Slashdot Mirror

Here is an observation: With all the publicity Ruby on Rails and other frameworks like Zend Framework, Turbogears and the like are receiving these days--why are we not seeing an innumerable number of security trolls like Chris Shiflett on the *framework side of web development? My thoughts are that PHP users are told "you can too" when in many cases, with forums other resources like the ten gazillion books, they *can*, to an extent (but either with really bad help or books assuming the reader is not working on a *real* project).

Conversely, Rails, Turbogears and Symphony are, too, saying "you can too." Yet, where are the security trolls? It seems though that the *actual* users of the *frameworks, the ones using them for real-life projects are those who have struggled with PHP and (perl, python, etc...) CGI programming for so long and decided "fuck it." Things like database abstraction (and therefore quoting, etc), single-entry-point, and template-safety are, in the most part, taken care of for you.

P.S. XSS is not a PHP problem!

If performance of PHP is absolutely critical, you can use one of the Zend packages to pseudo-compile your code. From what I've seen there is a noticeable improvement on any script which does anything above 'light' work.

"PHP started as a quick Perl hack written by Rasmus Lerdorf in late 1994. Over the next two to three years, it evolved into what we today know as PHP/FI 2.0." -- http://www.zend.com/zend/art/intro.php#Heading4

Try the following (it's where I am learning a great deal):

http://www.zend.com/zend/art/parsing.php (Very useful examples)
http://us2.php.net/manual/en/ref.xml.php (Found the above link the comments on this page)

PEAR is a component library with parts of a framework (like common error handling for some parts), if you want a framework as-is, there are others, like the upcoming zend framework.
imho the lack of a framework is not job, a language or even language design should solve, it only should provide the toolset used by a framework.
but not the framework itself.

Someone said it DID work with PHP4, but the FAQ says differently:

What version of PHP is required to run the Zend Framework?

The Zend Framework is compatible with PHP 5.0.4 and above. PHP 5.1 can be used but is not a requirement. Zend Framework is also tested against the current version of Zend Core. Sorry, PHP 4 will not be supported.

It's too bad. I wish there were a killer MVC framework for PHP4 with it's massive install base.

I just noticed the Zend Developer Zone is "powered by" the Zend Platform which claims it's "the only robust PHP production environment that ensures your applications run smoothly at all times."

I'll be sure to not tell all of my clients about it as they'll wonder what's wrong with the PHP builds we're running now.

There's a good summary on Zend: http://www.zend.com/php5/andi-book-excerpt.php

Basically, PHP 5 adds proper object support (think Java-style) including iterators for objects, and new extensions add good XML support, SOAP, SQLite, better MySQL support (prepared statements, OO interface, etc.)

I'd recommend reading Adam Trachtenberg's book Upgrading to PHP 5 if you're familiar with PHP 4.

Yes CVS or Subversion is a good choice.

If you are interested in PHP coding it is the best to get stick with some existing PHP platform or system that already solved this or is going to solve it: Zend collaboration or PEAR
or... any existing CMS like Mamboo or...

I was maintaining my own libraries for years but I found it very difficult and ineffective because of the way I did it.

Every project was slightly different so I ended up reinventing (or breaking and fixing and enhancing) the wheel over and over...

Sure, the low-level functions can be reused easily without any changes but higher
level functions that has more complicated logic are difficult to reuse in different systems which are often based
on different processing logic (and went through different historical evolution)...

I realized that maintaining separated snippets of libraries is very ineffective so I decided to write Elixon Platform
which helps me to organize existing libraries and still keep the same intercommunication and logic and
coding style intact because it is still one Platform.

So my advise is: try to avoid looking at the libraries as at "stand-alone independent snippets" and try to integrate
all libraries under one umbrella while keeping them modular and as much independent as possible.

Enterprise Integration - PHP Frameworks like WASP (and Zend's own) are on their way there.

Internet Focus - PHP is certainly that.

Interoperability - PHP Frameworks are very abstracted, and PHP has PECL connectivity to Java

Dynamic typing, OO, reflection - PHP 5 has all of those.

PHP itself may be too close to HTML, but that's what frameworks are for... You could say the same things about JSP/ASP. read this for more info on PHP frameworks

I second that suggestion! Zend Studio is fastastic! You can step through PHP code and examine the values of variables. Not to mention it has a really nice editor. Definitely check it out. http://www.zend.com/store/products/zend-studio/

Why is this excessively insecure?

