mirror of
https://github.com/codeguy/php-the-right-way.git
synced 2025-08-13 09:13:58 +02:00
Merge branch 'gh-pages' of git://github.com/eoconnell/php-the-right-way into gh-pages
This commit is contained in:
@@ -6,17 +6,21 @@ More importantly, `PDO` allows you to safely inject foreign input (e.g. IDs) int
|
||||
|
||||
Let's assume a PHP script receives a numeric ID as a query parameter. This ID should be used to fetch a user record from a database. This is the `wrong` way to do this:
|
||||
|
||||
{% highlight php %}
|
||||
<?php
|
||||
$pdo = new PDO('sqlite:users.db');
|
||||
$pdo->query("SELECT name FROM users WHERE id = " . $_GET['id']); // <-- NO!
|
||||
{% endhighlight %}
|
||||
|
||||
This is terrible code. You are inserting a raw query parameter into a SQL query. This will get you hacked in a heartbeat. Instead, you should sanitize the ID input using PDO bound parameters.
|
||||
|
||||
{% highlight php %}
|
||||
<?php
|
||||
$pdo = new PDO('sqlite:users.db');
|
||||
$stmt = $pdo->prepare('SELECT name FROM users WHERE id = :id');
|
||||
$stmt->bindParam(':id', filter_input(INPUT_GET, 'id', FILTER_SANITIZE_NUMBER_INT), PDO::PARAM_INT);
|
||||
$stmt->execute();
|
||||
{% endhighlight %}
|
||||
|
||||
This is correct code. It uses a bound parameter on a PDO statement. This escapes the foreign input ID before it is introduced to the database preventing potential SQL injection attacks.
|
||||
|
||||
|
@@ -40,19 +40,26 @@ When you come across documentation that states to run Composer as `php composer.
|
||||
|
||||
First, create a `composer.json` file in the same directory as `composer.phar`. Here's an example that lists [Twig][2] as a project dependency.
|
||||
|
||||
{% highlight json %}
|
||||
{
|
||||
"require": {
|
||||
"twig/twig": ">=1.8.0,<2.0-dev"
|
||||
}
|
||||
}
|
||||
{% endhighlight %}
|
||||
|
||||
Next, run this command from your project root directory.
|
||||
|
||||
{% highlight bash %}
|
||||
> php composer.phar install
|
||||
{% endhighlight %}
|
||||
|
||||
This will download and install the project dependencies into a `vendors/` directory. Next, add this line to your application's primary PHP file; this will tell PHP to use Composer's autoloader for your project dependencies.
|
||||
|
||||
{% highlight php %}
|
||||
<?php
|
||||
require 'vendor/autoload.php';
|
||||
{% endhighlight %}
|
||||
|
||||
Now you can use your project dependencies, and they'll be autoloaded on demand.
|
||||
|
||||
|
@@ -47,27 +47,33 @@ CLI PHP programs are powerful because you can use your app's code directly witho
|
||||
|
||||
Try running PHP from your command line:
|
||||
|
||||
{% highlight bash %}
|
||||
> php -i
|
||||
{% endhighlight %}
|
||||
|
||||
The `-i` option will print your PHP configuration just like the [`phpinfo`][phpinfo] function. There are a number of other useful [command line options][cli-options], too.
|
||||
|
||||
Let's write a simple "Hello, $name" CLI program. To try it out, create a file named `hello.php`, as below.
|
||||
|
||||
{% highlight php %}
|
||||
<?php
|
||||
if($argc != 2) {
|
||||
die("Usage: php hello.php [name].\n");
|
||||
}
|
||||
$name = $argv[1];
|
||||
echo "Hello, $name\n";
|
||||
{% endhighlight %}
|
||||
|
||||
PHP sets up two special variables based on the arguments your script is run with. [`$argc`][argc] is an integer variable containing the argument *count* and [`$argv`][argv] is an array variable containing each argument's *value*. The first argument is always the name of your PHP script file, in this case `hello.php`.
|
||||
|
||||
To run our script, above, from the command line:
|
||||
|
||||
{% highlight bash %}
|
||||
> php hello.php
|
||||
Usage: php hello.php [name]
|
||||
> php hello.php world
|
||||
Hello, world
|
||||
{% endhighlight %}
|
||||
|
||||
|
||||
* [Learn about running PHP from the command line][php-cli]
|
||||
|
@@ -13,6 +13,7 @@
|
||||
<meta property="og:type" content="website"/>
|
||||
<link rel="stylesheet" href="http://fonts.googleapis.com/css?family=Alfa+Slab+One|Droid+Serif"/>
|
||||
<link rel="stylesheet" href="/styles/all.css"/>
|
||||
<link rel="stylesheet" href="/styles/syntax.css"/>
|
||||
<link rel="icon" href="/images/favicon.png" type="image/png"/>
|
||||
<script>
|
||||
var _gaq = _gaq || [];
|
||||
|
60
styles/syntax.css
Normal file
60
styles/syntax.css
Normal file
@@ -0,0 +1,60 @@
|
||||
.highlight { background: #ffffff; }
|
||||
.highlight .c { color: #999988; font-style: italic } /* Comment */
|
||||
.highlight .err { color: #a61717; background-color: #e3d2d2 } /* Error */
|
||||
.highlight .k { font-weight: bold } /* Keyword */
|
||||
.highlight .o { font-weight: bold } /* Operator */
|
||||
.highlight .cm { color: #999988; font-style: italic } /* Comment.Multiline */
|
||||
.highlight .cp { color: #999999; font-weight: bold } /* Comment.Preproc */
|
||||
.highlight .c1 { color: #999988; font-style: italic } /* Comment.Single */
|
||||
.highlight .cs { color: #999999; font-weight: bold; font-style: italic } /* Comment.Special */
|
||||
.highlight .gd { color: #000000; background-color: #ffdddd } /* Generic.Deleted */
|
||||
.highlight .gd .x { color: #000000; background-color: #ffaaaa } /* Generic.Deleted.Specific */
|
||||
.highlight .ge { font-style: italic } /* Generic.Emph */
|
||||
.highlight .gr { color: #aa0000 } /* Generic.Error */
|
||||
.highlight .gh { color: #999999 } /* Generic.Heading */
|
||||
.highlight .gi { color: #000000; background-color: #ddffdd } /* Generic.Inserted */
|
||||
.highlight .gi .x { color: #000000; background-color: #aaffaa } /* Generic.Inserted.Specific */
|
||||
.highlight .go { color: #888888 } /* Generic.Output */
|
||||
.highlight .gp { color: #555555 } /* Generic.Prompt */
|
||||
.highlight .gs { font-weight: bold } /* Generic.Strong */
|
||||
.highlight .gu { color: #aaaaaa } /* Generic.Subheading */
|
||||
.highlight .gt { color: #aa0000 } /* Generic.Traceback */
|
||||
.highlight .kc { font-weight: bold } /* Keyword.Constant */
|
||||
.highlight .kd { font-weight: bold } /* Keyword.Declaration */
|
||||
.highlight .kp { font-weight: bold } /* Keyword.Pseudo */
|
||||
.highlight .kr { font-weight: bold } /* Keyword.Reserved */
|
||||
.highlight .kt { color: #445588; font-weight: bold } /* Keyword.Type */
|
||||
.highlight .m { color: #009999 } /* Literal.Number */
|
||||
.highlight .s { color: #d14 } /* Literal.String */
|
||||
.highlight .na { color: #008080 } /* Name.Attribute */
|
||||
.highlight .nb { color: #0086B3 } /* Name.Builtin */
|
||||
.highlight .nc { color: #445588; font-weight: bold } /* Name.Class */
|
||||
.highlight .no { color: #008080 } /* Name.Constant */
|
||||
.highlight .ni { color: #800080 } /* Name.Entity */
|
||||
.highlight .ne { color: #990000; font-weight: bold } /* Name.Exception */
|
||||
.highlight .nf { color: #990000; font-weight: bold } /* Name.Function */
|
||||
.highlight .nn { color: #555555 } /* Name.Namespace */
|
||||
.highlight .nt { color: #000080 } /* Name.Tag */
|
||||
.highlight .nv { color: #008080 } /* Name.Variable */
|
||||
.highlight .ow { font-weight: bold } /* Operator.Word */
|
||||
.highlight .w { color: #bbbbbb } /* Text.Whitespace */
|
||||
.highlight .mf { color: #009999 } /* Literal.Number.Float */
|
||||
.highlight .mh { color: #009999 } /* Literal.Number.Hex */
|
||||
.highlight .mi { color: #009999 } /* Literal.Number.Integer */
|
||||
.highlight .mo { color: #009999 } /* Literal.Number.Oct */
|
||||
.highlight .sb { color: #d14 } /* Literal.String.Backtick */
|
||||
.highlight .sc { color: #d14 } /* Literal.String.Char */
|
||||
.highlight .sd { color: #d14 } /* Literal.String.Doc */
|
||||
.highlight .s2 { color: #d14 } /* Literal.String.Double */
|
||||
.highlight .se { color: #d14 } /* Literal.String.Escape */
|
||||
.highlight .sh { color: #d14 } /* Literal.String.Heredoc */
|
||||
.highlight .si { color: #d14 } /* Literal.String.Interpol */
|
||||
.highlight .sx { color: #d14 } /* Literal.String.Other */
|
||||
.highlight .sr { color: #009926 } /* Literal.String.Regex */
|
||||
.highlight .s1 { color: #d14 } /* Literal.String.Single */
|
||||
.highlight .ss { color: #990073 } /* Literal.String.Symbol */
|
||||
.highlight .bp { color: #999999 } /* Name.Builtin.Pseudo */
|
||||
.highlight .vc { color: #008080 } /* Name.Variable.Class */
|
||||
.highlight .vg { color: #008080 } /* Name.Variable.Global */
|
||||
.highlight .vi { color: #008080 } /* Name.Variable.Instance */
|
||||
.highlight .il { color: #009999 } /* Literal.Number.Integer.Long */
|
Reference in New Issue
Block a user