Added syntax highlighting on codeblocks.

This commit is contained in:
Evan O'Connell
2012-07-09 14:38:58 -04:00
parent d366467eea
commit b0ea59033b
5 changed files with 80 additions and 1 deletions

View File

@@ -6,17 +6,21 @@ More importantly, `PDO` allows you to safely inject foreign input (e.g. IDs) int
Let's assume a PHP script receives a numeric ID as a query parameter. This ID should be used to fetch a user record from a database. This is the `wrong` way to do this:
{% highlight php %}
<?php
$pdo = new PDO('sqlite:users.db');
$pdo->query("SELECT name FROM users WHERE id = " . $_GET['id']); // <-- NO!
{% endhighlight %}
This is terrible code. You are inserting a raw query parameter into a SQL query. This will get you hacked in a heartbeat. Instead, you should sanitize the ID input using PDO bound parameters.
{% highlight php %}
<?php
$pdo = new PDO('sqlite:users.db');
$stmt = $pdo->prepare('SELECT name FROM users WHERE id = :id');
$stmt->bindParam(':id', filter_input(INPUT_GET, 'id', FILTER_SANITIZE_NUMBER_INT), PDO::PARAM_INT);
$stmt->execute();
{% endhighlight %}
This is correct code. It uses a bound parameter on a PDO statement. This escapes the foreign input ID before it is introduced to the database preventing potential SQL injection attacks.

View File

@@ -20,19 +20,26 @@ This will download `composer.phar` (a PHP binary archive). You can run this with
First, create a `composer.json` file in the same directory as `composer.phar`. Here's an example that lists [Twig][2] as a project dependency.
{% highlight json %}
{
"require": {
"twig/twig": ">=1.8.0,<2.0-dev"
}
}
{% endhighlight %}
Next, run this command from your project root directory.
{% highlight bash %}
> php composer.phar install
{% endhighlight %}
This will download and install the project dependencies into a `vendors/` directory. Next, add this line to your application's primary PHP file; this will tell PHP to use Composer's autoloader for your project dependencies.
{% highlight php %}
<?php
require 'vendor/autoload.php';
{% endhighlight %}
Now you can use your project dependencies, and they'll be autoloaded on demand.

View File

@@ -44,33 +44,40 @@ CLI PHP programs are powerful because you can use your app's code directly witho
Try running PHP from your command line:
{% highlight bash %}
> php -i
{% endhighlight %}
The `-i` option will print your PHP configuration just like the [`phpinfo`][phpinfo] function. There are a number of other useful [command line options][cli-options], too.
Let's write a simple "Hello, $name" CLI program. To try it out, create a file named `hello.php`, as below.
{% highlight php %}
<?php
if($argc != 2) {
die("Usage: php hello.php [name].\n");
}
$name = $argv[1];
echo "Hello, $name\n";
{% endhighlight %}
PHP sets up two special variables based on the arguments your script is run with. [`$argc`][argc] is an integer variable containing the argument *count* and [`$argv`][argv] is an array variable containing each argument's *value*. The first argument is always the name of your PHP script file, in this case `hello.php`.
To run our script, above, from the command line:
{% highlight bash %}
> php hello.php
Usage: php hello.php [name]
> php hello.php world
Hello, world
{% endhighlight %}
### Built-in, command line web server
Starting with PHP 5.4, you can develop locally on a PHP-enabled web server without the hassle of installing and configuring a full-fledged web server. To start the server, from your web root:
{% highlight bash %}
> php -S localhost:8000
{% endhighlight %}
* [Learn about running PHP from the command line][php-cli]
* [Learn about the built-in, command line web server][cli-server]