Slashdot Mirror

Here are a few pointers, mostly around PHP web app security:

- http://www.owasp.org/ - the Open Web Application Security Project has a comprehensive list of things to cover - see their http://www.owasp.org/index.php/PHP_Top_5 (top 5 PHP issues) in particular

- http://www.sitepoint.com/article/php-security-blunders/ Top 7 PHP security blunders - use =htmlspecialchars= for output of variables to page and do MySQL string escaping

- http://www.phpbuilder.com/columns/ian_gilfillan20050707.php3 - ensure include files can't be reached directly from HTTP.

- http://it.slashdot.org/comments.pl?sid=1121901&cid=26797895 - use http://us2.php.net/manual/en/function.filter-var.php -PHP Filter features]] (only in PHP 5.2.0 onwards)

- http://sucuri.net/ - monitors your site for free to detect compromises that affect readable pages

Final point: don't "filter out" dangerous characters, this is never ending and can never be done - instead, for any given parameter or input field, define the valid characters (e.g. alphanumeric, date, etc) and specifically allow ONLY those characters. This 'filtering in' approach is far safer.

My very first contribution to the OSS community can be found at PHPBuilder. Notice that the login names match?

Anyway, take a look at the first snippet if you want to see truly simple, juvenile code. No error checking, etc. Except that it solved a need, and somebody else who was (at the time) more developed than I, took my stupid little proof of concept and turned it into something a little more robust. And so have a few other people.

I don't recall anybody ever criticizing the simplicity and the juvenile nature of my first contribution. I would never contribute code like that again, but then, the lessons I learned from this guide me to this day.

I used to develop a GPL app, the GNUstep-based character map Charmap. It had a few dozen users, and I'm pretty sure none of them ever took a single look at the source. Only the very biggest applications get attention, and very often quite uncritical examination at that.

In a sort of backhanded way, the fact that nobody bothered to look is a complement!

Programmers typically look at sources when they need it to do something it doesn't already do. There's an itch they're looking to scratch, and your stuff doesn't do it. Years ago, when I was still pretty green at coding, I threw out some code that allowed you to send email through a remote server.

It was about as basic as you could get. And, the many revisions that happened thereafter over the years are a clear example of how source review is done.

What I originally threw out was pretty weak, and was extended by other programmers who wanted to scratch an itch that my original code did not fulfill. This is code review at work...

I used to develop a GPL app, the GNUstep-based character map Charmap. It had a few dozen users, and I'm pretty sure none of them ever took a single look at the source. Only the very biggest applications get attention, and very often quite uncritical examination at that.

In a sort of backhanded way, the fact that nobody bothered to look is a complement!

Programmers typically look at sources when they need it to do something it doesn't already do. There's an itch they're looking to scratch, and your stuff doesn't do it. Years ago, when I was still pretty green at coding, I threw out some code that allowed you to send email through a remote server.

It was about as basic as you could get. And, the many revisions that happened thereafter over the years are a clear example of how source review is done.

What I originally threw out was pretty weak, and was extended by other programmers who wanted to scratch an itch that my original code did not fulfill. This is code review at work...

Their list is great -- I'll be reading some of those articles for weeks before I get through them all. I'm especially interested in the 7 security blunders article. Nice!

But they did leave off a lot of sites that are useful. Here are a few:

• PHP Resource Index - a few thousand scripts for downloading, most free, all PHP.
• PHP Builder Forums -- the PHP Builder site is pretty useful all by itself, but in the forums there are thousands of people willing to answer your PHP questions.
• PHP Freaks -- one of the guys behind this site wrote a great PHP book. The site is excellent.
• ADOdb Database Abstraction Layer -- okay, okay, this isn't really a site, so much as a product. But still, it's a very efficient DBAL, and it should be used for every database query.

Anyone want to pitch in with some more? I'm sure there are some very useful sites that I've completely missed (and which the IBM site missed, too).

AJAX makes an HTTP request (using Javascript) which returns XML. The backend can be written in any language (Java, PHP, Perl, whatever).

