Sql injection attack lab

308

CASE STUDY II-5

The CliptomaniaTM Web Store

at a competitive price with outstanding customer service.

They have worked diligently to provide quality, honesty,

and friendliness through the Cliptomania Web site. For

example, Cliptomania has a very liberal return or exchange

policy that allows customers to return or exchange any

item within 30 days for any reason without question. Less

than one percent of their customers return any items.

First established as a Yahoo! store in November of

1999, Cliptomania has had spectacular growth in sales

during a very difficult period for retailing. Although it sells

only clip-on earrings, by June 2003 Cliptomania was the fifth

largest jewelry store on Yahoo! in terms of gross sales.

Yahoo! store customers are encouraged to rate their

satisfaction (or lack thereof) with their experience with the

store. If they choose to rate the store, in two weeks (by

which time they should have received their purchases) they

are sent an e-mail pointing to an online rating form to com-

plete. The ratings are on the following scale:

Excellent Better than I expected. Tell everyone that

Cliptomania is a great store.

Good Everything went just fine.

OK There were a few problems, but I would proba-

bly still order from Cliptomania again.

Bad There were real problems. I would be reluctant

to order from Cliptomania again.

Awful I had such a bad experience that I want to

warn everyone about Cliptomania.

Although the default rating (already checked) is Good, an

amazing 81 percent of Cliptomania’s ratings have been

Excellent! Ninety-eight percent of Cliptomania’s ratings

have been either Excellent or Good, so Cliptomania

quickly earned a five-star Yahoo! rating for service.

In addition to a numerical rating, the rating form pro-

vides space for customers to submit specific comments

that are available to the store through a database.

Cliptomania has received a great deal of effusive praise

such as the following:

I am very pleased and satisfied with the service I

received from Cliptomania. The customer service

representative was polite, helpful, and patient with

me being a new customer ordering with a credit card.

Cliptomania, LLC, a limited liability corporation, sells clip-

on earrings on the Internet at www.cliptomania.com.

Cliptomania is owned and operated by the Santo family—

father Jim, mother Candy, and daughter Christy. Its business

is conducted from the lower level of the Santo home in

Indiana, but it sells non pierced earrings throughout the

United States, Canada, Ireland, Australia, and New Zealand.

Most people who wear earrings have pierced ears,

so stores offer a limited assortment of non pierced

earrings. Those who want clip-ons have a very difficult

time finding appealing choices. Cliptomania sells nothing

but non pierced earrings, and it offers its customers a

choice of hundreds of different styles of clip-ons.

Although the percentage of people who want clip-ons is

small, the total number of potential customers available to

Cliptomania on the Web is huge. The Santos have found

an underserved market niche. According to Candy:

A lot of our buyers are first-time buyers on the

Internet, and some of them are older women. But

you would be surprised how many teens and young

twenties buy because for one reason or another they

have had trouble with pierced ears. There are young

mothers whose babies ripped the earrings out of their

ears and their ears cannot be pierced again. And

there are people like me who have problems with

scarring forming keloids and don’t want any unnec-

essary scars. There are people for whom piercing

their ears is against their religious beliefs.

Some women are so thrilled to find us—they

will tell me that they have this problem or that prob-

lem and ask which of the earrings will work best for

them. Because there are several different types of

clip mechanisms, I can often help them out.

Our customers are pretty evenly distributed by

age from pre-teens to the elderly. We had not anticipated

it, but we estimate that we get some 5 percent of our

sales from the cross-dresser and transgender population.

The Santos want Cliptomania to become the first

name someone thinks of when looking for non pierced

earrings. They concentrate on providing a quality product

Copyright © 2010 by E. W. Martin. This updated case replaces an earlier version © 2007.

Case Study II-5 • The Cliptomania TM Web Store 309

The service was superb! I am also very pleased with

the earrings. They are light, comfortable, and no

pinching of my ears. And the cost you cannot beat.

I am so thrilled with this. I plan on ordering more

earrings from them, and have told several of my

friends about this Web site. It is hard to find good

quality clips, and I found just what I was looking

for, and more. Working with the customer service

representative was just like talking to a friend.

I appreciated that.

History

In the mid-1990s, Jim and Candy Santo were living in New

Jersey near New York City. Candy was the development

director for a large nonprofit organization that provided a

broad continuum of care for the homeless, and before that

she had been executive director of a crisis line. Jim had a

long-time career in insurance sales that he still continues.

