mirror of
https://github.com/codeguy/php-the-right-way.git
synced 2025-08-09 15:36:36 +02:00
Minor style fixes
- use `()` when referencing functions
This commit is contained in:
@@ -36,7 +36,7 @@ can be used interchangeably with anonymous functions in almost all cases.
|
|||||||
* [Read about the Closure class][closure-class]
|
* [Read about the Closure class][closure-class]
|
||||||
* [More details in the Closures RFC][closures-rfc]
|
* [More details in the Closures RFC][closures-rfc]
|
||||||
* [Read about Callables][callables]
|
* [Read about Callables][callables]
|
||||||
* [Read about dynamically invoking functions with `call_user_func_array`][call-user-func-array]
|
* [Read about dynamically invoking functions with `call_user_func_array()`][call-user-func-array]
|
||||||
|
|
||||||
### Meta Programming
|
### Meta Programming
|
||||||
|
|
||||||
|
@@ -17,7 +17,7 @@ Try running PHP from your command line:
|
|||||||
> php -i
|
> php -i
|
||||||
{% endhighlight %}
|
{% endhighlight %}
|
||||||
|
|
||||||
The `-i` option will print your PHP configuration just like the [`phpinfo`][phpinfo] function.
|
The `-i` option will print your PHP configuration just like the [`phpinfo()`][phpinfo] function.
|
||||||
|
|
||||||
The `-a` option provides an interactive shell, similar to ruby's IRB or python's interactive shell. There are a number
|
The `-a` option provides an interactive shell, similar to ruby's IRB or python's interactive shell. There are a number
|
||||||
of other useful [command line options][cli-options], too.
|
of other useful [command line options][cli-options], too.
|
||||||
@@ -39,7 +39,7 @@ variable containing the argument *count* and [`$argv`][argv] is an array variabl
|
|||||||
The first argument is always the name of your PHP script file, in this case `hello.php`.
|
The first argument is always the name of your PHP script file, in this case `hello.php`.
|
||||||
|
|
||||||
The `exit()` expression is used with a non-zero number to let the shell know that the command failed. Commonly used
|
The `exit()` expression is used with a non-zero number to let the shell know that the command failed. Commonly used
|
||||||
exit codes can be found [here][exit-codes]
|
exit codes can be found [here][exit-codes].
|
||||||
|
|
||||||
To run our script, above, from the command line:
|
To run our script, above, from the command line:
|
||||||
|
|
||||||
@@ -54,10 +54,11 @@ Hello, world
|
|||||||
* [Learn about running PHP from the command line][php-cli]
|
* [Learn about running PHP from the command line][php-cli]
|
||||||
* [Learn about setting up Windows to run PHP from the command line][php-cli-windows]
|
* [Learn about setting up Windows to run PHP from the command line][php-cli-windows]
|
||||||
|
|
||||||
|
|
||||||
[phpinfo]: http://php.net/function.phpinfo
|
[phpinfo]: http://php.net/function.phpinfo
|
||||||
[cli-options]: http://php.net/features.commandline.options
|
[cli-options]: http://php.net/features.commandline.options
|
||||||
[argc]: http://php.net/reserved.variables.argc
|
[argc]: http://php.net/reserved.variables.argc
|
||||||
[argv]: http://php.net/reserved.variables.argv
|
[argv]: http://php.net/reserved.variables.argv
|
||||||
[exit-codes]: http://www.gsp.com/cgi-bin/man.cgi?section=3&topic=sysexits
|
[exit-codes]: http://www.gsp.com/cgi-bin/man.cgi?section=3&topic=sysexits
|
||||||
[php-cli]: http://php.net/features.commandline
|
[php-cli]: http://php.net/features.commandline
|
||||||
[php-cli-windows]: http://php.net/install.windows.commandline
|
[php-cli-windows]: http://php.net/install.windows.commandline
|
||||||
|
@@ -22,7 +22,8 @@ curl -s https://getcomposer.org/installer | php
|
|||||||
{% endhighlight %}
|
{% endhighlight %}
|
||||||
|
|
||||||
This will download `composer.phar` (a PHP binary archive). You can run this with `php` to manage your project
|
This will download `composer.phar` (a PHP binary archive). You can run this with `php` to manage your project
|
||||||
dependencies. <strong>Please Note:</strong> If you pipe downloaded code directly into an interpreter, please read the
|
dependencies.
|
||||||
|
<strong>Please Note:</strong> If you pipe downloaded code directly into an interpreter, please read the
|
||||||
code online first to confirm it is safe.
|
code online first to confirm it is safe.
|
||||||
|
|
||||||
#### Installing on Windows
|
#### Installing on Windows
|
||||||
|
@@ -17,9 +17,9 @@ for other services. Therefore, it is important to take security seriously.
