Otto wrote:

“It’s almost ironic that WebXPHP is becoming truly available just now — exactly when I’ve finished learning HTML, JavaScript, and PHP.
But that timing is precisely what makes the difference.”

That is not a problem, my system can allocate you and not knowldging people, because you can combine
Harbour + FiveWin + WebX + HIX + mod_Harbour + mod_WebX all in the same source file....

Why?

No lock-in.
I can now consciously decide when to use xBase/DBF — and when to rely on modern web tools. A transpiler would have introduced a dependency. Now I choose the tool, not the other way around.

No Lock-in, you can use

Code: Select all Collapse

WebX Database Access - Two Approaches
1. DBF Files → Traditional xBase Commands ✅

USE customers VIA "DBFNTX" NEW
SKIP
APPEND BLANK
REPLACE name WITH "John"
DbGoTop()
These work via DBFHandler class - pure PHP implementation of xBase record navigation.

2. SQLite/MySQL/PostgreSQL → ORM with SQL ⚡

// Create connection
LOCAL oDb := WebX_Database():New( "sqlite", "mydata.db" )

// Query with SQL
LOCAL oCursor := oDb:Query( "SELECT * FROM customers WHERE active = ?", { 1 } )

// Navigate using cursor (similar feel to xBase!)
DO WHILE !oCursor:Eof()
   ? oCursor:Field( "name" )
   oCursor:Skip()
ENDDO

or use HIX and mod_ to use any other way...

Future over nostalgia.
Frameworks come and go. Tools rise and fall.
HTML, JavaScript, and PHP remain.
The time I invested wasn’t about solving today’s problem faster — it was about long-term flexibility.

The entire system is created thinking of as much flexibility as possible, with defaults defined for easy of use...

Architectural control.
Instead of generated code that “somehow works,” I now build systems I fully understand, can explain to others, and can adapt without fear. Transparency beats magic every time.

You control the design and architecture on your .prg file, we do not dictate, the system only renders your code, the only thing we do is if you say make a ribbonbar, the system makes a ribbonbar... that's it... we just make sure it works in the web browser
We also have a full AI training and documentation that guides any AI on how to use the entire Framework... so the ai can take what you have, and extend it or do the entire thing for you... We have a Layout class to make it easy to position the elements on the web browser in the spot you want, and is already being used by our POS framework as you already saw the picture of it....

Hybrid strength.
I can combine the best of both worlds:
using DBF data selectively inside web applications — without relying on a black box or a forced framework.

Yes, it was more work.
But it was the right work — for projects meant to live longer than a quick migration tool.

If anyone finds themselves in a similar position:
I’m happy to share how I integrate DBF into PHP projects — without framework lock-in.
Just send me a private message.

we use ORM, that is the most flexible way to use databases, so regardless of using DBF, SQL, SQLITE, ORACLE, or any other, it will just work, we will do our best to make sure its used in the same way it is used in Fivewin/Harbour

Best regards,
Otto

Hello Bayron, thank you for the detailed explanation — I really appreciate the flexibility and the thought behind WebX.

For me personally, I’ve already completed and released a solution where HTML/JS/PHP is the primary web layer, with Harbour used mainly in microservices and FiveWin for tooling around them, so my architectural center has already shifted.

I have a lot of respect for what you’ve built and see WebX as a strong bridge for many others.

Best regards, Otto

Otto, you are doing the right thing, what I'm doing may become obsolete before i can release it... but i wont stop on a what if...

adding layers on layers, is not smart at all... But PHP, html, css, js, ajax, is out of the question for some people...
I have all the AI's, Claude, Gemini, Grock, Qwen, etc., all on paid accounts, and i hit limitations on all of them.. to the point of having to start from 0 several times already, because it doesnt matter how i design the prompts, they cant surpass their limitations, and instead of fighting, i learned more efficient ways to doit, so i ratter start from 0...

Now, on a single file app, that is cool and dandy, but on a real app, doing real business calculations, that becomes an issue, if you don't know what you are asking for, to the AI... It's not the same to ask for food, than to ask for a delicacy on a recipe...

There is were the use of my framework may be beneficial to some users... they know Harbour code, it will become 1,000 times easier to ask an AI to fix a .prg file than to change the background on a dialog of a very complicated app... I been there, and just to explain to the AI, becomes a nightmare...

About timing, we had mod_harbour and Server capability for years, and even I didn't moved to it, so i decided to do full PHP, that wasn't a simple translation of English to German, it was more an Ancient Egyptian to English translation, Oil to Water, event driven to static, you get the idea... in PHP we don't have the help of harbour, but i did it because i understood that if people was not mass consuming mod_harbour, it was because they did not want a server, they wanted a web page... were they could mount apps..

