PHPClasses.org: CAPTCHA harder to break using animations
692375
PHPClasses.org is spotlighting another package from their site today - this time it's a CAPTCHA class that takes things a step further and introduces animation into the mix to make it even harder for bots to get through.   Laszlo Zsidi is a PHP Web developer that has written an harder to break CAPTCHA solution. It consists in generating animated GIF images that exhibit the validation text.   Since the text never appears all at once in each of the animated frames, this solution certainly raises the bar in terms of difficulty for the robots to guess the validation text, making it very hard to defeat, if possible at all.    You can check out the class here, including a sample animated gif file and a download of everything you'll need to get started.
1897
Latest PHPClasses.org Releases:Auto-Gen CSS FormsadebugFox captchasecShieldImage ResizerPage Rating Classl10nFuerte Image ToolOsiris CoreOsiris CoreArZipStrOTP_TSArZipStrDBNavigatorWAP PushphpTubegCachePaging Class with AJAX or HREF
633181
Gareth Heyes has a new post today talking about one of the vulnerable values in the $_SERVER superglobal - PHP_SELF.   I thought it might be a good idea to gather a few test cases demonstrating the problem. Why PHP allows these URL's is beyond me and it wouldn't take much work to filter out these malicious URL's in the PHP code.   He provides four test cases to show how simple it is to abuse - one using a HTTP header, another pushing XSS through, the third mentions search pages and the fourth a direct code injection.   You can download the code here.
71505
Latest PHPClasses.org Releases:CAPTCHA 2Get Futurist DatePictoru's GIF TextFormulariosIP_to_countryMsSql To XMLrschatCheck spamTSfloCrosswordPictoru's GIF TextMYSQLCLS_DBFile2XMLColor extractphpmmPHP Array to Javascript
372556
Latest PHPClasses.org Releases:GmAtomclass splashAJAX LockingFormat ConverterGPX Mapper & CMSClass Email SenderWeb Server Infosimple XMLPhoto AlbumMisc StringValidator4FieldsasessioncPanel ToolsLeap year checker
634435
Andrei Zmievski has posted something new to his blog today about a feature of PHP6 that's finally been hammered down - HTTP input (request) decoding.   There have been no fewer than 4 different proposals floated before, but this one combines flexibility, performance, intuitiveness, and minimal architectural changes, and has only a couple of small drawbacks. Let's take a closer look.   He details the functionality - what it is, what's been decided on, and the advantages of the method. The basic approach is a "lazy" one where PHP will only store the request when it comes in, no filtering or anything, until you want to do something with it (i.e. get it via $_GET, $_POST, etc). When the request for data is made, PHP looks at the encoding settings and formats the data accordingly.   Advantages he mentions for this method include removing the guess-work on PHP's part for which encoding the request is and that it removes some of the overhead by not processing the data until it's actually needed.
605863
com staff. Danish security firm Secunia has reported a &quot;moderately critical&quot; window injection vulnerability in Firefox, Internet Explorer, Opera, Netscape, Safari and Konqueror.
194115
On the PHP Security Blog, there's three new posts that Stefan Esser has written up that demonstrate some of the more destructive uses of Javascript that he's found:  JavaScript/HTML Portscanning and HTTP Auth Bruteforcing HTTP Auth in Firefox with JavaScript JavaScript Scanning and expose_php=On    While the first two are interesting, it's the last of these that most directly applies to PHP. He gives a simple "proof of concept" that checks to see if the embedded image is the correct "size" to be related to a webserver running PHP with the expose_php setting set to "on".
740618
Jonathan Street has a tip for those developers out there that have no other choice than scraping content from a remote site - don't make it obvious. He also includes a suggestion on how to make it a little less obvious.   A couple of hours ago I was playing around scraping some content from a website. All was going well until suddenly I couldn't get my script to fetch meaningful content. [...] The first thing I did was stop visiting the site for 15 minutes or so and then increase the time between requests. It briefly worked again but quickly stopped.   One simple change to his user agent string in his php.ini made the problem evaporate pointing to a user agent filtering happening on the remote side. His helpful hint involves two methods - one in just PHP and the other in cURL - to change the user agent that your scripts are sending. An even better sort of solution might be some sort of rotating array that would alternate between four or five strings to make things even more random.
