DotVoid.com: Parsing the user agent string using PHP
690580
On the Dotvoid.com blog today, there's a new post that shares some handy code to parse out information from the incoming user agent string for the visitors for your site.   Recently I experimented a bit with an Apache log file analyzer written in PHP. It's not all that difficult were it not for trying to parse the browser, or user agent, string. [...] For my purposes I don't care much for the operating system details. This is the result so far. I'm still not very satisfied but I thought maybe other people might be interested and maybe help out.   He provides the code in the format of an encapsulated PHP function that returns the product they're using, the version number of the browser and other various comments.
194115
On the PHP Security Blog, there's three new posts that Stefan Esser has written up that demonstrate some of the more destructive uses of Javascript that he's found:  JavaScript/HTML Portscanning and HTTP Auth Bruteforcing HTTP Auth in Firefox with JavaScript JavaScript Scanning and expose_php=On    While the first two are interesting, it's the last of these that most directly applies to PHP. He gives a simple "proof of concept" that checks to see if the embedded image is the correct "size" to be related to a webserver running PHP with the expose_php setting set to "on".
347402
In this new post on the PHP Security Blog, Stefan Esser brings up an interesting issue when dealing with web applications - being able to bind a script/application to a different port on the local machine.   Unfortunately the ability to bind yourself to a port and receive connections is a threat to webapplications installed on different virtual hosts on the same IP, even if other security measures in place, like tight filesystem permissions or executing PHP script with the permission of the owner.   He gives an example in PHP of how this can happen and one of the scary side effects of having it in the same domain - the cookie information is passed in. It's a simple concept that could have very bad consequences in the wrong hands.    Additionally, you don't even have to create it in PHP either. As cyberlot mentions, it could be created in any language that has socket functions. Be sure to check out the comments for more thoughts and comments on the post.
703645
In a new post to the PHP Security Blog, Stefan Esser points out a recent commit to the PHP core as a fix to the session handling in PHP:   I just came back home and saw a very recent commit to PHP's session management. It is another attempt to fix the session cookie attribute injection that the PHP developers already tried to fix in PHP 5.2.3 without giving any credits. [...] their new fix that consists of blacklisting a bunch of legal characters from the session id, will most probably result in hundreds or thousands of broken sites.   Stefan points out that the fix blocks several valid characters that sites could potentially use in their session IDs, and that with this new code in place, it could drastically effect those site's functionality.   As of the time of this post, however, it seems that the issue has been recognized and corrected so as not to cause the above mentioned issue in future updates.
728050
According to this security release from Secunia, there's a cross-site scripting vulnerability with the Travelsized CMS package (PHP-based) in the main index file.   David Vieira-Kurz has discovered some vulnerabilities in Travelsized CMS, which can be exploited by malicious people to conduct cross-site scripting attacks.   The problem comes from the input parameters "page" and "langauge" not being verified and sanitized. Users are encouraged to go in and manually edit the source to correct the problem as there is no patch currently posted as of yet. You can get complete information about this issue from the full Secunia report.
558542
Easy-peasy-sleazy: A new piece of PHP code making the malware rounds can install a phishing site on a compromised server in about two minutes.
139275
Popular posts from PHPDeveloper.org for the past week:PHP-Coding-Practices.com: Try-Catch Syntax WeirdnessPHPBuilder.com: Cross-Platform Database PHP DevelopmentIBM developerWorks: Java and PHP technology on AIX - Integrate the Java business application w/ DB2OpenSourceCommunity.org: What do you think makes a good CMS?Jonathan Snook's Blog: Elemental: Conditional Content with CakePHPDevShed: The Basics of Using the Factory Pattern in PHP 5Builder.com.au: PHP exploit code plants itself in GIFJohn Cox's Blog:  Linux.com Now PHP PoweredNick Halstead's Blog: Solving Programming ProblemsPHP-Tools Blog: Testing FIT
350929
As Ed Finkler points out there's a new article posted (written by him) on the C7Y site (from php|architect) talking about his Inspekt library - an introduction to the filtering library showing how to help make your applications safer.   Inspekt is a library for PHP4 and PHP5 that aims to make safe input handing easier, and unsafe actions more difficult. Inspekt establishes a new development approach by wrapping input within "cage" objects, and requiring the developer to use validation and filtering methods to test and manipulate the input data. This article provides a brief introduction to Inspekt and its capabilities.   The article covers all of the basics - what the library can do for you, how it integrates into your application and how it helps to protect you from potential problems with the data in your superglobals ($_GET, $_POST, $_REQUEST, etc).
