Greg Beaver's Blog: Quick review of Pixy vulnerability scanner for PEAR users
524269
Greg Bever has a (very) quick post about his experiences with the Pixy XSS and SQLI Scanner running against PEAR files.   I tried out the Pixy XSS and SQLI Scanner (http://pixybox.seclab.tuwien.ac.at/pixy/index.php) on a few simple PEAR files.  On the first, I got a java exception, on the second it was unable to resolve the simplest of includes (no ability to resolve include_path). In short, the thing is useless for anything written using PEAR.  Fun!   The Pixy XSS and SQLI Scanner is made to find SQL and XSS injection issues in scripts. It runs as a Java application and scans PHP4 source code to try to find problems. For more information on the scanner or to try it out for yourself, check out the project's homepage for documentation and downloads.
558542
Easy-peasy-sleazy: A new piece of PHP code making the malware rounds can install a phishing site on a compromised server in about two minutes.
77586
David Coallier has an update today on the effort to get PEAR developers all over the world mapped out to a Google map to show their locations - one that's finally been launched.   Over the past weeks we have had many people asking around if it would be possible to have a place to see the pear developers around the world. Well now Christian Weiske and I (With the help of Arnaud Limbourg) have put up a nice little map system on pear.php.net. You can see it at http://pear.php.net/map/   David also links to images of some of the administration panels for the application (one, two, three) and the connection information for a web service (REST) that allows access to all of the data.
125329
Continuing on in their series of working with stand alone PHP scripts, DevShed has posted this third and last part looking at the creation of a basic script you can use to monitor your server (an excerpt from Advances PHP Programming by George Schlossnagle).   Last week, we continued our discussion of PHP standalone scripts with child processes and more. This week, we conclude our discussion and bring together what you've learned.   They start with the creation of a very basic daemon, including permission restrictions. They then modify this heavily to support the monitoring of processes through various parameters like frequency, status_time, and a description of the service. They then create the full example script and show the usage by checking to see if a URL passed in can be opened.   They also include, as a bonus, another more useful script that will email someone when the specified service goes down (still a HTTP check, though).
19207
As Greg Beaver mentions in his latest blog entry, the main website for PEAR, pear.php.net has been mirrored as part of an effort to restructure and "revamp" the PEAR wesbite.   I'm excited to announce the first two mirrors of pear.php.net are now actively mirroring the installer REST files and actual .tgz files of package releases.  They are http://us.pear.php.net (provided by Joshua Eichorn and bluga.net) and http://de.pear.php.net (provided by Christian Weiske).  The option exists at a future date of mirroring the entire website, but this will not be possible without further changes to the infrastructure.   Using these servers is only slightly different than the main site, setting the preferred_mirror setting in your configuration to use one of the above.
767738
Greg Beaver points out the numerous releases that were made in the PEAR community today - including an update to the PEAR website itself.   OK, today's release party wins.  I've just uploaded the 8th package for release, and it's a very significant day of releases.   The three updates made today are:  An update to the PEAR website that allows for patch tracking in the bug tracker The latest version of PHP_ParserGenerator - version 0.1.5 and the release of the first, full-featured parser for PHP - PHP_Parser along with a "companion", PHP_Parser_DocblockParser
559792
Latest PEAR Releases:File_Bittorrent 1.0.2Translation2 2.0.0beta11Crypt_Blowfish 1.1.0RC1PHP_CompatInfo 1.3.2Net_Sieve 1.1.4Auth 1.4.0RC1
122112
Latest PEAR Releases:MDB2_Schema 0.8.0File_Bittorrent 2.0.0b1File_Bittorrent2 1.0.0RC1XML_Query2XML 1.3.0
144022
A few more of the International PHP Conference slides have surfaced for your enjoyment:  Sandro Zic - A comparison of PEAR Installer, Phing, and ZZ/OSS Installer alan@akbkhome.com - PEAR and PHP 5 (blog entry)
357182
In a new post to his blog, Chris Hartjes, spurred on by an article in the latest edition of php|architect magazine (covering protecting your code), has shared a few opinions starting with a certain paragraph near the end.   To start, I will focus on the paragraph above. What I get out of that is that if only your source was closed and hidden from prying eyes, it would not have bugs in it. Which is, of course, total nonsense. Code has bugs because it's open and they feel safer? There are two kinds of bugs: application bugs (which is the code I would write) and system bugs (in this case, bugs that that appear from PHP itself). I'm sorry, but there is nothing I can do if there is a bug in PHP that causes my application to crash except to point this bug out to the people who have the ability to fix it.   He goes on to talk more about how protection like this (the article talks about using the IonCube Encoder) will not stop someone if they're really determine to get at the code underneath the encryption. His only suggestion is to make an application good enough that people wouldn't want to try to steal it as much and would rather pay for their version.   Encode your stuff if you want, but be aware that the minute you choose to do that you are telling your customers "I don't trust you" and I have a hard time understanding a business model that assumes people are going to want to steal the stuff you sell.
