I’m not sure if I completely understand the question. Do you mean, can we discuss our services with you before getting started? If so, most certainly! Please call us anytime, M-F, 9-5:30 EST.

Thank you,

Chad

Thanks.

We would definitely be interested! I’ll send you an email so we can discuss the details of the project.

Thank you,

Chad

I will be more than happy to go into more detail in further emails, however i am just looking to gauge your interest in a project such as this and to see if this would fit nicely into your expertise area.

Thanks
Jay

We have a talented team, and we can help with any task that you are willing to train us to do.

You will work with a single point of contact at LongerDays and you can call that person directly by extension. There is typically no waiting time to speak with your team lead.

I also need occasional appointment scheduling using an online service. Can you do this for me?

I suppose its possible to call directly to give tasks. Is this right? Sometimes calling is quicker than email.

Is there an average waiting time for calls?

Thanks. Just browsing but looking to hire within the month.

The problem is that marketing people are all for ease of use, and security is the inverse of ease squared. For example, wildly popular one-click upsell scripts will happily grab your infusionsoft contact ID for an upsell from a cookie. How do you feel about billing random people?

So you are suggesting it is best to setup webforms to create new contacts, and then routinely check for duplicates, instead of having the webform automatically update the contact information if the contact exists.

A real security issue, which is not widely discussed, is the IS API-special characters like % (the wildcard character for searches). Let’s say for example that your upsell script tries to locate a pre-existing contact by his email, before proceeding to bill him with the current product.

is_find($_GET['Email']).
if found, get first valid card, bill the product to him and ship to some address.

So, if I type my email to be “a*”, this will match all emails starting with an a. Most scripts just grab the first result of the query and bill him something.

Of course, having such a script where the only verification is an email is so bad, it should be illegal (is it?). But I have seen quite a few floating around. A “get hit first, fix later” security mentality of low-cost development which unfortunately is very popular in contractor-based development.

A more commonplace variation of this exploit is when an API-based webform creates/updates contacts:
1. check if contact already exists (by email).
2. If he exists, update the information on the contact table
3. If he doesn’t exist, create the contact.

In this case one can just wipe clean all your IS contacts by simply spamming the form with emails: a*, aa*. ab*… ba*,bb*…