how to disable SSL2 and weak cipher suites in apache

http://www.sslshopper.com/article-how-to-disable-weak-ciphers-and-ssl-2.0-in-apache.html

First, verify that you have weak ciphers or SSL 2.0 enabled. You can do this using a local OpenSSL command or by just entering your public domain name in at https://www.ssllabs.com/ssldb/index.html

Sex & Zend: Zend framework form input fields validator

zend framework form add validator




http://framework.zend.com/manual/1.12/en/zend.form.elements.html

->addValidator('Regex', false, array('/^[a-z0-9]{6,}$/i'))

If failing a particular validation should prevent later validators from firing, pass booleanTRUE as the second parameter:

1. $element->addValidator('alnum', true);

If you are using a string name to add a validator, and the validator class accepts arguments to the constructor, you may pass these to the third parameter ofaddValidator() as an array:

1. $element->addValidator('StringLength', false, array(6, 20));

Arguments passed in this way should be in the order in which they are defined in the constructor. The above example will instantiate the Zend_Validate_StringLenth class with its $min and $max parameters:

1. $validator = new Zend_Validate_StringLength(6, 20);

XXXXXXXXXXXXXXXXX

Its addValidatorS (multiple validators):

$this->addElement('text', 'firstname', array(
                          'label'      => 'Your first name:',
                          'required'   => true,
              'validators' => array(
                  array('regex', false, array(
                  'pattern'   => '/[^<>]/i',
                  'messages'  =>  'Your first name cannot contain those characters : < >'))
              )
));

Online Interpreter (and Pastebin) for most popular programming languages

online php interpreter

Google search for that search string reveals this handy webapp:
http://codepad.org/

Which I used, and resulted in this result, which I am able to share with the rest of the world:
http://codepad.org/XSQScOV1

Something like GitHub Gist or pastebin, only better.




So, what wrought this state of affairs?

1
Actually, I needed to write a regular expression condition in PHP, and I also wanted to check that all the special characters required to be escaped, ...are escaped.

To do that manually would be an error-prone affair, so:

php regex which need escape
http://stackoverflow.com/questions/1789382/php-escaping-regex-reserved-characters-anyone-know-whats-wrong-with-this
Answer: Why not simply use preg_quote?

http://php.net/manual/en/function.preg-quote.php
preg_quote() takes str and puts a backslash in front of every character that is part of the regular expression syntax. This is useful if you have a run-time string that you need to match in some text and the string may contain special regex characters.

The special regular expression characters are: . \ + * ? [ ^ ] $ ( ) { } = ! < > | : -

Last time I didn't know what did preg_match, preg...etc. meant... somehow sounds like a /contraction/ for 'pregnant'.
Okay, but it actually refers to 'Perl-style REGular expression'... thus, 'preg'.




2
Learnt from these:
how to write a regular expression for php

http://www.noupe.com/php/php-regular-expressions.html
http://www.catswhocode.com/blog/15-php-regular-expressions-for-web-developers
http://www.macronimous.com/resources/writing_regular_expression_with_php.asp
\s Matches any whitespace character including space, tab, form-feed, etc.
\S Matches any non-whitespace character.

As for the third link, it feels ironic that an info page on how to use PHP is written using M$ ASP.
(Btw, so is w3schools.)




3
Using PHP in codepad initially gave me a syntax error though:
http://stackoverflow.com/questions/9135784/syntax-error-unexpected-t-variable

Parse error: syntax error, unexpected T_VARIABLE in xxxx.php on line 2

There is no semicolon at the end of that instruction causing the error.
As in C or Perl, PHP requires instructions to be terminated with a semicolon at the end of each statement.

Never had to type a semicolon in recent days.


Anyway, the correct code:
<?php
$str = 'abc() !#$%^"\'&*()';
$result = preg_quote ( $str );
echo $result;
?>

The output:
abc\(\) \!#\$%\^"'&\*\(\)

Installing latest Geany (1.22) in debian 6

Installing latest Geany (1.22) in debian 6

you gotta make from sources package, just like installing python 2.7.3 on debian 6.

1. You need these dependencies first
apt-get install libgtk2.0-dev
apt-get install intltool

2. download source distrib

3. unpack
4. ./configure --prefix=/path/to/where-you-wanna-put-geany-program-files

You should get this

config.status: creating doc/geany.1
config.status: creating geany.spec
config.status: creating geany.pc
config.status: creating doc/Doxyfile
config.status: creating config.h
config.status: executing depfiles commands
config.status: executing libtool commands
config.status: executing default-1 commands
config.status: executing po/stamp-it commands
-----------------------------------------------------
Install Geany in                 : /home/your-path-to-install-to/geany
Using GTK version                : 2.20.1
Enable binary relocation         : no
Build with plugin support        : yes
Use (UNIX domain) socket support : yes
Use virtual terminal support     : yes
Configuration is done OK.

5. make install

There you have it.



EDIT: To install Geany plugins for debian 6, you need to build them,

set this env variable first:
export PKG_CONFIG_PATH=/home/<your-username>/geany/lib/pkgconfig
then only run ./configure

If successful you should get these results

    Pretty Printer:               yes
    ShiftColumn:                  yes
    Spellcheck:                   no
    TreeBrowser:                  yes
    Tableconvert:                 yes
    Updatechecker:                no
    WebHelper:                    no
    XMLSnippets:                  yes
  Features:
    GeanyVC GtkSpell support:     no
    TreeBrowser GIO support:      yes

Then
sudo make install

Linux Environment Variables by using export or not

Using export and not using export - environment variables

http://lowfatlinux.com/linux-environment-variables.html

code=$HOME/projects/src/spew

and then, regardless of what directory you are in, you can issue

cd $code

to pop over quickly to the directory containing the source code for that way-cool spew program you're developing. (The cd command means "change directory.")

A variable assignment like this will work just fine, but its scope (visibility) is limited to the current shell. If you launch a program or enter another shell, that child task will not know about your environment variables unless you export them first.

Unless you know for sure that an environment variable will have meaning only in the current shell, it's a good idea to always useexport when creating variables to ensure they will be global in scope--for example,

export PS1="\u \$ "
export code=$HOME/projects/src/spew

And be sure to add these commands to your .profile file so you won't have to retype them eac h time you log in.

http://en.wikibooks.org/wiki/Guide_to_Unix/Environment_Variables
http://en.wikipedia.org/wiki/Environment_variable


http://stackoverflow.com/questions/1158091/bash-defining-a-variable-with-or-without-export

export makes the variable available to sub-processes.

That is,

export name=value

means that the variable name is available to any process you run from that shell process. If you want a process to make use of this variable, use export, and run the process from that shell.

name=value

means the variable scope is restricted to the shell, and is not available to any other process. You would use this for (say) loop variables, temporary variables etc.

Specifically export makes the variable available to child processes via the environment. – Beano Jul 21 '09 at 13:35

How to use Flask micro-framework

1
Where does one draw the distinction between micro- and megaframeworks? Or, for that reference, just a "framework"?

2
The difference between a library and a framework is simply that you call the library whereas the framework calls you. The framework provides a frame into which you put your code as opposed to a library which you use as part of your code.

Generally I would consider any framework which requires (almost) no setup requirements to be a microframework. This is opposed to frameworks which require a basic configuration, directory layout or certain files to be present.

However there are a lot of other people with other definitions regarding this, the distinction is not at all very clear for example there are people that consider being written in a single file to be a distinguishing feature of microframeworks.

3
http://hitesh.in/2012/how-to-migrate-from-bottle-py-to-flask-micro-framework/

from flask import Flask, render_template as template, request, make_response, jsonify, abort from flask.ext.sqlalchemy import SQLAlchemy

from bottle import route, run, template, install, static_file, response import bottle



What is the g object in Flask?

How do I enable remote access to my Postgre database?

The actual file contents you used:





How do I enable remote access to my Postgre database?

http://kb.mediatemple.net/questions/1237/How+do+I+enable+remote+access+to+my+PostgreSQL+server%3F#dv

External PostgreSQL connections

1. To be able to reach the server remotely you have to add the following line into the file:/var/lib/pgsql/data/postgresql.conf:

listen_addresses = '*'

2. PostgreSQL, by default, refuses all connections it receives from any remote address. You have to relax these rules by adding this line to /var/lib/pgsql/data/pg_hba.conf:

host all all  0.0.0.0/0 md5

This is an access control rule that lets anyone login from any address if a valid password is provided (the md5 keyword). You can use your network/mask instead of 0.0.0.0/0 to only allow access from certain IP addresses.