313545
Luke Welling takes a humorous look at something he misses in PHP - register globals being set to on.    I am aware that there are some things so shocking that you are not supposed to say them in polite company [...] so confronting that they are best kept to yourself regardless of how strongly you believe them. I have a similarly shocking sentiment that I feel I have to share.   I really like register_globals in PHP.    He reminicies about the days gone by of being able to assume that register_globals is turned on, the days of simpler, lighter code that's even easier for the newbies to get into. Anyone for a tshirt?
666653
Sebastian Bergmann has a quick new posting on his weblog concerning the integration of PHPUnit and Phing.
404297
Latest PEAR Releases:PHP_CodeSniffer 0.1.1Net_UserAgent_Mobile 0.28.0Structures_DataGrid_Renderer_HTMLTable 0.1.1Structures_DataGrid_DataSource_XML 0.1.1Structures_DataGrid_Renderer_XML 0.1.1HTML_Table 1.7.3Spreadsheet_Excel_Writer 0.9.1PHP_CompatInfo 1.4.0XML_Query2XML 0.6.1Console_Color 0.0.4PEAR 1.5.0a1Crypt_XXTEA 0.8.0
41064
Gerd Schauffelberger writes on the PHP-Tools Blog today about the contents of the latest issue from the German PHP Magazine, specifically an article covering the PEAR package HTML_AJAX.   This article's target is (1st) to give a brief introduction to AJAX and how things work from Javascript an PHP side in contrary. Also (2nd) I wanted to show that you actually don't have to muck around with a mess of Javascript (browser compatibility issues and such) because it's it is all done by the Joshua Eichorn's HTML_AJAX framework.    The article doesn't build up an entire application (as Gerd mentions) but it does provide you a good base to work from and gives you a good direction to head from to learn more about this powerful package.
453155
Cal Evans of the Zend Developer Zone has posted a new book review of one of Packt Publishing's latest PHP-related offerings - "PHP Programming with PEAR".    For those who have been living under a virtual rock for a while now, PEAR is the "PHP Extension and Application Repository". In a nutshell, it is a collection of classes, it's a framework, and it's a distribution system. Most importantly though, it's an excellent place to find the classes you need so you don't have to re-invent the wheel. (Ok, beginner's time is over, I promise).   PHP Programming with PEAR, written by Stephen Schmidt, Carsten Lucke, Stoyan Stefanov and Aaron Wormus, takes a look at some important PEAR classes and how you can use them.     He mentions what the book covers (which packages) and highlights some of his favorite bits, including the chapter on web services.
512996
Today, Pierre-Alain Joye has fomally announced his "retirement" from working with the PEAR project as a lead developer. He's making a shift to work mainly towards other graphics/imaging work he's been developing and to continue work with his current extensions (and a few new ones on the way).   I spoke with him on some of the things that had lead up to making this decision and he mentioned it as a two-fold reason: one was some personal conflict between other PEAR developers and himself and the other an issue of time and interest in the project. He still wants to see it succeed, but just doesn't see the time in his life right now to do his part. Pierre will continue to work with the PECL extensions and on the PHP internals groups to help improve and develope them towards future versions. Some of the extensions he lists as the ones currently in his development are things like GD, xmlwriter, Zip (of course), and filter.   It is just a normal process, things and people change. I would have preferred a slower switch, as I was working on my leave (giving lead for many of my packages to other friends).   Pierre's PEAR work can be seen on this page of his blog and includes all of his PEAR and PECL work as well as PHP internals and Pimp/Cairo/GD development work.   You can also check out the decision in his own words over on his blog.
347086
On CodePoets.co.uk, there's a new tutorial posted by David Goodwin showing how to use PHP with the PEAR MDB2 component to access your database backend.   While writing some PHP Training materials for Pale Purple, I thought I'd add an updated guide on PHP and database access. I've already done one on PEAR::DB, but PEAR::MDB2 is it's successor and has a slightly different API.... and as PEAR::DB is now deprecated, it's probably about time I rewrote it anyway.   David looks at what the MDB2 package is, how to install it, connecting to your database and including some error handling as well. He (thankfully) also touches on one of the most handy features of the package - the prepared statements and the security they can offer.