The Fruits of my Labour » PHP

12 Things Mango Wishes He'd Known When He Was a PHP N00b.

Mango — Mon, 29 Jun 2009 16:32:15 +0000

Never use Register Globals. Ever. And if you ever even THINK of using Register Globals, and we find out, Mango is going to send someone over to your house to kick your ass. Are we clear?
As much as we love working with PHP, Register Globals is something that should be filed under "Monumentally Bad Ideas". And unfortunately, it's something that, at first glance, appears convenient. If a user submits a form to a PHP script with Register Globals enabled, the script will create a variable for each form element. However, keep in mind that this allows your end users to set any variable in your script that they like. Here is a common mistake that we see:
```
if ($logged_in) { secret_functions_allow(); }
```
In a situation like this, the author has first run some code to see if the user is logged in or not. If so, the script will have defined the $logged_in variable. When the above line of code fires, it will provide the user with some functions only availble to authenticated users. Innocent enough, yes? However, to "hack" this, all that a malicious user would need to do is form a URL like http://www.example.com/?logged_in=1. To turn off Register Globals, add php_flag register_globals off to .htaccess or register_globals = Off to php.ini. Many administrators ban use of Register Globals entirely, so by developing without it, your script will be more portable. This is a good thing.

Turn notices on when developing code.
Yes, we know they're annoying. However, notices provide you with some valuable information you can use both to improve your script and improve your skills as a programmer. One thing that notices will alert you to is undefined variables. Continuing with the above example, the fictitous script assumes that the $logged_in variable will be defined if the user is logged in. Proper programming practice would be a scenario more like $logged_in==1 if the user is logged in and $logged_in==0 if not. If notices are turned on, PHP will alert you to this. To turn notices on, add php_value display_errors on and php_value error_reporting 2147483647 to .htaccess or display_errors = On and error_reporting = E_ALL to php.ini. You can also use ini_set('display_errors', 1); error_reporting(E_ALL); in your PHP script however this will not display parse errors such as a missing quote or bracket.
Security note: you should turn display_errors off for a production server. It's best to use it only when developing code.

Don't rely on Magic Quotes.

Magic Quotes is a feature of PHP before (but not including) version 6. It was originally created to help prevent SQL Injection however new thinking is that programmers should write secure code (!) rather than rely on Magic Quotes. Here is an example of a function that you may pass $_GET, $_POST, and $_COOKIE to. It will work whether or not Magic Quotes is enabled.

function mysql_real_escape_array($data) {
 foreach ($data as $name=>$value) {
  if (is_array($value)) {
   unset ($data[$name]);
   if (get_magic_quotes_gpc()) $name = stripslashes($name);
   $data[mysql_real_escape_string($name)] = mysql_real_escape_array($value);
   } else {
   unset ($data[$name]);
   if (get_magic_quotes_gpc()) { 
    $value = stripslashes($value);
    $name = stripslashes($name);
    }
   $data[mysql_real_escape_string($name)] = mysql_real_escape_string($value);
   }
  }
 return $data;
 }

Do not use the path to your files in your script.
There's nothing worse than having to move servers in a hurry, realizing that you now have a new path to your home directory, and having to change a hardcoded path in dozens of files. Instead of hardcoding paths, use $_SERVER['DOCUMENT_ROOT'] to have your script discover your document root. Or, use dirname(__FILE__) to find the directory that the script is located in. (Note that this is literally dirname(__FILE__) - you don't replace __FILE__ with anything.) Or, use the getcwd function.
Avoid having the same or even similar code in different parts of your script.
You want to do this simply because it's more efficient. It's faster to write code when you don't have to write the same code over and over, it's faster to modify code when you don't have to modify it in multiple places, and it's easier for other people to read the finished product when the code is short. If you have to do the same thing more than once in your script, use functions or loops. If you have to do the same thing in multiple scripts, use include files.
Don't do for ($i = 0; $i < count($array); $i++) {
Yes, this will run and will often produce the desired results. However, the count function will run at every single iteration. Instead, it's faster to do:
```
for ($i=0, $count=count($array); $i < $count; $i++) {
```
Come up with a naming scheme for functions, variables, and column names.
Someone once told us that functions and variables should all be named with as much care as one names their first child. We agree. If your naming scheme is effective, one should be able to guess names by looking at other names. The Mailparse Extension is a good example of effective naming schemes. Additionally, take care when defining the order of parameters in a function. One example of why this is a good idea is the strpos function and the str_replace function. These functions have two strikes against them. By looking at str_replace, I would assume strpos would be named str_pos. Additionally, the parameters are in different orders: strpos requires the subject first and str_replace requires the subject last.

