2012年5月30日星期三
User Group: Guelph PHP User Group - May 30th @ 7:30pm - Deploying Database Changes
The Guelph PHP User Group (Guelph, Ontario) is having a meeting tonight, May 30th at 7:30 PM hosted at the Well.ca offices. The topic will be deploying database changes presented by Colin DeCarlo.
This month Colin DeCarlo will be talking about a tool called Liquibase which allows you to manage and automate database deployments as part of your build and deployment process. He'll also be looking at how to integrate it with Jenkins and may even talk a little about how this tool is used at Freshbook...
If you'd like to attend, please let them know sometime today so they can know how many to expect!
If you have a user group meetup that you'd like to announce, email the information over and it'll get posted!
Smashing Magazine: Replicating MySQL AES Encryption Methods With PHP
On the Smashing Magazine site today there's a new tutorial showing you how to replace your MySQL encryption methods for AES with their PHP equivalent.
At our company, we process a lot of requests on the leading gift cards and coupons websites in the world. The senior developers had a meeting in late October to discuss working on a solution to replicate the MySQL functions of AES_ENCRYPT and AES_DECRYPT in the language of PHP. This article centers on what was produced by senior developer Derek Woods and how to use it in your own applications.
He starts with a little bit of backstory - why to even bother using encryption, what AES encryption is and why you should probably avoid using the MySQL implementation of it in your apps. PHP's mcrypt functions don't return the same hashes as their MySQL counterparts (he includes the "why" of this) and includes some quick code to replicate the MySQL behavior. He also mentions some issues with the transformation, newlines and shows the source for their completed "aes_crypt" and "aes_decrypt" functions.
ServerGrove Blog: phpDay 2012 Report
On the ServerGrove blog today Pablo Godel has posted his wrapup of this year's phpDay/JsDay conferences that happened last week in Verona, Italy.
Last week I returned from Verona, Italy where I spent a full week with some of the best Javascript and PHP developers out there. I've been wanting to go to phpDay for a number of years so when I was invited to present a talk about Symfony2 and MongoDB, there were no more excuses, I had to be there!
Pablo talks about the sessions he attended (at both JsDay and phpDay) including Zeev Suraski's (Zend) keynote, a talk from Lorenzo Alberton about "Taming the Twitter Firehose" and his own presentation about MongoDB and Symfony2. He also mentions the second day's keynote from Rasmus Lerdorf and a workshop about building PHP extensions.
PHP Tip-a-Day: PHP Tutorial: Convoluted Code - Combining Ternary Operators and Anonymous Functions
On the PHP Tip-a-Day site Greg Bulmash shares a bit of "convoluted code" that could potentially cause confusion in the future maintenance of your application - combining ternary with anonymous functions.
Following on yesterday's post about chaining if statements without brackets on a single line, I tried to explore other ways to perform this "test if the variable is set, then do a comparison if it is" logic. I created one of the most convoluted lines of code I've ever written. It's no SQL join that spans 5 whiteboards, but it's pretty unreadable.
His example uses not just one ternary comparison, but nested ones with the anonymous function as the first condition. He points out that, if you're not careful with this method and make both sides anonymous functions, you could be in for a "cannot be converted to string" error on the closure side.
I'm sure there might be a very good reason to put two anonymous functions in a ternary operator, but I can't think of one at the moment. It's a fairly ugly proposition.
2012年5月29日星期二
Rob Allen's Blog: Zend Framework 2 beta 4 released
As Rob Allen mentions in his latest post, the latest revision of the Zend Framework v2 has been released and is ready for testing - Zend Framework 2 beta4.
Earlier this week, we got beta 4 of Zend Framework 2 out of the door. This version has some very significant improvements in it which mean that if you're following along at home with the betas, then you're going to be doing a bit of updating! Most of the B/C breaks are noted in this thread.
He's also made updates to his Zend Framework 2 tutorial to match these most recent changes. He points out three key new features - the ZendServiceManager, ZendForm and ZendInputFilter updates and the introduction of Composer support to pull packages.
Voices of the ElePHPant Podcast: ITBT (From php|tek 2012) - Telecommuting
The Voices of the ElePHPant Podcast has posted their latest episode - a special recording made at this year's php|tek conference (Chicago) and features several guests like Keith Casey, Eli White, Chris Hartjes, Luke Stokes, Paul Jones and Ed Finkler.
This special show (ITBT meaning "It's the Booze Talking") is a roundtable where they all discuss telecommuting from both a developer and manager's perspective. They each share something that works really well for them about telecommuting and something that doesn't. It's longer than a usual episode (about 1h 15m) but it's good discussion from a lot of different perspectives in the community.
You can listen to this latest episode either via the in-page player, by downloading the mo3 directly or by subscribing to their feed.
Tim Huegdon's Blog: Eliminating Web Development Waste
In this recent post from Tim Huegdon sharing some of his insights and discoveries about eliminating waste from your development process (with props to the methods introduced by the Toyota Corporation and the Poppendiecks).
Eliminating waste is the first - and most fundamental - principle of Lean Software Development; something that was introduced to me by an exceptionally talented Project Manager whom it was my pleasure to work with. Lean Software Development is a set of seven fundamental principles that really work hand in hand with agile development to improve software delivery.
He introduces the concepts behind the "lean" mentality, where it's origins came from (Toyota) and how it relates to software/web development. He points out some of the places that waste can come from in development including:
- Partially complete work
- Extra features
- Task switching
- Waiting
- Defects
For each of these (and a few more) he summarizes what they're all about and some of the things that can be done to help combat them.
Gary Hockin's Blog: Zend Framework 2 and a Restful Application
In this new post to his blog Gary Hockin looks at how to create a simple RESTful web service with the features provided by the Zend Framework v2 (currently in beta).
After speaking to a prospective employer in a job interview, I was interested to try out the ZendMvcControllerRestfulController. With Zend_Json_Server in ZF1 having, shall we say, a less than sterling reputation, it was very interesting for me to see how the strategy has been implemented in ZF2. The starting point for this is simply a completely fresh clone of the ZF2 Skeleton Application. The aim is to simply allow the pre-created index controller to function as a Restful interface.
He walks you through the steps you'll need to recreate it in your application - setting up the ViewJsonStrategy, creating the router configuration for the RESTful handling and changing what the controller extends to give it the RestController's superpowers.
2012年5月28日星期一
2012年5月25日星期五
Site News: Popular Posts for the Week of 05.25.2012
- Project: Gitlist - A Git Repository Viewer (based on Silex & Twig)
- Reddit.com: Protecting against attack?
- PHPMaster.com: PSR-1 and PSR-2 to be Approved as Standards
- Site News: Job Postings for the week of 05.13.2012
- Sean Coates' Blog: Use `env`
- Derick Rethans' Blog: MongoDB Cursors with PHP
- Gonzalo Ayuso's Blog: Database connection pooling with PHP and React (node.php)
- Phil Sturgeon's Blog: Laravel is Awesome
- Till Klampaeckel's Blog: Zend Framework: CRUD
- Nerdery Blog: Minnesota PHP User Group (May 2012 Meeting) Recordings
Rafe Colburn's Blog: A list of engineering blogs
On his blog today Rafe Colburn shares a list of engineering blogs he follows to keep up with various technologies companies are using and the interesting things they find out in using them.
