diff --git a/_posts/03-02-01-Programming-Paradigms.md b/_posts/03-02-01-Programming-Paradigms.md index 8d66796..9271541 100644 --- a/_posts/03-02-01-Programming-Paradigms.md +++ b/_posts/03-02-01-Programming-Paradigms.md @@ -36,7 +36,7 @@ can be used interchangeably with anonymous functions in almost all cases. * [Read about the Closure class][closure-class] * [More details in the Closures RFC][closures-rfc] * [Read about Callables][callables] -* [Read about dynamically invoking functions with `call_user_func_array`][call-user-func-array] +* [Read about dynamically invoking functions with `call_user_func_array()`][call-user-func-array] ### Meta Programming diff --git a/_posts/03-05-01-Command-Line-Interface.md b/_posts/03-05-01-Command-Line-Interface.md index eb38d86..5bc19e6 100644 --- a/_posts/03-05-01-Command-Line-Interface.md +++ b/_posts/03-05-01-Command-Line-Interface.md @@ -17,7 +17,7 @@ Try running PHP from your command line: > php -i {% endhighlight %} -The `-i` option will print your PHP configuration just like the [`phpinfo`][phpinfo] function. +The `-i` option will print your PHP configuration just like the [`phpinfo()`][phpinfo] function. The `-a` option provides an interactive shell, similar to ruby's IRB or python's interactive shell. There are a number of other useful [command line options][cli-options], too. @@ -39,7 +39,7 @@ variable containing the argument *count* and [`$argv`][argv] is an array variabl The first argument is always the name of your PHP script file, in this case `hello.php`. The `exit()` expression is used with a non-zero number to let the shell know that the command failed. Commonly used -exit codes can be found [here][exit-codes] +exit codes can be found [here][exit-codes]. To run our script, above, from the command line: @@ -54,10 +54,11 @@ Hello, world * [Learn about running PHP from the command line][php-cli] * [Learn about setting up Windows to run PHP from the command line][php-cli-windows] + [phpinfo]: http://php.net/function.phpinfo [cli-options]: http://php.net/features.commandline.options [argc]: http://php.net/reserved.variables.argc [argv]: http://php.net/reserved.variables.argv -[exit-codes]: http://www.gsp.com/cgi-bin/man.cgi?section=3&topic=sysexits +[exit-codes]: http://www.gsp.com/cgi-bin/man.cgi?section=3&topic=sysexits [php-cli]: http://php.net/features.commandline [php-cli-windows]: http://php.net/install.windows.commandline diff --git a/_posts/04-02-01-Composer-and-Packagist.md b/_posts/04-02-01-Composer-and-Packagist.md index e4224e3..77b8245 100644 --- a/_posts/04-02-01-Composer-and-Packagist.md +++ b/_posts/04-02-01-Composer-and-Packagist.md @@ -22,7 +22,8 @@ curl -s https://getcomposer.org/installer | php {% endhighlight %} This will download `composer.phar` (a PHP binary archive). You can run this with `php` to manage your project -dependencies. Please Note: If you pipe downloaded code directly into an interpreter, please read the +dependencies. +Please Note: If you pipe downloaded code directly into an interpreter, please read the code online first to confirm it is safe. #### Installing on Windows diff --git a/_posts/10-03-01-Password-Hashing.md b/_posts/10-03-01-Password-Hashing.md index cbc4da5..ee70a65 100644 --- a/_posts/10-03-01-Password-Hashing.md +++ b/_posts/10-03-01-Password-Hashing.md @@ -17,9 +17,9 @@ for other services. Therefore, it is important to take security seriously. **Hashing passwords with `password_hash`** -In PHP 5.5 `password_hash` was introduced. At this time it is using BCrypt, the strongest algorithm currently supported -by PHP. It will be updated in the future to support more algorithms as needed though. The `password_compat` library was -created to provide forward compatibility for PHP >= 5.3.7. +In PHP 5.5 `password_hash()` was introduced. At this time it is using BCrypt, the strongest algorithm currently +supported by PHP. It will be updated in the future to support more algorithms as needed though. The `password_compat` +library was created to provide forward compatibility for PHP >= 5.3.7. Below we hash a string, and then check the hash against a new string. Because our two source strings are different ('secret-password' vs. 'bad-password') this login will fail. @@ -38,10 +38,10 @@ if (password_verify('bad-password', $passwordHash)) { {% endhighlight %} -* [Learn about `password_hash`] [1] +* [Learn about `password_hash()`] [1] * [`password_compat` for PHP >= 5.3.7 && < 5.5] [2] * [Learn about hashing in regards to cryptography] [3] -* [PHP `password_hash` RFC] [4] +* [PHP `password_hash()` RFC] [4] [1]: http://php.net/function.password-hash diff --git a/_posts/10-04-01-Data-Filtering.md b/_posts/10-04-01-Data-Filtering.md index f7f4280..dcba882 100644 --- a/_posts/10-04-01-Data-Filtering.md +++ b/_posts/10-04-01-Data-Filtering.md @@ -6,8 +6,8 @@ anchor: data_filtering ## Data Filtering {#data_filtering_title} Never ever (ever) trust foreign input introduced to your PHP code. Always sanitize and validate foreign input before -using it in code. The `filter_var` and `filter_input` functions can sanitize text and validate text formats (e.g. email -addresses). +using it in code. The `filter_var()` and `filter_input()` functions can sanitize text and validate text formats (e.g. +email addresses). Foreign input can be anything: `$_GET` and `$_POST` form input data, some values in the `$_SERVER` superglobal, and the HTTP request body via `fopen('php://input', 'r')`. Remember, foreign input is not limited to form data submitted by the @@ -20,15 +20,15 @@ output, concatenate, or include data in your code, ask yourself if the data is f Data may be _filtered_ differently based on its purpose. For example, when unfiltered foreign input is passed into HTML page output, it can execute HTML and JavaScript on your site! This is known as Cross-Site Scripting (XSS) and can be a very dangerous attack. One way to avoid XSS is to sanitize all user-generated data before outputting it to your page by -removing HTML tags with the `strip_tags` function or escaping characters with special meaning into their respective -HTML entities with the `htmlentities` or `htmlspecialchars` functions. +removing HTML tags with the `strip_tags()` function or escaping characters with special meaning into their respective +HTML entities with the `htmlentities()` or `htmlspecialchars()` functions. Another example is passing options to be executed on the command line. This can be extremely dangerous (and is usually -a bad idea), but you can use the built-in `escapeshellarg` function to sanitize the executed command's arguments. +a bad idea), but you can use the built-in `escapeshellarg()` function to sanitize the executed command's arguments. One last example is accepting foreign input to determine a file to load from the filesystem. This can be exploited by -changing the filename to a file path. You need to remove "/", "../", [null bytes][6], or other characters from the file -path so it can't load hidden, non-public, or sensitive files. +changing the filename to a file path. You need to remove `"/"`, `"../"`, [null bytes][6], or other characters from the +file path so it can't load hidden, non-public, or sensitive files. * [Learn about data filtering][1] * [Learn about `filter_var`][4] diff --git a/pages/Design-Patterns.md b/pages/Design-Patterns.md index d3856e5..7e57cb9 100644 --- a/pages/Design-Patterns.md +++ b/pages/Design-Patterns.md @@ -134,11 +134,11 @@ var_dump($anotherObj === SingletonChild::getInstance()); // bool(true) The code above implements the singleton pattern using a [*static* variable](http://php.net/language.variables.scope#language.variables.scope.static) and the static creation method `getInstance()`. Note the following: -* The constructor [`__construct`](http://php.net/language.oop5.decon#object.construct) is declared as protected to +* The constructor [`__construct()`](http://php.net/language.oop5.decon#object.construct) is declared as protected to prevent creating a new instance outside of the class via the `new` operator. -* The magic method [`__clone`](http://php.net/language.oop5.cloning#object.clone) is declared as private to prevent +* The magic method [`__clone()`](http://php.net/language.oop5.cloning#object.clone) is declared as private to prevent cloning of an instance of the class via the [`clone`](http://php.net/language.oop5.cloning) operator. -* The magic method [`__wakeup`](http://php.net/language.oop5.magic#object.wakeup) is declared as private to prevent +* The magic method [`__wakeup()`](http://php.net/language.oop5.magic#object.wakeup) is declared as private to prevent unserializing of an instance of the class via the global function [`unserialize()`](http://php.net/function.unserialize) . * A new instance is created via [late static binding](http://php.net/language.oop5.late-static-bindings) in the static diff --git a/pages/Functional-Programming.md b/pages/Functional-Programming.md index 299c4aa..b625a84 100644 --- a/pages/Functional-Programming.md +++ b/pages/Functional-Programming.md @@ -17,7 +17,7 @@ Anonymous functions (with support for closures) have been present since PHP 5.3 PHP 5.4 added the ability to bind closures to an object's scope and also improved support for callables such that they can be used interchangeably with anonymous functions in almost all cases. -The most common usage of higher-order functions is when implementing a strategy pattern. The built-in `array_filter` +The most common usage of higher-order functions is when implementing a strategy pattern. The built-in `array_filter()` function asks both for the input array (data) and a function (a strategy or a callback) used as a filter function on each array item. @@ -45,8 +45,8 @@ A closure is an anonymous function that can access variables imported from the o variables. Theoretically, a closure is a function with some arguments closed (e.g. fixed) by the environment when it is defined. Closures can work around variable scope restrictions in a clean way. -In the next example we use closures to define a function returning a single filter function for `array_filter`, out of -a family of filter functions. +In the next example we use closures to define a function returning a single filter function for `array_filter()`, out +of a family of filter functions. {% highlight php %}