According to Jim:

In 1998 I went out to buy earrings for an anniversary

present for Candy, and I could not find a good selec-

tion of nice clip-on earrings anywhere. I looked

everywhere I could think of in the New York metro-

politan area. I could find plenty of earrings for

pierced ears, but it was clear that all the stores had

decided that they could not sell enough clip-ons to

justify carrying an adequate stock in their stores.

I knew that there must be millions of people in

the world who wanted clip-ons and could not find what

they wanted, so this appeared to be a great opportunity

to sell them on the Internet. This intrigued me, but I

knew little about the Internet or jewelry so I started

staying up at night and working weekends doing

research on jewelry and how to sell via the Internet.

After 13 months of research I concluded that the

Internet was the ideal medium for this type of business.

Earrings had a high markup, you could get started with

little capital, and the Internet was the way to access the

widely distributed market for clip-on earrings.

The Santos decided to try to sell clip-ons on the Web, and

Candy came up with the name Cliptomania for their new

Web store. They decided that if the URL Cliptomania.com

was available and the name Cliptomania had not been reg-

istered as a corporate name, they would go forward with

the endeavor. They employed a patent and trademark attor-

ney who checked and found that the corporate name

appeared to be available. And they were able to purchase

the URL Cliptomania.com from Network Solutions, so

they decided to go ahead.

On Thanksgiving day, 1999, traditionally the begin-

ning of the Christmas holiday sales season in the United

States, they went live with the Cliptomania store on the

Web, operating out of one small room of their home in

New Jersey. Their total capital investment was $10,000,

which came from their savings. Although Jim had hopes

that Cliptomania would grow, they expected it to be a side-

line activity that they would take care of in their spare time

while continuing their regular jobs.

Setting Up the Web Store

Neither Jim nor Candy had any expertise in the creation of

a Web site, so Jim had devoted a lot of time and effort to

determining how they would go about setting up the

Cliptomania Web site. Jim found that one way would be to

contract with an Internet service provider (ISP) for the

computer resources required, purchase several software

packages to perform the various functions that would be

needed to run the store, and design the site and write the

HTML code to set up the pages. The problem was that they

did not have the personal experience or any IT development

background to design the site and write the code or to inte-

grate the various software packages. To hire someone to do

all of that would be expensive, and they might have little

control over the process or the result.

The other alternative was to pay a vendor for hosting

a store. For a price, the vendor provides the computer

resources and integrated software as well as templates for

setting up the Web pages that provide the basic Web store

structure but allow you to customize them to suit your

business. The Santos chose this option and contracted with

Yahoo! to establish their Cliptomania Yahoo! store.

Yahoo! provided templates for setting up the home

page and the pages that displayed images of and described

the items offered, as well as for navigation across the site.

Yahoo! made it easy to add and delete items offered for

sale and to make changes in the images and descriptions of

these items. It used a shopping cart approach that holds

selected items there until the customer wishes to place an

order. Then it provides an online order form with the

selected items detailed and accepts a credit card number

and other billing information from the customer. Yahoo!

then sends the completed order to Cliptomania and

presents the customer with a page confirming that the

order has been placed with Cliptomania. By checking a

box, the customer can request that the order also be

confirmed by e-mail.

Another company, Paymentech, is integrated with

Yahoo! to validate the credit card by making sure that the

customer address on the order is the same as the billing

address of the credit card. After Cliptomania accepted the

order, Paymentech collected the money from the credit

310 Part II • Applying Information Technology

card company and deposited it in Cliptomania’s bank

account once a week.

Jim was very concerned with transaction security via

the Internet. When he was doing his research, he had read

that 40 percent of the transactions on the Internet were

fraudulent. He also read that Yahoo! had the best security

among the vendors providing support for Internet stores.

In addition to encryption to restrict access by outsiders

to credit card numbers and other financial data, the

Yahoo!/Paymentech combination detected and eliminated

most fraudulent purchases, and that was crucial to Jim. The

outstanding security and the ease of setting up and operat-

ing the store were the main reasons the Santos decided to

go with Yahoo! as their vendor.