3. When you have applied these modifications to your configuration files, you will need to restart the PostgreSQL server.

/etc/init.d/postgresql start

http://www.cyberciti.biz/tips/postgres-allow-remote-access-tcp-connection.html

Edit the file:
$ vi /var/lib/pgsql/data/pg_hba.conf
OR
$ vi /etc/postgresql/8.2/main/pg_hba.conf
Append the following configuration lines to give access to 10.10.29.0/24 network:
host all all 10.10.29.0/24 trust
Save and close the file. Make sure you replace 10.10.29.0/24 with actual network IP address range of the clients system in your own network.




installing postgresql on debian 6

http://library.linode.com/databases/postgresql/debian-6-squeeze

postgres allow remote connection
http://www.ndchost.com/wiki/postgres/remote-access
http://blog.akendo.eu/enable-remote-access-postgresql/

sqlalchemy postgres connection string
http://docs.sqlalchemy.org/en/rel_0_7/core/engines.html

from sqlalchemy import create_engine
engine = create_engine('postgresql://scott:tiger@localhost:5432/mydatabase')

The above engine creates a Dialect object tailored towards PostgreSQL, as well as a Pool object which will establish a DBAPI connection at localhost:5432 when a connection request is first received. Note that the Engine and its underlying Pool do not establish the first actual DBAPI connection until theEngine.connect() method is called, or an operation which is dependent on this method such asEngine.execute() is invoked. In this way, Engine and Pool can be said to have a lazy initializationbehavior.

http://docs.sqlalchemy.org/en/rel_0_7/dialects/mysql.html

Unicode

MySQLdb will accommodate Python unicode objects if the use_unicode=1 parameter, or the charsetparameter, is passed as a connection argument.
Without this setting, many MySQL server installations default to a latin1 encoding for client connections, which has the effect of all data being converted into latin1, even if you have utf8 or another character set configured on your tables and columns. With versions 4.1 and higher, you can change the connection character set either through server configuration or by including the charsetparameter. The charset parameter as received by MySQL-Python also has the side-effect of enablinguse_unicode=1:

# set client encoding to utf8; all strings come back as unicode
create_engine('mysql+mysqldb:///mydb?charset=utf8')

Manually configuring use_unicode=0 will cause MySQL-python to return encoded strings:

# set client encoding to utf8; all strings come back as utf8 str
create_engine('mysql+mysqldb:///mydb?charset=utf8&use_unicode=0')

Known Issues

MySQL-python version 1.2.2 has a serious memory leak related to unicode conversion, a feature which is disabled via use_unicode=0. It is strongly advised to use the latest version of MySQL-Python.

http://www.postgresql.org/docs/8.1/static/sql-grant.html

The possible privileges are:

SELECT

Allows SELECT from any column of the specified table, view, or sequence. Also allows the use of COPY TO. This privilege is also needed to reference existing column values in UPDATE or DELETE. For sequences, this privilege also allows the use of the currval function.

INSERT

Allows INSERT of a new row into the specified table. Also allows COPY FROM.

UPDATE

Allows UPDATE of any column of the specified table. (In practice, any nontrivial UPDATE command will require SELECT privilege as well, since it must reference table columns to determine which rows to update, and/or to compute new values for columns.) SELECT ... FOR UPDATE and SELECT ... FOR SHARE also require this privilege, in addition to the SELECT privilege. For sequences, this privilege allows the use of the nextval andsetval functions.

DELETE

Allows DELETE of a row from the specified table. (In practice, any nontrivial DELETE command will require SELECT privilege as well, since it must reference table columns to determine which rows to delete.)

RULE

Allows the creation of a rule on the table/view. (See the CREATE RULE statement.)

REFERENCES

To create a foreign key constraint, it is necessary to have this privilege on both the referencing and referenced tables.

what is the subnet for 192.168

http://www.pantz.org/software/tcpip/subnetchart.html

Ths is an Internet Protocol (IPv4) Subnet Chart. You can use this to quickly look up how your might need to subnet your network. At the bottom there is a quick how-to on calculating subnets.

