News Feed
Jobs Feed
Sections




News Archive
Looking for more information on how to do PHP the right way? Check out PHP: The Right Way

Community News:
Packagist Latest Releases for 03.09.2014
by Chris Cornutt March 09, 2014 @ 08:06:33
Recent releases from the Packagist:
0 comments voice your opinion now!



Community News:
Packagist Latest Releases for 03.08.2014
by Chris Cornutt March 08, 2014 @ 08:07:55
Recent releases from the Packagist:
0 comments voice your opinion now!



SitePoint PHP Blog:
Simple Captchas with PHP and GD
by Chris Cornutt March 07, 2014 @ 12:05:38

On the SitePoint PHP blog there's a new post by Mahul Jain looking at a simple way to create CAPTCHA images in PHP using the built-in GD libraries.

By now, we've all encountered captcha images in online forms. Captchas are a necessary evil, and this article will teach you how they're made. Please note that while there are better, automatic third party solutions for captchas out there such as ReCaptcha, this tutorial aims merely to explain and demonstrate how such technology actually works. We won't be explaining what captchas actually are, as it's assumed to be common knowledge and already covered in greater detail elsewhere.

He walks you through the whole process of making the sample CAPTCHA (like this one):

  • Display an empty image on the browser
  • Create a shape
  • Generate random lines
  • Generate random dots
  • Generate random text

There's screenshots all along the way too for reference as to what your result should look like. You can download the full code over on GitHub.

0 comments voice your opinion now!
captcha gd tutorial introduction

Link: http://www.sitepoint.com/simple-captchas-php-gd/

Master Zend Framework:
Make Module Configs Cacheable with the ZF2 Factory Interface
by Chris Cornutt March 07, 2014 @ 11:25:09

Matthew Setter has a new post today on the "Master Zend Framework" site looking at the use of caching for Zend Framework 2 module configurations.

For the longest time, I've been using closures in my Zend Framework 2 Modules Module class. I know they're not always the best approach, but they're not necessarily wrong either. But after reviewing Gary Hockin's recent talk at PHP Conference UK, I was reminded that outside of APC and OPCache, closures aren't cacheable. [...] So in today's tutorial, I'm going to show you a simple example of how to migrate from closures using [caching with Memcached, Redis and so on].

He starts with an example of the standard closure approach, returning an array from his "getServiceConfig" method with sub-array and object creation nested inside. He then refactors it to use the "FactoryInterface" to handle the configuration setup for the "delete form" handling.

0 comments voice your opinion now!
module configuration cache zendframework2

Link: http://www.masterzendframework.com/tutorial/zf2-factory-interface-closure-migration

Dougal Campbell:
mysql vs mysqli in WordPress
by Chris Cornutt March 07, 2014 @ 10:59:52

In his latest post Dougal Campbell shares his findings from a bug he was having with a plugin in WordPress. It revolved around the use of mysql or mysqli and errors being thrown to his logs.

The plugin had previously worked fine (it generates a sidebar widget), and I wasn't actively working on my site, so I wasn't really sure when it had quit working. In the course of debugging the problem, I discovered that the plugin was throwing warnings in my PHP error log regarding the mysql_real_escape_string() function. As a quick fix, I simply replaced all of those calls with WordPress' esc_sql() function. Voila, problem fixed.

He was interested in why this worked, though, and went digging in the code. As it turns out, the WordPress code tries to determine which mysql extension you have support for. As it turns out, his installation fit the "mysqli profile" so the "mysql_real_escape_string" wasn't available. To the WordPress users out there, he suggests esc_sql or $wpdb->prepare() instead.

0 comments voice your opinion now!
mysql mysqli wordpress escape string extmysql

Link: http://dougal.gunters.org/blog/2014/03/06/mysql-vs-mysqli-wordpress

PHP Town Hall:
Episode 20 A Nice Friendly Chat About Sculpin, Guzzle and PSR-7
by Chris Cornutt March 07, 2014 @ 09:03:51

The PHP Town Hall podcast has released their latest episode today, Episode 20: A Nice Friendly Chat About Sculpin, Guzzle and PSR-7 with guests Beau Simensen and Michael Dowling.