The Yahoo! store also had a “back office” that col-

lected and made available data about Cliptomania’s Web

site transactions. The Santos got a historical report for

each month showing the number of customers that

visited the store, the number of page views, the average

number of page views per customer, the number of

orders, the income, the number of items sold, the aver-

age number of items per order, and the dollar value of

the average order. This report also included daily and

yearly totals. They could also print out graphs showing

the volatility and seasonality of their orders. On many

orders they could find what search engine sent the

customer to Cliptomania and what search terms were

used, and this information could be summarized by

search engine. All of this information was of great value

to the Santos in managing the store and evaluating the

effect of their marketing efforts.

When Cliptomania was started in 1999, there was

only a $100 monthly charge for the Yahoo! store.

However, over the years Yahoo! has changed its pricing

structure and as of 2003 it charged $49.95 per month for

hosting, $0.10 per item carried per month, a 0.5 percent fee

on all sales, and a 3.5 percent revenue share on sales that

originate through a Yahoo! Store search.1 Paymentech

charged $0.20 for each credit card transaction it processed,

in addition to the percentage of the amount of the sale

charged by the credit card company (typically 2.5 percent

to 3.5 percent).

Designing the Cliptomania Web Site

Jim and Candy did most of the set up work on the original

Web pages themselves, with some help from a freelance con-

sultant they employed to help them with problems that were

beyond their technical capability. Since then Candy has

learned the basics of the HTML language. The consultant

is still available to the Santos via telephone and the Internet

for tougher questions, although they have had to turn to him

less and less often.

Before starting the store the Santos examined a num-

ber of Web stores and they had a pretty good idea of what

they liked and what they didn’t like in these Web sites.

Candy explains what they wanted to do:

I designed the logo in the banner at the top of our

page. I wanted the “t” to be dangling down from the

“p” like an earring hanging down. We chose the

burgundy and gold colors for our page because we

wanted to give the impression of a quality jewelry

store and not look like the typical Web store with

bright colors crying for your attention. We put our

names—Jim, Candy, and Christy—on the front page

and we use personal pronouns throughout the site

because people need to know that we are real people.

Some people call before they will place an order on

the Internet because they feel the need to talk to a

real person and have a sense that we are legitimate.

A lot of our buyers have been first-time buyers on

the Web. We are asking them to make a leap in faith

and we want them to feel comfortable about making

that leap.

From the start we put the various categories of

products that customers can click on down the left

side of the page. The names of these categories are

very important because they must guide the cus-

tomers to the products that they like. I have set things

up so that no more than six items appear on one

page. I do this because I think that most people don’t

like to scroll down a page—they will only look at the

top items. Also, our pages load fast, which is impor-

tant when people are coming in through regular

phone lines. Customers often mention how nice it is

that our pages load so fast.

Getting Items to Sell

Initially one of their biggest problems was finding sources

from which they could get earrings to offer in the

Cliptomania store. They searched yellow pages on the

Internet for jewelry wholesalers and manufacturers and

called lots of them. Half of them did not exist any more, and

the rest were not very helpful. They finally found a man in

Virginia who bought overruns and closeouts, so in the

beginning most of their stock was not the most attractive.

Jim remembers:

We were very naive in the beginning. We got any

stock we could get because we were almost desper-

ate. We didn’t know anything about jewelry, about1 For current charges see http://smallbusiness.yahoo.com.

Case Study II-5 • The Cliptomania TM Web Store 311

what styles were popular, or about fashion. And we

are in the fashion industry, so there was a big learn-

ing curve there. But somehow we survived.

I knew there was a jewelry district in

Manhattan, so I took a day off from my insurance

business and went to the city to the fine jewelry area,

the diamond district. I tromped around for five or six

hours before I concluded that I was in the wrong

area. Finally someone had mercy on me and told me

where to find the fashion jewelry area. That was a

major breakthrough.

We finally found the wholesalers that would

provide the kind of product we were looking for.

These wholesalers had the product, but they were

relatively expensive because they were several layers

down from the manufacturers, and each layer tacked

on its expenses and profit. After searching every-

where for manufacturers, we finally found this

woman manufacturer/wholesaler out on Long Island

who got all excited about what we were doing. We

started getting stock from her and developed a rela-

tionship with her. She told us that we should go to

the manufacturers’ International Fashion Jewelry,

Accessories and Gifts (IFJAG) national show in

Rhode Island, which is very difficult to get admitted

to. She got us an invitation that allowed us to get into

that invaluable show that we now go to each

February and September.