284802
Fast, intelligent, automatic spam detector using Paul Graham style Bayesian analysis of word counts in spam and non-spam emails. Filtering adapts to personal tastes automatically. No manual rule creation required. This release adds the final missing pieces to the new parser code.  MBX files and Content-Length headers are now supported.  Database cleanup when signals are caught has also been improved.  I would like to move 1.1 into the stable branch fairly soon so if folks would test out this release and report any problems it would be a big help!   The latest release can be found here: https://sourceforge.net/project/showfiles.php?group_id=61201&package_id=73566
728813
Matthew O'Phinney has a reminder for anyone in the Burlington, VT area tonight - there's a meeting of the Burlington PHP user group tonight at 5:30pm.   Bradley Holt will be giving a presentation on developing a web application using Zend Framework. Bradley Holt is founder and web developer for Found Line, a local design and development studio which has used Zend Framework in several recent projects.    You can get more information about the meetup from this event page on their Google Groups site (happening at the Brown & Jenkins Coffee Roasters).
310656
Popular posts from PHPDeveloper.org for the past week:IBM developerWorks: PHP frameworks, Part 1: Getting started with three popular frameworksWeb Development Blog: Tutorial: FTP Upload via cURLJoey's Blog: 8 Practical PHP Regular ExpressionsJeff Moore's Blog: Keywords and Language SimplicityAlessandro Crugnola's Blog: AMFPHP and mbstringTravis Swicegood's Blog: Why Inheritance SucksStefan Mischook's Blog: Creating Custom PHP Functions Video Tutorial - Part 3Johannes SchlÃ¼ter's Blog: PHP 5.3 UpdateInternet Super Hero Blog: mysqlnd to support PDO, mysqlnd in PHP 5.3Jacob Santos' Blog: Object Oriented Programming Isn't Easy
472605
Latest PHPClasses.org Releases:Simple CAPTCHA ClasssynDirectorycache_TSLinkMeInSimple HTTP browserImgManClasse UploadSingleton Interfacebib_servercaText n caMathgMemCacheClasse PrestazioniText To SpeechAutoForm
515933
Evolt.org has a new tutorial posted today concerning something that I still get a lot of questions about - creating a PHP Login System with Admin Features.
396172
Alexey Zakhlestin gave a talk for the PHPThinktank IRC channel recently on the topic of YAML, PHP, and some of the work that he's done combining the two.   It happened a bit of spontaneously, so noone was invited. It was my first try, to make introduction to yaml for php prgrammers, and if there is more interest I will give another talk which will cover more details, this time with proper scheduling :)   You can check out the log of the discussion for his entire talk (covering topics like what YAML is, where to get more information on it, some of its features, and a mention of the Syck library for parsing it).
84867
Tobias Schlitt has a great (long) post responding to a proposal made on the php.internals mailing list for the inclusion of "taint mode" in upcoming PHP versions.   Tobias starts with an overview of what "taint mode" is so that everyone's on the same page. His example involves the incoming and outgoing data usually involved in an application and how the incoming can be the most problematic when it comes to the values inside. This is where taint mode can come to the rescue. At its most basic level, it's a method for, assuming everything coming in is "tainted", creating a mechanism to automatically clean the data before it's even touched.   With the basics down, Tobias looks back to the proposal for a few additional comments. He considers the proposal a great way to introduce the functionality to the language. There are some draw backs he mentions, though, including the additional overhead of working through every inputted value.   Overall, I think this whole thing would be a great addition to PHP and I hope this could come for 6.0. What do you think?   You can also check out some other opinions on the matter:  "Tainted mode" pour php on the Kamelot Blog
698334
Popular posts from PHPDeveloper.org for the past week:The Bakery: Six New Articles/Tutorials PostedEvert Pot's Blog: PHP: Arrays vs. ObjectsDevArticles: Learning AJAXInternet Super Hero: PHP: mysqli_fetch_all()David Coallier's Blog: PHP Namespaces (Part 1: Basic usage & gotchas)I/O Reader: 15 Cool Things & 12 Things to Dislike About PHPProPHP Podcast: Newscast - August 16, 2007PHPBuilder.com: Dynamic XML with PHPSite News: Popular Posts for the Week of 08.17.2007PRADO Watch Blog: PRADO Watch: Interview With Timani Tunduwani - Why I Moved From CakePHP to PRADO
565545
On Dotvoid.com, there's a new post that reminds us of two of the more "ajaxified" features of the new releases of PHP 5 (like 5.2) - the JSON extension and the functionality to track file uploads.   These features aren't competing for the heavy weight title in the release notes. Still, having these implemented in PHP makes it a lot easier to develop modern, more responsive, web based applications.   You can get more info on the JSON extension here and an example of the file upload monitor in this entry on the Bitflux blog.