Gareth Heyes' Blog: Exploiting PHP SELF
633181
Gareth Heyes has a new post today talking about one of the vulnerable values in the $_SERVER superglobal - PHP_SELF.   I thought it might be a good idea to gather a few test cases demonstrating the problem. Why PHP allows these URL's is beyond me and it wouldn't take much work to filter out these malicious URL's in the PHP code.   He provides four test cases to show how simple it is to abuse - one using a HTTP header, another pushing XSS through, the third mentions search pages and the fourth a direct code injection.   You can download the code here.
582158
Michael Kimsal points out the posting of the latest part of his "Grails for PHP developers" series to his blog site - Part Five of the series.   I've put up the latest installment in my "Grails for PHP developers".  Rather than delve too much more in to Grails head on, I'm taking this installment (and at least the next one) to delve more in to the Groovy language itself.  Groovy offers similarities to PHP, but also many differences which can trip you up if you're not careful.  I'll try to lay those out as best I can in the next couple of installments.   This new part of the series goes back and puts the spotlight on GRoovy, the base of the Groovy/Grails combo. He talks about working with variables and arrays as containers for multiple pieces of data and some possible gotchas that could come up along the way.
187716
This month's edition of PHP Magazine has been released!
761608
Over on the Zend Developer Zone today, there's a newly posted interview with Chris Hartjes a developer and speaker in the PHP community.   I first met Chris Hartjes at php|works in Toronto where he was giving his What Can PHP Learn From Ruby on Rails talk. As I described him in one of my blogs from php|works, he looks like a biker with a laptop. He's large but he's always got a smile on his face and is always available to help if you've got PHP questions. Chris was kind enough to sit down with me and spend some time talking about PHP and his work at VerticalScope . Here's how our conversation went.   They talk about how Chris got into programming (including his first computer), his work with vBulletin, a little MySQL discussion, and some thoughts on PHP6.
84867
Tobias Schlitt has a great (long) post responding to a proposal made on the php.internals mailing list for the inclusion of "taint mode" in upcoming PHP versions.   Tobias starts with an overview of what "taint mode" is so that everyone's on the same page. His example involves the incoming and outgoing data usually involved in an application and how the incoming can be the most problematic when it comes to the values inside. This is where taint mode can come to the rescue. At its most basic level, it's a method for, assuming everything coming in is "tainted", creating a mechanism to automatically clean the data before it's even touched.   With the basics down, Tobias looks back to the proposal for a few additional comments. He considers the proposal a great way to introduce the functionality to the language. There are some draw backs he mentions, though, including the additional overhead of working through every inputted value.   Overall, I think this whole thing would be a great addition to PHP and I hope this could come for 6.0. What do you think?   You can also check out some other opinions on the matter:  "Tainted mode" pour php on the Kamelot Blog
242013
Popular posts from PHPDeveloper.org for the past week:ProDevTips.com: Writing a CMS/Community with Smarty and the Zend Framework: Part 6Nessa's Blog: Using an .htaccess with PHP Compiled as CGIArnold Daniels' Blog: How I PHP: The Output Handler - ContinuedMartynas Jusevicius' Blog: PHP 5 features: Class autoloadingSean Coates' Blog: Actually Solving a Problem (believe it or not)The Northclick Blog: Message Queue Project: First working versionStefan Mischook's Blog: A Question about object properties in PHP ClassesJob Posting: G2 Technology Seeks PHP Developer (Memphis, TN)Rob Allen's Blog: Zend_View: Access the view from a view helperDavid Walsh's Blog: Using PHP Generic Objects To Organize Your Code
385236
Scott Mattocks is back with the latest installment of the PHP-GTK news, issue number 22.   It's been a while, but I finally have some time to get back to summing up the world of PHP-GTK. Things have slowed down a little in the past few months on the development side but that doesn't mean that the world of PHP-GTK 2 has stood still.   In this edition, there's a call for help for anyone that would want to join the other (4!) developers in working on the PHP-GTK 2 project as well as some general information about the project and its involvement in the community - from talks at php/db|works, International PHP Conference, and the Zend/PHP Conference to the many PHP-GTK-related articles being printed to a new online resource for PHP-GTK tutorials.
