<?xml version="1.0"?>
<rss version="2.0">
  <channel>
    <title>PHPDeveloper.org</title>
    <link>http://www.phpdeveloper.org</link>
    <description>Up-to-the Minute PHP News, views and community</description>
    <language>en-us</language>
    <pubDate>Thu, 20 Jun 2013 01:45:58 -0500</pubDate>
    <ttl>30</ttl>
    <item>
      <title><![CDATA[Johannes Schmitt's Blog: A New Killer Feature for Symfony2 Security]]></title>
      <guid>http://www.phpdeveloper.org/news/17065</guid>
      <link>http://www.phpdeveloper.org/news/17065</link>
      <description><![CDATA[<p>
<i>Johannes Schmitt</i> has <a href="http://blog.jmsyst.com/2011/10/new-killer-feature-for-symfony2.html">a new post</a> about his "killer feature" he's added to the security for <a href="http://symfony.com">Symfony2</a> framework (as a bundle) - a new customized expression-based query language that's compiled down to native PHP to make permissions checking simpler and faster.
</p>
<blockquote>
If you have used the Symfony2 Security Component to any modest degree, you will know that we have a quite heavy voting system which uses attributes like "IS_AUTHENTICATED_FULLY" to make authorization decisions. [...] If you are concerned about performance, then you should not be all too generous with the isGranted() calls. The second option would work as well, but writing a new voter each time you need to make a new check does not really seem ideal either. Fortunately, we can do better.
</blockquote>
<p>
He includes an example of this expression language in a direct isGranted() call, a string that checks to see if a user has three different roles, and a snippet showing the same thing in the docblock comment of a controller method. The second is a bit more complex, checking for an admin role or if the user is the one that should be deleted. You can <a href="https://github.com/schmittjoh/JMSSecurityExtraBundle/blob/master/Resources/doc/index.rst">find more doucmentation here</a>.
</p>]]></description>
      <pubDate>Mon, 31 Oct 2011 14:26:08 -0500</pubDate>
    </item>
    <item>
      <title><![CDATA[PHPBuilder.com: File uploads made easy]]></title>
      <guid>http://www.phpdeveloper.org/news/8575</guid>
      <link>http://www.phpdeveloper.org/news/8575</link>
      <description><![CDATA[<p>
PHPBuilder.com has a <a href="http://www.phpbuilder.com/columns/bealers20000904.php3">new tutorial</a> posted to help you create a more complete file upload solution for your web application.
</p>
<blockquote>
Every time I've written some code to upload a file, either to send it off as an email attachment or as an image for some dynamic content piece, I've always meant to write a few functions so I don't have to write the code again. [...] So I *finally* sat down and wrote this script.
</blockquote>
<p>
They <a href=http://www.phpbuilder.com/columns/bealers20000904.php3">go through the settings first</a> including the path to put the files in, types that are known and the ones that are allowed. Then its on to the code that creates the form field and handles the upload and validates it. You can download the <a href="http://www.phpbuilder.com/columns/bealers20000904.zip">code for the tutorial here</a>.
</p>]]></description>
      <pubDate>Mon, 03 Sep 2007 11:28:00 -0500</pubDate>
    </item>
    <item>
      <title><![CDATA[Chris Shiflett's Blog: Allowing HTML and Preventing XSS]]></title>
      <guid>http://www.phpdeveloper.org/news/7444</guid>
      <link>http://www.phpdeveloper.org/news/7444</link>
      <description><![CDATA[<p>
In <a href="http://shiflett.org/blog/2007/mar/allowing-html-and-preventing-xss">this new post</a> to his blog, <i>Chris Shiflett</i> helps to solve one of the problems that several web designers face when allowing user input but wanting to protect themselves as well - allowing HTML while preventing a user from including a cross-site scripting issue.
</p>
<blockquote>
This problem comes up more and more often due to the rise of social networking and other Web 2.0 properties that embolden users. [...] Of course, BBCode inevitably comes up during these types of discussions, but I really hate the idea of using yet another markup language just because I'm too lazy to deal with HTML, especially if the markup language doesn't even try to be user-friendly.
</blockquote>
<p>
He <a href="http://shiflett.org/blog/2007/mar/allowing-html-and-preventing-xss">looks for a good solution</a>, one that doesn't require learning a new markup or becoming overly complex (while avoiding strip_tags). He provides several chunks of code for different aspects of the method - first make the content safe, then move backwards in the translation for the items you want to allow. 
</p>]]></description>
      <pubDate>Fri, 16 Mar 2007 09:23:00 -0500</pubDate>
    </item>
  </channel>
</rss>