For naming functions, we separate words with underscores. The first word in the name is a word that defines the general group of functions that we're writing, (for ease of identifying what the function is for, and also for ease of sorting when writing documentation) and then use more words as necessary to describe the function. Similar functions should have parameters in the same order, with parameters that have default values at the end. For naming database column names, we often use the actual human readable phrase, converted to lower case, with underscores instead of spaces. This occasionally makes for a slightly long column name, but the advantage is that we can later use str_replace and ucwords to display the name and not need to cross-reference a list of human-readable column names.
Use UTF-8
There's a great article about using UTF-8 with PHP and MySQL at developer.loftdigital.com.
Use SELECT * only when necessary.
This is a MySQL tip, however we include it here because a great deal of PHP students also wish to learn MySQL. SELECT * is not inherently a bad thing to do, however it's often misused. The only time that it should be used is when you need to select every single column in a table and you do not know in advance what columns the table will have. We see many people selecting all columns in the table but only actually using one or two. In this case, it's better to do something such as SELECT `first_name`,`last_name`. This makes for a longer query, however since the entire row is not loaded, your script uses less memory.

Here's an example of where you DO want to use SELECT *. Let's say you have a program that displays information about customers from a database. Perhaps one day you decide that you want to keep track of customers' birthdays. So you add a column to your MySQL table named `birthday`. When your program displays the information about the customer, it is necessary to see all of the information. Because in this case columns such as the `birthday` column may be added in the future and we do not yet know what columns may be added, we have satisfied both of the requirements for using SELECT *.
Make a wrapper for MySQL queries.
This might not be necessary for quick scripts but it's something we like to do for large projects. The simplest wrapper is as such:
```
function mysql_mangos_query($query) { return mysql_query($query); }
```
There are many advantages to this technique. For example, one may want to use the mysql_error() function to see if the query returned an error, and if so, write the error to a log. Or, if one is working on a large project with multiple tables, one might want to prefix the tables with something like projectname1_ so that multiple instances of the project may run with different data. One example of this is the content management system Joomla. All of Joomla's queries look like SELECT [columns] FROM #__content WHERE... Joomla removes #__ and replaces it with the appropriate table prefix.
Learn how to use regular expressions.
Regular expressions are by far the most powerful underused feature of PHP that we see. Students often avoid using them because they look intimidating. We agree, however they're easy to get to know in 15 or 20 minutes. They're often a very simple and efficient solution to data manipulation problems. If you're a programming student, one can easily impress friends (well, fellow programming students anyway) by being able to read and write complex regular expressions.
Finally, know where to go for documentation.
It's always a good idea to have documentation at your fingertips. We certainly don't claim to know every PHP function there is to know (although that would be really cool). To find documentation on any function, simply go to http://php.net/functionname. If you don't know the name of the function you need, look up a similar function and see if the one you want is listed as a related function. Often, you will also find examples and tips on usage. These are very helpful. For example, someone wanting to find out if a string is contained within a string might look up preg_match. However, this operation does not actually require regular expressions, and as the manual will tell you, it is faster in this situation to use strpos instead.

Happy coding!

Mango's PHP PostScript Functions

Mango — Thu, 18 Jun 2009 04:59:45 +0000

The latest techniques we've been playing with involve using a PHP script on our server in Michigan to print to a remote printer at our office in Vancouver. In the past we've done this by generating an XHTML document with high-resolution images and simply prompting the user to print it. This worked, but if any sort of precision was required, the user had to configure their browser's page setup just so, and to make things even more difficult, different browsers required different settings.

Enter PostScript, a language understood by many laser printers. With PostScript, we can go directly from our script to the printer, (pipe the finished PostScript document to the printer on port 9100) eliminating the stop off at the browser. And, we can position things on our page with as much precision as necessary.

PHP has a basic set of functions for creating PostScript documents - and we're very grateful for this because it meant we didn't have to learn PostScript itself - but it lacks advanced text handling features such as vertical alignment and automatic resizing of text. And, while it can do justified text, it does it in very mysterious ways. Fortunately, these issues were not a problem for Mango, and Mango's PostScript Functions were born.

Here's the source to Mango's PostScript Functions including ps_super_boxed, a demo of how to vertically align and dynamically resize text with PHP and pslib, and the results of the demo, converted to PDF for easy viewing. (One note: the demo requires the font file Helvetica.afm and we're not sure if we're allowed to distribute that, but it's very easy to find with Google.)

Enjoy!

Replacing smart quotes, em-dashes, and ellipses with MySQL or PHP

Mango — Thu, 05 Mar 2009 21:28:24 +0000

Alternate title: "Help! My Quotes Appear as Question Marks or Other Strange Characters!"

The "Smart quotes" feature in Microsoft Office transforms straight quotes into curly quotes. It also transforms hyphens into em-dashes and three periods into ellipses. While one might think, "How lovely! My document looks almost as if I'm educated!" readers of said document may not. Microsoft, in its infinite wisdom, decided to assign special characters such as the ones I just mentioned to a range of codes above 128. Problem: these codes were already assigned to other characters, resulting in frustrating incompatibility with non-Microsoft systems.

Keep reading for some PHP and MySQL code to help out with this issue, as well as a Joomla! plugin.

Our introduction to this was in a situation where we had people using many different systems submitting articles to one of our programs. We decided that we wanted all our articles to use straight quotes, hyphens, and periods. This was partly for consistency, and partly because these characters are common to many character sets and won't cause incompatibilities.

