SitePoint PHP Blog: WhatÃ¢ÂÂs so bad about the Singleton?
475410
On the SitePoint PHP Blog today Troels Knak-Nielsen asks th3e question "what's so bad about the singleton?" For all of its advantages, is there a darker side of the design pattern when it pertains to global variables.   As I have often taken this stance myself, I found it reasonable that I should be able to argue for it, so I'll try to give an explanation. This is also in part a follow-up on my post from last week, in which I present a way to avoid global symbols, without spending much time on why.   He talks about what they are and how they're commonly used - sometimes with some unpleasant side effects because of their use of globals.
458368
Despite opinions from some of the PHP community, interoperability between PHP applications isn't is such a bad state - at least According to Aaron Wormus:    The fact of the matter is that it's not such a big deal. Porting a plugin from Wordpress to Serendipity is usually trivial, and as we see more web-services based plugins (stuff like the awesome askimet) the task becomes simpler and simpler.   Interoperability is overrated, the more you think of it the more complex it gets. As you start throwing in new factors into the equation (how will this interoperate with a java/c# application) you start to develop monsters like JSR 170 which solve a lot of problems on paper, but in reality are too unwieldy to be truly useful.    He even lists out some of his "steps to interoperability" to help speed things along (like "use as much abstract code as possible" and "use services").
9540
The Hardened-PHP Project has released a new vulnerability for the PHProjekt groupware software.    While searching for applications that are vulnerable to a new class of vulnerabilities inside PHP applications we took a quick look into the current PHProjekt source code and discovered that a (remote) include vulnerability had been (re)introduced.   By overwriting a variable with user input it is possible to inject and execute arbitrary PHP code. Overwriting this variable is possible regardless of the register_globals setting.    They give a few more details further down the posting and note that users should download and install the latest version (at the time of this post, 5.1.2).
48844
According to this new post on DynamicWebPges.de and a message from Derick Rethans on the php.internals mailing list, there's an issue with PHP 4.4.5 where sessions are causing segfaults when register_globals is set to "On".   As per Derick:   Because of this I'd like to release a 4.4.6 soon with this fixes. As  there is also an upgrade to pcre 7.0 we'd need at least one RC, which I  plan to release on Thursday.   Users of the PHP 4.4.x series should keep watch for this new update to correct the issue quickly.
676141
While attending Gunter Kniesel's "Aspect-Oriented Software Development" lecture yesterday it occured to me that it might be possible to (ab)use PHP 5's __autoload(), __call(), __get(), and __set() interceptors to facilitate Aspect-Oriented Programming with PHP.
633181
Gareth Heyes has a new post today talking about one of the vulnerable values in the $_SERVER superglobal - PHP_SELF.   I thought it might be a good idea to gather a few test cases demonstrating the problem. Why PHP allows these URL's is beyond me and it wouldn't take much work to filter out these malicious URL's in the PHP code.   He provides four test cases to show how simple it is to abuse - one using a HTTP header, another pushing XSS through, the third mentions search pages and the fourth a direct code injection.   You can download the code here.
306188
In recent work, Ian Selby came across something odd - a setup where PHP was segfaulting without any real indication of where the error might be:   Starting to get a little frustrated, I took a peek at my error logs (/var/log/httpd/error_log for the unitiated), and discovered a wonderful message [about the segfault]. As any person scratching their head would do, I hit up google.. to no real avail. Just a bunch of php bug reports. So, what happened, and how did I fix it?   After searching through the code and narrowing down where it could be, the culprit looked like a custom session handler he was using. It uses MySQL to store the sesion information and, unfortunately, when Ian had compiled the server he didn't let PHP know about his unique setup.   His default installation was trying to use the default MySQL information (including the socket) to reach the database. Obviously failing, the server simply gave up and segfaulted. Thankfully, all it takes it a recompile with a few extra parameters and you're back in business.
437494
Popular posts from PHPDeveloper.org for the past week:PHPClasses.org: A PHP killer feature - Streams abstractionRob Thompson's Blog: Switch vs. IfPHPEverywhere: Octopussy numbers in PHPJob Posting: MODE Visual Seeks PHP Developer (Charlotte, NC)ProDevTips.com: Why PHP as a templating language sucksMatthew Turland's Blog: The Yin and Yang of TypingStubbles Blog: Stubbles 0.5.0 releasedChristopher Jones' Blog: Updated connection pooling in PHP's OCI8 extensionBen Ramsey's Blog: Congrats Costa Rica PHP!Carsten Lucke's Blog: Configuration issues with Xdebug on Debian Etch
114906
The results of the latest International PHP Magazine are in and posted today on their site. The question this time was asking developers and visitors alike what they think sucks about PHP.   Choices included "No lexical scoping", "PEAR", and "Worst Configuration System" but one climbed to the top far above the others - "No namespacing". Trailing that at a distant second were two, getting the same number of votes - "No lexical scoping" and "Can't afford a vowel" (hmm, interesting).    Up for this week is a new poll that asks those out there that have used the Symfony framework to cast their votes about what they think is the best feature the project has included. Check it out and cast your vote today...
470829
In response to this previous post, Ben Ramsey has relayed some of this thoughts on the benchmarks that were done by Jonathan Street comparing functions and their aliases:   Mmy first reaction was something like: "Egads! These benchmarks are stupid and misleading! These functions are simply aliases of each other. There should be no discernible difference, and any buffoon should realize this fallacy!" This was before I clicked through from PHPDeveloper.org to read his post.   After reading his data and going on to the Better Benchmarks post that followed it, he found that most of the results of additional testing came out negligible and that there was almost no difference between the two.    Ben illustrates the proof of this with a few lines pasted from the "ext/standard/basic_functions.c" in PHP's source showing that the code is shared via a PHP_FALIAS function call.