Example

PHP is not object oriented, therefore making it teh ghey.

Yes it is.

The MySQL extension has been debundled because

Last I checked (which probably has changed somewhat by now)...

MySQL does not support views, stored procedures, transactions (InnoDB does, but this is an additional product) and a bunch of other developer's friends. Check out the comparison at www.sql-info.de.

I also seem to remember replication was superior on PgSQL. Feel free to correct me.

MySQL's big draw was simplicity and speed. Not sure if that's really relevant, in the big picture, since PG has sped up quite a bit recently, and adding InnoDB kills the speed advantage, from what I've heard.

Also check this awesome comparison. This guy is amazing: http://www.phpbuilder.com/columns/tim20000705.php3

PHP's PDF Forms support seems centered around Adobe's FDF toolkit. This article and the PHP manual should be enough to get you started, if only for the right search terminology to get you closer to your application.

...people that talk about how MySQL is better because "it's faster"?

faster in what?? that's such a blanket assessment, and if they think that way then there's a good chance these same people never gave postgres the time of day, much less even downloaded it.

these people also probably never read that phpbuilder article. now i'm not saying this is the end-all postgres/mysql shootout, but it does give another perspective on this debate.

i'll put my money on postgres any day. it's been around longer. more enterprises think it's more robust.

6 months later, its proponents were telling people the same thing - "every entry was verified an open relay" (here)

Of course, these lists can be workable when combined with a system such as spamassassin, which uses them to weight whether or not a message might be spam, thus taking into account the too often power tripping and overreacting operators.

It must be frustrating playing whack-a-mole with spammers, but, slandering entire network service providers is wrong, too.

Remember the old adage: "be careful when you fight monsters lest you become one yourself"?

Or, how about "100 guilty men go free than for one innocent man to be put to death"? Just like with censorware, when people see legitimate sites and users suffering at the hands of the "protectors", it leads to wariness of placing much trust in these "protectors".

Save a load of time - read some comparisons, like this one and make your own mind up

and here is Open Source Databases: As The Tables Turn


same site, same author different opinion.

Here's a pretty good article comparing MySQL and Postgres.

We have been running postgresql for about 3 years in a production environment. The problem with postgresql is that number one it does not scale worth a shit. Number two it cannot be kept online 24/7 that in itself is some major faults. I run a system with databases consisting of simple data only about 15 million records or so. If we load on more than about 20 simultaneous users is slows to a grinding halt.

It seems that people's experiences vary on this. Certainly your complaints were valid in the pre-7.0 days, but PostgreSQL has improved an amazing amount since then, especially after the introduction of 7.2. The current stable version is 7.3.4, and 7.4 is right around the corner.

Much of the scalability issue you mention has to do with the default settings regarding shared memory, buffers, etc. The PostgreSQL developers have been very conservative about the defaults, because they want the database to run on the widest range of hardware possible. Unfortunately that leads to a "least common denominator" approach and the end result is a database that out of the box performs suboptimally on most systems in order to run on almost all of them.

But if you change the tunable parameters to values that are much closer to the actual hardware you're running the database on, the performance increases a great deal.

Some people have gotten very good scalability out of PostgreSQL as a result. I'm sure you're aware of the PHPBuilder article that talks largely about the scalability issues. That was written some time ago, and PostgreSQL has gotten quite a lot better since then.

It doesn't work for everyone. MySQL has the advantage of having a rudimentary replication mechanism out of the box, and its full-text indexing is much easier to set up and use. It's also much easier to upgrade between major versions (PostgreSQL requires that you dump and restore if you're upgrading to a new major version, e.g. 7.3 -> 7.4). But in the general case, PostgreSQL seems to me to be a much more capable database than MySQL is.

I don't know of any other database, commercial or otherwise, that allows you to write stored procedures in Perl, Python, or TCL. That alone might be worth the few tradeoffs.