We achieved use capabilities months ago, if the framework is used as is, but now we want to make sure it can use existing code, and that is very complicated due to the permissive nature or Harbour... not case sensitive, everything can be entangled, etc. Lets say, Harbour was and still is, ahead of its time... a very powerfull David vs Goliath...

Bayron, I believe the core problem was never the framework or the language, but that we have never shown users a truly secure, comprehensible standard setup for how to put their own application on the web in the first place. Without this “horse,” even the best riders are of little use.

Especially in the current situation, most users will initially want to work in a hybrid way — meaning self-hosting, with clear boundaries and full control over their own environment.

What is missing is not another framework, but a clearly defined, reproducible minimum standard for how a company server can be exposed to the web safely.

Something concrete, such as:

The server is reachable from the outside only through explicitly defined services — not as an open system. Web server, services, and data are cleanly separated and clearly isolated. Ports, users, and permissions are reduced to the absolute minimum required. Updates, logging, and backups are part of the initial setup, not afterthoughts. It is clearly documented what is public — and what is explicitly not.

A setup that says:

This is the smallest reasonable security baseline for self-hosting — not perfect, but manageable. As long as this clear, fear-free entry point does not exist, the following remain: WebX mod_harbour native PHP solutions

all theoretically strong, but practically intimidating.

Recommendations such as:

“Just use Cloudflare.” “Pick this hosting provider.” “It’s safe anyway.”

were intellectually correct, but emotionally ineffective.

Because they assume:

trust in external infrastructure understanding of real threat models willingness to take full responsibility immediately

For many people, that was simply too much.

Best regards, Otto

Otto,

You're absolutely right about the first point - and it cuts even deeper than you've stated.

Consider this: SQL itself has no built-in protection against injection attacks. After 50+ years, the most widely used database query language on Earth still requires developers to manually sanitize inputs or use prepared statements. The language doesn't enforce it.

Apache doesn't ship secure. Fresh install? Directory listing enabled. No rate limiting. No WAF. The .htaccess you need for basic protection? You write it yourself.

PHP? register_globals was the default for years. magic_quotes was the "solution" that created more problems. Even today, mysqli_real_escape_string() exists because the language won't protect you automatically.

These are the pillars of the modern web - and none of them come with training wheels.

So when someone says "WebX needs built-in security" - I ask: why is the burden different for us than for the technologies that came before?

That said - we actually did add automatic security layers:

CSRF protection - Forms automatically generate and validate tokens XSS prevention - All output is HTML-encoded by default AJAX action whitelist - Only alphanumeric action names allowed, sanitized server-side Secure session cookies - HttpOnly flag set automatically JavaScript escaping - Parameters safely serialized to prevent injection We went further than SQL, further than raw PHP, further than a fresh Apache install. The framework protects you by default - you have to actively disable protections if you want to shoot yourself in the foot.

But your point about the missing "horse" is spot on. The problem was never the framework. It's that nobody ever handed users a reproducible, minimal security baseline and said: "Start here. This is the floor, not the ceiling."

That's exactly what we should build.

I did add all those layers, because I'm aware that the users are not trained to be web exposed, so I already solved it as a install and use framework... so you and I are in the same page, we have the same concerns..

Hope your AI is doing all of this, without the proper prompt....

Best regards, Bayron

Security is an edge problem, not an application problem. Once a service is reachable from the internet, the attack has already begun.

"Your AI doesn't know what it doesn't know."

Copy-paste gets you the surface. It doesn't get you:

The decision to make CSRF automatic instead of opt-in The understanding that xBase developers aren't trained for web exposure The foresight to sanitize AJAX actions before anyone tried to exploit it An AI without the right prompt will build exactly what you ask for. Nothing more.

Not all the apps will be protected under a login, or will be only exposed to a company personnel, now real open apps can be built, exposed to the internet, for anyone to use....

So the question is "how do I protect people who don't know they need protecting?" The security layers are the answer, not the feature list.

That's the gap. And it's not closing with copy-paste.

Thanks Otto, i believe this conversation is very constructive for everyone...

Security is an edge problem, not an application problem.

A simple question may brake this argument: Do you have a password on your app? Why? if that's an edge problem...

Once a service is reachable from the internet, the attack has already begun.

