I just ran across this article that describes how researchers have discovered (and documented) a way to inject nefarious code into a computer in such a way that:

• avoids anti-virus detection
• does not rely on a vulnerability exploit
• survives hard disk formatting (or even replacement)

All an attacker needs to accomplish this is root access to the machine... that is, you administrative account password.

So, make sure you're machine passwords are strong!

To create the custom form, I used Google Docs to create a Google-hosted form.  Then I simply looked at the generated form, lifted the relevant HTML, and pasted it into my own CMS (MyST Blogsite, in this case, but any HTML web page would do.)

I basically rewrote the generated HTML to simplify it, style it the way I wanted, and to add some simple JavaScript form validation logic as you might in any web form.  The key was starting with the Google-generated form so I had the appropriate field names and action address.

To see the detail, feel free to view the source of this page:
http://myst-technology.com/public/enterprise-rss/setup

(Search the source for "SETUP_FORM" to find the custom form.)

There is a little HTML/JavaScript trickery that may not at first be obvious.  This is not absolutely necessary, but I added it to provide a little smoother user experience.

First, there is a hidden DIV element that contains a thank you message.  The JavaScript shows this DIV after the form is submitted.  Search for "ID_Response" to find this DIV.

Second, there is an empty IFRAME (search for "id_result") that is used to hold the response from the form submission.  This is accomplished using target="id_result" on the custom FORM element.  And, since we present our own "thank you" message for form submission, we really don't need to see Google's response, so I set the height of the result IFRAME to 1.