· Updated

Building secure low-code web applications

ASP.NET, PHP, Tutorials

Updated August 2026.

Low-code tools can handle much of the repetitive work involved in building secure web applications, but deployment and configuration still matter. Applications created by PHPRunner and ASPRunner.NET include built-in protections against common web application vulnerabilities such as SQL injection, XSS, and CSRF. For an overview of the most common web application security risks, see the OWASP Top 10.

In this article, we focus on additional security measures that are not directly related to generated application code but are still important when deploying a public web application. Use this checklist as a starting point and adapt it to your hosting environment, data sensitivity, and security requirements.

Continue Reading "Building secure low-code web applications" →
· Updated

Populate Dialog API Dropdowns from a Database in PHPRunner

ASP.NET, PHP, Tutorials

Dialog API runs in JavaScript, but the values you want to display in a dropdown often come from a database. The solution is to retrieve those values on the server, pass them to JavaScript with setProxyValue(), and then use them as the lookup options in your dialog.

The process has three steps:

  1. Query the database and build an array of lookup values.
  2. Pass that array to JavaScript using setProxyValue().
  3. Use the resulting proxy value as the Dialog API lookup options.

This approach works in both PHPRunner and ASPRunner.NET. The server-side code is different, but the Dialog API JavaScript is the same.

Continue Reading "Populate Dialog API Dropdowns from a Database in PHPRunner" →

New security providers in version 10.6

ASP.NET, News, PHP, Tutorials

Enterprise Edition of PHPRunner and ASPRunner.NET provides Active Directory authentication option. It is a useful feature but it has some restrictions, for instance, you cannot use a hybrid database/AD approach where some users will use Active Directory login and some others will have their usernames and passwords stored in the database.

This changes in version 10.6 where Active Directory is no longer a replacement for database-based login but a supplement. Active Directory is now considered a “security provider” and works the same way as “Login via Google” or “Login via Facebook”. We are also adding new security providers like OpenID, SAML, AzureAD and Okta.

This is how it works on the backend side. If you have used “Login via Google” or “Login via Facebook”, you should be already familiar with this concept. When user logs in via a third-party security provider we create a record in the users table with a unique id that for Facebook starts with fb, for Google it starts with go, and for Active Directory that prefix will be ad.

Continue Reading "New security providers in version 10.6" →
· Updated

Analyzing incoming emails

ASP.NET, PHP, Tutorials

As web developers, we deal with large amounts of data every day. Sometimes it helps to sit back and take a closer look at the data in hand and see what data is trying to tell.

Here, at Xlinesoft.com customer support is one of the most important parts of the business. We deal with a large number of emails and helpdesk tickets every day and, as a small weekend project, we decided to build a few charts to analyze those emails. We are sharing these results here and hoping that it can provide you or your clients with some insights.

First of all, we analyzed incoming support requests by the hour of the day. There is no surprise that 9am to 1pm US Eastern time is the busiest time of them all as emails from Europe and tickets from both East and West coast are coming in. We grouped those emails by the hour of the day and placed them on the world map with timezones for easy digesting.

Continue Reading "Analyzing incoming emails" →

Password-protecting additional admin actions

ASP.NET, News, PHP, Tutorials

Some businesses may require two people to confirm certain actions like big transactions may require a supervisor’s approval. Another scenario – certain actions require entering the second password. This additional password can be changed daily and distributed among employees in the morning along with the secret handshake. Btw, the whole application doesn’t need to be password-protected, you can add the password to a certain action.

In this article, we will show how to implement this additional password security feature. We will cover two scenarios here:
1. Password-protecting custom button
2. Password-protecting editing the field in inline mode

Continue Reading "Password-protecting additional admin actions" →
· Updated

Automatically Show New Records on a PHPRunner List Page

ASP.NET, News, PHP, Tutorials

In multi-user applications, new records may be added while another user is already looking at the List page. A helpdesk is a typical example: customers submit tickets while support staff keep the ticket list open and need to see new items quickly.

This example periodically checks whether new records were added. When new data is detected, the page can either reload automatically or display a notification. Newly arrived records are also highlighted so they are easy to notice.


PHPRunner notification showing new records on a List page

Continue Reading "Automatically Show New Records on a PHPRunner List Page" →

Context help in your web applications

ASP.NET, PHP

This article explains how you can implement context help in your PHPRunner or ASPRunner.NET application. Maybe you need to display some hints for users or a link to a more detailed page in the manual. If you ever checked PHPRunner or ASPRunner.NET live demo you probably noticed how it looks there: We, of course, do not want to add those messages manually to every page. Instead, we will store all those messages in the database and display the relevant message based on what page we…Continue Reading “Context help in your web applications” →