If you're running a relatively old (7.1 or earlier) version of PostgreSQL, you might want to give 7.3.4 a try. You might be pleasantly surprised.

OK, I understand that much, but how is your site different from, say, the SourceForge snippet repository, the many PHP repositories, HotScripts, CPAN, or Vaults of Parnassus (for Python code). There are many repositories available.

While I haven't read this book or the previous edition. If you are wanting to learn the language and don't want to pay for the book, php.net and phpbuilder.com are two of the best sites available. They post have good references and PHPbuilder has a very useful forum in case you get stuck.

Oh, really.

Oh, really.

Oops forgot the link. Take a look at this.

Also look here.

This shows how much postgreSQL can really scale.

Actually, you can do Flash using Apache, PHP and ming (the funk in your trunk). SWF is a reverse engineered version of flash that's free, open, and more importantly: scriptable!. Try generating real-time flash animations using Macromedia without headaches!

I will agree to an extent...

When I am writing a web-app... I will often go to their sites as a reference... however, I find that the examples are sometimes lacking.

MySQL's site is rather poorly laid out and makes assumptions that you already know all there is to know about MySQL - pretty good reference, poor for learning from.

PHP's website is excellent - again though - not a great learning source... there are user submitted examples - but they aren't moderated or proofread... so are often garbage.

I think I've learned more about PHP/MySQL from books and PHPBuilder than I have from the actual PHP/MySQL sites...

Actually it has "pretty good" OO.

If I' had modpoints right now, I'd mod this up as "funny" ..

Any C++ or Java Developer will loose his hair (I he has any left) when reading things like this or this

(the later has nothing to do with oop)

So, does PG+PHP match the speed of My+PHP? Is it as thoroughly tested? As I'm moving away from using Perl, I'd be really interested in seeing some benchmarks with this new version of PG...

The question shouldn't be whether PG+PHP matches teh speed of MySQL+PHP, but rather whether the speed of PG+PHP is good enough for your application and, more importantly, whether it will scale reasonably well under load.

This seems to indicate that PG+PHP will scale better than MySQL+PHP, but that will certainly depend on the configuration of MySQL (in particular, which table type you use).

You should be a lot more concerned about the features of the database that you will require, instead of the speed, because once you select a database engine you'll have a lot of trouble migrating to a different one. Speed can always be gained by throwing more hardware at the problem if necessary. Database features can't.

Cue all the people telling us why it's better than MySQL.

Well, if you insist... :-)

It's better for certain things (most things, actually). PostgreSQL is a bit more feature-complete as a SQL database than MySQL is. MySQL is improving, certainly: it now has transactions and such. But PostgreSQL has quite a bit more: triggers, rules, stored procedures, and views, for instance.

In terms of speed, MySQL is faster for certain specific operations but that speed comes at the price of database integrity: the lack of rules and triggers means that it is not possible for the database to enforce consistency between tables. One must thus trust applications to do the right thing, which is generally not wise.

It's like the difference between an OS with memory protection and one without. The one without may be faster for certain things, since the OS doesn't have to worry about messing with page tables and dealing with page faults of various kinds, but the price is that you now have to trust the applications running under the OS to do the right thing and not touch memory that doesn't belong to them.

As I said, MySQL is faster for certain things. But PostgreSQL is reportedly better at handling lots of concurrent transactions than MySQL. It's not clear, then, that MySQL is much better than PostgreSQL, if at all, under high load situations. And if it isn't, then there's really little reason to go with it over PostgreSQL.

Finally, even if MySQL is faster, it's not likely to be so much faster that it is the difference between success and failure. And I can tell you this: experience shows that the initial requirements of a project are often vastly different, and usually much less demanding, than the final requirements for the same project. So it makes more sense to go with the most capable database backend you can lay your hands on, as long as it remains within your budget (your real budget: remember that you're likely to spend a lot more money than you expected, if only because the requirements will change over time). That means going with PostgreSQL over MySQL, if given the choice. You have to make the decision early because changing your database engine mid-project is extremely difficult, especially if your code was written to work around the limitations of the database engine, as it almost certainly will if you're using MySQL.