For more information on subnetting, see RFC 1817 and RFC 1812.

Class address ranges:

• Class A = 1.0.0.0 to 126.0.0.0
• Class B = 128.0.0.0 to 191.255.0.0
• Class C = 192.0.1.0 to 223.255.255.0

Reserved address ranges for private (non-routed) use (see RFC 1918):

• 10.0.0.0 -> 10.255.255.255
• 172.16.0.0 -> 172.31.255.255
• 192.168.0.0 -> 192.168.255.255

Other reserved addresses:

• 127.0.0.0 is reserved for loopback and IPC on the local host
• 224.0.0.0 -> 239.255.255.255 is reserved for multicast addresses

Chart notes:

• Number of Subnets - "( )" Refers to the number of effective subnets, since the use of subnet numbers of all 0s or all 1s is highly frowned upon and RFC non-compliant.
• Number of Hosts - Refers to the number of effective hosts, excluding the network and broadcast address.

Class A

Network Bits	Subnet Mask	Number of Subnets	Number of Hosts
/8	255.0.0.0	0	16777214
/9	255.128.0.0	2 (0)	8388606
/10	255.192.0.0	4 (2)	4194302
/11	255.224.0.0	8 (6)	2097150
/12	255.240.0.0	16 (14)	1048574
/13	255.248.0.0	32 (30)	524286
/14	255.252.0.0	64 (62)	262142
/15	255.254.0.0	128 (126)	131070
/16	255.255.0.0	256 (254)	65534
/17	255.255.128.0	512 (510)	32766
/18	255.255.192.0	1024 (1022)	16382
/19	255.255.224.0	2048 (2046)	8190
/20	255.255.240.0	4096 (4094)	4094
/21	255.255.248.0	8192 (8190)	2046
/22	255.255.252.0	16384 (16382)	1022
/23	255.255.254.0	32768 (32766)	510
/24	255.255.255.0	65536 (65534)	254

Class B

Network Bits	Subnet Mask	Number of Subnets	Number of Hosts
/16	255.255.0.0	0	65534

Class C

Network Bits	Subnet Mask	Number of Subnets	Number of Hosts
/24	255.255.255.0	0	254

postgresql conf on postgres 8.4

Postgre config file locations
http://www.postgresql.org/docs/8.4/static/runtime-config-file-locations.html

18.2. File Locations

In addition to the postgresql.conf file already mentioned, PostgreSQL uses two other manually-edited configuration files, which control client authentication (their use is discussed in Chapter 19). By default, all three configuration files are stored in the database cluster's data directory. The parameters described in this section allow the configuration files to be placed elsewhere. (Doing so can ease administration. In particular it is often easier to ensure that the configuration files are properly backed-up when they are kept separate.)

data_directory (string)

Specifies the directory to use for data storage. This parameter can only be set at server start.

config_file (string)

Specifies the main server configuration file (customarily called postgresql.conf). This parameter can only be set on the postgres command line.

hba_file (string)

Specifies the configuration file for host-based authentication (customarily called pg_hba.conf). This parameter can only be set at server start.

ident_file (string)

Specifies the configuration file for Section 19.2 username mapping (customarily called pg_ident.conf). This parameter can only be set at server start.

external_pid_file (string)

Specifies the name of an additional process-id (PID) file that the server should create for use by server administration programs. This parameter can only be set at server start.

In a default installation, none of the above parameters are set explicitly. Instead, the data directory is specified by the -D command-line option or the PGDATA environment variable, and the configuration files are all found within the data directory.

http://www.postgresql.org/docs/8.4/static/runtime-config-connection.html

debian6 install php

debian6 install php

http://library.linode.com/web-servers/apache/installation/debian-6-squeeze
http://library.linode.com/lamp-guides/debian-6-squeeze



apache virtual host file location linux
http://www.debuntu.org/2006/02/22/7-virtual-hosting-using-apache-2

Now, we specified a new host to apache but it is not yet linked to the repertory where apache actually look for virtual hosts. Let go to:

$cd /etc/apache2/sites-enabled/

and create a link to the file we just created:

$sudo ln -s /etc/apache2/sites-available/example.com.conf example.com.conf

Now apache is almost ready to restart, but before doing so, we must inform our linux system that dev.example.com and www.dev.example.com are not to be looked for on the net, but on the local machine instead.
To do so, simply edit /etc/hosts and add the new host names at the end of the line beginning by 127.0.0.1, which is localhost.
In the end, your file should look like:

127.0.0.1 localhost.localdomain localhost dev.example.com www.dev.example.com

And now we are done, simply reload apache:

sudo /etc/init.d/apache2 reload

Open your web browser and enter the following address dev.example.com. Magic, it runs the same as when you were using http://localhost/~myuser/example.com but it is far more usefull when devellopping a web service and want to be able to develop applications on your machine just like it is where the real web site.

Edit: As you can see from the comments, many people pointed out that you can use a debian specific command (so if you are not using a debian based system, don't expect to find that command :) ).
to enable a new virtual host simply type:

sudo a2ensite mysiteavailable-site

to disable a virtual host:

sudo a2dissite mysiteavailable-site

where mysiteavailable-site is the name of the virtual hos you want to enable/disable, so in out example: example.com.conf

Hope this helped.

http://help.hardhathosting.com/question.php/95

How do I create a symbolic link?

ln -s [TARGET DIRECTORY OR FILE] ./[SHORTCUT] For example: ln -s /usr/local/apache/logs ./logs This points a symbolic link "./logs" to "/usr/local/apache/logs"

On my server I use the  'DirectoryIndex' directive and make sure index.php is listed there.  Then whenever you hit that directory it will search for 'index' files in the order they are listed in the DirectoryIndex directive.  I change the order around depending on if a site will be mostly serving up .html files or .php or something else...

Here is an example snipped out of my Vhosts.conf file...

ServerPath /var/www/html/domainname/joomla
DocumentRoot /var/www/html/domainname/joomla

DirectoryIndex index.php index.html index.cgi index.shtml index.htm index.pl

problem: apache downloads php file instead of executing AND how to change hosts file on Debian6

problem: apache downloads php file instead of executing



apache download php file instead executing
http://ubuntuforums.org/showthread.php?t=1361019
and then clear the local browser cache

Re: apache/php, serving php files for download instead of executing them

---

first, install libapache2-mod-php5

Code:

sudo apt-get install libapache2-mod-php5

Then enable it

Code:

sudo a2enmod php5

Restart paache

Code:

sudo service apache2 restart

Clear your cache on your browser, and re-load the page.

Changing Hosts file on Debian6
how to change hosts in debian6

http://www.cyberciti.biz/faq/debian-change-hostname-permanently/

Save and close the file. You may also need to edit the /etc/hosts file, enter:
# vi /etc/hosts
Find all references to server1 and replace with server2:

127.0.0.1 localhost
127.0.1.1 server2
# The following lines are desirable for IPv6 capable hosts
::1     ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters

Save and close the file. Please note that the host name is usually set once at system startup in /etc/init.d/hostname.sh (normally by reading the contents of a file which contains the host name, e.g. /etc/hostname). Just type the following command to apply new changes without rebooting the server:
# /etc/init.d/hostname.sh start

http://www.hostfromabc.com/2011/11/09/change-host-name-debian-6-squeeze/

TAL, phpTAL, cheatsheets

Primers
http://www.owlfish.com/software/simpleTAL/tal-guide.html
https://weblion.psu.edu/trac/weblion/wiki/TAL

This is also a way to "comment" things out of your code.

<tal:comment tal:replace="nothing">
*********************
Nothing between the opening and closing tal:comment tags will show up in the browser.
You can write what you like in here.
It's a great way of putting documentation into your templates.
Note, we don't have to say "tal:comment". We could say tal:aadvark or tal:teakettle or tal:whateverWeLike.
However, "tal:comment" is a useful convention to indicate to anyone reading the template that this is likely to be...
(gasp) a comment.
*********************
</tal:comment>

http://phptal.org/

PHPTAL is a templating engine for PHP5 that implements brilliant Zope Page Templates syntax:

<div class="item" tal:repeat="item itemsArray">
    <span tal:condition="item/hasDate" tal:replace="item/getDate"/>
    <a href="${item/getUrl}" tal:content="item/getTitle"/>
  <p tal:content="value/getContent"/>
</div>

PHPTAL is fast thanks to compiled templates and fine-grained caching. Makes it easy to generate well-formed XML/XHTML (protected against XSS attacks). PHPTAL's code is mature and improving. Released free under LGPL.

