Tobias Schlitt's Blog: Taint mode for PHP?
84867
Tobias Schlitt has a great (long) post responding to a proposal made on the php.internals mailing list for the inclusion of "taint mode" in upcoming PHP versions.   Tobias starts with an overview of what "taint mode" is so that everyone's on the same page. His example involves the incoming and outgoing data usually involved in an application and how the incoming can be the most problematic when it comes to the values inside. This is where taint mode can come to the rescue. At its most basic level, it's a method for, assuming everything coming in is "tainted", creating a mechanism to automatically clean the data before it's even touched.   With the basics down, Tobias looks back to the proposal for a few additional comments. He considers the proposal a great way to introduce the functionality to the language. There are some draw backs he mentions, though, including the additional overhead of working through every inputted value.   Overall, I think this whole thing would be a great addition to PHP and I hope this could come for 6.0. What do you think?   You can also check out some other opinions on the matter:  "Tainted mode" pour php on the Kamelot Blog
75713
Chris Chabot has posted a PHP package he's worked up that functions as a daemon sitting and listening on a socket.   To deal with 1000's of concurrent, always on (comet aka hanging iframe) http (server) connections, and an equal amount of IRC client connections, plus being able to interpret and parse and delegate all the messages and events, i needed a very fast, stable, flexible and easy to use 'daemon' library for PHP.   He links to the tarball of the release and to the project page as well as including an example of its usage - creating a simple HTTP server with various hooks built in (like on_connect, on_read, and on_timer).
649335
Michael Kimsal has posted some more thoughts on what he calls the "sad state of PHP development" pointing out some of the practices of the PHP group surrounding the development of the language.   Every few months there's a release, whether large or small, which introduces new features and bug fixes. However, with every release also comes fears of tiny, sometimes undocumented, changes that break existing code, and often for no solid reason other than someone with commit access decided they liked the 'new' way better than the old way.   He points out a specific example, get_object_vars and how its return values were changed in an earlier release as well as the update to glob made recently to change its return types.    In his opinion:   No changes should be made to the PHP core without an issue being opened, either in the 'bug' tracker or some other issues tracker.   Be sure to check out the comments for other great opinions on the topic.
139275
Popular posts from PHPDeveloper.org for the past week:PHP-Coding-Practices.com: Try-Catch Syntax WeirdnessPHPBuilder.com: Cross-Platform Database PHP DevelopmentIBM developerWorks: Java and PHP technology on AIX - Integrate the Java business application w/ DB2OpenSourceCommunity.org: What do you think makes a good CMS?Jonathan Snook's Blog: Elemental: Conditional Content with CakePHPDevShed: The Basics of Using the Factory Pattern in PHP 5Builder.com.au: PHP exploit code plants itself in GIFJohn Cox's Blog:  Linux.com Now PHP PoweredNick Halstead's Blog: Solving Programming ProblemsPHP-Tools Blog: Testing FIT
473226
Damien Seguy has continued his series looking at PHP configurations around the web and is sharing the results in the form of two new reports over on Nexen.net.   I just published the second part of the serie about PHP configurations. This part focuses on three aspects of PHP: PHP extensions, PHP streams, and disabled functions.   You can find the statistics themselves here and the latest configuration statistics here. It's interesting to see the drop-off when it comes to the various modules that are installed ("php, ftp and http are the most common. Besides them, tough luck.") and to see the somewhat more gradual curve of which functions are disabled - with system() topping out the list (with good reason).
722744
On his blog, Ian Bicking has posted some of his thoughts on a positive look at PHP - what he thinks PHP has done right.   With the recent talk on the blogosphere about deployment (and for Django, and lots of other posts too), people are thinking about PHP a bit more analytically. I think people mostly get it wrong.   He points out that PHP, in essence, is a CGI-style execution and, in being so, makes it more flexible. Both sides, web and command line, can work with the language equally well. He also mentions the developer/administrator split he sees in PHP's structure and how the language facilitates it.
320871
In a new post, Lukas Smith mentions (among other things) an upcoming webcast via the folks over at php|architect covering the best practices of using the opcode cache in your applications.    oin us as we host PHP internals developer, Stas Malyshev (Zend) with a presentation on optimizing your use of PHP opcode caching software, be it APC, Zend Platform, or another.   This talk will cover techniques that you can use to squeeze the most performance out of your cache, such as avoiding runtime includes and conditional class declaration.    Register soon because the event happens this Friday (March 16th, 2007) and there is no cost to attend - but you do have to sign up.
