Our research group has some hand-built pages that suck. They're awful. They actively get in the way of recruiting. It's time to do something about it. We all seem to agree that we want a database-based solution, but we're afraid that if we hire "just anyone" to do it, we'll get back a steaming pile of dung.

Of course, as researchers, our main output is research papers plus the occasional software release. That means a key feature of any site would be an easy way to say "here's the PDF of a paper and enough information to populate a BibTeX entry". Just like that, the link should magically show up on the home page of the appropriate research group(s) and in-line on the personal web pages of the authors, all nicely cross-linked and indexed. We'd probably also want some variant of a Wiki or a Slashdot-esque announcement system to be able to say what's up as well.

So, what's the right way to build this web site? It's unclear what I'm supposed to Google for to find tools like this. I know another research group here on campus hired an undergrad who built them most of what I said, but that student is gone, and it's unclear how that code will age over time. Thoughts?

I would sugest either PHPNuke or Movable Type. They are both great publishing/content management systems and they both allow for a lot of customization. Oh, and they are both free.

I've gotten an in-house recommendation for Zope / Plone. Any experience with this? Thoughts on one versus the other?

I wouldn't touch PHPNuke with a 500,000 foot barge pole. It's the buggiest piece of PHP code I've ever come across. Because of all this poorly written code, there are numerous security holes and issues and this includes the latest releases.

The main issues seem to be poor checking of user supplied input which is then directly put into a SQL query without any escaping of the strings. This includes variables passed by the client and also cookies stored on the client.

If you do decide to use it then be prepared for immensive amounts of patching. I have the misfortune of having to host a couple PHPNuke sites for some people. Every few months I have to do a mass security hole fixed up as they've been hacked. YMMV.

*cough*

The reason why I'm so opposed to PHPNuke is that I'm currently hosting two fairly popular UK PHPNuke based sites and it's a constant thing of patching and repairing security holes. Every week I can guarantee at least 1 person will try to break in.

The main issue I have is that the users I'm hosting the sites for, aren't programmers at all and can't handle anything to do with code. This means it gets left up to me...

I've had very limited experience with Zope (and Plone) - a client of mine uses Zope as a basis for an enterprise web app and loves it, he did find it had a lot to get your head around at first, but said it's one of those things that you just look at and think, 'yes, this is how it should be done'.

I setup a basic Plone site when I was considering using it for a client, it is very powerful and elegant, but (as an intermediate-level PHP coder) I also found the sheer complexity of it intimidating.

I get the impression that Zope is coded by professionals who think about things like scalability and security, whereas solutions like PHPNuke are written by hackers who are interested in cool features and buzzwords rather than whether it's done right.

Just a quick note; Zope & Plone are actually written in Python, not PHP.

Anyway, I would also recommend going with Zope/Plone and staying far, far away from PHPNuke.

If you do want to go with a PHP solution, I would check out drupal.

Just a quick note; Zope & Plone are actually written in Python, not PHP.

Oh, yeah, I didn't mean to imply that Zope was written in PHP, just that I was approaching it as someone with a background in PHP.

Quote:
I wouldn't touch PHPNuke with a 500,000 foot barge pole. It's the buggiest piece of PHP code I've ever come across. Because of all this poorly written code, there are numerous security holes and issues and this includes the latest releases.

Thanks for maybe saving me some hours of research. I looked at PHP-Nuke, but the main thing that made me nervous was the "one guy" aspect -- seemed like it all revolved around one developer. We know where that goes...."Ummmm, yeah I was going to fix that but...."

I can't cope with forking my limited neurons to Python, so I'm going to look at that PHP Drupal.

Yeah. The one man thing isn't good. He has said that he will do a big rewrite of PHP Nuke to make it secure etc.. This was ages and ages ago and nothing has happened since. Thats not the main problem however, to make it "secure" he's going to encode it with the Zend Optimiser which means you won't have any source code access at all...

The relevant post is here

While reading Kevin Rose's page I noticed a few more blog/CMS type systems mentioned, both written in PHP.

Don't know if they'll fit your needs, but...

WordPress
&
pMachine

Edit: Oh, and if you read the comments, there are links to others as well.
Edit (again): Wow. Mambo is a nice one (check out the demo site).

So, it turns out that Rice has an internal project to do more or less what I wanted. It's built in Microsoft ASP, which is unfortunately, but it does seem to work pretty well. I'm trying to twist some arms into getting this rolled out more widely. If you want, I can try to hook you up with our own developers and maybe you can compare notes. Here's the front of the web site: http://cmc.rice.edu/Default.aspx

Quote:
Sure. Set up a cron-job that uses recursive wget and snapshots your entire website every night. Push it as plain HTML to /archive/yyyymmdd/

I would be concerned about bloat, but I may do something like this. I could probably make it conditional for different branches -- only archive it is a page changed, then use whatever perl script to update a "previous versions" index page.

Now I have *another* question (I never run out!). Is there a tool out there that will analyze PHP code for vulnerabilities like SQL injection? Does the analyzer in Zend do this? My concern is that I am pulling in various PHP applets in from various projects/authors and have inherited some others and haven't the skill to check these in a timely fashion myself. I've Googled a bit, but maybe I am not using the right terms.

Also, I have to say that after installing about 8-9 CMS in the past week, the one that looks most promising to my casual view is PostNuke I don't know that their fork from PHP-Nuke has fixed all of the aforementioned security problems, but I can hope!