|
|||||||
|
|
||||||
**Hashing passwords with `password_hash`**
|
**Hashing passwords with `password_hash`**
|
||||||
|
|
||||||
In PHP 5.5 `password_hash` was introduced. At this time it is using BCrypt, the strongest algorithm currently supported
|
In PHP 5.5 `password_hash()` was introduced. At this time it is using BCrypt, the strongest algorithm currently
|
||||||
by PHP. It will be updated in the future to support more algorithms as needed though. The `password_compat` library was
|
supported by PHP. It will be updated in the future to support more algorithms as needed though. The `password_compat`
|
||||||
created to provide forward compatibility for PHP >= 5.3.7.
|
library was created to provide forward compatibility for PHP >= 5.3.7.
|
||||||
|
|
||||||
Below we hash a string, and then check the hash against a new string. Because our two source strings are different
|
Below we hash a string, and then check the hash against a new string. Because our two source strings are different
|
||||||
('secret-password' vs. 'bad-password') this login will fail.
|
('secret-password' vs. 'bad-password') this login will fail.
|
||||||
@@ -38,10 +38,10 @@ if (password_verify('bad-password', $passwordHash)) {
|
|||||||
{% endhighlight %}
|
{% endhighlight %}
|
||||||
|
|
||||||
|
|
||||||
* [Learn about `password_hash`] [1]
|
* [Learn about `password_hash()`] [1]
|
||||||
* [`password_compat` for PHP >= 5.3.7 && < 5.5] [2]
|
* [`password_compat` for PHP >= 5.3.7 && < 5.5] [2]
|
||||||
* [Learn about hashing in regards to cryptography] [3]
|
* [Learn about hashing in regards to cryptography] [3]
|
||||||
* [PHP `password_hash` RFC] [4]
|
* [PHP `password_hash()` RFC] [4]
|
||||||
|
|
||||||
|
|
||||||
[1]: http://php.net/function.password-hash
|
[1]: http://php.net/function.password-hash
|
||||||
|
@@ -6,8 +6,8 @@ anchor: data_filtering
|
|||||||
## Data Filtering {#data_filtering_title}
|
## Data Filtering {#data_filtering_title}
|
||||||
|
|
||||||
Never ever (ever) trust foreign input introduced to your PHP code. Always sanitize and validate foreign input before
|
Never ever (ever) trust foreign input introduced to your PHP code. Always sanitize and validate foreign input before
|
||||||
using it in code. The `filter_var` and `filter_input` functions can sanitize text and validate text formats (e.g. email
|
using it in code. The `filter_var()` and `filter_input()` functions can sanitize text and validate text formats (e.g.
|
||||||
addresses).
|
email addresses).
|
||||||
|
|
||||||
Foreign input can be anything: `$_GET` and `$_POST` form input data, some values in the `$_SERVER` superglobal, and the
|
Foreign input can be anything: `$_GET` and `$_POST` form input data, some values in the `$_SERVER` superglobal, and the
|
||||||
HTTP request body via `fopen('php://input', 'r')`. Remember, foreign input is not limited to form data submitted by the
|
HTTP request body via `fopen('php://input', 'r')`. Remember, foreign input is not limited to form data submitted by the
|
||||||
@@ -20,15 +20,15 @@ output, concatenate, or include data in your code, ask yourself if the data is f
|
|||||||
Data may be _filtered_ differently based on its purpose. For example, when unfiltered foreign input is passed into HTML
|
Data may be _filtered_ differently based on its purpose. For example, when unfiltered foreign input is passed into HTML
|
||||||
page output, it can execute HTML and JavaScript on your site! This is known as Cross-Site Scripting (XSS) and can be a
|
page output, it can execute HTML and JavaScript on your site! This is known as Cross-Site Scripting (XSS) and can be a
|
||||||
very dangerous attack. One way to avoid XSS is to sanitize all user-generated data before outputting it to your page by
|
very dangerous attack. One way to avoid XSS is to sanitize all user-generated data before outputting it to your page by
|
||||||
removing HTML tags with the `strip_tags` function or escaping characters with special meaning into their respective
|
removing HTML tags with the `strip_tags()` function or escaping characters with special meaning into their respective
|
||||||
HTML entities with the `htmlentities` or `htmlspecialchars` functions.
|
HTML entities with the `htmlentities()` or `htmlspecialchars()` functions.
|
||||||
|
|
||||||
Another example is passing options to be executed on the command line. This can be extremely dangerous (and is usually
|
Another example is passing options to be executed on the command line. This can be extremely dangerous (and is usually
|
||||||
a bad idea), but you can use the built-in `escapeshellarg` function to sanitize the executed command's arguments.
|
a bad idea), but you can use the built-in `escapeshellarg()` function to sanitize the executed command's arguments.
|
||||||
|
|
||||||
One last example is accepting foreign input to determine a file to load from the filesystem. This can be exploited by
|
One last example is accepting foreign input to determine a file to load from the filesystem. This can be exploited by
|
||||||
changing the filename to a file path. You need to remove "/", "../", [null bytes][6], or other characters from the file
|
changing the filename to a file path. You need to remove `"/"`, `"../"`, [null bytes][6], or other characters from the
|
||||||
path so it can't load hidden, non-public, or sensitive files.
