Aaron Saray has a post to his site sharing the "anatomy of a PHP hack" - the evidence that he found and pulled apart based on a recent hack he experienced.

It’s hard to come up with a title for this - but - basically I found some rogue code the other day that I thought was pretty interesting. I was fixing a “hacked” website when I came across the source of the symptoms of the hack.

He starts with the code he found in the hacked website, obfuscated to hide the true intent and how he disassembled it to find the true intent. He walks through the method he used to reverse the code ultimately ending up with a simple call to base64_decode a value that comes in from a $_POST request.

Michael Dyrynda has a tutorial posted to his site starting off a new series showing how to create the functionality in your application to upload files to Amazon S3 from the browser. The tutorial is designed for those that don't already have something in their framework that allows for this upload handling.

I recently took on a freelance project that involved having to upload media files. This is a trivially simple task to accomplish if you're using something like Laravel, using out-of-the-box support for S3 storage.

In this particular case, however, I was dealing with files potentially multiple gigabytes in size. Although a simpler to implement, I didn't want to have to have users of the site upload the file to my application - and thus server - before having my server re-upload the file to S3.

In his case, he needed something that would allow for the upload of very large files without having to pass it through the backend server to get there. He starts by walking you through the setup on the S3 side, creating an IAM policy for the upload and a form that points to the instance. The form includes a "key" value that contains the filename for the end result. He also shows some of the other options that can be included like the policy to use a redirect location and a signature to verify the upload. He then shows the code required to make it work, creating an upload route and a main form page that generates the signature and policy information for the form based on configuration options.

On the Laravel News site today there's a tutorial posted showing you how to test your middleware with HTTP tests and how they can help in more practical testing of your application.

In this post, I’d like to demonstrate a practical example of testing a middleware using HTTP tests. Testing at the HTTP level can make your tests more resilient to change and more readable.

On a recent episode of Full Stack Radio (#72) with Adam Wathan and Taylor Otwell, it was refreshing to hear them find a lot of practical value in HTTP testing. I have found HTTP tests to be easier to write and maintain, but did feel like I was Doing Testing Wrong™ somehow or that I was cheating by not mocking and isolating everything. If you haven’t listened to this episode yet, give it a listen, it’s full of good, practical testing advice.

He starts by laying out the example middleware he wanted to test, one for validating and securing webhooks coming back from the Mailgun service to handle incoming email. The code for the middleware is included, defining the handle, buildSignature and verify methods. He then uses the artisan command to make a test and provides the code to test and ensure that the middleware forbids requests that aren't POST.

On his Medium blog Peter Lafferty has written up a post showing you a method for HTTP request validation in Silex, the microframework from the creators of Symfony.

This article covers three validation scenarios: routes, query strings [and] POST with a JSON body.

He starts with a simple Silex application that creates a "RESTful" API with endpoints providing emojis back when queried (three endpoints). He then uses this to show how to validate:

• routes for their expected values in the URL
• using a ValidatorService provider to build a set of assertions (GET request)
• using the same service to create assertions for the JSON content of a POST request

All code required is included in the post including the correct handling of the emoji output via a UTF-8 JSON response handler.

To start off the new year the Laravel News site has posted a list of 80 tutorials, packages and resources they've shared with the community over the past year.

As 2016 is coming to a close it’s a great time to look back on the year and see just how much progress has been made. Laravel had a busy year with 5.3 being released, Laracon, updates to all the components, and now gearing up for the Laravel 5.4 release.

To look back on the year I’ve put together a list of some of the hits of 2016 and arranged them by month so you can get a quick overview of all the highlights.

There's lots of good content posted here and it's interesting to see all of the developments in not only the Laravel community but also the wider PHP community (including the fifth birthday of Laravel in June). Check out the full post for the complete list and links to each post.

In this post to his site Gonzalo Ayuso shows you how to create a logger for your POST requests and their information with a bit of helpful code and Websockets.

Last days I’ve been working with background geolocation with an ionic application. There’s a cool plugin to do that. [...] Basically this plugin performs a POST request to the server with the GPS data. [...] I can develop a simple Silex application with a POST route and log the request in a file or flush those request to the console. This’d have been easy but as far as I’m a big fan of WebSockets (yes I must admit that I want to use WebSockets everywhere :) I had one idea in my mind.

He shows the creation of a simple Silex-based application with just two endpoints (channel that handles both GET and POST) that uses the Guzzle HTTP library to listen on the Websockets port for incoming connections. He then shows how to add the code necessary on the frontend (using express) to send the POST data automatically to the waiting Silex application. He's provided the full working code for the example on his GitHub account as well so you can see it fully fleshed out.

php[architect], organizers of the annual php[tek] conference, have start to post the videos recorded at their 2014 event over on YouTube. Not all of the sessions are published yet, but there's a few to get you started if you missed the event (or just want a refresher):

• Mental Health Summit
• Tim Lytle - Adventures in Contract Development
• Elizabeth Smith - HHVM in 2014

Be sure to subscribe to the channel to be notified when new videos are added of the over forty sessions that happened during the event.

Sameer Borate has a post today showing how you can create a simple Twitter application in PHP making use of their REST API and the twitter-api-php library.

In this post we will look into accessing Twitter REST API in PHP. This can be useful if you need to post Tweets from your PHP application or anaylze, search Tweets. In the following examples we will use the twitter-api-php PHP wrapper for Twitter v1.1 API. Although there are a few wrappers around, this one I like for its simplicity.

He helps you get the library installed (via Composer) and create an application on the Twitter side at apps.twitter.com. Sample code is included showing how to connect to the API with your credentials, including handling the OAuth authorization piece. From there he shows two examples of action to make on the API: posting a new tweet and searching for new tweets based on a query string.

The SitePoint PHP blog has posted the second part of their series about the creation of a simple comment posting social site based on PHP, MongoDB and jQuery. In this second part they build on the structure from part one and add in posting and "liking".

In the previous part of the series, we explained the database architecture, post stream design and application flow required for developing our post mechanism wherein the user will be able to post a status, like/unlike other people's statuses and comment on them. This part of the series will drive you through the coding required to implement these functionalities. We will use the application flow and database structure as discussed in the last article. Don't forget to download the code from the github repo if you'd like to follow along.

First he shows you how to get new posts added to the database, POSTed to the backend PHP script. He also shows how to insert the contents back into the page and pull out the latest posts. Next up is the like/unlike-ing of the posts, handled by a simple submission to another backend script.

The SitePoint PHP blog has a new tutorial posted today kicking off a series about creating a "social network style posting" application that combines PHP, MongoDB and jQuery that feels similar to a nested commenting system you'd see on most social sites.

Post mechanisms similar to Facebook are nowadays very common within any application. The concept of Post-Like-Comment is familiar to everyone who ever used a social network. In this article, we will learn how to create a similar working model wherein the user will be able to post his status, like posts and comment on them. What’s more interesting is that after learning things from this article, going forward you will be able to implement a lot of other features on your own.

In this first part of the series they start you off with the base code and introduce you to how the data is stored. They also walk you through how the "stream" part of the code works and the tracking of the current user. From there, there's a brief look at how to pull out the comments and display them to the page.