Because said file has to be readable to user "nobody" in order to have an Apache child process read it. Because of that, ANY WEAKNESS in your scripting can result in a complete compromise of your data.

Here's the only method that I've found that offers ANY better for PHP:

1) Create a function that returns a database connection resource.

2) Within the function, include the login credentials.

3) Encrypt said file with with a "source protector", like IonCube Encoder or the Zend Encoder.

Now, you've limited the damage of a compromise so that an attacker would have to trick the application into actually making the request directly thru the function, rather than allowing attacker to actually access the DB directly.

It's not much - but can you do better?

PDO is a free solution to most of these. It's slated to go stable this weekend.

IBM has spiffed up Cloudscape to be somewhat compatible to DB2, renamed it to Derby and is giving it away
PDO_ODBC, Zend Core for IBM

Oracle is giving away a mildly crippled version of its DB, I don't remember the exact circumstances
PDO_OCI, Zend Core for Oracle

ADABAS, also known as SAP DB, is now also FOSS
This one, I know very little about..

Firebird, née Interbase, was freed years ago and is said to be working well and under active development. I don't know why so few people seem to like it.
PDO_Firebird

I believe I heard about SQL Server being "free" under some circumstances too, but I'm not sure.
Correct, it's called "SQL Server 2005 Express Edition", formerly MSDE. (although, I've not tried EE2005, only MSDE -- it worked well)
PDO_DBLIB

S

PDO is a free solution to most of these. It's slated to go stable this weekend.

IBM has spiffed up Cloudscape to be somewhat compatible to DB2, renamed it to Derby and is giving it away
PDO_ODBC, Zend Core for IBM

Oracle is giving away a mildly crippled version of its DB, I don't remember the exact circumstances
PDO_OCI, Zend Core for Oracle

ADABAS, also known as SAP DB, is now also FOSS
This one, I know very little about..

Firebird, née Interbase, was freed years ago and is said to be working well and under active development. I don't know why so few people seem to like it.
PDO_Firebird

I believe I heard about SQL Server being "free" under some circumstances too, but I'm not sure.
Correct, it's called "SQL Server 2005 Express Edition", formerly MSDE. (although, I've not tried EE2005, only MSDE -- it worked well)
PDO_DBLIB

S

Now that PHP is popular it is undergoing something of an identity crisis. Rasmus said it was an answer to "the web problem", a very simple answer. A "right to the point" approach, terse rather than elegant.

But as more "serious" developers pick it up, more "serious" features are requested.

The fact is, if you're flexible you can build whatever you need in PHP4. It may not always be the way you prefer to code, but you can do it.

PHP is what it is. And it won't appeal to everyone. Fortunately there are many other platforms for the unsatisfied. Take your pick.

If your primary gripe with PHP is that it isn't enough like Java, shut up and use Java. Same for - insert language here -

I am very interested to see the new framework being promised by Zend and IBM. (http://www.zend.com/php-collaboration/) Can they really deliver on their promises? If not, I do predict a mass exodus to ROR. PHP could wind up being relegated to individual scripts or 5 page websites.

Yeah, for PHP, there's Zend Encoder. Does a much better job than GZip :^P

This is the most amazing product ever. It's so well put together and easy to use that Zend doesn't feel they have to document or describe it and so light weight that there's nothing to download! WOW!

Yes folks once again the PHP admits to being the last player to the game feild with essential technology.

Remember folks these are the people who can't even standardize the naming conventions for functions in their core language.

Please go to the frameworks site it's basically an empty shell coated in marketing buzzwords.

http://www.zend.com/collaboration/framework-overvi ew.php

I like better the ability to have interfaces, standards, Struts, lots of things that make Java better for developer teams.

interfaces (i assume you mean the OO type) : http://www.zend.com/php5/articles/engine2-php5-cha nges.php

Struts = Smarty: http://smarty.php.net/ (and this is about 100 times easier to configure and deploy than Struts)

And because I'm bored and I like PHP, my reply to all of the above:

* PHP sucks.

PHP has functions for practically anything you can imagine. Of course, I'll get into why it doesn't suck in the replies below, as this is a bit too general.

* PHP is for n00bs.

PHP is for developers who want to get something done quickly. The syntax is very easy to learn, and variables are loosely typed, but in my experience this doesn't mean that the language is flawed; it means that one can code up something without having to worry about unnecessary things like pointers, variable conversion and the like. And to be honest, in website scripting I've never come across a need for more advanced syntax than PHP provides in my five or more years of using it.

* PHP is usually poorly written.