I agree partially - and this is why edge protection alone isn't enough:

What edge protection stops:

DDoS attacks (volume-based)
Known malicious IPs
Bot traffic patterns
Rate limiting abuse
Protocol-level attacks

What edge protection CANNOT stop:

A single, well-crafted SQL injection in a login form
An XSS payload hidden in a "customer name" field
A CSRF attack from a link in an email
A malicious AJAX call that looks like legitimate traffic
Cloudflare sees: POST /api/save {"name": "O'Reilly"}
Cloudflare thinks: "Normal request, let it through."
Your unprotected app executes: INSERT INTO customers (name) VALUES ('O'Reilly') — SQL broken.

The attack surface has shifted.

The old model: Thousands of requests, brute force, hope something breaks.
The new model: One request. One injection. Surgical.

A skilled attacker doesn't trigger rate limits. They don't come from blacklisted IPs. They don't send malformed packets. They send one perfectly valid HTTP request that your edge sees as legitimate traffic — because syntactically, it is.

The difference between a safe request and a lethal one is semantic, not structural. Only the application understands context. Only the application knows that <script> doesn't belong in a name field. Only the application can validate a CSRF token.

Edge security is the wall. Application security is the lock on the door.

You need both. But if you only have the wall, a single person with the right key walks right in.

WebX assumes the wall can be bypassed. That's why every form validates tokens, every output is encoded, every action is whitelisted. Not because edge security failed — but because it was never designed to catch this.

Best regards,
Bayron

WebX will not be just a UI that renders pages to a web browser.

We are creating a true Web aware Framework, with default behavior, that no Dialect or Framework has, not C, nor Python, nor PHP, nor Laravel, nor Symphony, etc.

We have already the attack layer framework, and we are working also on

Rate limiting per session/IP (application-level) (Cloufare independent, Not sure about Captcha yet, i hate the interruptions) SQL prepared statements helper (added to the DB layer) Content Security Policy headers (CSP)

so we are hopping to create a solid architecture....

A framework where a developer writes business logic and the framework handles web security by default. Not "here's a library, go figure it out" - but "we already protected you, opt-out if you want."

That's the opposite of how every major framework works:

PHP Nothing by default. Good luck. Laravel Helpers available. You must use them. Django Better defaults, but still opt-in for many Express/Node Bring your own everything WebX Protected by default. Opt-out to disable.

The xBase community doesn't have 20 years of web trauma teaching them to sanitize inputs. They come from desktop apps where the user was the security boundary.

We're building the framework they need.

"Web-aware by default" - that's the tagline. That's what makes WebX different.

Thanks...

Bayron, I believe you on the technical side. The issue is simply this: in this forum, you are not an authority — so people don’t really believe you.

That’s not a judgment of your competence, it’s a description of the dynamic here.

Antonio is the project founder. This is his life’s work, his economic foundation, and he possesses undisputed technical expertise and vision in this field. Because of that, his voice carries a different weight here — not by hierarchy, but by history, trust, and long-term contribution.

If this topic is going to move forward, it will require either a top-down signal (Antonio explicitly engaging with the problem), or a thread where multiple active members collectively surface concrete security questions and assumptions.

Otherwise, even correct arguments tend to disappear without effect.

This isn’t a technical problem — it’s a structural one.

Best regards, Otto

Otto,

Absolutely, and just out of respect, we are not jumping the gun.

I even abandoned my first project months ago, because it would have become direct competition to FiveWin. It was already 90% done.

https://forums.fivetechsupport.com/viewtopic.php?p=282167#p282167

Instead, I focused on classes that FiveWin doesn't have, and made compatibility require a FiveWin license (starting with version 25.12) — specifically to motivate FiveWin upgrade purchases, not to compete.

On the authority question:

You're right. I'm not the authority here — Antonio is. And I have no intention of challenging that.

https://forums.fivetechsupport.com/viewtopic.php?p=283778#p283778

I'm sharing progress, answering technical questions, and being transparent about where we are.

If Antonio wants to engage, partner, sanction, censure or ignore — that's his decision. We are keeping the door open. In the meantime, we will continue building for profit or contribution/personal satisfaction, time will judge.

On licensing:

We haven't finalized a licensing schema. We don't know yet if we'll:

Partner with FiveTech
Sell independently
Some hybrid model
Free is unlikely but not out of the table— the investment is already substantial, and everyone needs to eat.

On market focus:

The biggest opportunity isn't FiveWin users anyway. It's:

Visual FoxPro — 1+ million legacy apps, Microsoft abandoned them
Alaska Xbase++ — Enterprise market with no real web migration path, only similar to thtml class i think (costs up to $10k a year)
Clipper/dBase legacy — Ancient systems still running in production
FiveWin developers already have options. The others don't. That's where WebX creates the most value — and the least conflict.

Best regards,
Bayron

Bayron, thanks for the clarification — and I appreciate the respect and transparency you’re showing.