See the introduction.

http://en.wikipedia.org/wiki/Template_Attribute_Language

omit-tag

allows to omit the start and end tag and only render the content if the given expression is true.

on-error

if an error occurs, this attribute works like the content tag.

POST and GET

http://prajwal-tuladhar.net.np/2009/05/31/397/there-is-a-difference-between-http-post-and-http-put/


According to the HTTP 1.1 specification:

The fundamental difference between the POST and PUT requests is reflected in the different meaning of the Request-URI. The URI in a POST request identifies the resource that will handle the enclosed entity. That resource might be a data-accepting process, a gateway to some other protocol, or a separate entity that accepts annotations. In contrast, the URI in a PUT request identifies the entity enclosed with the request — the user agent knows what URI is intended and the server MUST NOT attempt to apply the request to some other resource. If the server desires that the request be applied to a different URI, it MUST send a 301 (Moved Permanently) response; the user agent MAY then make its own decision regarding whether or not to redirect the request.

http://stackoverflow.com/questions/5926898/can-one-send-a-put-or-delete-http-request-using-the-browser
http://tomayko.com/writings/rest-to-my-wife

I just read the famous article "How I explained REST to my wife" http://tomayko.com/writings/rest-to-my-wife. Needless to say, I had a suspicion before and I am now convinced that RESTful is the best way to design a web application.

A.
It is not about browsers but about version of HTML used to define the form - both HTML 4.01 a XHTML 1.0 (I'm not sure about HTML 5) supports only GET and POST as method of HTML form. If you want to use PUT and DELETE you must either use JavaScript and XMLHttpRequest directly or some JavaScript library which simplifies this (like jQuery).

http://stackoverflow.com/questions/165779/are-the-put-delete-head-etc-methods-available-in-most-web-browsers
A.

HTML forms support GET and POST. (HTML5 at one point added PUT/DELETE, but those were dropped.)
XMLHttpRequest supports every method, including CHICKEN, though some method names are matched against case-insensitively (methods are case-sensitive per HTTP) and some method names are not supported at all for security reasons (e.g. CONNECT).
Browsers are slowly converging on the rules specified by XMLHttpRequest, but as the other comment pointed out there are still some differences.

http://www.diffen.com/difference/Get_vs_Post

• Class vs Object
• self vs this in PHP
• Echo (PHP) vs Print (PHP)
• PHP vs Ruby
• JQuery vs script.aculo.us
• Calloc vs Malloc

http://www.packetizer.com/ws/rest.html

POST

POST is similar to PUT, and therefore confusing. POST also creates a resource, like PUT. The key difference is that POST is used when the server is in control of storing information, not the client. This is usually the case when posting a blog entry, for example. If the client wishes to create a new blog entry, it is the server that is responsible for storing the information in a database and assigning a unique value and/or URI to the newly posted content.
POST is also the appropriate tool to use when the operation does not result in the creation of a resource, but perhaps the invocation of some action. As an example, using a web-based form to transmit an email message would be an appropriate use of POST.
OK, that last sentence will raise a few eyebrows in the REST community. But, alas, what system exists where there are not some "things" that do something, other than store information? If one wishes to transmit an e-mail message, for example, POST is the method to use. In that case, some action is performed, but a new resource is not created as a consequence.

