Hi apollo123,

I fixed this issue in a release last week. Can you please download the latest version, install it on top of the previous version (no need to uninstall first), then try again?

Cheers,
Stephen

The place that you host with is extremely important. If you need to change anything to 777 permissions then it's bad news!

Essentially you need to have apache running as the owner of your account, rather than as a generic "httpd" or "apache" or "_www" user. If apache is running as one of those users, then you should run a mile too! [there are some exceptions, but in general the host should be running apache as a CGI or FastCGI or using phpSuExec or suPHP.

After that it's useful to have mod_security or suhosin set up on the server, and administered by someone who knows what they are doing.

After that, most of it's down to you:

- don't install a million extensions you're trying out from the JED
- carefully evaluate each and every one that you do install
- keep them up to date, always
- keep Joomla up to date, always
- avoid hacking Joomla directly as it makes you have to think twice before upgrading
- avoid hacking other extensions for the same reason, unless your programming skills are excellent
- completely remove any extensions you are not using; also any unused templates. Don't just disable things and think that they are removed.
- If you are writing your own extensions, don't use $_GET and $_POST: learn about JRequest and how it works
- ALWAYS sanitise variables you get from the outside. Using JRequest is a good start.
- ALWAYS do an htmlentities() call on anything from user input or the database that you are outputting to the HTML document, if it's not intended to include HTML. If it IS intended to include HTML, learn about how to sanitise HTML code.

They're my top tips!
There should be zillions of resources about this sort of thing on the internet - just do a search.

Cheers,
Stephen