|
file path so it can't load hidden, non-public, or sensitive files.
|
||||||
|
|
||||||
* [Learn about data filtering][1]
|
* [Learn about data filtering][1]
|
||||||
* [Learn about `filter_var`][4]
|
* [Learn about `filter_var`][4]
|
||||||
|
@@ -134,11 +134,11 @@ var_dump($anotherObj === SingletonChild::getInstance()); // bool(true)
|
|||||||
The code above implements the singleton pattern using a [*static* variable](http://php.net/language.variables.scope#language.variables.scope.static) and the static creation method `getInstance()`.
|
The code above implements the singleton pattern using a [*static* variable](http://php.net/language.variables.scope#language.variables.scope.static) and the static creation method `getInstance()`.
|
||||||
Note the following:
|
Note the following:
|
||||||
|
|
||||||
* The constructor [`__construct`](http://php.net/language.oop5.decon#object.construct) is declared as protected to
|
* The constructor [`__construct()`](http://php.net/language.oop5.decon#object.construct) is declared as protected to
|
||||||
prevent creating a new instance outside of the class via the `new` operator.
|
prevent creating a new instance outside of the class via the `new` operator.
|
||||||
* The magic method [`__clone`](http://php.net/language.oop5.cloning#object.clone) is declared as private to prevent
|
* The magic method [`__clone()`](http://php.net/language.oop5.cloning#object.clone) is declared as private to prevent
|
||||||
cloning of an instance of the class via the [`clone`](http://php.net/language.oop5.cloning) operator.
|
cloning of an instance of the class via the [`clone`](http://php.net/language.oop5.cloning) operator.
|
||||||
* The magic method [`__wakeup`](http://php.net/language.oop5.magic#object.wakeup) is declared as private to prevent
|
* The magic method [`__wakeup()`](http://php.net/language.oop5.magic#object.wakeup) is declared as private to prevent
|
||||||
unserializing of an instance of the class via the global function [`unserialize()`](http://php.net/function.unserialize)
|
unserializing of an instance of the class via the global function [`unserialize()`](http://php.net/function.unserialize)
|
||||||
.
|
.
|
||||||
* A new instance is created via [late static binding](http://php.net/language.oop5.late-static-bindings) in the static
|
* A new instance is created via [late static binding](http://php.net/language.oop5.late-static-bindings) in the static
|
||||||
|
@@ -17,7 +17,7 @@ Anonymous functions (with support for closures) have been present since PHP 5.3
|
|||||||
PHP 5.4 added the ability to bind closures to an object's scope and also improved support for callables such that they
|
PHP 5.4 added the ability to bind closures to an object's scope and also improved support for callables such that they
|
||||||
can be used interchangeably with anonymous functions in almost all cases.
|
can be used interchangeably with anonymous functions in almost all cases.
|
||||||
|
|
||||||
The most common usage of higher-order functions is when implementing a strategy pattern. The built-in `array_filter`
|
The most common usage of higher-order functions is when implementing a strategy pattern. The built-in `array_filter()`
|
||||||
function asks both for the input array (data) and a function (a strategy or a callback) used as a filter function on
|
function asks both for the input array (data) and a function (a strategy or a callback) used as a filter function on
|
||||||
each array item.
|
each array item.
|
||||||
|
|
||||||
@@ -45,8 +45,8 @@ A closure is an anonymous function that can access variables imported from the o
|
|||||||
variables. Theoretically, a closure is a function with some arguments closed (e.g. fixed) by the environment when it is
|
variables. Theoretically, a closure is a function with some arguments closed (e.g. fixed) by the environment when it is
|
||||||
defined. Closures can work around variable scope restrictions in a clean way.
|
defined. Closures can work around variable scope restrictions in a clean way.
|
||||||
|
|
||||||
In the next example we use closures to define a function returning a single filter function for `array_filter`, out of
|
In the next example we use closures to define a function returning a single filter function for `array_filter()`, out
|
||||||
a family of filter functions.
|
of a family of filter functions.
|
||||||
|
|
||||||
{% highlight php %}
|
{% highlight php %}
|
||||||
<?php
|
<?php
|
||||||
@@ -80,7 +80,7 @@ defined to capture variables in scope and access them later when the anonymous f
|
|||||||
|
|
||||||
* [Read about Anonymous functions][anonymous-functions]
|
* [Read about Anonymous functions][anonymous-functions]
|
||||||
* [More details in the Closures RFC][closures-rfc]
|
* [More details in the Closures RFC][closures-rfc]
|
||||||
* [Read about dynamically invoking functions with `call_user_func_array`][call-user-func-array]
|
* [Read about dynamically invoking functions with `call_user_func_array()`][call-user-func-array]
|
||||||
|
|
||||||
|
|
||||||
[anonymous-functions]: http://php.net/functions.anonymous
|
[anonymous-functions]: http://php.net/functions.anonymous
|
||||||
|
Reference in New Issue
Block a user