This, unfortunately, is usually true. Because PHP is easy to use, it is often used by people who don't want to worry about writing good code either. But like everything else, there are varying grades of professionalism. PHP *can* be written well, it's just a case of taking the time to do so.

* PHP is a scripting language and you can't do anything but write web pages with it.

Scripting language, yes. But it most certainly can be used for things other than websites.

* PHP sucks because the function names are inconsistent.

True, but this is why one has a manual. I've never been all that concerned about it.

* PHP is slow.

Actually, it's really not. Take a look at this comparison between different CGI modules for Apache: PHP actually outdoes Perl here.

* PHP isn't capable of working in a real enterprise.

I haven't had experience with integrating PHP into an "enterprise" situation personally, but I'll refer you to Zend's Enterprise PHP page for various reasons why PHP is indeed ready for the enterprise.

* Real coders use Perl.

Real coders use the tool that best fits the problem.

* PHP doesn't scale.

Now THIS is something I can definitely refute. I work for a company that creates mods for a PHP / Smarty-based online shopping cart known as X-Cart and I can tell you, PHP scales wonderfully, otherwise stores wouldn't use it as a base of their business operations. X-Cart is on the order of hundreds of thousands of lines of PHP code, and very commonly has tens of thousands of customers accessing it concurrently.

And yeah, I know you were joking, but hey, I was bored. ;^)

Zend Technologies, Inc., the PHP company and creator of products and services supporting the development, deployment and management of PHP-based applications, today announced Marc Andreessen and Gaurav Dhillon as the newest members of the Zend board of directors.

That's a good MS promoter!
If it doesn't run on Windows, it's Jerry-rigged, and pushing companies to write cross-platform software would just be pushy.

Here's a little-known-fact about linux: Many major software manufacturers write software that runs on linux. The ones that don't, are doing it based on marketing strategies. If the market changed, so would their coding practices. As a business owner, I do not have the type of money to back up a Microsoft platform, and I also cannot justify using the software due to quality and corporate tie-ins. When I'm bigger, maybe I'll dig myself a hole and dive in head first (Microsoft said they already have it started for me whenever I feel like jumping).

Honestly, if Adobe made their software for Linux, then I would guess at least another 29 million people would switch over to linux. I just love how software like Blender 3d, Firefox, Thunderbird, OpenOffice.org, Zend Studio, Star Office, MySQL, Oracle, Apache, PHP, and many many others all work on Windows and Linux, and oftentimes MacOSX, but lazy companies like Adobe/Macromedia, Autodesk, and most gaming companies choose to single out one or two platforms to target simply because of marketing strategies.

Microsoft has chosen time and time again to refuse to implement global standards simply because they want to lock people into using their software. Your post proves that their marketing strategy works.

Also keep in mind that hardware working with the operating system says more about the hardware manufacturers than the operating system. Microsoft has been known to strongarm hardware manufacturers to not create linux drivers, and many hardware manufacturers are just too lazy to work with the linux community.

So while Linux, being about half the age of windows, is still lacking in a few areas, it is still more stable and provides enough features for me to use. I still keep a windows box around at work for troubleshooting other users' microsoft office problems, and for running the Adobe Creative Suite, but you can bet I'll be formating every windows box I own as soon as Adobe releases Linux binaries. (considering how closely related OSX and Linux are, I still don't understand why they don't make a linux port)

In short, if industries really did shift to linux, companies that write software wouldn't hesitate to change as well. It is our fear of something different that keeps us on Windows, and keeps software developers from writing linux code, resulting in jerry-rigged solutions like Firefox, Thunderbird, PHP, Apache, Oracle Enterprise server, and others. (note the sarcasm)

Look into Zend Studio java based IDE good tool to debug php scripts. Read the zend page for more details and if you really into php development you i think it might worth 100 bucks for you...

When it comes to a development tool for PHP, I know no better than Zend Studio http://www.zend.com/store/products/zend-studio/

I used to be a big fan of Notepad++, but this really helps me reduce my programming time by leveraging intellisense as well as database connectivity right in the package. They have a Beta out of their newest version that you might want to download to try.

