Common mistakes in web development

Question

what are the common mistakes developers/architechs do when developing a portal/web application... what should we avoid or take care of when we are developing a web application.

Answer 1

Security issues mainly.

• Not escaping (user submitted) content
• SQL injection (still see it around unfortunately)
• XSS / CSRF
• Trusting the client data - things like putting the amount for an order in a 'read only' text box and just expecting users not to tamper with it
• Emailing credit card details (most cases they shouldn't be stored anyway).
• Storing passwords in plain text.

Rescuing a custom e-commerce project at the moment - where a malicious user could simply send a form post to the 'thank you' page to have their order confirmed, skipping the payment gateway entirely.

Answer 2

Wow this could get huge:

• Security (as DaRKoN suggested)
• Inadequate planning for load and scaling (too many/few users for the hardware used)
• Internationalization, and issues related to it
• Site Indexing, navigation and user experience
• eCommerce and handling local taxes/laws
• Caching and Persistence of data
• Assuming that Web is Stateful vs Stateless
• Client bandwidth issues
• Client browser and browser preferences (do they have javascript enabled, is it firefox, etc)
• Data storage and management, especially when planning for multi site installation
• Managing a service infrastructure vs an application infrastructure (upgrading multiple machines, and varied equipment).

The list goes on...

Answer 3

Thinking too much about mistakes ahead of time, instead of just building the damn thing as quickly and simply as possible, and figuring it out as you go, with occasional refactorings.

Answer 4

There are a whole class of mistakes related to lack of adequate compatibility testing:

• Site looks nice in IE, but how does it handle in Firefox, Chrome, Safari, Opera, etc? See BrowserShots.org.
• Have you tested it on multiple screen sizes? 800x600? 1024x1080? 480x500 as commonly seen on mobile devices? Use Conditional CSS for screen resolutions.
• Never assume fonts are always rendered black, Times New Roman, 10pt unless otherwise specified. Always use a Base Style Sheet in case users have tweaked their default styles to something crazy.
• Using ActiveX on a public website? I spit on you.
• Have you tested your client-side script in multiple browsers?
• Are you sure those partial transparency PNGs render consistently across all browsers?

You could probably write a book on everything you'd need to check just getting cross-browser compatibility right alone.

Answer 5

Using Flash for anything except video in IE.

Answer 6

• Modifying server state with GET requests - I've had to explain to veterans of almost 10 years why this is bad.
• Making a mess of everything client-side: invalid HTML with inline CSS and JavaScript. Like any other code, client side markup/scripts should be easy to read an maintain.
• Assuming that web development is exclusively devoted to the browser environment.