27208
Latest PHPClasses.org Releases:Adventure-(PHP-)FrameworkOhloh APIdm.KittenAuthuserManagerImage TransformSimple error handling classPHP Tree GraphPHP5 Calendarb3rtCSVReaderb3rtCSVWriterCRUD Class
466256
Ligaya Turmelle has relayed some great news in her latest blog entry, something that the web's been needing for a long time - a new group from the W3C created specifically for enhancing the HTML standard.   Now I have to admit to being curious about what is going on - after all anything new dealing with the web affects me as PHP coder. Since the W3C is supposedly interested in input from the Web community and content developers, I decided to see who from PHP would be there. Granted it is very early for the formation of the group so it didn't really surprise me to see no one from PHP that I know or heard about in there, but I wonder if anyone from the PHP Group will become a "invited expert" somewhere down the road.   The group is looking for members to help define this next generation of markup on the web. Check out their page for some of the qualifications needed to participate and for some of the upcoming events.W3C Launches New HTML Working Group
731797
This is really cool!  I finally get my own comment spam!  For some reason I felt left out of the party.  I just wasn't cool enough for the spammers to consider me worthy of their spam.  Anyway.  I implemented my own little turing test.  Now the comments say:  {{{  Turing Test: Are you a human? (required. Just type yes... this is for automated spam prevention)  }}}  While this wouldn't work for all blogs in the wild I'm sure it will work just fine here in my little corner of the blogosphere.  If spammers really want my blog enough then I'll deploy a captcha.  If they solve the captcha I'll deploy a sentient robot  which will traceroute packets back to the host and then terminate with prejudic ...
401233
From the RefreshinglyBlue blog, there's a new post that makes a comparison between two of the most popular web scripting languages - PHP and Ruby - on a practical, basic level.   There are rather significant syntactical differences between PHP and Ruby. For example PHP requires semicolons at the end of lines and generally requires curly brackets to enclose blocks of code. Ruby, on the other hand, uses newline characters to denote the end of a line of code...   The post goes through other differences like: value return methods, function/method naming, similarities between them, frameworks, namespaces, documentation and hosting options.
563255
Harry Fuecks is back today on the SitePoint PHP Blog with part two of his "joy of regular expressions" series, continuing on from this previous entry.   He jumps right in, summarizing the first part in a small section before getting back into the examples:  Hunting for .jp(e)gs Escaping Meta-Characters Search and Replace preg_quote() preg_replace() Word Boundaries, Word Characters...and everything else Sub patterns Spot the XSS Hole eval() is evil! preg_replace_callback()  As you can see, it's crammed with just as much infromation as the first part and covers a wide range of topics to help you get more in tune with your inner regular expression guru.
659863
In this blog entry Arnold Daniels talks about an issue he had in the past (needing a bit more functionality than the PEAR DB library could offer) and how he ended up solving it with what he calls a "dark corner" of PHP - class casting.   PHP has a function serialize, which can create a hash from any type of variable, scalars, array, but objects as well. Using the unserialize function, PHP can recreate the variable from the serialized hashed. If we look at how an object is serialized, we see only the properties and the class name are stored.   His method allows for class manipulation via changes to the serialized class information (like changing the value of the name parameter). His "casttoclass()" function makes changing this value simple.
70997
Latest PHPClasses.org Releases:DAOSQL2CSVGD2 ClassCBenchmarkdeckThe ZipavRIFEdit BitmapPHP DirectAdminbm_chartLinkedin public profile plugin for SerendipityArc LengthPHP IOCDataGridAnother CAPTCHA projectNewsBox
437982
One of the more elusive concepts of programming can be working with regular expressions. Now, there's lots of places to learn them and to get a handle on what they can do (such as this book), but what if you don't need the full-blown reference and just want a quick and dirty reference source? ILoveJackDaniels.com is happy to be of service with their latest cheat sheet divided up into the different formats (anchors, character classes, assertions, escape characters, etc).   The Regular Expressions cheat sheet is designed to be printed on an A4 sheet of paper and live by a designer or developer's desk, to make life a bit easier. A description of what is on the cheat sheet follows, or if you are impatient, you can go straight to the full size Regular Expressions cheat sheet.   This time, they've posted it in a few different formats, including a torrent file to make for faster/easier download. They still have the usual methods (PDF and PNG) but you'll need to visit the page for those links - it's been requested not to directly link to them.