diff --git a/_layouts/default.html b/_layouts/default.html index 2717256..7bcd73c 100644 --- a/_layouts/default.html +++ b/_layouts/default.html @@ -39,6 +39,7 @@
  • {{ post.title }} {% assign lastIsChild = post.isChild %} {% endfor %} +
  • Credits
    • @@ -55,7 +56,7 @@ Tweet {{ content }} -
    + + diff --git a/_posts/01-04-01-Mac-Setup.md b/_posts/01-04-01-Mac-Setup.md index a568bd3..c646ce9 100644 --- a/_posts/01-04-01-Mac-Setup.md +++ b/_posts/01-04-01-Mac-Setup.md @@ -4,15 +4,21 @@ isChild: true ## Mac Setup -OSX comes prepackaged with PHP but it is normally a little behind the latest stable. Lion comes with PHP 5.3.6 and Mountain Lion has 5.3.10. +OSX comes prepackaged with PHP but it is normally a little behind the latest stable. Lion comes with PHP 5.3.6 and +Mountain Lion has 5.3.10. -To update PHP on OSX you can get the PHP executable through a number of Mac [package managers][mac-package-managers] or [compile it yourself][mac-compile] (if compiling, be sure to have installed either Xcode or Apple's substitute ["Command Line Tools for Xcode" downloadable from Apple's Mac Developer Center][apple-developer]). +To update PHP on OSX you can get it installed through a number of Mac [package managers][mac-package-managers], with +[php-osx by Liip][php-osx-downloads] being recommended. -For a complete LAMP package with GUI try [MAMP][mamp-downloads], otherwise consider the [Entropy 5.4][entropy-downloads] package. +The other option is to [compile it yourself][mac-compile], in that case be sure to have installed either Xcode or +Apple's substitute ["Command Line Tools for Xcode"][apple-developer] downloadable from Apple's Mac Developer Center. + +For a complete "all-in-one" package including PHP, Apache web server and MySQL database, all this with a nice control +GUI, try [MAMP][mamp-downloads]. [mac-package-managers]: http://www.php.net/manual/en/install.macosx.packages.php [mac-compile]: http://www.php.net/manual/en/install.macosx.compile.php [xcode-gcc-substitution]: https://github.com/kennethreitz/osx-gcc-installer [apple-developer]: https://developer.apple.com/downloads [mamp-downloads]: http://www.mamp.info/en/downloads/index.html -[entropy-downloads]: http://php-osx.liip.ch/ \ No newline at end of file +[php-osx-downloads]: http://php-osx.liip.ch/ diff --git a/_posts/04-01-01-Dependency-Management.md b/_posts/04-01-01-Dependency-Management.md index 46f0d9e..1c414c8 100644 --- a/_posts/04-01-01-Dependency-Management.md +++ b/_posts/04-01-01-Dependency-Management.md @@ -1,3 +1,10 @@ # Dependency Management There are a ton of PHP libraries, frameworks, and components to choose from. Your project will likely use several of them — these are project dependencies. Until recently, PHP did not have a good way to manage these project dependencies. Even if you managed them manually, you still had to worry about autoloaders. No more. + +Currently there are two major package management systems for PHP - Composer and PEAR. Which one is right for you? The answer is both. + + * Use **Composer** when managing dependencies for a single project. + * Use **PEAR** when managing dependencies for PHP as a whole on your system. + +In general, Composer packages will be available only in the projects that you explicitly specify whereas a PEAR package would be available to all of your PHP projects. While PEAR might sound like the easier approach at first glance, there are advantages to using a project-by-project approach to your dependencies. diff --git a/_posts/07-04-01-Data-Filtering.md b/_posts/07-04-01-Data-Filtering.md index 5534a0b..d3ebe41 100644 --- a/_posts/07-04-01-Data-Filtering.md +++ b/_posts/07-04-01-Data-Filtering.md @@ -5,39 +5,35 @@ isChild: true ## Data Filtering Never ever (ever) trust foreign input introduced to your PHP code. Always sanitize and validate -foreign input before using it in code. - -PHP functions `filter_var` and `filter_input` can sanitize text and validate text formats (e.g. +foreign input before using it in code. The `filter_var` and `filter_input` functions can sanitize text and validate text formats (e.g. email addresses). -Foreign input can be anything, from `$_GET` and `$_POST` form input data, some values in `$_SERVER`, -the HTTP body via `fopen('php://input', 'r')`, etc are all considered foriegn inputs. It is not -limited to form data submitted by the user, both uploaded and downloaded files, session values and -cookies count too. +Foreign input can be anything: `$_GET` and `$_POST` form input data, some values in the `$_SERVER` +superglobal, and the HTTP request body via `fopen('php://input', 'r')`. Remember, foreign input is not +limited to form data submitted by the user. Uploaded and downloaded files, session values, cookie data, +and data from third-party web services are foreign input, too. -While foreign data can be stored, combined and accessed later, it is still a foreign input. Every -time you process, output, concatenate or include some data in your code you should ask yourself if +While foreign data can be stored, combined, and accessed later, it is still foreign input. Every +time you process, output, concatenate, or include data in your code, ask yourself if the data is filtered properly and can it be trusted. -Filtering is tailored to the specific data usage. For example, when including foreign input is passed -to a HTML page output it can execute HTML and JavaScript on your site! This is known as Cross-Site -Scripting (XSS) and can be a very dangerous attack. One way to avoid this is to sanitize all HTML tags -in the input, or encode them. +Data may be _filtered_ differently based on its purpose. For example, when unfiltered foreign input is passed +into HTML page output, it can execute HTML and JavaScript on your site! This is known as Cross-Site +Scripting (XSS) and can be a very dangerous attack. One way to avoid XSS is to sanitize all HTML tags +in the input by removing tags or escaping them into HTML entities. -That is of course one instance of filtering against a specific type of attach. Another example would be -when passing options to be executed on the command line. This can be extremely dangers and is usually bad -idea, but you can use the built-in `escapeshellarg` function to sanitize the arguments. +Another example is passing options to be executed on the command line. This can be extremely dangerous +(and is usually a bad idea), but you can use the built-in `escapeshellarg` function to sanitize the executed +command's arguments. -One last example would be accepting foreign input to determine a file to load. This could be expoited by -changing the filename to a file path, so you need to remove and / from the path, so it cant load potentially -hidden or sensitive files. - -For performance, you can store filtered data and have it ready for usage next time. Just remember -that data filtered for one kind of the output may not be sufficiently filtered for the other. +One last example is accepting foreign input to determine a file to load from the filesystem. This can be exploited by +changing the filename to a file path. You need to remove "/", "../", [null bytes][6], or other characters from the file path so it can't +load hidden, non-public, or sensitive files. * [Learn about data filtering][1] * [Learn about `filter_var`][4] * [Learn about `filter_input`][5] +* [Learn about handling null bytes][6] ### Sanitization @@ -66,4 +62,5 @@ email address, a phone number, or age when processing a registration submission. [3]: http://www.php.net/manual/en/filter.filters.validate.php [4]: http://php.net/manual/en/function.filter-var.php [5]: http://www.php.net/manual/en/function.filter-input.php +[6]: http://php.net/manual/en/security.filesystem.nullbytes.php [html-purifier]: http://htmlpurifier.org/ diff --git a/_posts/08-02-01-Test-Driven-Development.md b/_posts/08-02-01-Test-Driven-Development.md index 04e2255..4498555 100644 --- a/_posts/08-02-01-Test-Driven-Development.md +++ b/_posts/08-02-01-Test-Driven-Development.md @@ -17,7 +17,7 @@ expected, from the point you build them all the way through the development cycl values going in and out of various functions and methods, you can make sure the internal logic is working correctly. By using Dependency Injection and building "mock" classes and stubs you can verify that dependencies are correctly used for even better test coverage. -When you create a class or function you should create a unit test for each behaviour it must have. At a very basic level you should +When you create a class or function you should create a unit test for each behavior it must have. At a very basic level you should make sure it errors if you send it bad arguments and make sure it works if you send it valid arguments. This will help ensure that when you make changes to this class or function later on in the development cycle that the old functionality continues to work as expected. The only alternative to this would be diff --git a/_posts/08-04-01-Complementary-Testing-Tools.md b/_posts/08-04-01-Complementary-Testing-Tools.md index 1ba5892..7abc24b 100644 --- a/_posts/08-04-01-Complementary-Testing-Tools.md +++ b/_posts/08-04-01-Complementary-Testing-Tools.md @@ -4,7 +4,7 @@ isChild: true ## Complementary Testing Tools -Besides individual testing and behaviour driven frameworks, there are also a number of generic frameworks and helper libraries useful for any preferred approach taken. +Besides individual testing and behavior driven frameworks, there are also a number of generic frameworks and helper libraries useful for any preferred approach taken. ### Tool Links diff --git a/_posts/10-03-01-Object-Caching.md b/_posts/10-03-01-Object-Caching.md new file mode 100644 index 0000000..df29b2e --- /dev/null +++ b/_posts/10-03-01-Object-Caching.md @@ -0,0 +1,44 @@ +--- +isChild: true +--- + +## Object Caching + +There are times when it can be beneficial to cache individual objects in your code, such as with data that is expensive +to get or database calls where the result is unlikely to change. You can use object caching software to hold these +pieces of data in memory for extremely fast access later on. If you save these items to a data store after you retrieve +them, then pull them directly from the cache for following requests you can gain a significant improvement in +performance as well as reduce the load on your database servers. + +Many of the popular bytecode caching solutions let you cache custom data as well, so there's even more reason to take +advantage of them. APC, XCache, and WinCache all provide APIs to save data from your PHP code to their memory cache. + +The most commonly used memory object caching systems are APC and memcached. APC is an excellent choice for object +caching, it includes a simple API for adding your own data to its memory cache and is very easy to setup and use. The +one real limitation of APC is that it is tied to the server it's installed on. Memcached on the other hand is installed +as a separate service and can be accessed across the network, meaning that you can store objects in a hyper-fast data +store in a central location and many different systems can pull from it. + +In a networked configuration APC will usually outperform memcached in terms of access speed, but memcached will be able +to scale up faster and further. If you do not expect to have multiple servers running your application, or do not need +the extra features that memcached offers then APC is probably your best choice for object caching. + +Example logic using APC: + +{% highlight php %} +This project would not be possible without the help of our amazing contributors on GitHub.

    '); + }; + $.ajax({ + cache: false, + dataType: 'jsonp', + timeout: 3000, + type: 'GET', + url: 'https://api.github.com/repos/codeguy/php-the-right-way/contributors' + }).done(function (data) { + if ( data.data && data.data.length ) { + var $ul = $(''), dataLength = data.data.length; + for ( var i = 0; i < dataLength; i++ ) { + $ul.append(['
  • ', data.data[i].login, '
    • '].join('')); + } + $contributors.html($ul); + } else { + fail(); + } + }).fail(fail); + } +})(jQuery);