These days I don't think the question should be whether you should go with PostgreSQL instead of MySQL. It should be whether you should go with MySQL instead of PostgreSQL. PostgreSQL should be the default choice these days, because it is so much more capable at the same price.

It seems to me that unless you have some compelling reason not to port your web application to PostgreSQL, you should start doing so. The consensus of opinion is that PostgreSQL is superior to MySQL is virtually every way, including speed in most situations. (For interesting real-world info, refer to this well-known article.)

Both MySQL and PostgreSQL are totally free, and both support the core SQL command set. In general, PostgreSQL supports more features than MySQL, so in some ways you can consider PostgreSQL to be a superset of MySQL.

I have done all of my unfunded web application programming with PostgreSQL for about four years now, and I can't say I've regretted it for a minute.

Good luck.

I read a comment by one poster saying that PHP 4.2.3 did not work with Apache 2.0.42 on win32. This is not true! Once you have Apache up and running, install PHP 4.2.3 (or what ever the latest PHP distribution is). If Apache wont start, follow these directions.

1) Move php.ini to your {winnt} directory.
2) Move php4ts.dll and php4ts.lib to your {system32} directory.
3) Go to Snapshot and download php4-win32-latest.zip
4) Extract the file php4apache2.dll from the downloaded file to your folder, overwrite the old file.
5) Restart Apache!

When ever PHP seems to break the latest Apache release just repeat this process. If this still does not work try asking for help over at Install Forum

mysql vs postgresql scalability

check out this article by tim perdue of sourceforge

Its interesting that whenever anyone quotes a MySQL vs Postgres link and includes the PHP article the referenced above, they rarely realize that the author of that article (and one of the initial developers of Sourceforge) wrote an article 4 months later that Revisiting the MySQL vs Postgresql Implementation. The original quoted article ended up recommending MySQL while the later article clearly showed that PostgreSQL blew away MySQL under a high load. This research is what made Sourceforge convert from an initial MySQL implementation to a PostgreSQL one.

As a sidenote, I am currently building a pgdiff tool that allows users to create alter scripts for migrating between schemas. This is useful for shops where there may be a development/staging/production versions of the database...

If you do a Google search for "MySQL vs. PostgreSQL, you'll get a lot of hits. Here are a few that seem to be pretty informative (if not slightly dated):

here
here
here
here
here
here (not really a comparison, but read this article and the linked Postgres article for more info)

In my personal experience, Postgres has historically been the database more prepared for larger, more multi-threaded applications.

Obviously, there have been debates about which are faster in various different applications. To be honest, I have no hard data, nor have I stretched them either to their capacity, but as a user and casual developer, they are both fast enough for me not to notice.

What's inarguable exciting can be directly quoted from MySQL's own comparison of the two (listed above):

[B]oth products are continually evolving. We at MySQL AB and the PostgreSQL developers are both working on making our respective databases as good as possible, so we are both a serious alternative to any commercial database.

Your just missing it. :) I missed them a lot too before I found them.

ADODB for PHP is a good abstraction layer (some people think it is too bloated and the code is ugly, of course those people haven't written their own or anything)

The PearDB
functions are very useful as well.

I've heard that the phpBB DB layer is very good but I haven't looked at it myself or tried to use it in other programs.

Personally, I haven't found anything in PHP to be short-sighted. I've programmed ASP, JSP, and even some Perl and I've found PHP to be the best all around language for server side web scripting.

MySQL, ehhhh....my opinion is they should change their slogan to "MySQL - Hey, it's better than using a flat file!" :) (which is not meant to denegrate all of the volunteers that have put in a lot of hard work creating MySQL, for simple web sites and applications I don't think it can be beat. But Oracle, IBM, and MS don't have anything to fear from it)

And BTW: "show tables" is no SQL either and exactly as non-standard as "\d"...