Safety and Idempotence

There are two other terms associated with REST that you should know, simply because they appear in all of the literate related to REST. Those are the words "safe" and "idempotent". These words do not come from Fielding's original PhD thesis on REST, but do appear in RFC 2616 and have been popularized through the book RESTful Web Services from O'Reilly.
The word "safe" means that if a given HTTP method is invoked, the resource state on the server remains unchanged. In theory, GET is always safe. No matter how many times you download this web page, the contents of it will not change due to your repeated downloads, since you cannot change the web page in that way. That sounds obvious, but if you build a RESTful web service that uses GET in such a way as to modify any state contained within a resource, then you have violated the rules.
PUT is not safe, because if you store something on the server, then you are creating a new resource or you are modifying a resource. (Of course, one might modify a resource to contain the same representation, but that is a corner case and not the general rule we apply to PUT.)
DELETE is clearly not safe.
HEAD is safe for all the same reasons that GET is safe.
So, what about POST? Some argue that POST is not safe. But, we argue that "it depends". If a POST operation is used to create a resource (e.g., a blog entry), then it is not safe. However, if POST is used to send an e-mail, then why would it not be considered safe? In the latter case, the state of the resource did not change. As such, it is safe.
The word "idempotent" means that, regardless of how many times a given method is invoked, the end result is the same. GET and HEAD are idempotent. GET and HEAD are both safe and idempotent, actually.
PUT is also idempotent. If you issue PUT 100 times, the resource state on the server is exactly the same as if you use the PUT method one time.
DELETE is also idempotent. If you delete a resource once, it is gone. One cannot delete it again and, if one tried, it would have obviously not make state changes to the resource, since there is no resource to change.
So, what about POST? As you can tell, POST is really the "problem child" for REST. It is somewhat ill-defined in the HTTP specifications and does not map perfectly to the concepts of REST. Most of the time, POST is not idempotent, as we will discuss below. However, if the server state is not changed as a consequence of issuing a POST, it is idempotent. In most cases, though, a POST is used to create or modify a resource, and often not idempotent.
Have you ever visited a web site to post an article or blog entry, or make a payment and accidentally press "submit" twice? Often, the server will accept that and perform the request two times, because POST is not idempotent. To be useful, though, one might design a means of using POST in such a way as to make it idempotent. There are a few non-standard mechanisms out there for that, the most common approach being to use POST to first create a new resource used to accept a subsequent POST method. Then, once the POST method is received for the given resource, the resource refuses to accept any additional POST requests.
This probably requires a more concrete example. Suppose you wish to post a blog entry. You might press the "post a blog entry" link, which might result in creating a resource called "http://example.org/blog/post/123" and your web browser is now showing a web form that allows you to type the contents of the blog. When you press the "submit" button, the HTTP POST is issued to the URL "http://example.org/blog/post/123" and, once that is received, and further posting attempts are rejected. If you had inadvertently clicked on the "post a blog entry" two times, two different blog posting resources might have been created (e.g., 122 and 123), but the first one (122) should be deleted automatically at some point, restoring the server state with no ill side-effects. But, since there are no standard procedures, then we cannot tell you exactly how to implement the logic. Hopefully, you get some idea.










http://programmers.stackexchange.com/questions/120716/difference-between-rest-and-crud
http://en.wikipedia.org/wiki/CRUD

Each request contains a URL, so the server knows which resource you want to access, but it can also contain a method. A method describes what to do with that resource.

But this "method" concept wasn't used very often.

Usually, people would just link to pages via the GET method, and issue any type of updates (deletions, insertions, updates) via the POST method.

And because of that you couldn't treat one resource (URL) as a true resource in itself. You had to have separate URLs for deletion, insertion or update of the same resource. For example:

http://...com/posts/create- POST request  -> Goes to posts.create() method in the server
http://...com/posts/1/show- GET request  -> Goes to posts.show(1) method in the server
http://...com/posts/1/delete - POST request  -> Goes to posts.delete(1) method in the server
http://...com/posts/1/edit- POST request  -> Goes to posts.edit(1) method in the server

With REST, you create forms that are smarter because they use other HTTP methods aside of POST, and program your server to be able to distinguish between methods, not only URLS. So for example:

http://...com/posts - POST request  -> Goes to posts.create() method in the server
http://...com/posts/1 - GET request  -> Goes to posts.show(1) method in the server
http://...com/posts/1 - DELETE request  -> Goes to posts.delete(1) method in the server
http://...com/posts/1 - PUT request  -> Goes to posts.edit(1) method in the server

Remember, a single URL describes a single resource. A single post is a single resource. With REST you treat resources the way they were meant to be treated. You're telling the server which resource you want to handle, and how to handle it.