From b0ea59033bd0e801ce0d0bdc4f283156f5d264ce Mon Sep 17 00:00:00 2001 From: Evan O'Connell Date: Mon, 9 Jul 2012 14:38:58 -0400 Subject: [PATCH 1/2] Added syntax highlighting on codeblocks. --- _includes/databases.md | 4 ++ _includes/dependency-management.md | 7 ++++ _includes/language-highlights.md | 9 ++++- _layouts/default.html | 1 + styles/syntax.css | 60 ++++++++++++++++++++++++++++++ 5 files changed, 80 insertions(+), 1 deletion(-) create mode 100644 styles/syntax.css diff --git a/_includes/databases.md b/_includes/databases.md index 858926a..8504ba7 100644 --- a/_includes/databases.md +++ b/_includes/databases.md @@ -6,17 +6,21 @@ More importantly, `PDO` allows you to safely inject foreign input (e.g. IDs) int Let's assume a PHP script receives a numeric ID as a query parameter. This ID should be used to fetch a user record from a database. This is the `wrong` way to do this: +{% highlight php %} query("SELECT name FROM users WHERE id = " . $_GET['id']); // <-- NO! +{% endhighlight %} This is terrible code. You are inserting a raw query parameter into a SQL query. This will get you hacked in a heartbeat. Instead, you should sanitize the ID input using PDO bound parameters. +{% highlight php %} prepare('SELECT name FROM users WHERE id = :id'); $stmt->bindParam(':id', filter_input(INPUT_GET, 'id', FILTER_SANITIZE_NUMBER_INT), PDO::PARAM_INT); $stmt->execute(); +{% endhighlight %} This is correct code. It uses a bound parameter on a PDO statement. This escapes the foreign input ID before it is introduced to the database preventing potential SQL injection attacks. diff --git a/_includes/dependency-management.md b/_includes/dependency-management.md index a5c6893..d8bdf54 100644 --- a/_includes/dependency-management.md +++ b/_includes/dependency-management.md @@ -20,19 +20,26 @@ This will download `composer.phar` (a PHP binary archive). You can run this with First, create a `composer.json` file in the same directory as `composer.phar`. Here's an example that lists [Twig][2] as a project dependency. +{% highlight json %} { "require": { "twig/twig": ">=1.8.0,<2.0-dev" } } +{% endhighlight %} Next, run this command from your project root directory. +{% highlight bash %} > php composer.phar install +{% endhighlight %} This will download and install the project dependencies into a `vendors/` directory. Next, add this line to your application's primary PHP file; this will tell PHP to use Composer's autoloader for your project dependencies. +{% highlight php %} + php -i +{% endhighlight %} The `-i` option will print your PHP configuration just like the [`phpinfo`][phpinfo] function. There are a number of other useful [command line options][cli-options], too. Let's write a simple "Hello, $name" CLI program. To try it out, create a file named `hello.php`, as below. +{% highlight php %} php hello.php Usage: php hello.php [name] > php hello.php world Hello, world - +{% endhighlight %} ### Built-in, command line web server Starting with PHP 5.4, you can develop locally on a PHP-enabled web server without the hassle of installing and configuring a full-fledged web server. To start the server, from your web root: +{% highlight bash %} > php -S localhost:8000 +{% endhighlight %} * [Learn about running PHP from the command line][php-cli] * [Learn about the built-in, command line web server][cli-server] diff --git a/_layouts/default.html b/_layouts/default.html index a8d3340..6ce843f 100644 --- a/_layouts/default.html +++ b/_layouts/default.html @@ -13,6 +13,7 @@ +