I want transactions, foreign keys, views and reliability *NOW* and can't wait for MySQL 17.3. Stick with your "MySQL" or whatever for your tiny, little application if it pleases you and you don't need an standards compliant SQL database.

The so-called MySQL benchmark compares MySQL and other databases doing a whole pile of somewhat obscure database functions one at a time. If your database only has one user, and you spend a lot of time truncating tables, then MySQL is probably the correct choice. For a much more realistic benchmark try here. After looking at MySQL's benchmarks I had to conclude that either the MySQL developers are ridiculously naive about real world data loads or that they are being deliberately deceitful. No one cares how a database performs when there is one single user.

MySQL is a fine database if your are creating an appliation that is read intensive and that doesn't need any of PostgreSQL's more advanced features.

• http://www.phpbuilder.com - PHP, some real world examples.
• http://www.devshed.com - PHP, Perl, Python and more.
• http://www.php.net - PHP
• http://www.perl.com - Perl
• http://www.coveryourasp.com - ASP, all real world examples.
• http://www.builder.com - C, C++, Java, Perl, Python and more.
• http://www.devcentral.com - C, C++, Java, PHP, Perl and more.
• http://www.eskimo.com/~scs/C-faq/top.html - C FAQ.

• Programming Perl - Perl
• The C Programming Language - C
• The C++ Programming Language - C++
• PHP and MySQL Web Development - PHP and MySQL. All real world examples.

Your question is rather broad and lacks any specifics, but I get this feeling you're looking for information regarding web site programming, hence the "My intention is to ask about web sites this weekend". In that case:

Sitepoint
A fantastic web site dealing with everything from learning new programming languages to design ethics to search engine tips.

Cool Home Pages
Stuck? Out of ideas? Check out some other fantastic designs. "The only known cure for designers block"

PHP.net
Even though it's the languages official site, there is a wealth of information here. Every function is very well documented and you'll recieve a ton of information.

PHP Builder
Possibly the single best resource to ask your questions - but before you do that, search the forums. Chances are your question has already been asked and has a fantastic answer.

w3schools
Great resource for all things HTML, CSS and so much more. Remember CSS is your friend on the internet - print the quick reference!

And if you're looking to getting into some open source databasing:

MySQL
Once again, the developer of an open source project has a fabulous web site just rigged with useful information.

Just a side note ... did you ever get a message saying "Hacked by Chinese" ?

If so, you might want to look into a firewall...

What about dynamic flash content?

why do people keep saying this? FLASH DOES ALLOW YOU TO HAVE DYNAMIC CONTENT!

you can put sql queries right into your flash code. you wanna connect to an oracle db, do your queries or update data and then output things so they look pretty? no problem. you want to use flash with php and mysql to make your sites dynamic? no problem

if you have a quick connection to the web (the site is a bit bloaty... we are talking about flash) go here and click on "tv times". play around with that. then check out how the same thing looks in html.

both are dynamic...

Lots of them! Pick any four, and mix and match on your page for maximum effect.

Seriously, Flash can be used for good effect. There's nothing wrong with making pages that are beautiful, but the best way to do that is to choose a decent color palette instead of layering your page in graphics.

Too much text is just as annoying as too many graphics. Is there any reason why you need a summary of the forums, two sets of incomplete listings of articles, a list of news headlines, a list of quick tips, and two sets of links provided by Internet.com. It seems like the people at PHPBuilder.com were so enamoured with their ability to pull data from a database that they chose to stuff the front page with as much of it as would fit. One of the primary goals of an index page is to provide the user with an idea of how to navigate your site and how it is organized. Too many graphics is bad, but too many links is worse, its confusing!

Clarity should be your first goal in presenting your message. Sometimes I come across SourceForge projects that don't bother to tell you what the project is about. Your webpage is presumably about talking to visitors, not talking to yourself.

Bad graphics are worse than no graphics at all. It looks unprofessional if you do a hack job at it. Better to stick with basic text elements and a few colors

Other scripting languages have really hit a wall in development because of the objectless syntax, but ruby, is a piece of work.

