Ryan Malesevich's Blog: MD5 to SHA-1 in PHP and MySQL
686172
Ryan Malesevich is taking a break from his look at some handy WordPress packages to share a small series on how to move from using MD5 hashes out to SHA-1 hashes for passwords in a MySQL database. He's posted part one today.   What if you're using MD5 in your web application and want to switch over to another encryption method. It's actually not that hard and I plan to cover them in this multi-part tutorial (I know I planned on writing this months ago, but it's better late then never). In this first part I plan on going over updating the database structure and a 'pseudo-code' of what will need to be done.   As mentioned, he gives the outline (pseudo-code) of how the process will work - basically, creating an SHA1 hash of the MD5 and the username in a "newpassword" column added to your database.
675185
In a new entry on his blog today, Marco Tabini introduces us to 5 PHP Performance Tips that we "probably don't want to hear".   I thought it might be interesting to write an article about the performance-enhancing tips you probably don't want to hear about - that is, those that are most likely to produce measurable (and durable) results but do require some effort on your part.   His list consists of:  You Don't Need To Plan Ahead In Order To Have A Plan Combat Database Abuse Do You Really Need A Database Anyway? Scale Horizontally Refactor To Scale Vertically  For each, he explains the title and gives a bit of validation to the point. There's some great mentions of tools that you can use to help accomplish them too - a profiler, the Lucene and Xapian full-text databases, and Lustre.
705643
The Hardened-PHP Project has released another vulnerability today, this time it's an issue with one of PHP's own internal functions - open_basedir.    The design of the open_basedir feature of PHP that is meant to disallow access to files outside a set of configured directories is vulnerable to race conditions.   It was discovered that this design flaw can be exploited with the usage of PHP's symlink() function in a very easy way. We believe that the only solution to this problem is disabling the function symlink() while open_basedir is used (this feature was therefore added to our Suhosin PHP Security Extension).    They also note, unfortunately, that the problem may not be fixable due to how it can be implemented. They provide a more detailed explaination and some PHP psuedo-code to help illustrate the point.
343971
With the recent acquisition Sun has made (you heard about that, right?), there's tons of resources in the open source community that are talking about it, lots of them are more PHP-specific. Cal Evans has put together a list of some of the PHP bloggers/community memembers that have posted some of their thoughts on the purchase.   With all of the buzz floating around yesterday on this topic, I decided to let some of the dust settle before posting. From everything I've seen, the PHP community is largely positive about the news. [...] As I said, the community at large seems to be pleased with this news. Here are the links I've collected so far.   Names in the list include Andi Gutmans, Lukas Smith and Jaremy Zawodny. There's also a list of some comments from the "pundits" as to what this purchase could mean for the web as a whole.
460038
In this post to his blog, Chris Shiflett talks about some issues surrounding character encoding and the cross-site scripting issues it can open up in your application.    In the post [on Good and Bad PHP Code], he provides a few useful PHP interview questions, including some questions from Yahoo. He explains that good PHP code should be Structured, Consistent, Portable and Secure   In the comments, many additional improvements have been suggested, but there's one that has yet to be mentioned. When using htmlspecialchars() without specifying the character encoding, XSS attacks that use UTF-7 are possible.    Included in the post is an example to illustrate the point as well as a solution, a simple one involving the header() function, to help correct the problem and prevent bad things from happening.   Be sure to check out http://shiflett.org/blog/2007/may/character-encoding-and-xss#comments">the comments for more great tips.
144022
A few more of the International PHP Conference slides have surfaced for your enjoyment:  Sandro Zic - A comparison of PEAR Installer, Phing, and ZZ/OSS Installer alan@akbkhome.com - PEAR and PHP 5 (blog entry)
743840
Chris Shiflett has posted his own recap of the (just passed) php|works conference up in Toronto over on his blog.   I've been traveling non-stop since php|works, so I haven't had a chance to reflect on the conference, what I learned, who I met, and things like that. (Zak has been doing a good job of this lately, and I'd like to follow his lead.) I've probably forgotten more than I remember, but this is my recap.   Included in the things he mentions are:  The people he was able to meet (like Joshua Eichorn and Sebastian Bergmann) The talks he gave ("Truth about XSS" and "Agile PHP Testing") His interview with Cal Evans of the Zend Developer Zone The PHP 5 Certification and Wez Furlong's "Not PDO" talk
90155
Based off of a previous article from Mike Willbanks, Stuart Herbert has posted some of his own thoughts on tuning and tweaking your applications for the best performance you can get out of them.   There's some good advice in there, and I thought it'd be a good idea to quickly add a bit more detail about the separate approaches that Mike raises.   He goes over the APC caching, memcache, the "gzip trick", the "Not Modified" header and optimized SQL statements.   He also mentions one thing that Mike didn't mention - a split between static files (no PHP needed) and their dynamic cousins. Having a more pure Apache (no PHP installed) can help give a minute jump in speed that, depending on the size of the site, could really add up from a user's perspective.