I have recently taken (and passed) certification exams for Zend PHP, MySQL Core, and LPI Linux 1. I work with these technologies every day and studied for these tests. Some of the questions were pretty difficult, and some were fairly easy. I think that anyone who has passed these tests does possess a least a minimum amount of knowledge about these subjects. Anyone can say they know something on a resume, but if you can prove you know at least a minimum before you are even interviewed... in my opinion that can only help when job hunting. And if your current employer pays for it, why not get certified for your resume's sake? But if your just trying to impress your coworkers and others already in the industry, I doubt that certs will help you out much.

http://www.zend.com/php/design/patterns1.php?print =1

You can get a taste of his writing skills which are pretty straight forward.

php can be cached into bytecode. very similar to jsp pages on a first run basis. there are a few op code caches available for php including one from zend (which costs money) and a few free ones such as mmcache (which we use at FotoFlix and it's great).

My advice to everyone who wants dynamic websites is to use PostgreSQL for the database, it supports more of the SQL standard. But don't use JSP, use Ruby and Rails.

There are many reasons why I would give this advice:

• Java is not Free as in Freedom. This might not matter to some, but it does matter to me.
• Web applications in Java require complex application servers like Tomcat or JBoss to run.
• There are half a billion different web, database, and other "frameworks" out there for Java, and they nearly all incompatible with each other. You'll spend a week figuring out how to publish a SOAP call using JAX-RPC, for example. Spring, Hibernate, EJB, Tapestry, Torque, Struts... so many crappy ways to do the same thing!
• Java forces you to love duplicating things you've expressed in code in myriad XML configuration files.
• Jerks like this.

I always think of Java as more of a distraction for CS students and developers who like to secure their jobs behind layers of complexity and expensive purchases of commercial software ("we paid thousands for this, now we have to use it!"). This probably accounts for the success of Java in the corporate world.

Huge, enterprise applications can be written in any language; hell, Yahoo! runs on PHP for god's sake, as does Lufthansa's ticketing system. Languages are languages. What makes a "real" one in your eyes? The only thing you should be concerned about is code quality. Whether a language is interpreted or byte-compiled really means nothing.

According to the PEAR Development mailing list, PayPal is in fact willing to push some changes back to the community. According to this Zend press release, PayPal paid Zend, to make improvements to PEAR::SOAP package 0.9.0.

So for all of you PHP 4 developers, you might just owe PayPal for your ability to make SOAP-based web service calls.

I USED to be able to follow developments in PHP via the PHP Weekly Summaries, but these "weekly" summaries got sporadic late last year (several weeks without any, then the missing weeks would all show up at once) and now it hasn't even been updated in several months...

PHP IS still being developed, I assume, but I haven't spotted any news on it in some time...

Products like PHPAudit make PHP commercially viable as well. You can actually embed the licensing system into your PHP applications and use an encoder such as ionCube or Zend to create byte code that will protect your work from piracy.

No idea. Apparently there are a lot of them. This quote is from Zend.com "Due to the fact that there are more rather than less of non-thread safe libraries...". (page http://www.zend.com/zend/week/week131.php#Heading3 )

It's a shame too. Apache 2 can be up to 3 times faster than 1.3 using mpm-worker.

• Help with a project's documentation. Many OSS projects have mediocre documentation. It doesn't take a lot of skill to fix typos, expand sections and write up HOWTOs on things you've done. Perhaps you even know a language other than English, and can help with translation? The same concept applies to projects' User Interfaces, if you're artistically inclined.
• Help newbies. Many projects have general-inquiry mailing lists that are flooded with simple-to-answer questions. You've probably already overcome some of the hassles of installing the software that you use on a given configuration. Share your knowledge.

new functions:
http://www.zend.com/manual/migration5.functions.ph p

new object model:
http://us3.php.net/manual/en/language.oop5.php

exceptions:
http://us3.php.net/manual/en/language.exceptions.p hp

I'm a web developer (PHP, primarily). Web developers get hobs based on their portfolios. However, I don't particularly like working in an environment that is condusive to building a nice portfolio (flashy, public sites).

I work in a closed environment. On intranet and back-end systems. I can't put these in my portfolio. So, I spend a decent amount of time supporting my language, and I work on various php.net related projects. This lets any future employers see what I'm capable of doing, even though they might not be able to see the work I'm currently doing, professionally.

Having an @php.net address (although quite easy to get if done right) is instant credibility (at least for anyone I'd want to work for).

I know of several key PHP contributors that have been offered (and have taken) positions as a direct result of their contributions.

So, in short: yes. (-:

S

Here is Zend's page on the integration ... ironically enough, Sun is a supporter, but IBM is not.

Give us some free and good tutorials online as to how to secure PHP code. Show us some old exploits and how to avoid falling in the same traps like that again.

http://phpsec.org/projects/guide/
http://phpsec.org/library/

Give courses all over the world that go in-depth regarding these matters.