One of my favorite technology trends of the past few years has been the emergence of engineering blogs. They are, mostly, a recruiting tool, but that doesn't mean that you can't learn a lot about how companies operating at varying levels of maturity and scale go about their business.
Some of the blogs on his list include:
- Ety's "Code as Craft"
- Facebook's blog
- SlideShare
- Twitter
You can check out the full list here.
2012年5月24日星期四
Site News: Blast from the Past - One Year Ago in PHP
- Elated.com: Object-Oriented PHP: Working with Inheritance
- PHPBuilder.com: Tracking User Activity in PHP with Cookies and Sessions
- Shameer Chamal's Blog: Tutorial : Simple ajax validation for Kohana
- Box UK: Unboxing: Silex
- Michelangelo van Dam's Blog: Book Review: PHP Development in the Cloud
- Omar Abdallah's Blog: Installing LAMP with PHP 5.3.6 on Ubuntu 11.04 Natty Narwhal
- NetTuts.com: Easy Authentication with CodeIgniter
- Zend Developer Zone: Caching of Zend Framework application configuration file
- DZone.com: PHP Tool Integration (PHPsrc)
- Symfony Blog: Symfony2: Annotations gets better
- Justin Carmony's Blog: MySQL, Redis, and a Billion Rows - A Love Story
- Jani Hartikainen's Blog: You don't need a service layer: Fat controllers are okay
- Christian Weiske's Blog: How to integrate PHP_CodeSniffer with Git repositories?
- Slawek Lukasiewicz's Blog: Zend Framework: logging with Firebug and FirePHP
- Till Klampaeckel's Blog: Yahoo: oauth_problem=consumer_key_rejected
Anthony Ferrara's Blog: Open Standards - The Better Way
In this new post to his blog Anthony Ferrara responds to some of the recent news about PHP standards being up for voting (PSR-1 and PSR-2). He has an issue with how they were created, though, and notes that the current PSR process doesn't encourage open standards.
There has been a lot of traction lately on the topic of the PSR "PHP Framework Interoperability Group". They are introducing two new proposed standards: PSR-1and PSR-2, both dealing with code formatting standards. [...] I have read both, and actually agree and think they are quite good. However, there's a deeper problem. Open Standards is something that the internet was built upon. From HTTP, E-Mail and HTML to ECMA Script (JavaScript), OAuth and JSON, open standards are everywhere. The problem with the entire PSR process is that it is not designed to produce open standards.
He describes an "open standard" and points to this RFC as an example of the open process they should result from. He talks about the importance of the process and how having more people reviewing and contributing their ideas could help find issues in the proposal. He issues a "call to the PSR team" to adopt this practice, allowing a more open flow to the ideas that are being proposed.
Note that I'm not asking to open the vote to anyone else. I'm not saying that standards should be approved by everyone in the community. There should still be a standards body that makes the final decision. But they should make that decision based on community input. They should actively look for and encourage open discussion prior to voting.
NetTuts.com: 3 Key Software Principles You Must Understand
On the NetTuts.com site today there's a set of reminders about some software principles that all developers (PHP or otherwise) should keep in mind when doing their work:
he fundamental things will always apply. If you have an understanding of the underlying ideas of software development, you will quickly adjust to new techniques. In this tutorial, we will discuss three basic principles and mix them with many more. They provide a powerful way of managing the complexity of software. I'll share some of my personal opinions and thoughts, which, hopefully, will prove useful when it comes to applying them to code and real-world projects.
Their three ideas that should always be in mind during development are:
- DRY - Don't Repeat Yourself
- KISS - Keep It Simple Stupid
- "You Ain't Gonna Need It" (YAGNI?)
For each principle, there's a but of an example showing either some current project that follows the idea or a process that can be used to implement it.
PHPMaster.com: 10 Tips for Better Coding
PHPMaster.com has a new post with ten helpful tips for you to consider using during your development. These tips can help to not only make your current development simpler but make for easier to maintain, stronger code in the future.
Good code is maintainable, reusable, and testable. The following tips address how you and/or your development team can handle various coding tasks and how to keep everything as neat as possible. I will introduce you to some "best practices" that will help you write better code and help make you and your team happy and efficient.
Among the suggestions on the list, there's things like:
- Use a Coding Standard
- Refactor
- Use Meaningful Names
- Use Automated Build Tools
- Use a Testing Framework
Links are provided in several of the tips to other resources/tools that can provide you with more information about how to use it in your development.
PHPBuilder.com: Debugging Your Magento E-Commerce Applications in PHP
On PHPBuilder.com there's a recent post looking at debugging Magento applications with some of the built-in tools the platform makes available.
Magento is the world's most popular open source e-commerce platform, relied upon by countless Fortune 500 and small business alike for selling goods and services of all types. [...] But with Magento's considerable power comes a great deal of complexity [but] it can be incredibly difficult to even identify the origin of an error let alone resolve it. You can however dramatically improve your productivity as a Magento developer by taking advantage of a few key debugging features.
They recommend using four tools built into the platform - the developer mode, logging, template path hints and viewing the raw SQL queries. They also recommend using a few other tools like FireBug and the features of Eclipse to help with code formatting and completion.
2012年5月23日星期三
Lineke Kerckhoffs-Willems' Blog: How to use the Symfony2 SonataAdminBundle
In this recent post to her blog Lineke Kerckhoffs-Willems talks about some recent Symfony2 development she's been doing and some of the trials she's come across when trying to implement the SonataAdminBundle to build on their pre-existing Doctrine2 entities.
I have been doing a lot of Symfony2 development lately for our project ProTalk and one of the things we needed was a backend for our database. This should be a fairly simple backend to start with, just an easy way to get data into the database. So I thought I would use the SonataAdminBundle to easy generate this backend based on the doctrine2 entities that we already have. Eventually, I got it working, but it took me some time to find out exactly how, so I thought I'd share my experiences.
Based on some information she found in this other post, she was able to configure and connect it to a "tag" entity. To make it work, however, she needed an empty controller to move forward.
Phil Sturgeon's Blog: Laravel is Awesome
Phil Sturgeon (a developer on the FuelPHP and CodeIgniter frameworks) has a new post to his blog today talking about the Laravel framework and how "it's awesome" .
You might not expect to hear that from a CodeIgniter and FuelPHP developer, but it's true. Taylor has done a brilliant job writing code that is clean, functional and has built a huge community of smart developers in less than a year of active development. People are flooding to Laravel from other frameworks and that's great for the PHP community. [...] Taylor has done a brilliant job of building up a framework that takes advantage of callbacks, IoC and event driven behaviour very well.
He talks about why he likes Laravel and the features it includes that appeal to him...and why he doesn't use it yet. He notes that it's a "snazzy new framework" that gives PHP developers tired of the usual framework methods something new to try out, noting that it can help to keep the "brain drain" of PHP developers away from the language just because they get bored.
2012年5月22日星期二
PHPMaster.com: Using SPL Iterators, Part 2
On PHPMaster.com today they've posted the second part of the series covering the Iterators that come with PHP as a part of the SPL.