Before we went to the show, manufacturers’

reps wouldn’t talk to us because at that point we

weren’t buying in large enough quantities to interest

them. But when we went to the show and got to talk

directly to the manufacturers, some of them con-

nected with our passion to offer quality products for

women who don’t want to pierce their ears. Some of

the manufacturers would say: “I think you’ve got a

good idea, and you remind me of my wife and I

when we were your age. We’re going to gamble on

you. I’m going to take orders from you that I would

kill any rep of mine if he came in with them.” They

started providing stock to us that we couldn’t have

gotten otherwise.

That was the beginning of some mutually

beneficial relationships. Since then we have grown

to the point that we are ordering in such volumes that

we are higher up on their customer lists. Some

manufacturers will now make special manufacturing

runs for us. At the 2003 February show one of the

manufacturers said that it was time that we had our

own exclusive earrings, and that manufacturer

designed some for us and we have had our own

special designs ever since.

Early Growth

The year 2000 showed steady growth in Cliptomania’s

sales. The Santos had only three orders in January, but by

the end of the year, they were up to more than one order a

day. In 2001, Cliptomania’s sales continued to grow rapidly

to where sales had more than quadrupled over its sales for

the year 2000. Candy recalls:

Jim and I both had full time jobs and Christy was a

student. We took no pay out of the business for the

first two years—we just plowed everything back in.

We started with pure sweat equity.

It started very, very slowly. When we got to

one order a week we were celebrating. But it just

grew and grew. Around October of 2001 I left my

full-time development director job because I was

really burning-the-candle-at-both-ends at that point.

I took a part-time job where I could just go to work

and leave it behind when I came home.

The Move to Indiana

In December 2001, the Santos sold more than they had in

the entire year 2000. They were running out of space for

operating out of their small house in New Jersey. Candy

was originally from Indianapolis, Indiana, and she began

to think about getting away from the high costs of New

Jersey to the Midwest where the costs of space were much

lower. She explains:

I could see after the holiday season of 2001 that we

would not be able to handle the next holiday season

out of the space in which we were working. If you

needed packing material you either went up into the

attic or out into the garage. We didn’t have separate

offices—we were all trying to work out of one room.

After we searched for a suitable space in our area and

found that everything available was far too expensive,

it dawned on me that the people on the Internet don’t

care whether you are doing it out of high-cost New

Jersey or lower-cost Indiana.

Jim provides another perspective on the move:

Another reason we moved to Indiana was to change our

lifestyle. Candy and I recognized that if I continued to

work 80 hours a week, I was going to kill myself. Our

expensive lifestyle wasn’t giving us any quality of life.

Also, I think that the events of 9/11/2001 had

something to do with it. We lost several friends and

some neighbors in the World Trade Center disaster.

Moreover, after 9/11 thousands of people who felt

vulnerable living in Manhattan wanted to move out of

312 Part II • Applying Information Technology

the city. They bid up real estate by 50 percent in our

neighborhood across the river in New Jersey, so we

could sell our house easily and at a very good price.

In March 2002, we took a trip out to Indiana,

and after that trip we decided to move. We sold our

house in New Jersey and bought our present one in

Indiana. We got twice the house for half the money,

the equity in our New Jersey house paid for our new

home, and we now have no mortgage. That was a big

plus in enabling us to devote the time necessary to

bring Cliptomania to the point where it could fully

support the three of us and enable us to hire adequate

help to make sales 24/7 without having to cover every

day on our own.

When they moved to Indiana, Candy quit her part-

time job. She has been full time with Cliptomania since

then. Also, Jim cut back his insurance agent job to half

time and has since hired his own help to continue to build

his insurance clientele in Indiana.

Later Developments

In 2004 Candy began to question the use of Paymentech to

verify and process credit cards. She explains:

Paymentech proved to be very expensive and diffi-

cult to work with. In credit card processing there are

three costs to us: the monthly fee we pay for the

service, a per transaction fee, and the percentage that

the credit card company gets. In addition to a hefty

monthly fee, Paymentech was charging us 20 cents

for each transaction, and in addition was charging us

30 cents for any credits or voids.

I went to our local bank and they set me up

with a group called Nova that was much lower cost

to us. Nova only charges us 10 cents per transaction

and they charge nothing on the credits. Also, the

monthly fee is less and the percentage that the credit

card company keeps is almost a full percentage point

less than it was with Paymentech. That adds up

quickly.

