If you’re passing user input to a SQL query, escape the input with addslashes() before putting it into the query. If you’re using MySQL, escape strings with mysql_real_escape_string() (or mysql_escape_string() for PHP versions before 4.3.0). If you’re using the PEAR DB database abstraction layer, you can use the DB::quote() method or use a query placeholder like ?, which automatically escapes the value that replaces the placeholder.

See Also:

• PHP Manual: escapeshellcmd(), escapeshellarg(), realpath(), addslashes(), mysql_real_escape_string(), mysql_escape_string()
• PEAR Package: DB, DB Documentation
• PHP Cookbook: Recipe 18.20 (“Escaping Shell Metacharacters”), Recipe 10.9 (“Escaping Quotes”)

7. Error Handling Problems

If users (and attackers) can see the raw error messages returned from PHP, your database, or external programs, they can make educated guesses about how your system is organized and what software you use. These educated guesses make it easier for attackers to break into your system. Error messages shouldn’t contain any descriptive system information. Tell PHP to put error messages in your server’s error log instead of displaying them to a user with these configuration directives:

log_errors = On
display_errors = Off

See Also:

• PHP Manual: Error Handling and Logging Functions
• PHP Cookbook: Recipe 8.14 (“Hiding Error Messages from Users”)

8. Insecure Use of Cryptography

The mcrypt extension provides a standardized interface to many popular cryptographic algorithms. Use mcrypt instead of rolling your own encryption scheme. Also, be careful about where (if anywhere) you store encryption keys. The strongest algorithm in the world is pointless if an attacker can easily obtain a key for decryption. If you need to store keys at all, store them apart from encrypted data. Better yet, don’t store the keys and prompt users to enter them when something needs to be decrypted. (Of course, if you’re prompting a user over the web for sensitive information like an encryption key, that prompt and the user’s reply should be passed over SSL.)

See Also:

• PHP Manual: Mcrypt Encryption Functions
• PHP Cookbook: Recipe 14.7 (“Encrypting and Decrypting Data”)

9. Remote Administration Flaws

When possible, run remote administration tools over an SSL connection to prevent sniffing of passwords and content. If you’ve installed third-party software that has a remote administration component, change the default administrative user names and passwords. Change the default administrative URL as well, if possible. Running administrative tools on a different web server than the public web server that the administrative tool administrates can be a good idea as well.

10. Web and Application Server Misconfiguration

Keep on top of PHP patches and security problems by subscribing to the php-announce mailing list. Stay away from the automatic PHP source display handler (AddType application/x-httpd-php-source .phps), since it lets attackers look at your code. Of the two sample php.ini files distributed with PHP ( php.ini-dist and php.ini-recommended), use php.ini-recommended as a base for your site configuration.

Read the Original Post at: http://www.sklar.com/page/article/owasp-top-ten

JavaFX first and foremost will be a scripting language like Adobe’s ActionScript, which allows programming to be run in the Flash Player. Likewise, JavaFX will serve the same function as JavaScript, used to power the interactive user applications in the browser window built with Ajax.

JavaFX also will have a timeline sequence engine, something like the one pioneered by Adobe’s Flash, that will allow animations and coordination of a multimedia sound and video roll out.

But even more important, perhaps, JavaFX is a bid by Sun to coordinate powerful back-end programming on a multiprocessor server with an engaging and rich presentation for the end user. All three — Sun, Adobe, and Microsoft — still have issues in pulling together the power of the Internet server and the presentation to the user. Think of the difference between bumping your way through Web pages versus the enveloping action of a computer game. Sun thinks it’s going to win the arms race to coordinate the two.

Sun expects to give developers the option of producing user interfaces for Web applications that run inside the browser window, or outside on the user’s normal computer desktop work space. It can do this because it will have a plug-in for the browser that updates the Java Virtual Machine, resident on many PCs. That JavaFX runtime exists in Java Standard Edition 6, update 10, and will gradually be added to existing Java Virtual Machines through an automated update process, Singh said.

At the same time, JavaFX applications will have the ability to migrate out of the browser window. The icon for a JavaFX application, once it’s been downloaded, can be moved onto the user’s desktop and run there through the usual drag-and-drop method. The application, unlike most that are streamed down to the browser, can be either run while connected to the Internet or stored and saved as a permanent addition, available to run when the user is disconnected. Online application suppliers have been struggling with that issue — what to do when the user is no long plugged into the Net.

But there’s still the issue of simplicity of application building. “Designers for end-user interfaces want to assemble content, not program it. We start from a strength among programmers, but we will produce incremental tools that allow designers to make the front end more enticing. We need to bring both of these communities together,” Singh said.

Exactly how that “bringing together” will proceed will await the first software development kit Sun can produce for FX this fall. Will it also be able to produce “assembly oriented” content tools, the way Adobe has?

In a demonstration Tuesday that needed to be restarted twice, Sun illustrated a mashup JavaFX application. A user’s collection of Facebook and Flickr pictures were loaded into the application, then a sophisticated flocking algorithm applied. If the user entered a person’s name, all the pictures with that person in them began to flock together out of a slowly moving mass on the screen. Pictures with similar colors could be enticed to flock together, etc. It was a combination of programming and presentation that many in the audience hadn’t seen before.

Whether they will see it on their own computers will depend on how fast Sun can deliver the goods and whether they will be able to perform as expected.

“We are focused on strengthening the designer/developer integration,” claimed Singh. The flocking demo illustrated Sun’s programming skills. The scripting code behind it had been compiled and could run fast enough in the Java Virtual Machine to keep everything in motion. Most scripting or “dynamic” languages wouldn’t have been equal to the feat; they must go through an interpreter, and interpreted code is slower than compiled code.

As Sun produces JavaFX for the desktop, it hopes to capitalize on its capabilities by following up with JavaFX for mobile devices in the spring of 2009. Java already has a strong presence in the cell phone and mobile device market.Nokia (NYSE: NOK) representatives say more than half of all their phones — not just their smartphones but all their mobile device inventory — run Java now. If JavaFX gets a toehold on the desktop, Sun may outsprint the competition in offering capabilities for rich Internet applications on mobile devices.

If advertising, for example, could be inserted into an Internet server’s response to a user, based on what that user wanted to do with a running application, such coordination might yield competitive advantage. It already can be done in various clunky Internet applications, but that’s not the point. The point, said Singh, is “how seamlessly all the pieces can be overlaid with each other.”