But I think we’re still slightly talking past each other.

My point was not about competition, licensing, intentions, or respect toward FiveWin. It was also not about who is right technically.

It was about how arguments are received in this forum.

Even when the technical reasoning is solid, it doesn’t land here unless one of two things happens:

Antonio explicitly engages with the topic, or multiple long-standing participants collectively surface the same concerns.

Until then, the discussion remains informational, not formative.

So when I say “this is not a technical problem, but a structural one,” I mean: the bottleneck is not implementation, vision, or goodwill — it’s how consensus and legitimacy are formed in this community.

That’s the gap I was pointing at.

Best regards, Otto

Getting closser to full true transpilation, a few adjustments are needed, but we are translating true complex code, not just base code already:

Code Example:

		SELECT 10
		SET FILTER TO !DELETED()
		
	LIStvenWidth := ( Cuadro3[1][4] * 2 ) - 80
	@ ( Cuadro3[1][1] + 9 ) , ( Cuadro3[1][2] + 11 ) xBrowse listven fields str(&diario->udes,3), &diario->des_ticket, trans(&diario->pventa,'99999.99'),trans(&diario->pventa*&diario->udes,'99999.99') of oDialog headers 'CAN','DESCRIPCIÓN','PRECIO','T O T A L' FIELDSIZES ( LIStvenWidth * .10 ) , ( LIStvenWidth * .50 ) , ( LIStvenWidth * .15 ) , ( LIStvenWidth * .25 ) FONT If( oDialog:nHeight > 900 , oFont3 , oFont1 ) PIXEL JUSTIFY {AL_CENTER, AL_LEFT, AL_RIGHT, AL_RIGHT} SIZE ( Cuadro3[1][4] - Cuadro3[1][2] - 22 ),(Cuadro3[1][3] - Cuadro1[1][1] - ( (Cuadro3[1][3] * .17 ) ) )
	
	WITH OBJECT ListVen
		:bClrGrad := { | lInvert | If( ! lInvert, { { 0.20 , 4144959, 16777215 } , { 0.20 , 16777215 , 4144959  } }, { { 0.50 , 128 , 16777215 }, { 0.50 , 16777215 , 128 } } ) } //Color Header y Footer
		:bClrStd    := { || { CLR_BLACK, If( ListVen:KeyNo() % 2 == 0, RGB(224,236,255), RGB(189,211,253) ) } }
		:bClrStd  := { || If( Eval( ListVen:bKeyNo,,ListVen ) % 2 == 0, { CLR_BLACK, RGB( 224, 236, 255 ) }, { CLR_BLACK, RGB( 189, 211, 253 ) } ) }  //Aqui el Efecto Pijama	
		:lAllowRowSizing := .F.  //Activar/Desactivar Redimensionado de Lineas por Usuario
		:lColDividerComplete := .T.  //Lineas verticales hasta abajo
		:lAllowColSwapping := .F.
		:lAllowColHiding := .F.
		:nFreeze := 4
		:nColDividerStyle := LINESTYLE_INSET
		:nMarqueeStyle := MARQSTYLE_HIGHLROW // Con cursor de todo el renglón
		:lColDividerComplete := (.T.) // (.T.) Mantiene siempre llena la pantalla
		:lRecordSelector := .f.
		:nHeaderHeight := ( ( ( ListVen:nHeight ) / 5 ) + 10 )// Altura de los encabezados
		:nHeaderLines := 1 // Número de líneas de encabezados
		:nDataLines := 1 // Número de líneas de detalle
		:nFooterLines := 1 // Número de líneas en el footer
		:lFooter := (.T.) // (.T.) Sí queremos línea de footer
		:nFooterHeight := 8 //+ ( INT( ListVen:nHeight) - ( INT( ListVen:nHeight / 9 ) * 9 ) )// Altura del footer
		:nRowHeight := ( ( ListVen:nHeight - ( :nHeaderHeight / 2 ) - ( :nFooterHeight / 2 ) - 3 ) / 5 )//INT( ListVen:nHeight / If( oDialog:nHeight < 800 , 7 , If( oDialog:nHeight > 800 .and. oDialog:nHeight < 900 , 8 , 10 ) ) )// 40 // Altura del renglón
		:aCols[ 2 ]:addbmpfile( Camino + "images\delete.bmp" )
		:aCols[ 2 ]:lBtnTransparent := .t.
		:aCols[ 2 ]:nBtnBmp := 1
		:aCols[ 2 ]:nEditType := EDIT_BUTTON 
		:aCols[ 2 ]:bEditBlock := { || eliven( .F. ) }
		:lHScroll := (.F.) // Quitamos el scroll horizontal
		:lVScroll := (.F.) // Quitamos el scroll horizontal
		:lKinetic := .f.
		//:nStretchCol := STRETCHCOL_WIDEST
		//:bLostFocus := { || ListVen:GoBottom() }
		:bClrSel = { || { CLR_BLACK , GetSysColor( COLOR_INACTIVECAPTIONTEXT ) } }       //Puntero LostFocus 
		:bClrSelFocus := {|| { CLR_BLACK, GetSysColor( COLOR_INACTIVECAPTIONTEXT )} } //Puntero GotFocus
		//:bClrSelFocus := {|| { CLR_WHITE, GetSysColor( COLOR_HIGHLIGHT )} } //Puntero GotFocus
		//:bClrSelect = { || { 0, nRGB( 100, 149, 237 ) } }
		//:l2007 := .T.
		//:lTransparent := .f.
		//:lAllowSizings := .f.  //Did not work with 10.2
		//:nRowDividerStyle := LINESTYLE_INSET
		