This article isn't really intended as a complete explanation of charsets, though we recommend The Absolute Minimum Every Software Developer Absolutely, Positively Must Know About Unicode and Character Sets if you're interested in learning more. We will however show you some MySQL and PHP techniques for replacing all instances of smart quotes, plus the en dash, em dash, and ellipsis with straight quotes, one or two dashes, or three dots. This code should operate with both the Windows-1252 charset, and also UTF-8, an encoding with an extended character set that has made it the preferred encoding for email and websites.

MySQL:

# First, replace UTF-8 characters.
UPDATE `t` SET `c` = REPLACE(`c`, 0xE28098, "'");
UPDATE `t` SET `c` = REPLACE(`c`, 0xE28099, "'");
UPDATE `t` SET `c` = REPLACE(`c`, 0xE2809C, '"');
UPDATE `t` SET `c` = REPLACE(`c`, 0xE2809D, '"');
UPDATE `t` SET `c` = REPLACE(`c`, 0xE28093, '-');
UPDATE `t` SET `c` = REPLACE(`c`, 0xE28094, '--');
UPDATE `t` SET `c` = REPLACE(`c`, 0xE280A6, '...');
# Next, replace their Windows-1252 equivalents.
UPDATE `t` SET `c` = REPLACE(`c`, char(145), "'");
UPDATE `t` SET `c` = REPLACE(`c`, char(146), "'");
UPDATE `t` SET `c` = REPLACE(`c`, char(147), '"');
UPDATE `t` SET `c` = REPLACE(`c`, char(148), '"');
UPDATE `t` SET `c` = REPLACE(`c`, char(150), '-');
UPDATE `t` SET `c` = REPLACE(`c`, char(151), '--');
UPDATE `t` SET `c` = REPLACE(`c`, char(133), '...');

PHP:

// First, replace UTF-8 characters.
$text = str_replace(
 array("\xe2\x80\x98", "\xe2\x80\x99", "\xe2\x80\x9c", "\xe2\x80\x9d", "\xe2\x80\x93", "\xe2\x80\x94", "\xe2\x80\xa6"),
 array("'", "'", '"', '"', '-', '--', '...'),
 $text);
// Next, replace their Windows-1252 equivalents.
 $text = str_replace(
 array(chr(145), chr(146), chr(147), chr(148), chr(150), chr(151), chr(133)),
 array("'", "'", '"', '"', '-', '--', '...'),
 $text);

Joomla!:
Joomla! plugin for removing smart/curly quotes, em-dashes and ellipses.

Additionally, here's a table of character codes that you may find useful:

Character	HTML Code	Windows	UTF-8	name
‘	‘	145	E28098	left single curly quote
’	’	146	E28099	right single curly quote
“	“	147	E2809C	left double curly quote
”	”	148	E2809D	right double curly quote
–	–	150	E28093	en dash
—	—	151	E28094	em dash
…	…	133	E280A6	ellipsis

Further reading from Wikipedia:
UTF-8

ISO/IEC 8859-1

Windows-1252

Some nifty PHP date/time functions

Mango — Sat, 08 Mar 2008 20:11:23 +0000

I wrote two date/time functions in PHP that I was really pleased with so thought I'd post them.

string friendlydate ( numeric or string $input )
Return value is a day in relation to today in the format "Today", "Yesterday", "Wednesday", "March 2", or "November 7, 2007".
string howlong ( numeric or string $a, numeric or string $b ) Return value is the approximate length of time between two dates, $a and $b. Examples are "4 seconds ago", "1 minute from now", "1 hour ago", "yesterday", "2 months ago", "1 year ago".

function friendlydate($input) {
 if (!is_numeric($input)) $input = strtotime($input);
 if (date("Ymd", $input) == date("Ymd", hometime())) return "Today";
 if (date("Ymd", $input) == date("Ymd", hometime()-60*60*24)) return "Yesterday";
 if ($input > hometime()-60*60*24*6) return date("l", $input);
 if (date("Y", $input) == date("Y", hometime())) return date("F jS", $input);
 return date("F jS, Y", $input);
 }

function howlong($a=0, $b=0) {
 if (!is_numeric($a)) $a = strtotime($a); if (!is_numeric($b)) $b = strtotime($b);
 if ($a == 0) $a = hometime(); if ($b == 0) $b = hometime();
 if ($a == $b) return "at the same time";
 if ($a > $b) { $aa = $b; $b = $a; $a = $aa; $q = "away"; } else { $q = "ago"; }
 $value = $b-$a;
 if ($value == 1) return "1 second $q";
 if ($value < 60) return "$value seconds $q";
 $value /= 60;
 if (round($value) == 1) return "1 minute $q";
 if ($value < 60) return round($value) . " minutes $q";
 $value /= 60;
 if (round($value) == 1) return "1 hour $q";
 if ($value < 24) return round($value) . " hours $q";
 $value /= 24;
 if (round($value) == 1) if ($q == "ago") return "yesterday"; else return "tomorrow";
 if ($value < 31) return round($value) . " days $q";
 $value /= 31;
 if (round($value) == 1) return "1 month $q";
 if ($value < 12) return round($value) . " months $q";
 $value /= 12;
 if (round($value) == 1) return "1 year $q";
 return round($value) . " years $q";
 }