632891
Popular posts from PHPDeveloper.org for the past week:Job Posting: WorldNetJobs.com Seeks Expert PHP Developer (Multiple Locations - FL/MD/NY)Stefan Reuter's Blog: Profiling PHP ApplicationsRich Zygler's Blog: People work with WS-* web services in PHP? Why?PHPBuilder.com: Securing Data Sent Via GET RequestsKore Nordmann's Blog: Comparision of PHP image librariesJim Wynia's Blog:  WebDAV, PHP and YouPadraic Brady's Blog: Namespaces (or Yet Another Pointless Opinion Piece)Christopher Jones' Blog: PHP 5.2.5 RPMs with OCI8 and PDO_OCI are availableZend Developer Zone: PHP Abstract Podcast Episode 29: PHP Women Podcast (Recorded Live)Evert Pot's Blog: PHP WebDAV Integration Library
125329
Continuing on in their series of working with stand alone PHP scripts, DevShed has posted this third and last part looking at the creation of a basic script you can use to monitor your server (an excerpt from Advances PHP Programming by George Schlossnagle).   Last week, we continued our discussion of PHP standalone scripts with child processes and more. This week, we conclude our discussion and bring together what you've learned.   They start with the creation of a very basic daemon, including permission restrictions. They then modify this heavily to support the monitoring of processes through various parameters like frequency, status_time, and a description of the service. They then create the full example script and show the usage by checking to see if a URL passed in can be opened.   They also include, as a bonus, another more useful script that will email someone when the specified service goes down (still a HTTP check, though).
760386
Last weekend a new version of Santy appeared which is even more dangerous. Santy.e doesn&#39;t only targets phpBB but it also attacks other PHP scripts that are vulnerable to the file inclusion exploit.
703645
In a new post to the PHP Security Blog, Stefan Esser points out a recent commit to the PHP core as a fix to the session handling in PHP:   I just came back home and saw a very recent commit to PHP's session management. It is another attempt to fix the session cookie attribute injection that the PHP developers already tried to fix in PHP 5.2.3 without giving any credits. [...] their new fix that consists of blacklisting a bunch of legal characters from the session id, will most probably result in hundreds or thousands of broken sites.   Stefan points out that the fix blocks several valid characters that sites could potentially use in their session IDs, and that with this new code in place, it could drastically effect those site's functionality.   As of the time of this post, however, it seems that the issue has been recognized and corrected so as not to cause the above mentioned issue in future updates.
211060
A few days back there was a post on the "The Codist" blog about why the author would never quite understand the appeal of PHP to the masses and some of his thoughts behind it. Well, there was such an outcry and response to his comments that he's written up another post on what he learned from comments made.   Clearly I touched a nerve. However I did learn a lot of things that you don't read in a quickly tutorial on PHP. The whole point of writing something is to get feedback, positive or negative, and hopefully learn from it.   He admits that his experience with PHP and its developers has been limited, so his perspective might have been thrown off a bit. He still holds to one thing from the previous article, though - that PHP just isn't for him.
732440
The International PHP Magazine has posted results from their latest PHP community poll as voted on by visitors to their site. The question for this poll asked developers what they thought, of the choices on the list, was the most common mistake that PHP developers make.   Coming in at number one by an overwhelming lead was "Not escaping entities and SQL input" (a definite problem indeed) with the next highest option, "Not using a Framework" a full twenty percent lower. The next two options were closer (descending) - "Using old PHP versions" and "No or little use of Object Orientation".   There's a new poll this week for your consideration - this time asking which stage, of the five options, should come first in the development cycle of a typical content management system. Head on over and cast your vote today!
122012
In a new posting on Chris Shiflett's weblog today, he shares with the world a little bit of what he's written for php|architect - a free version of one of his columns: Security Corner: Session Fixation.
697974
Secunia has released an advisory for PHP today related to an issue caused by an integer overflow that could allow for bypassing of security of an application.   A weakness and a vulnerability have been reported in PHP 5, where the vulnerability has unknown impact and the weakness can be exploited by malicious, local users to bypass certain security restrictions.   The issue is caused by issues with the chunk_split and realpath functions that can lead to a bypass of the open_basedir restriction on a server.   The issue is marked as "moderately critical" and it is suggested that users update to PHP 5.2.3 to correct the issue.
86222
In brief Exploit circulating for unpatched vuln
20940
As mentioned on the Zend Developer Zone, Jaybill McCarthy has written up a Blog post about ten of the PHP myths that are common on the web and the facts that dismiss them.   I am a PHP developer. Maybe even a halfway decent one. As such, I often find myself engaged in conversations on the subject of web application development in general and PHP in particular. I am continually flustered by the myths, half-truths and outright falsehoods that technical and non-technical people alike hold about this humble programming language.   Some of the points included in his "top ten" list are things like "PHP Encourages Sloppy Code", "PHP is slow because itÃ¢ÂÂs interpreted" and "PHP apps all look the same".