607777
Sometimes developers just don't think about how much trouble they'd cause with a rewrite of existing software. They think that moving up to the latest and greatest is the way to go, and that it makes perfect sense to say out with the old and in with the new. Aaron Wormus disagrees. Well, sometimes - it depends on the circumstances, really.   At ZendCon I talked about "Planning a PHP 4 to PHP 5 codebase rewrite, a practical approach". The talk was based on my own experience, as well as famous discussion of the topic such as Joel Spolsky's "Things you should never do" and the examination of "famous" platform rewrites.   Aaron gives an example of a large company making a move from a COBOL system out to C for a mission critical system. Based on his tale, they didn't put the thought needed into making this move - new development time, keeping old developers on staff, etc - besides the fact that customers don't like change and making a move to another platform is almost definitely going to be noticed by them.
217574
As mentioned by Ed Finkler, there's a list of signs your PHP needs refactoring from Soledad Penades.    I have had to go through a php application recently which has given me more than one headache and has required me to use all my possible patience. While working with it, I thought This is good material for an article, so that nobody else does the same in the future, and nobody else will need to experience the same displeasure as I have had to.   So here are the signs your PHP application needs a serious refactoring, right now    Included in the list are things like:   Uses global variables Everything's an array The neverending switch Interface inconsistency   It hits on one of the thing that bugs me too, the problem of "Brackets galore" - so many subarrays that you have to resort to three or more sets of bracketed keys to get to the value you want. It's bad enough trying to follow someone else's code without having to "trace down" an array to figure out which of the values they're talking about.
357182
In a new post to his blog, Chris Hartjes, spurred on by an article in the latest edition of php|architect magazine (covering protecting your code), has shared a few opinions starting with a certain paragraph near the end.   To start, I will focus on the paragraph above. What I get out of that is that if only your source was closed and hidden from prying eyes, it would not have bugs in it. Which is, of course, total nonsense. Code has bugs because it's open and they feel safer? There are two kinds of bugs: application bugs (which is the code I would write) and system bugs (in this case, bugs that that appear from PHP itself). I'm sorry, but there is nothing I can do if there is a bug in PHP that causes my application to crash except to point this bug out to the people who have the ability to fix it.   He goes on to talk more about how protection like this (the article talks about using the IonCube Encoder) will not stop someone if they're really determine to get at the code underneath the encryption. His only suggestion is to make an application good enough that people wouldn't want to try to steal it as much and would rather pay for their version.   Encode your stuff if you want, but be aware that the minute you choose to do that you are telling your customers "I don't trust you" and I have a hard time understanding a business model that assumes people are going to want to steal the stuff you sell.
20940
As mentioned on the Zend Developer Zone, Jaybill McCarthy has written up a Blog post about ten of the PHP myths that are common on the web and the facts that dismiss them.   I am a PHP developer. Maybe even a halfway decent one. As such, I often find myself engaged in conversations on the subject of web application development in general and PHP in particular. I am continually flustered by the myths, half-truths and outright falsehoods that technical and non-technical people alike hold about this humble programming language.   Some of the points included in his "top ten" list are things like "PHP Encourages Sloppy Code", "PHP is slow because itÃ¢ÂÂs interpreted" and "PHP apps all look the same".
91596
Padraic Brady has posted a manifesto of sorts about the work that he's been doing on his PHPSpec library and trying to work it into the approval process for the Zend Framework.   I'll be attempting to pound the Zend Framework into submission so I can apply Behaviour-Driven Development (BDD) using PHPSpec when I write a Controller. Why? Because I feel like it, and it gives me an excuse to promote one possible incarnation of PHPMock and the PHPSpec Zend Framework extension. See? Perfectly reasonable selfishness!   He hopes to move it past the typical test-driven development process that PHPUnit offers and "kick your ass into high-TDD gear" without having to have worked much with it before then (the key is simplicity).   He includes some code examples (how it should flow) and describes some of the challenges that he's coming across so far, specifically with the way that the Zend Framework works with the Controllers and what he wants to accomplish.
192641
DevShed has posted the second and last part of a series of two articles based around the Composite design pattern - using it to work with strings in PHP5.   Are you a PHP developer who wants to improve your skills in pattern-based programming in PHP? If the answer to this question is a emphatic yes, then you should begin reading this article now! Welcome to the final part of the series "Implementing the composite pattern with PHP 5." Comprised of two instructive tutorials, this series walks you through the basic concepts of this important design pattern, and shows you how to apply it with some educational examples.   They start by defining a simple StringProcessor class as an abstract interface to build from. From there, they create two other classes - the SingleStringProcessor and the MultipleStringProcessor. Each of these takes in either a single file or multiple filenames and spits back out the value of the string and the length of the string.
571915
In a quick note from Steven's blog is a pointer to tricky problem with the clone keyword in PHP 5- "There is a nasty change in PHP5: objects are now always passed by reference. Variables hold a handle to the object rather than the object itself. This brings PHP more in line with other OO languages (like Java) and removes some of the ugly from PHP OO code, but it also means that objects are treated differently from all the other types. Old code that depends on having objects copied when not passed by reference will break." For the fix, go here.