Any DELAVO Alternatives? (For Sales/Affiliate Mgmt)

I am pretty sure the download page said they will change the domain once for free but charge $47 for every time after that.

Is the subdomain the problem? From reading the download page, it shouldn't be a problem for them to change the url.

Brian,
I would not say I am putting anything up against Delavo..

What I am building is the most advanced membership script to hit the market with a full all-in-one solution which includes building sites on the fly with no ftp or design software needed. Building memership sites with recurring payment, one time payment, trial access, or free and at the same time run affiliate review sites. All managed from your admin area.

That is just the tip of the iceberg.. complete affiliate system built in and mass mail management built in for members and subscribers or use aweber or getresponse if you wish. Also will include paypal fraud protection against those serial refunders that love to hit IM sites.

No plugins, no third party scripts needed... Best of all it will be very affordable even for those just starting out.

James

Thanks Brian, I'll have a couple of days off soon from the lesson tee...I'll PM you!

chuck

Mark Joyner who never recommends anything recommends Delavo. So who better to believe that Delavo is the best then the father of internet marketing? And of course others are going to recommend their platform over Delavo. That is the nature od sales. But then again, is their platform being recommended by anyone of Mark's caliber? If not, and none are, think about why Mark choose Dealvo as the platform he says EVERYONE should have.

There are contextual help files on every page, videos, manuals, workshops, 1 on 1 Skype consults, email support, all free as was Delavo itself.

And it is very easy to get a domain name changed. Just submit a help desk ticket with your license number, your full name, your old domain and the new domain.

I don't know if Delavo will work on a subdoomain in this format: sub.main.com but I do know it works in this main.com/sub.

However, I will find out and let everyone know.

Donna

Ok I have changed it and am now sending you a PM

Donna

Hi,

I have P.M.'d you the link

Brian

hashing & salting user passwords wether it be using md5, sha1 or sha512 is a proven technique to protecting user passwords. It's used in a lot of applications including wordpress and similar methods are implemented by amazon & ebay.

It's bad practice to store passwords in the database unhashed or unencrypted.

md5 alone is not as effective as it used to be, but salting the password then hashing the password is much more effective. Using this method for only logins does not slow down the software dramatically. Using php to hash and salt the password before hand does not put any extra load on the database as its all done before the string is sent to the database. I don't mean use the functions built in to the database to hash the password, if thats what you thought i meant.

There probably is security settings built into delavo but looking at the database structure that is what i saw.

Exactly.. you can't get access to just one table, if you can access the one table you can access the whole database.

But at the same time, there have been known security vulnerabilities in quite a few web scripts (opensource or proprietary) that have caused a lot of trouble recently. While you have a responsibility to have a secure host, the developer has a responsibility to write secure software too, especially in the case where you can not modify the software yourself to fix any security vulnerabilities you find because the developer hasn't provided editable source code (for example, a script with heavily obfuscated source code or an IonCube or Zend encoded script).

I don't know specifically about Bad-Bot Killer since I've never used it, but there are a number of different scripts that block certain bots, IPs of known hackers and forum spammers, etc. I'm assuming Bad-Bot Killer is something along those likes. Always a good idea to have something like that as an extra line of defense.

Not necessarily. That's one way to handle it, for sure, but considering that most PHP scripts use one of 3 methods (MD5, SHA1 or the much-hated crypt() function) it wouldn't be too hard to let your new developer know what hash or encryption algorithm the old script was using to hash the passwords. Even failing that, it would be trivial to write a small script that generates a random password for each user, emails it to that user and hashes it with the new script's hash algorithm to store it in the database.

But there is one thing to keep in mind when you're thinking about encrypting passwords in the database. How many of us use SSL on our login pages (or any page where a user might enter or change their password)? What good does it do to encrypt the password in the database when that password is always sent "in the clear" from the user to the server every time they log in?