In part one of this series I introduced you to some of the SPL Iterators and how to use them. There may be times however when the provided iterators are insufficient for your needs and you'll want to roll your own custom iterator. Luckily, SPL provides interfaces that will allow you to do just that. For an object to be traversable in a foreach loop, PHP requires that it be an instance of Traversable. You cannot however implement this interface directly (though you can use it in instaceof checks); instead you'll need to implement either SPL's Iterator or IteratorAggregate interfaces.
He shows you how to implement these two interfaces in your own custom classes, looping through a set of books for the Iterator example and a "getIterator" method that creates an ArrayIterator when executed. The results of both are used in foreach loops showing how they can be used just like any other iteratable variables.
MaltBlue.com: Zend Form Mastery with Zend_Config - Part 3, Standard Form & Element Options
On the MaltBlue.com blog they've posted the latest part of their series on using Zend_Config configuration files to create Zend_Form elements. In this latest article, they show how to set some of the other properties on the elements (like "readonly" or "required").
We've looked at custom form filters and we've looked at the core form configuration. But what about the other form properties? What about: setting an element as readonly, an element as required, ignoring an element and love them or hate them, what about decorators.
He shows how to update the XML file to add these new attributes into the structure and the resulting form. Also included are a few examples of using decorators to configure the look, feel and modify the attributes.
Till Klampaeckel's Blog: Zend Framework: CRUD
In this new post to his blog Till Klampaeckel shares a Zend Framework "base" controller that makes it easier to do the usual CRUD (Create, Read, Update, Delete) operations in an application.
I think it took me (or us) a couple attempts to get this right - let me introduce you to Zf_Crud, a CRUD controller for the Zend Framework. [...] Zf_Crud aims to provide you with an interface for any table possible - think of it as a phpMyAdmin more tailored towards your data and (thanks to Twitter Bootstrap and the Easybib_Form_Decorator) prettier!
He shows how to install and use it (via PEAR or Composer) and an example of a controller extending it. You can find the code here on github, ready to clone and try out.
2012年5月21日星期一
PHPMaster.com: REST - Can You do More than Spell It? Part 4
PHPMaster.com has posted the latest tutorial in their series covering RESTful APIS - part four of "REST - Can you do More than Spell it?" In this latest part of the series, they focus on something very key to RESTful services, the HTTP spec (and headers).
We're getting close to the end now, and the only thing remaining is to discuss a little more about the protocol you'll most likely use in any RESTful application that you write. Because HTTP is so often used with REST, that's the protocol I'd like to focus on.
He goes through the structure of a typical (raw) HTTP header and talks about some of the more common headers and what actions/settings they represent. He includes examples of setting headers (with header, naturally) and a curl example showing how to set the request headers. The tutorial is finished off with a brief mention of custom HTTP headers and the the good and bad that comes with them.
Mike Purcell's Blog: PHPUnit - Upgrade - Convert assertType to assertInternalType
In this quick post to his blog, Mike Purcell mentions the deprecation of the "assertType" assertion and includes some code you can add to correct the issue in your tests.
We recently upgraded phpunit from a very old version to the current 3.6.x version (at time of writing). During the upgrade I noticed that assertType is no longer supported in many of our tests which were testing if something was a string, an array, or an object. So I had to write a quick script to update assertType to assertInternalType and figured I would post it for others if they needed to do the same.
The code goes into each of your tests (recursively) and finds the places where the "assertType" assertion is used and replaces it with its newer cousin "assertIntrnalType".
Gonzalo Ayuso's Blog: Database connection pooling with PHP and React (node.php)
In this latest post Gonzalo Ayuso his recent experiences with <1 href="http://nodephp.org/">React (Node.js in PHP) and an example of how he worked up a script to pool database connections.
Last saturday I meet a new hype: "React" also known as "node.php". Basically it's the same idea than node.js but built with PHP instead of javascript. [...] Basically I want to create a database connection pooling. It's one of the things that I miss in PHP. I wrote a post here some time ago with this idea with one exotic experiment building one connection pooling using gearman. Today the idea is the same but now with React.
He includes the sample script, also including the line to add to your composer.json file to install React and the SQL to create the sample tables. The script makes a PDO connection and assigns it to the pool, an instance of his "CPool" class. If you want to try it out, you can find the code over on github.
2012年5月19日星期六
2012年5月18日星期五
Site News: Popular Posts for the Week of 05.18.2012
- Tom Barrett's Blog: WordPress is more than a CMS, it is a PHP Framework
- Community News: Drafts of PSR-1 (and prelim PSR-2)
- NetTuts.com: Aspect-Oriented Programming in PHP
- Developer.com: Creating a Custom ACL in PHP
- Jeremy Cook's Blog: Implementing IteratorAggregate and Iterator
- Anson Cheung's Blog: Create nodes in eZ Publish using PHP
- Gonzalo Ayuso's Blog: Building a simple SQL wrapper with PHP
- Fabien Potencier's Blog: Sami: Yet another PHP API documentation generator
- Sean Coates' Blog: PHP as a templating language
- PHPMaster.com: Using SPL Iterators, Part 1
Nerdery Blog: Minnesota PHP User Group (May 2012 Meeting) Recordings
On the Nerdery blog today there's a new post about the recent Minnesota PHP User Group's latest meeting where the topics were "When SQL Meets Developers" and "Message Queues & Distributed Job Processing".
In their May meeting, the Minnesota PHP User Group heard two talks on "When SQL Meets Documents" [above] and "Message Queues & Distributed Job Processing" [below]. MNPHP meets once a month at The Nerdery's office in Bloomington.
Both of the presentations were recorded - you can find the videos over on Vimeo: SQL Meets Developers and Message Queues.
Project: Gitlist - A Git Repository Viewer (based on Silex & Twig)
Klaus Silveira has submitted a project he's been working on to make browsing through git repositories a bit simpler with a local tool - gitlist.
GitList is an elegant and modern web interface for interacting with multiple git repositories. It allows you to browse repositories using your favorite browser, viewing files under different revisions, commit history, diffs. It also generates RSS feeds for each repository, allowing you to stay up-to-date with the latest changes anytime, anywhere. GitList was written in PHP, on top of the Silex microframework and powered by the Twig template engine. This means that GitList is easy to install and easy to customize. Also, the GitList gorgeous interface was made possible due to Bootstrap.
Since it's just a PHP-based application, installing it is as easy as cloning the source to a web-accessible directory and setting up a "config.ini" file with your settings. You can find out more about this project based on the popular Silex microframework on its GitHub page.
Reddit.com: Protecting against attack?
In this recent post to Reddit.com, the question of application security is asked - the poster wants recommendations on how he should keep his app safe from would-be attackers:
I can code fairly well in PHP these days, but my security isn't so hot. Is there a tutorial or plugin you guys can recommend as to how I should be protecting my php pages/inputs? I want to avoid common attacks like XSS, inputs with NULL or DROP TABLE etc?
Responses on the post include recommendations related to:
- Using the Chorizo scanner to find common issues in your code
- Using PDO for database connections (with bound parameters)
- Not trusting "$_SERVER"
- Data sanitization
There's also links to a few other resources with more details.
2012年5月17日星期四
Site News: Blast from the Past - One Year Ago in PHP
- Ralph Schindler's Blog: Learning About Dependency Injection and PHP
- Artur Graniszewski's Blog: Drupal 7: HipHop for PHP vs APC - benchmark
- NetTuts.com: Create WordPress Plugins with OOP Techniques
- Lorna Mitchell's Blog: PHP OAuth Provider: Request Tokens
- Volker Dusch's Blog: How i judge frameworks - Or: Let me code in peace
- Martin Sik's Blog: How to "steal" Google's "did you mean" feature
- Rafael Dohms' Blog: Debugging PHPUnit Tests in NetBeans with XDebug
- Web Developer Juice: PHP Magic Functions: Best Part of Object Oriented PHP - Part 2
- Timothy Boronczyk's Blog: Spaghetti Code Considered Harmful
- XPertDeveloper.com: Is Your PHP Application Affected by the Y2K38?
- Josh Adell's Blog: Logging User Sessions Across Requests
- James Morris' Blog: Removing Dependencies with the Observer Pattern (SplObserver, SplSubject)
- PHPBuilder.com: Implementing User Authentication and Session Management with PHP
- Script-Tutorials.com: Phar - PHP archiving practice
- Web Species Blog: Virtual Machines for Web Developers
PHPMaster.com: Handling Collections of Aggregate Roots - the Repository Pattern
On PHPMaster.com today they have a new tutorial focusing on using the Repository (a part of the domain driven design architecture) to enhance your model's current functionality.
Unlike mappers, though, which are part of the infrastructure, a repository characterizes itself as speaking the model's language, as it's intimately bound to it. And because of its implicit dependency on the mappers, it preserves the persistence ignorance as well, therefore providing a higher level of data abstraction, much closer to the domain objects.
Included in the tutorial is the full code you'll need to create a simple UserInterface class and a User model that extends it. He also makes a UserCollection class to handle working with multiple User objects and a UserMapper to handle the actual data source fetching. Finally, he implements the Repository on top of this base structure showing how it lays on top of everything via the UserMapperInterface instance. At the end some example code showing it in use is also included - making the PDO connection, creating the UserRepository and fetching by a few different data types (email, name and role).
Chris Hartjes' Blog: How the Testing Sausage Gets Made
For those either just getting into unit testing your applications (maybe even TDD) or those that are old hat at it and what to figure out a few more tricks of the trade, you should check out this latest post from Chris Hartjes about some of the tools he uses to get the job done.
So how does the Grumpy Programmer write code, TDD style? It starts with using a set of tools that reduce the amount of friction required. First, I do almost all my work from a terminal. [...] Why the terminal? PHPUnit is a CLI application. Yes, many popular editors and IDE's can do things like execute PHPUnit for you, but they are limited in what flexibility they provide.
He also talks about his editor of choice, vim, and some of the plugins he uses in his day to day testing development. This includes tools to handle things like interfacing with git/gists, working with ctags to see the code's structure, working with "surroundings" and the pathogen plugin to make adding other plugins easier. He keeps the code up in one terminal and his testing tool (PHPUnit or other) accessible in a second, making it a simple matter of switching to write the test then the functionality to make it pass.
If there is a lesson to be learned from this, it's to make sure that every tool that you use reduces the friction that is generated when building your application using TDD.
Reddit.com: Too many bugs and too much stress
In this recent post on Reddit.com, a developer asks the community about some of his feelings about bugs in his software and his focus on quality:
No one has told me this and I don't need them too. I feel like one bug that has a negative impact on the user experience is too many bugs. I've been programming for over 5 years professionally and I still introduce bugs into my code. [...] I don't like the expectation that I (and maybe others have) that my code must be perfect when I am not perfect. I don't like the fact that it only takes one mistake to affect so many people. [...] I'm wondering if others on here have every felt this way. What have you done about it?
Suggestions in the comments talk about everything from dealing with the apparent burnout the developer is facing, a reminder that no code is bug free and some recommendations of testing and bug tracking to help make the quality of the code better (and give visibility into the level of work being done).
Community News: "PHP Tip a Day" Blog
Greg Bulmash has started up a new site that's dedicated to the "tip of the day" sharing of PHP facts he finds out in the course of his development, php-tip-a-day.com.
I started a daily PHP tip blog a couple of weeks ago, figuring the daily writing will keep me curious about programming. [...[ I've found that I learn things better when I have to absorb them well enough to explain them to someone else, so this site (and a couple others I'm starting up) are my attempt to just solidify my knowledge and push my skills. The goal of writing five brief tutorials about various functions, methods, or solutions each week is meant to force me to keep expanding my knowledge and to help me burn it into my brain. I hope others might find it useful.
So far he has posts about things like:
- Getting the raw POST contents on a request
- A series on creating a "meme" site (like the Cheezburger ones): Part 1, Part 2, Part 3 & Part 4
- REST and Ajax
- Timing (benchmarking) your code
- Validating email addresses
There's lots of good content here, especially if you're a beginning developer and want to discover these helpful hints along with him.
2012年5月16日星期三
Community News: AtlantaPHP June Meetup - Introduction to Laravel
The Atlanta PHP User Group has announced their latest meeting for June 2012 - an introduction to the Larvel framework from Ben Edmunds.
Are you ashamed to admit you're a PHP developer? Have you been using the same old, boring PHP framework for years? Tired of your PHP applications turning into enormous beasts? Maybe you've heard about Laravel but haven't made the effort to dive into it? In this presentation, we'll walk through what makes Laravel an elegant, fun, and exciting framework to make PHP applications that you'll be proud of.
The meeting is happening June 7th at 7pm at the Strongbox West on Defoor Place. Food will be provided and there'll be giveaways of AtlantaPHP and Laravel swag!
Have a user group meeting coming up you'd like posted? send it over and we'll get it posted!
Symfony Blog: Symfony Community Survey 2012
The Symfony Project is running a community survey for developers using the framework. It asks some generic questions including "how long have you been working with Symfony?" and "how did you get to know Symfony?"
Symfony 2.0 has been released for quite a long time now, and so we would like to conduct a quick survey to get a better understanding of the Symfony community. I'm going to use some of the aggregated results for my Symfony Live keynote, and all the aggregated results will be published on this blog after the conference.
If you're a SenseioLabs Connect user, you can also get a badge for participating and will be included in a giveaway for tshirts and hats.
Chris Hartjes' Blog: Have a 'Strategy'
In response to this suggestion from Alessandro Nadalin about using the "Strategy" design pattern to replace a switchChris Hartjes has this new post sharing his opinion of "the right way" do it it.
Once I realized what he was doing, I realized that the Strategy pattern was applicable in this case…but his chosen example was dumb and one that I wouldn't have used to demonstrate things. As expected, he told me to supply a sample of a better way. I did, telling him that the sample would be better if he didn't mash the logging level together with the message.
Included in the post is sample code, first showing the initial version of the logging class, complete with accompanying tests. Following that, he shows how to refactor it into something using the Strategy pattern, replacing the logging type switch statement with protected methods for each logging message type (critical, notice, etc).
2012年5月15日星期二
Voices of the ElePHPant Podcast: Interview with Derick Rethans
The Voices of the ElePHPant podcast has released their latest episode - an interview with Derick Rethans of 10gen and XDebug fame.
Cal's "three questions" for Derick involve
- How did you come up with the idea and how did the project get started?
- What's been the most fun and interesting part about building the community around XDebug?
- What's the hardest lesson you've learned about running a project like XDebug?
You can listen to this latest episode either via the in-page player or by downloading the mp3 directly. You can also subscribe to their feed to get the latest as they're released.
Fabien Potencier's Blog: Sami: Yet another PHP API documentation generator
Fabien Potencier has released a new tool to the open source community today - a documentation generation tool called Sami.
Nowadays, phpDocumentor version 2 is probably the best option out there as it has a good architecture, it works fine, it is extensible, and quite a few big PHP projects is already using it. And that's fine. I don't want to compete with it, I don't want to replace it, I'm just open sourcing some code used by Symfony, Twig, and Silex because I'm not comfortable with closed-source software. And to be totally honest and transparent, I have not released the code before because it was not "good enough".
He gives an example of how to install and use Sami - configuring the directories to parse and setting up a custom theme for the resulting generated documentation (using regular CSS and HTML definitions).
Sean Coates' Blog: PHP as a templating language
In this new post to his blog Sean Coates talks about PHP as a templating language and why he (and Gimmebar) have decided to go another, more frontend-based direction.
For many years, I was a supporter of using PHP as a templating language to render HTML. However, I really don't buy into the idea of adding an additional abstraction layer on top of PHP, such as Smarty (and many others). In the past year or so, I've come to the realization that even PHP itself is no longer ideally suited to function as the templating engine of current web applications - at least not as the primary templating engine for such apps.
His reasoning is pretty simple - more and more web applications are becoming less and less server-driven. When building applications (and APIs) you don't know how the data will be consumed, so your frontend has to be agnostic. So, what's his current alternative of choice? The Mustache templating framework provides a simple way to create reusable templates (along with the compatible Handlebars Javascript library).
MaltBlue.com: Zend Form Mastery with Zend_Config - Part 2, Core Form Configuration
In his previous post to the MaltBlue.com blog Matt introduced the concept of configuration-driven Zend_Form instances. He's back with a second part to the series, enhancing his original examples by covering some of the base-level form configuration settings.
Ok, this should have been part one, but irrespective, here's the second installment in zend form mastery with zend config - core form configuration. As the W3c Form spec says, there are 8 attributes applicable to forms.
These attributes, including "action", "name" and "onsubmit", can all be set easily in the XML-based configuration file. He includes an example of the full XML file to show how they all fit together (updated from part 1). You can see an example of the output here and can grab the source for the example from github.
2012年5月14日星期一
Engine Yard: Cloud Out Loud Podcast - MongoDB and OpenStreetMap
On the EngineYard site today there's a new podcast released with Elizabeth Naramore interviewing Derick Rethans (of 10gen) about MongoDb and the OpenStreetMap project.
Derick gives a little background about himself (including being a PHP evangelist for 10gen) and how he ended up working with MongoDB. They talk about how MongoDb is different and some of the involvement he has in contributing to open source projects and the OpenStreetMap project.
You can listen to this latest episode either via the in-page player or by downloading the file directly.
PHPMaster.com: REST - Can You do More than Spell It? Part 3
On PHPMaster.com they've posted the third part of their series looking at development around RESTful APIs. In this latest article they take an outsider's perspective and look at using services rather than creating one from scratch. (Part 1, Part 2)
Imagine it's a warm, sunny, summer day. You're just walking along, taking a leisurely noonday stroll, when all of a sudden you come face to face with a RESTful API. What do you do? How do you interface with it? Or, as those of us in the know would say, "how do you consume RESTful services?" That, my friends, is the subject of this article.
They mention using other tools (like components/features of common frameworks) to interface with the services, but end up using the curl extension to make a POST request to a service to add a few events to a "/summerschedule" resource.
Gonzalo Ayuso's Blog: Building a simple SQL wrapper with PHP
In this new post to his blog Gonzalo Ayuso has shared a simple SQL wrapper that he uses to work with his databases. It takes in an injection of the database connection component (a href="http://php.net/pdo">PDO) and provides functionality for inserts, updates, etc. with transaction support.
If we don't use an ORM within our projects we need to write SQL statements by hand. I don't mind to write SQL. It's simple and descriptive but sometimes we like to use helpers to avoid write the same code again and again. Today we are going to create a simple library to help use to write simple SQL queries.
It's a lightweight library that'd be good for basic uses, but when you start getting into something a bit more complex, something like Doctrine2 or Propel might be a better solution (or whatever your framework of choice has built in).
2012年5月11日星期五
Site News: Popular Posts for the Week of 05.11.2012
- Lorna Mitchell's Blog: Tips on Writing an API for a Smartphone App
- PHPMaster.com: REST - Can You do More than Spell It? Part 2
- Site News: Job Postings for the week of 04.29.2012
- Fawad Hassan's Blog: Load More Using KnockoutJS, PHP/CodeIgniter (Part 1)
- PHP-Security.net: New PHP-CGI Exploit (CVE-2012-1823)
- PHP.net: PHP 5.3.12 and PHP 5.4.2 Released!
- PHP.net: PHP 5.3.12 and 5.4.2 and the CGI flaw (CVE-2012-1823)
- Larry Garfield's Blog: readfile() not considered harmful
- Ibuildings techPortal: Conference Report: Whisky Web
- ZetCode.com: PostgreSQL PHP Tutorial
Evan Coury's Blog: Module-specific layouts in Zend Framework 2
Evan Coury has a new Zend Framework 2 related blog post looking at how to use module specific layouts in your application (even though, technically, it's more related to the controller).
There's really no such thing as "module-specific" anything in ZF2, so what we're really talking about is the topmost namespace of the controller being dispatched. So in the case of MyModuleControllerSomeController, the topmost namespace would be MyModle. In most cases, this will be the name of a given module.
He gives a quick piece of sample code showing a "Module" class that attaches an event on the dispatch of its request. Inside this event, he grabs the controller (target) and updates the layout via a call to the "layout" method. This is all handled in the "init" method of the module, so it should "just work" when the module is used.
NetTuts.com: Aspect-Oriented Programming in PHP
On the NetTuts.com (Plus) site there's a new tutorial focusing on aspect-oriented programming in PHP, a shift from the usual methods of development with the goal of "crosscutting" your classes/objects by weaving in extra functionality. Their examples of this method use the FLOW3 framework.
All modern frameworks (including FLOW3) push a lot of patterns into the software stack that do a great job at separating the concerns of your business logic; among them the famous MVC that is separating your logic into different layers. However, an application is not only built on business logic alone. As it grows, you may want to implement additional services, features, plugins or plugins of plugins. You surely don't want this stuff in your business logic! But what are your options?
For their example, they show how to implement a logger across your classes, taking it out of the actual code and implementing it in an aspect (at the "pointcut") by "weaving" it into a DocBlock comment with special annotations. They help you get the FLOW3 framework set up and show you how to "kickstart" a new project and work with its controllers and resources. They show you how to implement the Logging aspect and how to define it in your code (and where it caches the requests).
Developer.com: Creating a Custom ACL in PHP
On Developer.com there's a recent tutorial showing you how to create a basic access control list in PHP (not in any specific framework). It allows you to define not only user permissions but groups and group permissions as well.
So, what are the advantages of an ACL model? The first advantage is security. Using this model will make your application more secure and less vulnerable to exploits. When securing any program, it is good to give to the user only the privileges he/she needs. That means that, for example, you should not give super administrator privileges to someone who will only manage website content. The ACL security model allows you to do just that. The second advantage is the easiness of user management. You can divide users into groups, while each group has certain access permissions. Also, you can easily add new user groups, delete the old ones or change group permissions.
They include the database structure you'll need to make the backend work (four tables) and the code to create an "Acl" class with methods to check a user+group for a permission, get the permissions for a user and get the permissions for a group. It's a pretty simple system and has a lot more that could be added to it to make it more robust, but it's a good start.
2012年5月10日星期四
Site News: Blast from the Past - One Year Ago in PHP
- Chris Jones' Blog: Oracle Tuxedo: A New way to Run PHP Applications
- Brian Swan's Blog: Book Review: Easy PHP Websites with the Zend Framework
- Gonzalo Ayuso's Blog: Real time monitoring PHP applications with websockets and node.js
- DZone.com: WebMatrix: Why PHP Developers Should Pay Attention
- Jason Gilmore's Blog: Sixteen Best Practices- and Productivity-Related PHP Tutorials
- Lorna Mitchell's Blog: Idiot-Proof Deployment with Phing
- Query7.com: Kohana 3.1 Wiki Tutorial
- DevShed: Custom Session Management Using PHP and MySQL
- Liip Blog: Silex - A Grand Micro Framework for PHP
- Chris Roane's Blog: Advanced PHP Form Validation
- Padraic Brady's Blog: CodeIgniter 2.0.2: Cross-Site Scripting (XSS) Fixes And Recommendations
- NetTuts.com: How to Work with PHP and FTP
- Chris Jones' Blog: PHP 5.4 is Gathering Momentum
- Shay Ben Moshe's Blog: Hashing Passwords Properly
- PHPBuilder.com: Create a Dynamic Username Validator with PHP, MySQL and jQuery
PHPMaster.com: The Dependency Inversion Principle
Continuing on in their series looking at the SOLID development principles, Alejandro Gervasio picks back up and looks at the "D" in the set - the dependency inversion principle.
While some central concepts in the realm of object-oriented design are generally harder to digest at first, such as separation of concerns and implementation switching, more intuitive and untangled paradigms on the other hand are simpler, like programming to interfaces. Unfortunately, the DIP's formal definition is surrounded by a double-edged curse/blessing that often makes programmers gloss over it, as in many cases there's an implicit assumption that the principle is nothing but a fancy expression for the aforementioned "programming to interfaces" commandment.
He talks about how decoupling your code and working against interfaces is only part of the equation. The other half is the actual "inversion" part of the process - the ownership that the high-level modules must have over the abstractions. He illustrates with an example, a storage module that is highly dependent on a Serializer. Using the DIP principle, he turns this around and refactors his storage class to take in an Encoder object as a part of its construction. Complete source for both versions is included.
PHPClasses.org: Using DaDaBIK to create a PHP CRUD Database Front-End without coding
On the PHPClasses.org blog there's a recent post about using the DaDaBIK project to automatically generate a database CRUD frontend without having to code any of it by hand.
Writing CRUD database front-ends and simple database applications is a very common task that almost all PHP developers need to implement. It is usually a simple job to accomplish, but is also time consuming, boring and error-prone to implement. Software developer's tend to avoid time wasting and repetitive tasks in favor of more challenging tasks. This lead to the development of applications with the goal to automate front-end development. DaDaBIK is one of the precursors of this kind of applications for automated creation of PHP front-ends. Released initially in the year 2000 by myself, Eugenio Tacchini, the project continues to be actively developed until today.
Included in the post are a few screenshots of the interface and a screencast showing it in use. You can find out more about the project on the DaDaBIK website.
Stuart Herbert's Blog: Getting PEAR Working On Windows 7
Stuart Herbert has a new post today showing how to get the well-established PEAR package management system working on Windows 7 so you can easily call "pear install" on whatever your needs might be.
So that I don't forget how to do this next time around. Worked for me, your mileage may vary. First step is to get a working install of PHP. [...] At this point, you should be able to open up a Command Prompt, and type 'php -v', and see the response 'PHP v5.4.latest …' appear as expected. Now for PEAR itself.
He gives step-by-step instructions on how to get PEAR up and running - downloading and configuring it with the correct Windows-based paths and using the PEAR_ENV.reg file to update your registry.
2012年5月9日星期三
PHP.net: PHP 5.4.3 and PHP 5.3.13 Released!
The PHP project has released another update to both the 5.3.x and 5.4 revisions of the language correcting the bug that was found dealing with a flaw in CGI-based setups.
The PHP development team would like to announce the immediate availability of PHP 5.4.3 and PHP 5.3.13. All users are encouraged to upgrade to PHP 5.4.3 or PHP 5.3.13 The releases complete a fix for a vulnerability in CGI-based setups (CVE-2012-2311). Note: mod_php and php-fpm are not vulnerable to this attack. PHP 5.4.3 fixes a buffer overflow vulnerability in the apache_request_headers() (CVE-2012-2329). The PHP 5.3 series is not vulnerable to this issue.
Users are encouraged to upgrade their applications, especially those using CGI-based setups. You can find the latest source on the downloads page and the Windows binaries on windows.php.net.
Rob Allen's Blog: Vagrant in Zend Framework 1
In the latest post to his blog Rob Allen looks at using Vagrant with Zend Framework applications to use for testing your code against multiple ZF versions.
Vagrant is a fantastic tool that enables you to manage and run virtual machines from the command line, including automatic provisioning of them using puppet or chef. The really cool thing about it however from my point of view is that vagrant automatically sets up the VM with a folder called /vagrant that holds the code on your local hard drive from where you started the VM. This means that you can continue to edit your code in your local editor/IDE and test it within the VM easily
Inspired by similar work on the joind.in project, he's created the instructions to make a Vagrantfile that, using VirtualBox and this puppet configuration, sets up and configures a VM you can ssh into and execute your tests.
Derick Rethans' Blog: 10 years of Xdebug and Xdebug 2.2.0 released
Congratulations go out to Derick Rethans for the outstanding work he's done on XDebug for the last ten years. From his latest blog post:
Today it has been ten years since the first release of Xdebug: version 0.7.0. I would like to celebrate this tenth anniversary with a new release: Xdebug 2.2.0. Xdebug 2.2 adds support for PHP 5.4 and provides some new features.
There's five new things on his list of updates in this latest release:
- Colours on the command line
- Better support for closures in stack and function traces
- The size of arrays is now shown with the overloaded variable output
- Added the method call type to xdebug_get_function_stack
- Extra information to error printouts to tell that the error suppression operator has been ignored due to xdebug.scream
If you've found XDebug handy for testing and finding those tough to track bugs over the years, you should consider buying "support" to show Derick your appreciation (oh, and you also get a "first in" preference on your XDebug questions)!
Lorna Mitchell's Blog: Using an Existing Vagrant Setup for PHP Development
In this new post to her blog Lorna Mitchell dives into the world of vagrant/puppet/chef and looks at using the tools to automatically create VMs that you can use for PHP development (or testing).
I've been hearing great things about puppet, chef, vagrant, and friends for a while now, but since I work on my own I tend to either develop straight onto my ubuntu machine or grab an appropriate existing VM and use that. So I read about this brave new world of virtualisation but (as with most tools) they can be hard to introduce on your own, and I didn't. [...] Then I went to WhiskyWeb, which had a hackathon [...] with the shiny new technology all packaged for me, I decided it was time to take a look!
She shows you how to get the VM started up using vagrant, pausing the instance and removing it all together (destroy). She also includes the command to directly access the VM via ssh and links to the joind.in project with its sample puppet configuration and Vagrant file.
2012年5月8日星期二
Henri Bergius' Blog: Using Composer To Manage Dependencies In Heroku PHP Apps
Henri Bergius has a new post to his blog showing you how to use the popular Composer package management tool to manage dependencies in Heroku applications.
While Heroku got its start from hosting Ruby on Rails applications, it nowadays supports many different environments in the Cedar stack. Node.js is what many use, but they also do support PHP. Dependency management is easy for Node.js applications as Heroku recognizes your package.json files and automatically installs the libraries needed via NPM.
Until now PHP developers haven't had this convenience, but as Composer is emerging as the default PHP package manager, I've now added support for it. Before the pull request gets accepted, Composer dependency handling can already be used by specifying my custom PHP buildpack when creating Heroku apps.
He shows you how to get it up and running with a sample application - creating the new git archive, creating the Heroku app with the custom backapack (and a "composer.json" file), setting up the main "index.php" file and push it all to Heroku.
You can view his sample application here (a simple URL encoding form).
Sameer Borate's Blog: Downloading Gmail attachments using PHP
Sameer Borate has a quick tutorial posted to his site today about using PHP, specifically the IMAP functionality, to grab attachments off of emails from Gmail.
Automatically extracting attachments from Gmail can be important for reasons where you need to process the attached files periodically with a CRON job. Also it can be useful for automatically archiving important attachments. Below is a simple proof-of-concept plain PHP code, devoid of any object-oriented features that extracts attachments from your Gmail account. It uses PHPs imap extension to access the inbox.
His simple script opens an IMAP connection to the Gmail server and loops through your current emails (max of 16) and tries to find any that have attachments. It then extracts this part of the message, base64_decodes it, and saves the set of them to the local file system. You can download the source here.
PHPClasses.org: Lately in PHP, Episode 23 - Will it ever Matter if PHP Sucks?
On the PHPClasses.org site today they've posted their latest episode of the "Lately in PHP" Podcast, "Will it ever Matter if PHP Sucks?"
Once in a while we see fans of other languages writing long articles on why PHP sucks and you should not use it. But will that ever matter? That is one of the main topics discussed by Manuel Lemos and Ernani Joppert in the episode 23 of the Lately in PHP podcast, for the first time also recorded in video using Google Hangouts On Air.
They also talk about some of the recent proposals for PHP itself and the buzz surrounding the "HTTP 2.0" protocol that's been proposed. You can listen to this latest episode either via the in-page player, by downloading the mp3 or subscribing to their feed. Since they used the Google Hangouts to record the session, you can also watch the video.
Shashikant Jagtap's Blog: Enjoy 'MinkExtension' for Behat
In this new post to his blog Shashikant Jagtap talks about a new extension for Behat (the BDD testing tool) that makes working with Mink even easier - MinkExtension.
'MinkExtension' has been just released which has additional services for Behat. This extension has 'Mink' instance for your 'FeatureContext' and 'SubContext'. UI testers would be happy now, as they don't need to create Mink instance every time in order to use Mink API's.
He points you to an example application you can use to follow along. He includes the commands needed to install the dependencies via Composer and get this extension working (note: it requires PHP 5.4 for some of the traits stuff. If you don't want to use that, comment out the "TraitedFeatureContext.php" file). Also included are the commands to execute the tests with a Selenium server and a list of a few handy new things this extension enables.
Martin Sikora's Blog: Silex + Doctrine 2 ORM
Martin Sikora has shared some of his experience with setting up a Silex instance to work with Doctrine2 in a new post to his blog. The popular microframework comes with a built-in Doctrine service provider, so integration isn't overly difficult.
Silex is great for its simplicity, however for larger projects you probably want to use some ORM like Doctrine but there's build-in service provider only for Doctrine DBAL and not ORM.
He breaks it up into five smaller steps, each with code samples to help clarify:
- Doctrine 2 ORM Service Provider
- Create your entity classes
- Mind Doctrine DBAL and Doctrine ORM versions
- Doctrine CLI
- Working with Doctrine ORM
2012年5月7日星期一
Kore Nordmann's Blog: PHP Subconference at FrOSCon 2012
Kore Nordmann has a new post to his blog today about the officially announced PHP subconference happening at this year's FrOSCon (in August near Bonn, Germany).
For the seventh time we will be at the Free and Open Source Conference (FrOSCon) in St. Augustin, near Bonn. This time we will organize a full fleged PHP subconference agian. We also offer space to discuss PHP related topics, or just hack with other open minded people around you. We would love to welcome you at the PHP subconference.
Speakers for the subconference will get the same benefits as the normal conference speakers - a reduced rate at a hotel and food/drinks for the duration of the event. (No travel included as it is a community-driven conference). If you'd like to submit, you can send in your ideas here - hurry, though! The deadline ends on the 23rd of this month (May).
PHP.net: PHP 5.3.12 and 5.4.2 and the CGI flaw (CVE-2012-1823)
PHP 5.3.12/5.4.2 do not fix all variations of the CGI issues described in CVE-2012-1823. It has also come to our attention that some sites use an insecure cgiwrapper script to run PHP. These scripts will use $* instead of "$@" to pass parameters to php-cgi which causes a number of issues. Again, people using mod_php or php-fpm are not affected.
The rewrite rule is there in the post, ready for copy and pasting into your config. Even if you're running the latest PHP 5.3.12 and 5.4.2., be sure to use this rule as a stop-gap measure for now. Another release is planned for tomorrow to fully correct the CGI flaw.
Freek Lijten's Blog: SOLID - The O is for Open Closed Principle
Freek Lijten has posted the second part of his series looking at the SOLID development methodology. In this latest post his looks at the second letter in the acronym - "O" for "Open Closed Principle."
Software that requires an enormous amount of changes to implement one new feature or fix a bug is unstable and should be considered as "bad". Software should be designed so, that in case of a new feature, no existing classes should have to change. In other words: it is closed for modification. Existing software may be extended to achieve new features however.
He starts off with a "What" section explaining a bit more about what this open/closed means for your code and gets into an example showing it in a more practical way. He shows how to take the principle and refactor an API connector class to pass in the object it needs (Bike) and use that to get information (rather than just passing in the data). He uses a Factory to get the object type he needs based on the Bike type.
ZetCode.com: PostgreSQL PHP Tutorial
On the ZetCode.com site there's a five part tutorial posted about getting your PHP application up and running on a PostgreSQL database (updated on the 4th).
This is a PHP tutorial for the PostgreSQL database. It covers the basics of PostgreSQL programming with PHP. The examples were created and tested on Linux. [...] PostgreSQL is a powerful, open source object-relational database system. It is a multi-user, multi-threaded database management system. It runs on multiple platforms including Linux, FreeBSD, Solaris, Microsoft Windows and Mac OS X. PostgreSQL is developed by the PostgreSQL Global Development Group.
The chapters guide you through every step you'll need:
- An introduction to PostgreSQL and getting it and PHP support installed (with the php5-pgsql package)
- Example code showing how to extract data from your tables
- Working with images and storing their data in a table
- Pulling out the metadata from the database, things like number of rows returned and table information
- Transactions and database-side processing
2012年5月5日星期六
2012年5月4日星期五
Site News: Popular Posts for the Week of 05.04.2012
- Marcelo Gornstein's Blog: PHP Continuous integration, with Jenkins and Phing
- SitePoint.com: Sneak Peek at Kevin Yank's New Book 'PHP & MYSQL: Novice to Ninja'
- Kevin Schroeder's Blog: ZF2 Dependency Injection - Multiple Object Instances
- Kevin Schroeder's Blog: ZF2 Dependency Injection: Managing Configuration - Part 2
- PHPMaster.com: REST - Can You do More than Spell It? Part 1
- PHPMaster.com: PHP Security: Cross-Site Scripting Attacks (XSS)
- /Dev/Hell Podcast: Episode 11: From Gas Station Attendant to Java Developer
- ServerGrove Blog: Spooling emails with Symfony2 on VPS and Shared Hosting
- Court Ewing's Blog: Common, Cryptic PHP Errors
- Evan Coury's Blog: Sharing a database connection across modules in Zend Framework 2
PHP.net: PHP 5.3.12 and PHP 5.4.2 Released!
The PHP project has officially released the latest versions in both the 5.3.x and 5.4.x series in response to a bug that was found in the CGI setup of certain server+PHP configurations.
There is a vulnerability in certain CGI-based setups (Apache+mod_php and nginx+php-fpm are not affected) that has gone unnoticed for at least 8 years. Section 7 of the CGI spec states: 'Some systems support a method for supplying a [sic] array of strings to the CGI script. This is only used in the case of an `indexed' query. This is identified by a "GET" or "HEAD" HTTP request with a URL search string not containing any unencoded "=" characters.'
A large number of sites run PHP as either an Apache module through mod_php or using php-fpm under nginx. Neither of these setups are vulnerable to this. Straight shebang-style CGI also does not appear to be vulnerable. If you are using Apache mod_cgi to run PHP you may be vulnerable. To see if you are, just add ?-s to the end of any of your URLs. If you see your source code, you are vulnerable. If your site renders normally, you are not.
You can download this latest version from the downloads page for the source releases or windows.php.net for the Windows binaries. You can look at the Changelog if you'd like more details on the update.
PHP-Security.net: New PHP-CGI Exploit (CVE-2012-1823)
The PHP-Security.net site has two posts related to the recently discovered bug in PHP (hence the new versions) related to the CGI handling in certain server configurations.
In the first they detail more of what the bug is, how it could be exploited and link to the original advisory for the problem. Also included are more details on the issue, including sample avenues of attack.
In the second post they look at the recent PHP release and note that it does not completely rid the language of the problem. They point out that the Rewrite rule that's included in their post (not the one on PHP.net) should be used to prevent this issue from effecting your installations.
Larry Garfield's Blog: readfile() not considered harmful
In this new post to his blog Larry Garfield tries to dispel a common misconception in the PHP development world - that the readfile function should be considered harmful and can cause memory issues in your code.
If you're like me, you've probably read a dozen or two articles about PHP performance in your career. Many of them are quite good, but some are simply flat out wrong, or misinformed. One of the old truisms that has been repeated for as long as I can recall is "don't use readfile() if you have big files, because it reads the whole file into memory and your server will explode." [...] There's just one problem with that age-old truism: It's not true.
He created some benchmarks to illustrate the differences between several of the common methods for working with files via the fread, fpassthru, stream_copy_to_stream and of course readfile. He reports the results based on the runtime and the peak memory usage and noted, ironically, that while the times varied slightly, the memory consumption was exactly the same for all of the approaches. Since there's no real reason not to use "readfile", he looks at three reasons why there might be this stigma attached to it (including the issues that could come up with output buffering enabled).
Lorna Mitchell's Blog: Tips on Writing an API for a Smartphone App
Lorna Mitchell has a recent post to her blog with some handy tips for building an API for a smartphone app and some key points to focus on.
Yesterday, I saw this tweet: "@lornajane @nabeels tips on starting to write an API to interact with Smartphone App?" I have lots of advice for Olly (whom I know personally) but there's no way it will fit into a tweet! So here it is, in rather longer form :)
She touches on five different things to help you on the road to success:
- Be consistent
- Fail really really excellently
- Keep it tidy
- Recommendations for using JSON, a RPC format and understanding HTTP
- Some tools to help you in your development (debugging)
2012年5月3日星期四
Site News: Blast from the Past - One Year Ago in PHP
- PHPBuilder.com: Building Web Apps with the Limonade PHP Framework
- DevShed: 7 PHP Frameworks Tested For Speed - Benchmarking PHP Frameworks
- Web Developer Juice: PHP Magic Functions: Best Part of Object Oriented PHP - Part 1
- Symfony Blog: Symfony2: Getting easier (Parts 2 & 3)
- Script-Tutorials.com: Creating a Modern Looking Animated Login System in PHP
- Chris Aitchison's Blog: You are NOT a Software Engineer!
- Community News: Dutch PHP Conference - Important update: Conference Social Location has Changed!
- Phil Sturgeon's Blog: Benchmark 2011: A call for Participants
- PHPRiot.com: Translating Text Using the Google Translate API and PHP, JSON and cURL
- SitePoint PHP Blog: Sophisticated Object Iterators in PHP
- Zend Developer Zone: Creating Web Page Templates with PHP and Twig (part 2)
- Kevin van Zonneveld's Blog: Revisiting Faster PHP Sessions
- Christian Weiske's Blog: Visualizing PHPUnit runs
- Rob Allen's Blog: Exploring Zend_Paginator
- PHPBuilder.com: PHP Dependency Injection Creates More Maintainable Code
Christopher Kunz's Blog: Now serving: SPDY
Christopher Kunz is trying out the new web acceleration tool Google recently released (SPDY) when his site is served under HTTPS (warning, self-signed cert).
The reason this posting lands in the PHP category is that I want to have a playground testing PHP applications with mod_spdy. Currently (and probably also in the future), this machine uses mod_php instead of php_(f)cgi(d) - this is not recommended for interoperation with mod_spdy. To test the real-life impact of the possible thread safety issues, I am using my private pages as a sandbox.
He has two other PHP-based applications running with the accelerator - a Gallery3 install and a WordPress site. SPDY ("speedy") was released by Google and is similar to HTTP but with a focus on minimized latency and heightened web security.
PHPMaster.com: An Introduction to Redis in PHP using Predis
On PHPMaster.com today there's a new tutorial by Daniel Gafitescu showing you how to work with Redis (a key-value store) via PHP with the help of the Predis library.
There is a lot of argument whether Redis or Memcache is better, though as the benchmarks show they perform pretty much on par with each other for basic operations. Redis has more features than Memcache has, such as in-memory and disk persistence, atomic commands and transactions, and not logging every change to disk but rather server-side data structures instead. In this article we'll take a look at some of the basic but powerful commands that Redis has to offer using the Predis library.
He helps you get a local redis server up and running and includes a link to the repository for the latest version of the Predis library. Some sample code is provided showing how to connect to the server, push data into a key/value combination, get the value back out, increment it and check to see if it exists. He also talks about some of the available data types Redis provides and a few other more complex operations you can perform on things other than strings.