	END
	
	//AEval( ListVen:aCols, { |oCols| oCols:nEditType := EDIT_BUTTON } )
	AEval( ListVen:aCols, { |o| o:lAllowSizing := .f. } ) 
	AEval( ListVen:aCols, { |o| o:nHeadStrAlign  := AL_CENTER} )
	
	ListVen:CreateFromCode()

Bayron,

I have a very similar system to yours, but I start consistently with a mobile-first approach. My system is designed for a hotel, while yours seems to me more specifically focused on a shop.

I mainly use it to register food items as orders. Of course, I also have a mode where the whole system functions purely as a cash register.

I have organized the products into main groups. At the bottom, you can see two horizontal navigation bars that are scrollable: one for the product groups, and below that another for functions such as increasing quantity, printing, changing the price – everything a cash register needs.

I can very easily switch the layout size, for example as shown in the GIF on the iPad. With a simple div, I can move the areas for the order view and the product selection. This is very practical when reassigning items or partially splitting a bill, especially when there are multiple payers.

Since you are a very experienced web programmer, you will probably immediately understand the advantages of the Harbourino concept. Harbourino is a patcher and preprocessor. I can split the code into small parts, for example the navigation, and in the main file I only have a placeholder for it.

This makes the program much clearer, and I can work within the individual modules. At the end, before deployment, I merge everything together and end up with a completely normal PHP program.

What I find interesting about my way of programming is that I use no, or extremely few, external modules. If you look at the header, you will see that I do not use libraries such as Bootstrap or jQuery.

In the Harbourino block styles, for example, you can see the CSS. I manage these blocks inside OB Utilities. OB stands for Online Bee.

Another example is the navigation at the bottom with the different functions. I think it would be difficult to structure the code any more simply. Harbourino is a power utility for me. It simplifies the view of the code.

Especially in collaboration with AI, this approach is optimal. I only pass a small block of code to the AI and let it work on that specific part. This makes fixing and improving the code much easier.

I always enjoy exchanging ideas with you.

Best regards,
Otto

MicroSoft Visual Fox Pro 9

*Migration Capabilities - What Can Be Migrated

Date: 2026-02-19
Status: Beta testing
Success Rate: 90-95% for recoverable files

Executive Summary

WebX can migrate Visual FoxPro applications even without original source code, as long as you have the runtime files (.fxp, .vcx, .scx, .app). Only final compiled executables (.exe only) cannot be migrated.

What Can Be Migrated ✅

1. Loose Runtime Files (BEST CASE - 95%+ Success)

Files Required:

• ✅ .fxp - Compiled program files
• ✅ .vcx - Visual class libraries
• ✅ .scx - Screen/form definitions
• ✅ .frx - Report definitions
• ✅ .mnx - Menu definitions
• ✅ .dbf - Database tables

Recovery Quality:

• .vcx/.scx/.frx/.mnx → 100% PERFECT (Fully human-readable)
• .fxp → Logic 100%, variable names generic (Var1, Var2, etc. but context makes them obvious)

Example Deployment Structure:

C:\BankApp\
├── main.fxp           ← Can decompile to main.prg
├── login.fxp          ← Can decompile to login.prg
├── forms\
│   ├── customer.scx   ← 100% PERFECT recovery
│   ├── invoice.scx    ← 100% PERFECT recovery
├── classes\
│   ├── business.vcx   ← 100% PERFECT recovery
│   ├── controls.vcx   ← 100% PERFECT recovery
├── reports\
│   └── invoice.frx    ← 100% PERFECT recovery
└── data\
    └── customers.dbf