I can't address everything, but on update 2, are you using contemplate? That is the easiest way I know to link an image to another page. Let me know if you need an example of the code needed.

I use View Rotator a lot, but never use imceimage. I use CCK, imagefield, and imagecache. Those three work great together. There are several ways to make it work. Let me know if you need some more specific help.

I have not looked into using contemplate, but I will check it out right now. I've heard of it before in reference to views rotator, but never looked into what it actually did. I'll keep you posted.

Thanks!

Let me know if you need any help with it.

Took a look at it, and it looks like it's definitely over my head. I'm trying to find some documentation on it or a tutorial somewhere, but not having much luck. Unfortunately at this point my skills in drupal are little more than setting up modules and doing the occassional edit to a css document. Any help would be greatly appreciated.

If it helps at all, you can check out the test page I made for views rotator at http://www.tenmilevineyard.org/test

My end result will hopefully be that same thing but at the bottom of the front page of the site and when visitors click on the image it will take them to the specified page. I'll be adding and removing images every month or so as new events come up.

Given all that info, any advice or tips you can give would be greatly appreciated.

Thanks again!

Here's how I have done it:
1) Create a CCK content type with an imagefield and a link field.
2) Set up an image cache profile if you need image resizing / cropping
3) In the content type, set up the image to display with the appropriate imagefield profile (no link).
4) In Views, select the node body as the field to display.
5) In Contemplate, select your content type, and click to override the body output and enter something like the following in the body template:

You will need to change "$node->field_your_link_field[0]['display_url']" and "$node->field_your_image_field[0]['view']" to correspond to the appropriate body variables, that you can find in the "Body Variables" section.

Email me if you are interested in going this way but need help, and I'll step you though it.

jeff@studioninecreative.com

Thanks so much for your help, as I'm following your steps I do have one question so far. To add a link field to a content type, does that require a separate module? When I try to add a field my only options are Date, Datestamp, and Image. If I do need to add another module, what is it called?

Thanks again for all your help.

http://drupal.org/project/link

sent you an email Jeff, thanks for all the help.

Don't forget to escape all text that goes to the page. I don't think the link in this case is being properly escaped which could allow someone to do some cross site scripting.

Instead of putting an a tag in the template I would use the l function. It can provide filtering for you and check the url. If not that, make sure you filter that a tag with something to make sure any bad stuff is removed. In the case above I could execute arbitrary JavaScript on a page.

Wow, everything you just said went over my head.

@smurray - When something from the database get's presented in the page it needs to be sanitized to make sure there is no malicious code in it. This should happen for any data that can be entered via any interface.

Something bad can happen when someone puts malicious data (e.g., JavaScript) in a field, submits that field, and that info it presented back to someone else without having the malicious code filtered out. The most common form of attach is called a cross-site scripting attack.

Drupal provides mechanisms to help with this.

To start, many of the variables in drupal are sanitized for you. The $output variable in views templates has been sanitized before it gets to the template. The $content variable in page.tpl.php and node.tpl.php files are other examples.

Some pieces of information you can display have not been sanitized for you. They are the pieces of info that aren't presented as is. For example, if you start picking random info off a $node object you might get something that hasn't been filtered.

If you present unfiltered data to the user you are opening them up to an attack.

Some places to start learning how to handle this are the Writing Secure Code section in the handbook, the functions filter_xss(), check_markup() and check_plain() on http://api.drupal.org, and any functions that build things for you. For example, I use l() to generate my links because it has ways of filtering my stuff.

This is a general thing that goes well beyond drupal and theming. Starting to make sense?

@MF - It makes sense a little, though most of the technical details still go way over my head. I'll read some of the links you mentioned and see if I can understand more. For now however, would you say the church's site is in danger by having it how it is? Is the problem something that any visitor can take advantage of, or is it only those who can create the content type that is using the template I made?

@MF - Would it be possible for you to help me understand how to use the code that was included in the theme.txt file of views rotator in order to change the settings when using Drupal 5. I've looked through everything in the txt file a couple times, but as I've mentioned before I'm extremely new to all of this so the code doesn't make much sense. I'm not sure how much of it I need to copy and paste into my template.php file and also where to paste it, what to override in the current file, etc... Any help you can give would be greatly appreciated.

Matt,

Is the concern you mentioned above only a concern if the public is adding node content themselves? What if I'm the only one that can create content on the site?

@IX - That was my question as well, you just weren't quite as long winded as I was :)

I was highly interested in knowing whether the concern you mentioned above was applicable to sites that don't allow the public to post info. Can you point me in the right direction to read more about the concern you raise? Thanks.

As a rule anything input by a user should be sanitized before display. If only admin are going to input information that may be different.

But, say you have a secretary who is copying something from MS Word and pasting it into a field that should be sanitized. Especially if there is a WYSIWYG in the loop. When I say admin I mean someone who can spot something malicious in a field and they are entering it in the field.

Sanitation should happen at the time of presentation instead of storage time. You might sanitize the information differently as a web page vs an excel file vs something else.

Thanks. I'll do some more reading on how to do this properly.