273337
Here's what was popular in the PHP community one year ago today:Job Posting: National Auto Warranty Seeks MySQL DBAJob Posting: National Auto Warranty Seeks PHP Web App Developer (Wentzville, MO)DevShed: Creating a Login Script for a PHP Invoicing SystemZak Greant's Blog: The eZ partner program (response to Seth Gottlieb's Commercial O/S business post)php|architect: Application-level Logging with the Zend FrameworkPaul Reinheimer's Blog: Object-Oriented PHP, Concepts, Techniques, and CodeRyan Malesevich's Blog: Fight Spam Comments with Bad Behavior and AkismetZend Developer Zone: SQLite: Lean, Mean DB MachineBuilderau.com.au: Cache PHP scripts with APC modulePro-PHP Podcast: Interview With Cal EvansSitePoint PHP Blog: PHP extension for Cairo graphics libraryTechnobabbler.com: making a radar loop with PHPDevShed: Working with MySQL Result Sets and the Decorator Pattern in PHPJob Posting: exhibit-E Seeks Interactive Developer (New York, NY)Jacob Santos' Blog: Patterns for PHP: Page Controller Draft
343971
With the recent acquisition Sun has made (you heard about that, right?), there's tons of resources in the open source community that are talking about it, lots of them are more PHP-specific. Cal Evans has put together a list of some of the PHP bloggers/community memembers that have posted some of their thoughts on the purchase.   With all of the buzz floating around yesterday on this topic, I decided to let some of the dust settle before posting. From everything I've seen, the PHP community is largely positive about the news. [...] As I said, the community at large seems to be pleased with this news. Here are the links I've collected so far.   Names in the list include Andi Gutmans, Lukas Smith and Jaremy Zawodny. There's also a list of some comments from the "pundits" as to what this purchase could mean for the web as a whole.
403472
Reinhold Weber has put together a list of signs (40 in all on his "programming list of shame") that you're a lousy PHP programmer. Here's a sampling:   don't see the need and/or benefits of a good programming IDE like Zend Studio or Eclipse PDT have never used some form of version control like Subclipse don't use a consistent methodology don't use test-driven development don't return content but echo or print it from your functions or classes return HTML, not data, strings, or objects. don't allow intelligent error handling you think reusable software equals/requires your code to be OOP   Now granted, some of them are a bit more high level than others, but if you're not headed towards a lot of these, you might change paths, hop out of that comfort zone and branch out into the community and the language a little bit more.
20039
Paul Jones will be one of the presenters at this year's php/db|works Conference happening up in Toronto this week and he's offering a teaser of his talk (here's the synopsis) for those interested - "Organizing Your PHP Projects".   Fans of Henry Hazlitt's "Economics in One Lesson" will recognize the kind of talk I have in store, although I don't have the time available to expound in detail the way Hazlitt does. The talk will consist of a one-sentence lesson for you to remember when deciding how to organize your PHP project, whether it's a library, an application, a CMS, or a framework. I'll then explain how to apply the One Lesson in your project, and the various follow-on effects the One Lesson will have on your project organization.   He also jokes that he'll be the only presenter to use references to livestock, Jimmy Hoffa, and Mir as a part of the talk. He's even included a slide of the presentation for even more info.
89086
With the third posting in his "Crouching Javascript, Hidden PHP" series, Harry Fuecks has a new script server that allows you to comingle PHP and Javascript in a very interesting way.
45632
Matthew Turland has posted some of his thoughts about a topic that's being tossed around in the programming world these days - that PHP is "on its way out".   I have to vehemently disagree with this, and not just because PHP is my language of preference.   He gives several reasons to back up the claim including the fact that large players use the language in high-profile sites as well as the recent upturn of popularity the language has seen (as people come back from the over-hyped other languages).   He mentions collaborations between PHP companies/divisions as well as components made to more efficiently run PHP applications on other web server types.
761948
A new submission from Ophir Prusak came in this morning about a new article he has posted on his site - Understanding PHP - How did we get here?
451020
On CodeSnipers.com there's a new book review of one of O'Reilly's PHP-related offerings, "PHP Hacks" by "Jack D. Herrington".   I had borrowed a Perl Hacks book from and friend and really liked it, it was great! It had a lot of practical things as well as some fun things. I expected the same from PHP Hacks and I was not disappointed!   She links to both the table of contents and the sample chapter to give you an idea of the feel of the book. There's two main sections in the review covering both aspects of the book - the Practical Stuff and the Fun Stuff. Of course, no book is perfect, so there is one thing she mentions that wasn't really worked into the book, but you'll need to read the review to find out what.
275619
Travis Swicegood is teasing us with some output from a script in his latest blog post:   So my free time of late (what there is of it) has been spent on a project that's getting really close to v0.1 release. In other words, its first functional release. If you've ever run a test using the PEAR installer or know what a .phpt file looks like, you might be able to guess what I've been up.   Keep an eye on his blog for more information on his "secret project".
475410
On the SitePoint PHP Blog today Troels Knak-Nielsen asks th3e question "what's so bad about the singleton?" For all of its advantages, is there a darker side of the design pattern when it pertains to global variables.   As I have often taken this stance myself, I found it reasonable that I should be able to argue for it, so I'll try to give an explanation. This is also in part a follow-up on my post from last week, in which I present a way to avoid global symbols, without spending much time on why.   He talks about what they are and how they're commonly used - sometimes with some unpleasant side effects because of their use of globals.