In his latest post Paul Reinheimer looks at cross-site request forgeries and, despite the best efforts of the PHP security community, how developers still just miss the point in protecting their own code.

So, cross site request forgeries are a pretty common topic these days; they're in almost every security talk, book, site etc. This is okay; they're important [...] Most of the sites, and all of the books I've read demonstrate things correctly, but when it comes to actual implementation, time and time again, I see code that's just wrong.

He looks at two of the "essentials" when it comes to protecting you and your application - comparison (not taking other values of variables into account) and the unpredictable token (not making tokens, like md5 hashes of information, random enough).

On the SitePoint PHP blog there's a new post from Harry Fuecks talking about a replacement method using token that works a bit better than the typical regular expression method.

Promtped by a real world example, one often-overlooked feature of most regular expressions engines is how subpatterns can useful to whip up tokenizers relatively easily. The problem? I needed to match the word any of the words "Canton", "Region" or "Group" in a string and perform a follow up action depending on which matched.

His ultimate solution used a set of preg_match generated tokens to do the replaces a bit more reliably. It also makes it easy for other scripts (like his Python example) to use them too.

Troels Knak-Nielsen has posted a script that he's developed (for use in Emacs) to look through a PHP file and pull out all of the classes and functions found inside.

As you probably know, PHP has a ridiculous amount of functions for all kinds of things, and as it happens, token_get_all gives access to the Zend Engine tokenizer. In other words, the same chunk of code, which PHP itself uses, when reading a .php file. This provides an excellent base for writing a script, which can parse the socks off ctags.

The emacs file to bind the editor and the PHP script together is also included, making it as simple to use as binding the function key of your choice to the "php-tokens" script.