Furthermore, I am dealing with either my local

bank or Nova, and they are much easier to deal with

than was Paymentech. They provide much better

support at substantial savings.

Cliptomania’s Operations

Candy is Cliptomania’s CEO and Christy is Customer

Relations Manager. In addition to sharing responsibility

for receiving and processing orders with Christy, Candy

maintains the Web site, chooses the styles of earrings to

stock, orders the stock, sets the prices, and manages the

inventory.

Customers access the items for sale by clicking on

one or more of the categories arranged vertically along the

left side of the main page. Therefore, Candy carefully

chooses the categories and selects the words to describe

them. Candy also produces the images of the items that are

shown and writes the descriptions that appear alongside

the pictures. According to Jim:

Candy describes each earring very honestly so that

the customer knows exactly what she is getting. But

she has the gift of wording it in such a way that the

person reading about it thinks that she will look like

a million bucks when she wears our $10 earrings.

The quality of the pictures is critical. The

customer cannot pick up an earring and look at it

like you would in a brick-and-mortar store, so if she

does not feel she is seeing the real thing and is not

attracted to the earring, she is not going to buy it.

Candy also does all of our imaging and her pictures

look great!

Earrings are fashion items, so the market is contin-

ually changing. Candy changes Cliptomania’s Web page

almost every day as new items are added, old ones are

removed, items are featured during special times of the

year, items are put on sale, the categories are reorganized,

and so on.

Buying Earrings to Stock

About half of their sales are for fairly standard items that

sell year in and year out. But the other half are fashion

items that are very dynamic. Candy and Christy try to keep

abreast of fashion trends to choose what to stock. There is a

long lead time in ordering and receiving fashion items—in

fact many decisions must be made at the national manufac-

turers’ show in February. Therefore, they depend heavily on

the manufacturers whose judgment they trust to help them

decide what will be hot for the next year.

With the dynamism and long lead times of the fash-

ion business, keeping adequate stocks of the good sellers

while not getting stuck with items that don’t sell is a contin-

uing challenge for Candy. She describes the problem:

We do about 60 percent of our business in the last

third of the year—September through December.

September is the latest that I can order fashion items

and expect to get delivery before Christmas, so I

have to make decisions as quickly as I can figure out

what items are going to be hot for Christmas. In

mid-December the manufacturers worldwide close

Case Study II-5 • The Cliptomania TM Web Store 313

down, and don’t open back up until mid-January.

They have the IFJAG show in February, so they

won’t really start making the stock to fill the IFJAG

orders until March and I will be lucky to get the new

stock in May. When I order in September I figure it

is going to have to hold me until May, but I don’t

want to overbuy on something that will have passed

its peak by the time February rolls around so I will

be sitting on it forever.

Many of the newer fashion items are designed and

manufactured in the United States. Many of the standard

items that do not change are made overseas where costs are

much lower. Even the standard items can be difficult to

maintain in inventory because the lead times on them are

long and delivery schedules can be uncertain. Candy

sometimes runs out of some of her standard earrings that

are best sellers because of shipping problems in getting

deliveries from China.

Candy gets lots of helpful information that is

gathered by the Web site, which helps her with stocking

decisions. She can see how many people visited, how

many put items in the basket but have not bought yet, what

they put in the baskets, and which search engine they came

from and what search terms they used. She can get online

graphs showing sales trends by item as well as for total

sales. She can request summaries for various time periods

and sort by gross receipts or number of items sold.

Candy also uses an Excel spreadsheet she developed

that has a line for each item Cliptomania sells. It shows

the Cliptomania product code, the name of the item, the

cost per unit, the total number she has received, the dollars

she has invested in the item, how many they have sold, the

number damaged or lost in the mail, gross receipts for the

item, total net margin, the vendor of the item, the vendor’s

product code, the current inventory, and the value of the

current inventory. But even with all this information, there

is still a lot of judgment involved in deciding what to stock

and how much to order.

Processing Orders

Cliptomania operates out of the lower level of the Santos’

home in Bloomington, Indiana. There is a large workroom

that contains the inventory in wide shallow drawers in

cabinets and small plastic containers in cubbies along one

wall. There is also room for assembling and packing

orders, two desks with computers, and workspace for

receiving orders. In addition, there are two offices and a

storeroom for packing materials and reserve stock.