So, you know the drill. Drag this onto your bookmark toolbar:

Random Password

It uses code from str_shuffle() (project php.js) – thanks guys!

You can edit the javascript code and change the set of characters that are used in the password (str). You can also change the password length there (passLength).

I did search the web for an existing solution before writing my own. I found quite a few bookmarklets that generate a unique password based on your master password and the place that you want to use the password for. It wasn’t my case. I needed passwords for new ftp or mysql users, this kind of stuff.

To be honest, I haven’t tested it in anything else than Firefox, the only true browser ;-)

The reason is that php.exe when run from a command line uses a different php.ini than PHP that’s run as an Apache module. To fix this edit cake.bat and add -c"C:\xampp\apache\bin\php.ini". This is the path where XAMPP placed php.ini.

Anyway, here’s a piece of code that unbinds all belongsTo models in order to remove JOINs from an updateAll() query.

(suggested by Serge Rodovnichenko)

Setting $content->recursive = -1 doesn’t work. I debugged the call in CakePHP 1.2.5.

Edit September 27th, 2009:
Let’s move this up to another level – let’s override the default updateAll() and add support for recursive = -1. Add this to your app_model.php

Then I googled for an online ico creator and found iConvert that can not only create Windows icons but also Mac and Linux icons.
Click, click and I was finally able to link my shortcut to a new icon. Perfect!

But what if you need to clone sets of radio buttons? You end up with a single group of radio buttons – not with a group of radio button groups.

If you clone the whole cloneThis group you’ll get a group of six radio buttons but you’ll be able to choose just one.

Unfortunately, you have to give up the empty square brackets and start numbering them (name=”options[0]“). In the cloning function then you replace the cloned number with an ever increasing counter value.

This function is generic and works for any set of input fields (not textarea and select though). You can have many “add this” and “add that” on a single page and still use the same function. You just have to switch from using id to class for identifying the containers, links and cloning sources.

1. A password (or/and username) that doesn’t contain any numbers
2. MySQL type conversion in conditions – when comparing a VARCHAR column to an INTEGER value it converts VARCHAR to INTEGER, not the other way around.
3. My own database wrapper was trying to be smart and didn’t wrap numeric values with apostrophes

Consider this template:

and something along these PHP lines:

I won’t go into details about mysqlValue(). The important part is that it checks for special cases of NULL, true, false and is_numeric() and runs the rest through mysql_real_escape_string(). Then it inserts all parameters into the template using vprintf().

The problem is with is_numeric(). After being evaluated as a numeric value, ’00′ is entered into the query without apostrophes.

And because any varchar that doesn’t contain a number compared to an integer is evaluated as true the result is a catastrophe.

'abc' = 00 is evaluated as true. 'abc1' = 00 would be false however, unfortunately only few users append a number to their password. If you use 00 for both the username and the password you get authenticated as the first user who didn’t do so.

Check out this false bug report or the related documentation page.

Why you could want to pass numeric values without apostrophes

I wonder myself :-) Here are some reasons I remembered:

• I need to pass NULL in some cases and for that I can’t use %d
• Using apostrophes for integer comparison (1 = ’1′) means unnecessary type conversion that takes time. A small amount of time but still.
• An argument for abandoning the is_numeric() code: Using %d and %s in SQL templates provides a visual clue about what values can be expected there. But then I couldn’t insert NULL values.

So how to fix this mess?

What do you think? Should I remove the is_numeric() test and replace all %d with %s in all SQL templates? Remember that printf("%d", "'123'") will return 0.
Or should I keep the is_numeric() test and rewrite vulnerable queries to use for example CAST:

Update 2010-01-18: I added the real reason for wanting to preserve %s in the template.

Update 2010-01-20:
Unfortunately, what I thought to be a solution (CAST(%s AS CHAR)) has another flaw – strips leading zeroes from the username / password which results into authentication failure.
So dear reader, any ideas?

I created a file /app/views/layouts/popup.ctp that contains only:

And I call the static page as:

Which is created using this call:

With this setting in my /app/config/routes.php:

That Router setting is redundant if you use urls that look like this:

Then you also have to use a different call to the Router::url():

We all develop (and test) on one computer and deploy to a different computer to make the changes live. Having to run the application in two different environments brings a challenge of using different configuration based on where the application runs.

Multiple configuration files

I started by having two configuration files, one for my dev box and another for the production server. They were named the same and I had one on my dev box and one on the server. Each deployment though, meant that I had to be careful not to overwrite the server file with my local copy. That ruled out using a simple synchronization script like lftp or WinScp.

The simplest solution is to name the configuration files differently and upload them both to both servers. All right, even simpler is to have a single configuration php file and define different values using if/else but that can quickly get out of hands as the number of variables grows.

If you need to upload to more production servers (more than one customer) you need to use some more sophisticated deployment script (Ant?).

Let’s return to the simple solution for now. You need to find a piece of information that can be used as a computer identifier and use it to choose the right set of configuration data.

$_SERVER['SERVER_NAME'] & $_SERVER['SERVER_ADDR']

You can use these two for most situations. I develop on my workstation and I have set up domain name based web hosts (C:\xampp\apache\conf\extra\httpd-vhosts.conf) using fake domains (C:\WINDOWS\system32\drivers\etc\hosts).

Using $_SERVER['SERVER_NAME'] works when you know it up front but sometimes your client is going to choose it just before launching the site. Or he decides to change it later on. Not a big deal but I don’t like chaos.

$_SERVER['SERVER_ADDR'] is also fine but don’t forget to change it when your production server’s ip address changes. Not an issue if you use just two computers with 127.0.0.1 and “else”.

Running scripts locally

Sometimes you need to run a script locally as an extra level of security. Say you run a cron job and you don’t want public to mess with it by running it off schedule. So you run it as http://localhost/tadada.php and check for SERVER_NAME/ADDR to make sure it was indeed run that way. But then your cannot use it for picking the right configuration set.

getenv(“COMPUTERNAME”) to the rescue

This value is unlikely to change during the lifetime of your application and doesn’t change based on the way you run it. The drawback is that not all servers define this variable so you may have to seek a different computer identificator.

What is your way of dealing with configuration sets?

Here’s what you probably try at first:

It’s not gonna work and you will have to use find(‘all’) and Set::combine() to get what you want:

The recommended way now is to place it into the key or not make the array associative at all. It is no longer possible to put it into the value part of the definition.

So instead of:

you have to use: