CREATE TABLE directors
(
    id INT NOT NULL AUTO_INCREMENT PRIMARY KEY,
    director VARCHAR(100) NOT NULL,
    film VARCHAR(100)
 
) ENGINE = MyISAM;

Add a few rows to the table and you can see the ‘id’ column sequence marching steadily in a uniform fashion.

+----+------------+-----------------------+
| id | director   | film                  |
+----+------------+-----------------------+
|  1 | spielberg  | The Sugarland Express |
|  2 | spielberg  | Minority Report       |
|  3 | spielberg  | Empire of the Sun     |
|  4 | soderbergh | Traffic               |
|  5 | soderbergh | Erin Brockovich       |
|  6 | spielberg  | The Goonies           |
+----+------------+-----------------------+

Complex sequences

Linear sequences are fine, but sometimes we need to generate some complex sequence in our AUTO_INCREMENT column. A complex sequence is something that does not increase monotonically, but according to some pattern. In our example we want a separate linear sequence in the ‘id’ column for each director. To create a such a sequence we change the table definition a little by combining two columns for the PRIMARY KEY; the ‘id’ column (which is a AUTO_INCREMENT type) and the ‘director’ column.

CREATE TABLE directors
(
    id INT NOT NULL AUTO_INCREMENT,
    director VARCHAR(100) NOT NULL,
    film VARCHAR(100),
    PRIMARY KEY (director, id)
 
) ENGINE = MyISAM;

Now add a few rows and the below table is what you will get.

+----+------------+-----------------------+
| id | director   | film                  |
+----+------------+-----------------------+
|  1 | spielberg  | The Sugarland Express |
|  2 | spielberg  | Minority Report       |
|  3 | spielberg  | Empire of the Sun     |
|  1 | soderbergh | Traffic               |
|  2 | soderbergh | Erin Brockovich       |
|  4 | spielberg  | The Goonies           |
+----+------------+-----------------------+

Although the ‘id’ column may now look random, sorting it by the ‘director’ field will make it clear. The ‘id’ column sequence is now linked up with the ‘director’ field.

mysql> SELECT * FROM directors ORDER BY director;
 
+----+------------+-----------------------+
| id | director   | film                  |
+----+------------+-----------------------+
|  1 | soderbergh | Traffic               |
|  2 | soderbergh | Erin Brockovich       |
|  1 | spielberg  | The Sugarland Express |
|  2 | spielberg  | Minority Report       |
|  3 | spielberg  | Empire of the Sun     |
|  4 | spielberg  | The Goonies           |
+----+------------+-----------------------+

In the above example we have a two column index, but the concept can be applied to a n-column index, where the last column is the AUTO_INCREMENT column. MySQL than generates a independent sequence for each unique non-AUTO_INCREMENT column combination.

Sequence calculation

Incidentally, this is how MySQL calculates the next sequence number for a multi column index.

MAX(auto_increment_column) + 1 WHERE prefix=given-prefix

So to get the next sequence number for ’soderbergh’, MySQL runs something like the following query.

SELECT MAX(id) + 1 FROM directors WHERE director = 'soderbergh'

Some notes

Note:
The ‘id’ (AUTO_INCREMENT) field comes last in the key definition. Not placing the AUTO_INCREMENT field last will give you a normal AUTO_INCREMENT sequence.

If any of the non AUTO_INCREMENT columns to be indexed will contain a NULL value, create a UNIQUE index instead of a PRIMARY KEY.

Or maybe you are just curious to find how various types of files are taking up your directory space.

Whatever the reason, below is a small php script that displays the distribution of files in a particular directory and its sub-directories by its type. This can be handy if you would like to see which files are taking up space in your project. Although you can easily do such kind of things with a variety of desktop tools, the following code can easily be used online, or integrated into your existing php application.

Downloading the class

Before proceeding download the class from below.

Displaying file stats

The class allows you to display the stats in a text format on the command-line or in a HTML format, which you can use online.

To display a text based stats you can use the class as given below and run it from the command line.

<?php
 
include('FileTypeStats.php');
 
$stats = new File_Type_Stats;
$stats->getText("/localhost/home/project");
 
?>

Below is the output for the above. Note that files that do not have an extension are not displayed.

D:\localhost\test\scan_dir>php textStat.php
 
=====================================================
File Type      Total Files      Total Size     %
=====================================================
 php                214           2149 kb    (53.72 %)
 js                  55           1183 kb    (29.57 %)
 db                   6            264 kb    (6.60 %)
 css                 20            144 kb    (3.62 %)
 gif                 90            124 kb    (3.11 %)
 pdf                  2             55 kb    (1.40 %)
 jpg                 48             45 kb    (1.14 %)
 png                 41             24 kb    (0.62 %)
 log                  3              5 kb    (0.13 %)
 sql                  1              3 kb    (0.09 %)
 prefs                1              0 kb    (0.00 %)
 txt                  2              0 kb    (0.00 %)

Setting a path in the function can be a bit limiting, so you can take the path argument from the command line instead.

<?php
 
include('FileTypeStats.php');
 
$stats = new File_Type_Stats;
$stat_data = $stats->getText($argv[1]);
?>

Now you can get the path from the command line.

D:\localhost\test\scan_dir>php textStat.php /localhost/home/project/

Set the textStat.php in you path variable, and you will have the file stat functionality available anywhere.

Someone could have written this class as a shell script easily, but the advantage of doing it in PHP is that we can also have a HTML version of the above stat display, as shown below.

To display HTML table based stats you can use the class with the getHtml() method and run it from the browser.

<html>
<head>
<link rel="stylesheet" type="text/css" href="style.css" />
</head>
<body>
<?php
 
include('FileTypeStats.php');
 
$stats = new File_Type_Stats;
$stat_data = $stats->getHtml("/localhost/home/project");
echo $stat_data;
 
?>
</body>
</html>

Below is the HTML output.

The style is defined in a CSS, so you can customize it to your liking.

A word of caution. For hugely nested directory running into thousands of files the script can timeout, so make sure that you increase the php max_execution_time in your script to an appropriate number.

set_time_limit(600);

curl_multi_init();
curl_multi_add_handle();
curl_multi_select();
curl_multi_exec();
curl_multi_getcontent();
curl_multi_info_read();
curl_multi_remove_handle();

Using parallel curl libraries

But there is one caveat when using the multi mode; it can be a little confusing. And as always, working with asynchronous code is not always easy, so I prefer to use classes developed by other people. Between the various libraries I’ve found on the net, pete wardens is the one I like. Below is a rough outline of how it works. You first initialize the class and specify the number of requests it should handle in parallel (10 here) along with some curl options.

$parallel_curl = new ParallelCurl(10, $curl_options);

Next we call the startRequestmethod, specifying the url to request and a callback function, which will be run when the request is processed. We can also pass a optional third parameter which will be handed over to the callback function. If there are any post fields, you can pass them as the fourth parameter in the startRequestmethod.

$parallel_curl->startRequest($search_url, 'on_request_done', $search);

Thats it, this is all that is required to execute parallel curl requests. Below is a broad overview of how to use the class.

<?php
 
require_once('parallelcurl.php');
 
$url1 = 'http://www.example.com/');
$url2 = 'http://www.example.com/');
$url3 = 'http://www.example.com/');
 
// This function gets called back for each request that completes
function on_request_done($content, $url, $ch, $search) {
...
}
 
$max_requests = 10;
 
$curl_options = array(
    CURLOPT_SSL_VERIFYPEER => FALSE,
    CURLOPT_SSL_VERIFYHOST => FALSE
);
 
$parallel_curl = new ParallelCurl($max_requests, $curl_options);
 
// Start 3 parallel requests. All three will be started simultaneously.
$parallel_curl->startRequest($url1, 'on_request_done');
$parallel_curl->startRequest($url2, 'on_request_done');
$parallel_curl->startRequest($url3, 'on_request_done');
 
$parallel_curl->finishAllRequests();
 
?>

The complete test script using the class to run Google search queries in parallel is shown below.

 
require_once('parallelcurl.php');
 
define ('SEARCH_URL_PREFIX', 'http://ajax.googleapis.com/ajax/services/\
                            search/web?v=1.0&rsz=large&filter=0');
 
// This function gets called back for each request that completes
function on_request_done($content, $url, $ch, $search) {
    $httpcode = curl_getinfo($ch, CURLINFO_HTTP_CODE);    
    if ($httpcode !== 200) {
        print "Fetch error $httpcode for '$url'\n";
        return;
    }
 
    $responseobject = json_decode($content, true);
    if (empty($responseobject['responseData']['results'])) {
        print "No results found for '$search'\n";
        return;
    }
 
    print "********\n";
    print "$search:\n";
    print "********\n";
 
    $allresponseresults = $responseobject['responseData']['results'];
    foreach ($allresponseresults as $responseresult) {
        $title = $responseresult['title'];
        print "$title\n";
    }
}
 
// The terms to search for on Google
$terms_list = array(
    "Paul", "Lena",
    "Lee", "Marie",
    "Tom", "Ada",
    "Herman", "Josephine",
);
 
if (isset($argv[1])) {
    $max_requests = $argv[1];
} else {
    $max_requests = 10;
}
 
$curl_options = array(
    CURLOPT_SSL_VERIFYPEER => FALSE,
    CURLOPT_SSL_VERIFYHOST => FALSE,
    CURLOPT_USERAGENT, 'Parallel Curl test script',
);
 
$parallel_curl = new ParallelCurl($max_requests, $curl_options);
 
foreach ($terms_list as $terms) {
    $search = '"'.$terms.' is a"';
    $search_url = SEARCH_URL_PREFIX.'&q='.urlencode($terms);
    $parallel_curl->startRequest($search_url,'on_request_done',$search);
}
 
$parallel_curl->finishAllRequests();
 
?>

Note: I have found the php curl multi mode execution to be inconsistent on Windows. But it works great on Linux (I’m using Ubuntu).

You can download the parallelCurl class from gitHub.

- Server-side JavaScript applications
- Command line tools
- Desktop GUI-based applications

Installing node.js

As mine was a clean Ubuntu installation, I needed to install certain libraries first.

sudo apt-get install g++ curl libssl-dev apache2-utils

The easiest way is to download node.js is to get a git clone. For that I needed to install the git package.

sudo apt-get install git-core

Now download node.js with git.

git clone git://github.com/ry/node.git

If you do not want to use git you could get the tar package instead.

wget http://nodejs.org/dist/node-v0.1.96.tar.gz
gunzip node-v0.1.96.tar.gz
tar -xf node-v0.1.96.tar

Now you are ready to install node.js.

cd node
./configure
make
sudo make install

Example node.js code

Below is a simple program using node.js for translating text using google API.

var http = require('http');
 
var url = ('ajax.googleapis.com')
var google = http.createClient(80, url);
 
var text = "Hello World from node!";
var requestUrl = '/ajax/services/language/translate?v=1.0&q=' + 
                 escape(text) + '&langpair=en%7Cfr'
var request = google.request('GET', requestUrl, 
              {"host": "ajax.googleapis.com"});
request.end();
 
request.addListener('response', function (response) {
  	var body = '';
 
	response.addListener('data', function (chunk) {
		body += chunk;
    });
 
    response.addListener("end", function() {
        var jsonData = JSON.parse(body);
	    console.log(jsonData.responseData.translatedText);
    })
 
});

This simple example does not to justice to the true power of node.js. I’ll be posting useful examples in the near future. Keep watching.

$var = $_GET['data'];

If the ‘data’ parameter is not defined the expression will generate an error.

Notice: Undefined index: data in /var/www/test.php on line 9

You can hide the error using the silence @-operator.

$var = @  $_GET['data'];

Although quite useful at some times, using the @-operator can have some annoying side effects. Say you are using some external libraries in your application which uses the @-operator. If everything works fine than good. But if the library is generating some errors than it becomes difficult to point the exact location where the error occurs, as the @-operator hides it. If the external library is large, it becomes a headache to remove all the @ from the code. One nice option I found is the Scream Pecl extension. The extension allows you to easily disable the @-operator in your code without making any actual changes to the code.

Installing the Scream extension

As a pre-complied binary is not available, you need to make it yourself. The following shows commands to compile the extension on Ubuntu.

First you need to install the Pear distribution environment.

sudo apt-get install php-pear

Next you will need to install the php5-dev package to get the required PHP5 source files to compile additional modules.

sudo apt-get install php5-dev

Finally we are ready to actually create and install the extension.

sudo pecl install scream-0.1.0

Once the extension is created and installed, we need to add one to the php.ini file.

sudo gedit /etc/php5/apache2/php.ini

In the ‘extensions’ section add the following line:
extension=scream.so;

After the php.ini has been updated, you need to restart Apache, so that the new extension is loaded.

sudo /etc/init.d/apache2 restart

If hopefully all went well, the Scream extension should now be loaded, which you can confirm using phpinfo().

Breaking the Silence operator

Now you can disable the @-operator in your code using the following:

ini_set('display_errors', 1);
error_reporting(E_ALL | E_STRICT);
 
// Disable the @-operator
ini_set('scream.enabled', true);
$var = @ $_GET['data'];

Or you can directly enable the extension in your php.ini.

scream.enabled=1

Now even though the silence operator is present the above code generates an error if the ‘data’ parameter is not set. Atlast no need to hunt down for @’s while debugging.

 
echo DateToWords(time()) . "<br>";
echo DateToWords(time() - (3600 * 24 * 1)) . "<br>";
echo DateToWords(time() - (3600 * 24 * 4)) . "<br>";
echo DateToWords(time() - (3600 * 24 * 7)) . "<br>";
echo DateToWords(time() - (3600 * 24 * 14)) . "<br>";
echo DateToWords(time() - (3600 * 24 * 100)) . "<br>";
echo DateToWords(time() - (3600 * 24 * 366));

And the output for the above. For dates above 1 year it returns the actual date.

 
today
yesterday
4 days ago
1 week ago
2 weeks ago
14 weeks ago
06-17-2009

The function code is shown below.

<?php
 
<?php
 
/* Change the following constants to suit your language */
 
define('STRING_TODAY', "today");
define('STRING_YESTERDAY', "yesterday");
define('STRING_DAYS', "%d days ago");
define('STRING_WEEK', "1 week ago");
define('STRING_WEEKS', "%d weeks ago");
 
/* Change the following date format to your taste */
define('DATE_FORMAT', "m-d-Y");
 
/* The functions takes the date as a timestamp */        
function DateToWords($time)
{
 
    $_word = "";
 
    /* Get the difference between the current time 
       and the time given in days */
    $days = intval((time() - $time) / 86400);
 
    /* If some forward time is given return error */
    if($days < 0) {
        return -1;
    }
 
    switch($days) {
        case 0: $_word = STRING_TODAY;
                break;
        case 1: $_word = STRING_YESTERDAY;
                break;
        case ($days >= 2 && $days <= 6): 
              $_word =  sprintf(STRING_DAYS, $days);
              break;
        case ($days >= 7 && $days < 14): 
              $_word= STRING_WEEK;
              break;
        case ($days >= 14 && $days <= 365): 
              $_word =  sprintf(STRING_WEEKS, intval($days / 7));
              break;
        default : return date(DATE_FORMAT, $time);
 
    }
 
    return $_word;
}
 
?>

Hope someone finds this useful.

PHP variable functions

Before we learn something about anonymous functions we will take a quick look into a PHP concept known as a variable function. It means that if we append parenthesis to a variable, then php will look for a function with the same name as to whatever the variable evaluates to and tries to execute it. Say we have the following simple function:

function Hello($name)
{
    echo "Hello $name";
}

We could then call the function indirectly by using a variable whose value evaluates to the function name. This can be quite useful when the name of the function that you want to execute cannot be determined till run-time.

$func = "Hello";
$func("World!");
 
//Output-
//Hello World!

Another example using a class and a static method:

<?php
 
class CHello
{
    static function hello($name)
    {
        echo "Hello $name";
    }
}
$func = "Hello";
CHello::$func("World!");
 
// Output-
// Hello World!
?>

Anonymous or lambda functions

There are times when you need to create a small localized throw-away function consisting of a few lines for a specific purpose, such as a callback. It is unwise to pollute the global namespace with these kind of single use functions. For such an event you can create anonymous or lambda functions using create_function. Anonymous functions allow the creation of functions which have no specified name. An example is shown below:

<?php
 
$str = "hello world!";
$lambda = create_function('$match', 'return "friend!";');
$str = preg_replace_callback('/world/', $lambda, $str);
echo $str ;
 
// Output
// hello friend!
?>

Here we have created a small nameless (Anonymous) function which is used as a callback in the preg_replace_callback function. Although create_function lets you create anonymous functions, it is not truly a part of the language itself but a hack. PHP 5.3 introduced true Anonymous functions in the base language itself. We create a unnamed function and assign it to a variable, including whatever parameters the functions accepts and then simply use the variable like an actual function. A example is given below:

<?php
 
$func = function($name)
{
    echo "Hello $name\n";
};
 
$func("world!");
$func("Sameer!")
 
//Output-
//Hello world!
//Hello Sameer!
?>

Note the ending semicolon at the end of the defined function. This is because the function definition is actually a statement, and statements always ends with a semicolon. Another example is shown below.

<?php
 
$str = "Hello World!";
$func = function($match)
{
    return "friend!";
};
 
$str = preg_replace_callback('/World/', $func, $str);
echo $str ;
 
// Output
// Hello friend!
?>

Anonymous and Nested functions

PHP allows functions to be nested inside one another. Although it seems like a side-effect of the parser rather then a design decision, it can be quite helpful in some situations. Take the example below. The function censorString takes a string as a parameter and replaces any censored word given with a string of ‘*’. The censorString functions defines a nested function replace that is used as a callback function by preg_replace_callback. Assuming that the ‘replace’ function is only used by the censorString function in our program it is better to define it within censorString itself and avoid polluting the global namespace with small single use functions

<?php
 
function censorString($string, $censor)
{
    function replace($match)
    {
        return str_repeat("*", strlen($match[0]));
    }
 
    return preg_replace_callback('/'.$censor.'/', 'replace', $string);
 
}
 
echo censorString("hello world!", "world");
echo censorString("hello world!", "hello");
 
// Output-
// hello *****!
// Fatal error: Cannot redeclare replace() 
?>

When you define a nested function as above, the inner function does not come into existence until the parent function is executed. Once the parent function (censorString) is executed the inner function (replace) goes into global scope. Now you can access the inner function from anywhere in your current document. One problem though is that calling the parent function again in the current document will cause a redeclaration of the inner function, which will generate an error, as the inner function is already declared. A solution is to use a anonymous function as shown below. (Note again the semicolon at the end of the inner function.)

<?php
 
function censorString($string, $censor)
{
    $func = function($match)
    {
        return str_repeat("*", strlen($match[0]));
    };
 
    return preg_replace_callback('/'.$censor.'/', $func, $string);
 
}
 
echo censorString("hello world!", "world");
echo censorString("hello world!", "hello");
 
// Output-
// hello *****!
// ***** world!
 
?>

Now whenever the censorString function is executed the inner anonymous function comes into existence. But unlike a normal nested function it goes out of scope once the parent function ends. So we can repeatedly call the censorString function without throwing a redeclaration error.

Another way is to define the function in the callback itself.

<?php
 
function censorString($string, $censor)
{
 
    return preg_replace_callback('/'.$censor.'/', 
                                function($match) 
                                {
                                    return str_repeat("*", 
                                           strlen($match[0]));
                                },
                                $string);
 
}
 
echo censorString("hello world!", "world");
echo censorString("hello world!", "hello");
 
// Output-
// hello *****!
// ***** world!
 
?>

Closures

Closures are anonymous functions that are aware of their surrounding context. In short these are anonymous functions which have knowledge about variables not defined within themselves. A simple example will make it clear. Say we want to create a anonymous function that returns a given number multiplied by 5.

<?php
 
$mult = function($x)
{
    return $x * 5;
};
 
echo $mult(2);
 
// Output-
// 10
?>

If we want to return a number multiplied by 7 rather then 5 ,we have to create another function and so on for other numbers. Instead of creating a series of different functions we can create a closure using the ‘use’ construct, which allows variables outside the anonymous function to be accessible or ‘closed’ within the current function.

<?php
 
$multiply = function($multiplier)
{
    return function($x) use ($multiplier)
    {
        return $x * $multiplier;
    };
};
 
// $mul5 now contains a function that returns a number multiplied by 5
$mult5 = $multiply(5);
 
// $mul7 contains a function that returns a number multiplied by 7
$mult7 = $multiply(7);
 
echo $mult5(5);
echo $mult7(5);
 
// Output-
// 25
// 35
 
?>

Take another example along the above lines. Lets say we want to filter an array of number according to a certain criteria; say all the numbers above 100. The code for the same is given below. Note the use of a anonymous function.

<?php
 
function filter($condition, $numbers) 
{
    $len = count($numbers);
    $filtered = array();
 
    /* Iterate through all the array elements */
    for($i = 0; $i < $len; $i++) 
    {
        $num = $numbers[$i];
 
        /* If the number satisfies the $condition, store
           it in the $filtered array
        */
        if($condition($num)) {
            $filtered[] = $num;
        }
    }
    return $filtered;
}
 
/* An array of random numbers */
$randomNumbers = array(34, 56, 22, 1, 5, 67, 897, 123, 4, 55);
 
$condition = function($x) 
{ 
    return ($x > 100) ? true : false; 
};
 
$greaterThan100 = filter($condition, $randomNumbers);
 
 
print_r($greaterThan100);
 
// Output
// Array ( [0] => 897 [1] => 123 ) 
?>

Now what if we want to allow all numbers above 400, then we have to change the anonymous function to the following.

 
$condition = function($x) 
{ 
    return ($x > 400) ? true : false; 
};

Rather then creating different functions for various criteria, we can create a closure.

 
function filter($condition, $numbers) 
{
    $len = count($numbers);
    $filtered = array();
 
    /* Iterate through all the array elements */
    for($i = 0; $i < $len; $i++) 
    {
        $num = $numbers[$i];
 
        /* If the number satisfies the $condition, store
           it in the $filtered array
        */
        if($condition($num)) {
            $filtered[] = $num;
        }
    }
    return $filtered;
}
 
 
/* createFilter now returns a anonymous function */
function createFilter($lowerBound)
{
    return function($x) use ($lowerBound)
    {
        return ($x > $lowerBound) ? true : false;
    };
}
 
 
/* An array of random numbers */
$randomNumbers = array(34, 56, 22, 1, 5, 67, 897, 123, 4, 55);
 
/* Create a new function and store it in $greaterThan400 */
$greaterThan400 = createFilter(400);
$greaterThan100 = createFilter(100);
 
print_r(filter($greaterThan400, $randomNumbers));
print_r(filter($greaterThan100, $randomNumbers));
 
// Output
// Array ( [0] => 897 ) 
// Array ( [0] => 897 [1] => 123 )

Note that in the above example when createFilter exists, normally the $lowerBound variable goes out of scope, but because we have used closure here using the ‘use’ keyword, the inner anonymous function binds the $lowerBound variable with itself even after the createFilter function exists. This is what we call closure. The inner function ‘closes’ over the variables of the outer function in which it is defined.

We can do a var_dump on the $greaterThan400 and $greaterThan100 objects to see if the inner function really carries the $lowerBound variable with itself.

var_dump($greaterThan400);
var_dump($greaterThan100);

Which returns the following:

 
object(Closure)#1 (2) {
  ["static"]=>
  array(1) {
    ["lowerBound"]=>
    int(400)
  }
  ["parameter"]=>
  array(1) {
    ["$x"]=>
    string(10) "<required>"
  }
}
 
object(Closure)#2 (2) {
  ["static"]=>
  array(1) {
    ["lowerBound"]=>
    int(100)
  }
  ["parameter"]=>
  array(1) {
    ["$x"]=>
    string(10) "<required>"
  }
}

Or better yet we can use the Reflection API.

echo ReflectionFunction::export($greaterThan400);

Which gives the following:

Closure [ <user> function {closure} ] {
  @@ D:\localhost\test\\index.php 27 - 30
 
  - Bound Variables [1] {
      Variable #0 [ $lowerBound ]
  }
 
  - Parameters [1] {
    Parameter #0 [ <required> $x ]
  }
}

In closing

Lambda functions and closures have taken PHP a notch closer towards other modern languages. In practice how much people really use lambdas and closures in their daily work remains to be seen. I’m still getting a hang of it.

As a programming language, PHP has many advantages but security has always been a major issue. Partially these security problems are inherent to the language itself because PHP was meant to be an easy and powerful programming language, while security came second. However, when you add bad coding and non-adherence to even the basic security rules, the situation gets out of control.

Fortunately, it is possible to fix PHP vulnerabilities and make PHP applications more secure. Some of the defenses are common for all programming languages, while others are found only in PHP. Here are some of the best defenses you have when you want to fix PHP vulnerabilities and make your site more secure.

Defend Your Code Against SQL Injections

SQL Injection is one of the most typical PHP vulnerabilities and many hackers take advantage of it. In order to prevent SQL injections, you need to always check input data and to escape characters (such as single quotes (‘) or double quotes (“)). If you do it, it won’t be possible to execute malicious SQL queries, which take control over your database or compromise the security of your site in other ways.

The two most common defenses against SQL injections are the use of the mysql_real_escape_string and PDO. The mysql_real_escape_string prepends special characters and as a result these special characters are not sent directly to the MySQL database. It is recommendable to use mysql_real_escape_string on all input variables, which are sent to the MySQL database.
PDO adds an abstraction layer to your code, thus making it more secure. PDO prepares a statement for execution and returns a statement object.

Don’t Leave Room for Cross-Site Scripting Vulnerabilities

Cross-Site Scripting (XSS) is also common in PHP. Again, the defense against XSS isn’t rocket science. If the users input HTML data is escaped properly, your code won’t be vulnerable against XSS. If you don’t do it, then a hacker can insert any HTML code (or even Javascript) he or she likes and modify your page, so that he or she can steal data from users.

The best defense against XSS is to use the htmlspecialchars() function. This function identifies any output you wouldn’t like to be considered as HTML output. While you can never be certain that XSS is impossible, the htmlspecialchars() function will make it harder for a hacker to succeed.

Watch out for File Inclusion Vulnerabilities

Of all PHP vulnerabilities, file inclusion attacks are the most severe. A file inclusion attack gives the hacker the opportunity to include a random file and to deploy it on your server. File inclusion attacks are possible when the register_globals directive is on, which means that unchecked input variables are allowed. The best defense against file inclusion vulnerabilities is to mind how you use PHP include() functions. If you are not sure you can use these functions properly, you’d better avoid any include statements – just use switch statements with hard coded strings and this will help to avoid file inclusion vulnerabilities.

Don’t Forget to Initialize Variables

If you program in many other languages, then you maybe don’t need to be told explicitly to initialize variables because you already have the habit of doing it. However, if you are mainly a PHP programmer, maybe you don’t always initialize variables because in PHP, unlike in many other programming languages, a variable can be used without being initialized first. From a security point of view, uninitialized variables are a huge risk and this is why you should never use them.

Don’t Leave the register_globals Directive ON

File inclusion attacks aren’t the only evil the register_globals directive brings to your code. The register_globals directive is very powerful but unfortunately its power is easily abused. In recent versions of PHP the directive register_globals is OFF by default and in PHP 6 it is altogether removed but if you are using earlier versions of PHP, take the time and check if it isn’t ON by accident.

Encryption Always Helps

No matter which programming language you use, encryption always helps. It doesn’t matter how secure your PHP code is when you send sensitive data unencrypted and anybody can read it. The safest form of encryption is end-to-end encryption but it takes a lot of resources and it might be hard to implement. This is why it is acceptable if you encrypt at least passwords, credit card numbers, and other similar data. Don’t leave sensitive data unencrypted because this is what hackers want most.

Test Your PHP Code with Tools

There are many PHP tools to test the security of your code with. Sure, you should do your best to write secure code, adhere to security practices, and carefully review your code for errors but an automated tool to check your code with is always useful. Some of the best tools to test PHP vulnerabilities with are PhpSecInfo, PHP Security Scanner, and Spike PHP Security Audit Tool. Run them on your code and see what they will find.

Further Reading

These steps are just the beginning to make your PHP code secure. You must always take at least these steps because if you don’t you leave the door wide open to hackers. On the other hand, even if you do everything we described here, you can never be sure that no vulnerabilities exist. There is much more to PHP security and if you want to expand your knowledge, read the PHP Security manual and this paper. Both of them will tell you more about how to fix PHP vulnerabilities and make your site secure.

This guest article was written by Christopher Shepard of Webhost Gear, a website that provides information about hosting and reviews of the most popular web hosting services, as well as technical and website maintenance tutorials.

Faker.js is a JavaScript implementation inspired by Benjamin Curtis’s Ruby Gem Faker and Perl’s Data::Faker that lets you generate commonly required data quickly. You can check the demo page to get an idea.

Getting Fake.js

You can download the library form github and include in your pages where you need to generate the data.

..
<script src = "Faker/Faker.js" type = "text/javascript"></script>
..

Generating fake data

The API is divided into various sections as show below:

# Name
    * findName
# Address
    * zipCode
    * city
    * streetName
    * streetAddress
    * secondaryAddress
    * ukCounty
    * ukCountry
# PhoneNumber
    * phoneNumber
# Internet
    * email
    * userName
    * domainName
    * domainWord
...

So if you need to generate a random email address or a zip code you could do it like this:

var randomEmail = Faker.Internet.email();
var randomZip = Faker.Address.zipCode();

Some sample API methods are shown below, but there are more of them which you can find here in the API section.

<script>
var longParagraph = Faker.Lorem.paragraphs();
var singleSentence = Faker.Lorem.sentence();
var companyName= Faker.Company.companyName();
var catchPhrase = Faker.Company.catchPhrase();
</script>

One of the interesting methods is ‘ Faker.Company.catchPhrase()’, which generates catchy technological phrases. A kind of a tag line generator for your new multi-million dollar company . A sample output is shown below.

Stand-alone 5th generation utilisation
Ergonomic explicit focus group
Horizontal human-resource solution
Automated contextually-based knowledge base
Distributed multi-state encoding
Extended zero administration interface
Proactive coherent productivity
Streamlined national approach
Total transitional algorithm
Stand-alone fault-tolerant moderator

The API also includes several helper methods that lets you create bulk fake data using the single API methods. For example you can generate complete user information templates cards by using a single helper method ‘Faker.Helpers.userCard()’. A sample run is shown below:

name: Blair Nikolaus
username: Fernando_Olson
email: Jacklyn_Brekke@aurore.name
address:street: Kozey Meadow
suite: Apt. 664
city: Felipastad
zipcode: 88071
 
phone: 571.540.8605 x136
website: reba.co.uk
company:name: Kuhic and Sons
catchPhrase: Integrated solution-oriented Graphical User Interface
bs: seize scalable web services

The ‘Faker.Helpers.userCard()’ method returns a nested object, so you will need to recursively traverse the object to extract the data. A simple function to do the same is given below:

<script>
// Recursively traverse a nested Javascript object and return it.
function printObj(obj)
{
  var prop, res = '';
 
  for(prop in obj)
  {
    if(typeof obj[prop] == 'object'){
        res += prop + ':' + printObj(obj[prop]) + '<br>';
    }else{
        res += prop + ': ' + obj[prop] + '<br>';
    }
  }
   return res;
}
</script>

So now you can do something like this:

...
var obj = Faker.Helpers.userCard();
alert( printObj(obj) );
...

Another Randomizer library

Club AJAX Mock Data Randomizer library is another library that lets you generate random data quickly. This library lets you generate random dates, colors, boolean values which is lacking in the Faker library. Check a simple demo using this library.