This show has a history of talking about FIG stuff as it is hard to avoid. The group is working on so much cool stuff and prominent figures of the community are involved. We got two more prominent figures, who also happen to be involved with FIG stuff: Beau Simensen lead developer of Sculpin and Michael Dowling lead developer of the wonderful HTTP library Guzzle, who also works at AWS on their PHP SDK.

They talk about each of the projects mentioned and what's coming up for each. There's also some discussion around the PSR-7 HTTP spec that's been proposed and is in the works. You can listen to this latest show in a few different ways - either through the in-page audio player, by downloading the mp3 or you can watch the video of the live recording via Google Hangouts.

0 comments voice your opinion now!
phptownhall ep20 podcast beausimensen michaeldowling psr7 http

Link: http://phptownhall.com/blog/2014/03/06/episode-20-a-nice-friendly-chat-about-sculpin-guzzle-and-psr-7/

Community News:
Packagist Latest Releases for 03.07.2014
by Chris Cornutt March 07, 2014 @ 08:04:48
Recent releases from the Packagist:
0 comments voice your opinion now!



Site News:
Popular Posts for the Week of 03.07.2014
by Chris Cornutt March 07, 2014 @ 07:06:12
Popular posts from PHPDeveloper.org for the past week:
0 comments voice your opinion now!



Pádraic Brady:
Thoughts on Composer's Future Security
by Chris Cornutt March 06, 2014 @ 11:09:06

Pádraic Brady has a new "let's watch Paddy think aloud in a completely unstructured manner blog post" about the future of security when it comes to the popular PHP package manager Composer. It's recently come under criticism around its lack of package signing and TLS/SSL support.

The Composer issue, as initially reported by Kevin McArthur, was fairly simple. Since no download connection by Composer was properly secured using SSL/TLS then an attacker could, with the assistance of a Man-In-The-Middle (MITM) attack, substitute the package you wanted to download with a modified version that communicated with the attacker's server. They could, for example, plant a line of code which sends the contents of $_POST to the attacker's server.

He's been working on some updates to the project, one of with is TLS/SSL support as defined in this pull request currently pending. It enables peer verification by default, follows PHP 5.6 TLS recommendations and uses local system certificates in the connection. He talks some about other additional TLS/SSL measures that could be added in the future and how, despite it being safer than nothing, TLS/SSL is not the "cure all" for the problem.

He then moves on to package signing and suggests one method for implementation - signing the "composer.phar" executable and signing "everything else" (packages to be downloaded) to verify their validity.

The flaw in Composer's installer isn't that it's unsigned, it's that it doesn't afford the opportunity for the downloader to read it before it gets piped to PHP. It's a documentation issue. You can go down the route of using a CA, of course, but that's further down the rabbit hole than may be necessary. Signing the composer.phar file is another matter.
0 comments voice your opinion now!
composer package signing tls ssl support security

Link: http://blog.astrumfutura.com/2014/03/thoughts-on-composers-future-security

PHP.net:
PHP 5.5.10 released
by Chris Cornutt March 06, 2014 @ 11:02:55

The PHP development group has announced the release of the latest version of the language in the PHP 5.5.x series today - PHP 5.5.10.

The PHP development team announces the immediate availability of PHP 5.5.10. Several bugs were fixed in this release, including security issues related to CVEs. CVE-2014-1943, CVE-2014-2270 and CVE-2013-7327 have been addressed in this release. We recommend all PHP 5.5 users to upgrade to this version.

Other changes include fixes to date/time handling, JSON serializing and an upgrade to PCRE 8.34 for regular expression handling. As this release has several security-related fixes, it's highly advised that 5.5.x users upgrade. As always, you can get the latest release from the downloads page or for Windows users, windows.php.net.

0 comments voice your opinion now!
language release cve security update

Link: http://php.net/index.php#id2014-03-06-1


 Community Events











Don't see your event here?
Let us know!

voicesoftheelephpant release dependency package introduction hhvm development laravel composer developer community security performance language series podcast design interview framework opinion

All content copyright, 2014 PHPDeveloper.org :: info@phpdeveloper.org - Powered by the Solar PHP Framework