Yeah, I can see your point. The other languages have a totally objectless syntax!

Too bad they have all hit a wall.

One thing that has just occurred to me in this, round 5,408 of the MySQL-versus-PostgreSQL flame fest is to ask if anybody has tried to replace MySQL with PostgreSQL or vice versa in any project that both sides would consider "worthy" in some sense.

I find the people here slamming MySQL are often doing so based on their theoretical, rather than practical knowledge. But perhaps you are different. I'd like to see you back up your claim.

Here is a recent (MySQL 3.23.26beta and PGSQL 7.1 CVS pre-beta) benchmark. Now I know that benchmarks are the devil's tools, but he really seemed to try and make it a balanced, true-type of benchmark. It is interesting to look at his 1999 benchmark between the two too, where MySQL appeared faster on simple selects and non -concurrent writes to tables. I forget (and don't see it mentioned) if Tim Purdue actually turned off the fsync action that Postgres leaves on by default. If not, it could have explained some of the slowness of Postgres at that time.

My personal experience with older MySQL is that it is unstable and buggy. We used it for our RADIUS backend for about 3 years and it fell over regularly without much effort. About 18 months ago I replaced it with GNU-RADIUSd and Postgres and -- with four times the load -- it has yet to fail. This wasn't super-high-end stuff either. We're talking about 300 dialup lines with a couple RADIUS daemons making SQL calls to update user logins and time spent when logged out. With MySQL it was 48 lines and a single daemon and I was restarting MySQL so much I wrote a script to do it for me (about five times a week or so).

I am glad to hear that MySQL works for you; chacon son gout, as the French say (when they don't have accents handy). However based on my experience and the experiences of those who at least appear to be doing unbiased benchmarking, and also based on my need for referential integrity, ACID compliance and robustness, MySQL loses. Hell even those using it for pure speed are losing too, since it isn't the fastest, despite what MySQL, Inc. claims.

*cough cough* slashdot

You're giving /. as an example of a rock-solid stable system? I surely hope you're kidding. /. Has fallen up and down more times than I care to remember.

IIRC, /. heavily caches both stories and the front page to avoid load on the MySQL server. Before this was done the crashes were a lot more visible. Now, you just don't see new comments until the cache is refreshed. This is both a good and a bad thing, but it does not show that MySQL works well under load.

/. Also shows its MySQL troubles when you try to log in or change your viewing prefs; if the SQL server is down, you get the threaded (ick) cached page instead of what you want.

The first thing that springs to mind is an ASP -> PHP converter that I've heard of, called 'asp2php'.

Perhaps a more 'correct' way of doing things would be to use the ASP-mimicing PERL functions (although I'm aware that this isn't exactly what you were asking for, it's the most 'neat' manner, if you really /have/ to use ASP-based nonsense).

A search through Google is the most obvious place to look, however, which turns up, amongst others, a thread on PHPBuilder, which suggests Apache::ASP, which, AFAICT, uses the abovementioned PERL module (given that it requires the Apache module mod_perl).

HTH.

The first thing that springs to mind is an ASP -> PHP converter that I've heard of, called 'asp2php'.

Perhaps a more 'correct' way of doing things would be to use the ASP-mimicing PERL functions (although I'm aware that this isn't exactly what you were asking for, it's the most 'neat' manner, if you really /have/ to use ASP-based nonsense).

A search through Google is the most obvious place to look, however, which turns up, amongst others, a thread on PHPBuilder, which suggests Apache::ASP, which, AFAICT, uses the abovementioned PERL module (given that it requires the Apache module mod_perl).

HTH.

Postgres offers great stability; and numerous features that MySQL simply doesn't offer - most notable being transactions.

Postgres scales real nicely, and while it once was slow and didn't handle large records well, both of these have been very well addressed in the most recent versions. A recent article at phpbuilder demonstrates quite nicely these issues. (current release is 7.2)

I use it, I love it! Why do people use that so-limiting MySQL, anyway?

-Ben