I'm not sure if this counts, but Zend offers online training, and one of their advanced courses is Securing PHP Code.

I love working with PHP but the constant screwing around with globals, superglobals and what-have-ye-not really make security a nightmare on it.

There are two scopes. If that's too many, programming might just not be your thing.

Those among us who are serious about PHP want actions, not propaganda.

This is in reply to the bit you quoted? If so, perhaps this will help:

http://www.answers.com/propaganda

Give us some free and good tutorials online as to how to secure PHP code. Show us some old exploits and how to avoid falling in the same traps like that again.

http://phpsec.org/projects/guide/
http://phpsec.org/library/

Give courses all over the world that go in-depth regarding these matters.

I'm not sure if this counts, but Zend offers online training, and one of their advanced courses is Securing PHP Code.

I love working with PHP but the constant screwing around with globals, superglobals and what-have-ye-not really make security a nightmare on it.

There are two scopes. If that's too many, programming might just not be your thing.

Those among us who are serious about PHP want actions, not propaganda.

This is in reply to the bit you quoted? If so, perhaps this will help:

http://www.answers.com/propaganda

With PHP 5, a lot of things aren't quite as you portray them anymore.

You can't even dynamically add methods to PHP classes or dynamically modify the methods on an existing class.

Classkit does a lot towards this end, though it's not enabled by default, I believe.

There are no hooks called before and after method calls, etc. No way to access the syntax tree of a class.

There aren't any hooks, this is true. One could extend a class and place the hooks in the new version (even using the __get and __call functions to make a generic wrapping class). Still, I recognize this isn't a particularly workable solution in many cases.

The syntax tree of a class can be accessed via reflection.

I spoke to the Zend guys about this at OSCON six months ago. They said they had a suexec version of PHP in "private Beta". I sent them several emails afterwards asking whether we could test it / help out etc, and haven't received a single reply, so I have no idea whether that's still coming.

Anyone have any more info on this?

cLive ;-)

Zend Studio is excellent... well, it's better than anything else I've used over the last 5 years - pico, vi, emacs, Dreamweaver, Quanta, Jedit. It's well worth the money and runs on OS X. If you're on the cheap, go with JEdit and install the PHP plugin.

Zend Engine II has Object-Oriented development features for component-based enterprise applications

Extended XML support

Support for web services

Enhanced Database support

A much more better speled deskripshun of PHP5's OO language enhancements are is available from the horse's mouth

The thing that bothers me about PHP is that it is Free... unless you want it to run fast. Even the "free" Zend Optimizer is closed source. It makes me wonder if optimizing patches to the Zend Engine (PHP Engine) would be rejected because they compete with Zend's buisness model. I know Zend doesn't owe me anything, but the fact that fast PHP is not free should weighed properly when evelauting solutions.

You'd expect the purveyors of PHP tools to answer developer requests, and they have.

There are several alternates around.

If you want to try something a bit different, there's this or this.

You might want to look into this: PHP 5 Migration for starters.

I've been using Zend Studio for about a year and a half now, and it's a great IDE for doing PHP stuff. It has code completetion, a nice debugger, good integrated documentation, and a host of other nice features. I run it on both my Windows and Linux boxen, and I absolutely love it.

No site should require compiled PHP code. If you need speed, get a cache extension like APC, Turck MMCache which are free, or Zend Accelerator or ionCube's accelerator if you require a commercial product with support.

If you need even faster code, write a PHP extension (in C, compiled) to handle your resource-intensive functions.

Both of those solutions are much more versatile than a compiler that doesn't support the full language.

I'm surprised with all this PHP vs PERL talk that no-one's mentioned that ZEND says you can use PERL from within PHP, as of release 5. Does no-one else find this highly interesting? Anyone tried it yet?

zend is offering a package that includes the zend accelerator, studio, & encoder for $295 or $450 with upgrades/bells/whistles per year, as long as your company is pulling in less than 100k per year.

i dont work for zend; i bought the package (think its a good deal).

if you insist on free software, there are a number of free php code caching apps as well as development ides available...

What does it mean finally and complete?

The Zend compiler is quite complete and AFAIR for flat-fee. Do you mean that it does not produce binaries but byte-code? Then neither Java nor CMUCL have compilers...

The biggest issues developers have with the PHP compilation:

1. They don't want to sell their sources unobfuscated;
2. They want to gain some optimization speed eliminating the parsing (this can also be achieved by caching);