247778
From the PHP-Coding-Practices.com site today, there's a new article that discusses some of the top security vulnerabilities that surround PHP applications.   PHP has allowed people with all sorts of backgrounds to put their ideas on the web. With several hundred million web pages programmed in PHP, security plays a big deal for us web programmers. In this introduction I will outline the most common security vulnerabilities in PHP scripts.   Topics include:  All Input is Tainted Cross-Site Scripting SQL Injection Code Injection Command Injection Session and Cookie Security Securing File Access   Each has their own explanation (including code where needed) that talks about what the issue is and a hint at its solution. This post will be followed by more tutorials that will focus on each of the topics in more detail with solutions to help solve and prevent them from happening in your application.
374142
WebReference.com has posted part two in their series looking at security techniques in PHP. This time they focus on the use of a few things - the PECL filter, the PEAR Auth module and mcrypt.   For each of the three topics covered, they include a few code examples on their use - an HTML form with the filter extension, user authentication with the PEAR Auth, and encrypting data to be used in a more secure cookie.   The article is excerpted from PHP 5 Advanced: Visual QuickPro Guide by Larry Ullman.
519884
Marco Tabini (of php|architect) has posted some thoughts to his blog about the PHP4 end-of-life announcement and its relations to the current push to go PHP5 - mainly how it relates to hosting providers.   I'm sure that a large number are owners of small hosting firms - which, by far, provide the vast majority of PHP-powered websites that Netcraft carefully tracks for us - that sell cheap shared hosting. [...] If you provide shared-hosting plans, it's likely that your servers are still running PHP 4. Upgrading to PHP 5 is a logistical nightmare for two reasons: first, you don't necessarily know that you'll be able to properly set up and secure your systems; second, you don't know that your customers' applications will keep on running.   Both reasons can cause very different kinds of hassles for the hoster, especially when it comes to their customers. As Marco puts it "hell hath no fury like a customer scorned". When things are going smoothly, everything's good, but the second that you try to explain that the update is what's good for them, all they see are things breaking and freak out.   He suggests only one real solution - make the move and tell the customers now that things are changing. Help them all you can (with information about updated software and resources) but ultimately it's up to them to make the change.
506696
On the Zend Developer Zone, Cal Evans has posted a quick look at one of the new offerings from the Manning Publishing group - "PHP in Action".   My buddy Olivia over at Manning Publications sent us a present recently. They are working on the title PHP in Action and they sent us a chapter to share with you. PHP in Action is scheduled to release in April of this year but it's available now in "Manning Early Release Program", or MEAP. MEAP is a cool program that allows you to buy the book long before it is released and have access to the chapters as they are released. Then, when the final dead-tree edition ships, they will send you one. The great thing is, there is no additional cost for MEAP.   He links to the book's description on the Manning site and gives some credit to the authors, Dagfinn Reiersol with Marcus Baker and Chris Shiflett. And, of course, the link to the sample chapter from the book - a look at Design Patterns.
188297
Christian Wenz, back from the php/db|works conference and at a break following the conference, has posted some of his thoughts about this years conference over on his blog.   My schedule was crammed right after php|works 2006, so I could not find an earlier possibility to blog. Anyway, the extended entry contains my short report on php|arch's second conference this year.   He talks about some sightseeing before-hand, Tutorial Day, XML Security demos, Unicode in PHP6, a "slight problem" concerning his laptop, and his role on the Zend PHP5 Certification Panel. Check out the full entry for all of the details and "expect a separate blog entry later" on his experience on the panel.
473226
Damien Seguy has continued his series looking at PHP configurations around the web and is sharing the results in the form of two new reports over on Nexen.net.   I just published the second part of the serie about PHP configurations. This part focuses on three aspects of PHP: PHP extensions, PHP streams, and disabled functions.   You can find the statistics themselves here and the latest configuration statistics here. It's interesting to see the drop-off when it comes to the various modules that are installed ("php, ftp and http are the most common. Besides them, tough luck.") and to see the somewhat more gradual curve of which functions are disabled - with system() topping out the list (with good reason).
416901
Aaron Wormus has a new note on his blog today about his presentation at this year's Zend/PHP Conference & Expo and another speaker he's excited to hear.    One of the Zend conference sessions that I'm pretty excited about is Don Samisa Abeysinghe's (of WSO2) "Fully Fletched Web Services with PHP".   I'll be presenting a session on "Moving to PHP5 with Style." This tutorial/case study will be based on experience in transitioning several codebases from PHP4 to PHP5, creating unit tests & started a move towards a service based architecture without a complete platform rewrite.    Aaron's talk fits under the banner of the "PHP Development" talks, including others on topics like hosting PHP applications on Windows, working with PDO, unicoding in PHP6, and using PHPUnit.
558542
Easy-peasy-sleazy: A new piece of PHP code making the malware rounds can install a phishing site on a compromised server in about two minutes.
732440
The International PHP Magazine has posted results from their latest PHP community poll as voted on by visitors to their site. The question for this poll asked developers what they thought, of the choices on the list, was the most common mistake that PHP developers make.   Coming in at number one by an overwhelming lead was "Not escaping entities and SQL input" (a definite problem indeed) with the next highest option, "Not using a Framework" a full twenty percent lower. The next two options were closer (descending) - "Using old PHP versions" and "No or little use of Object Orientation".   There's a new poll this week for your consideration - this time asking which stage, of the five options, should come first in the development cycle of a typical content management system. Head on over and cast your vote today!