Rob Allen's Blog: Zend_Filter_Input / Zend_Validate Messages
291979
Rob Allen has been working with the Zend_Filter component of the Zend Framework and has discovered a few things:   The basic usage of Zend_Filter_Input is [a simple call to Zend_Filter_Input with the filter types and data to filter]. The problem is that the message you get out isn't always written as you would like. Consider the output if the body record is empty. The text isn't exactly what I would want to display to a user. To change it you pass in a messages parameter to the $validators array.   There's a long list of these "messages parameters" and Rob includes them in the post - things like NOT_ALNUM, CHECKSUM, QUOTED_STRING, INVALID_DASH and UNDECIPHERABLE_TLD (37 of them in all).
744724
As pointed out by the Zend Developer Zone and several other blogs/community sites lately, the latest version of the HTML filter HTML Purifier has been released - version 2.2.0.   Because it uses whitelists and a comprehensive knowledge of the HTML specification, it is bullet-proof against XSS, fixes malformed input rather than reject it, and is open and extensible. The 2.0.0 release lets users customize HTML Purifier's tag sets easier than ever before.   You can check out the official release announcement for of the updates in this release (including a comparison to other similar libraries). There's also a demo they've posted so you can give it a try.
110841
The Zend Developer Zone has "lifted the skirt" on a new feature in the Zend Framework today with this new article - a look at the Zend_Form component, a simple method for creating, validating and generally working with your user's input.   Zend_Form gives you all the tools necessary to create forms and form elements via PHP code. Like everything in Zend Framework, almost everything is configurable; however the defaults are probably good for most uses.   They include some sample code that shows the creation of both a simple, sample form and something a little bit more advanced - including validation methods and making fields required.
460038
In this post to his blog, Chris Shiflett talks about some issues surrounding character encoding and the cross-site scripting issues it can open up in your application.    In the post [on Good and Bad PHP Code], he provides a few useful PHP interview questions, including some questions from Yahoo. He explains that good PHP code should be Structured, Consistent, Portable and Secure   In the comments, many additional improvements have been suggested, but there's one that has yet to be mentioned. When using htmlspecialchars() without specifying the character encoding, XSS attacks that use UTF-7 are possible.    Included in the post is an example to illustrate the point as well as a solution, a simple one involving the header() function, to help correct the problem and prevent bad things from happening.   Be sure to check out http://shiflett.org/blog/2007/may/character-encoding-and-xss#comments">the comments for more great tips.
259423
Rob Allen has posted about a small modification that he made to his Zend Framework setup that allows for a little safer echoing of information out to the View later of an application.   One of my biggest issues with using PHP as the templating engine in View scripts is that the easiest way to echo a variable is the least secure. [...] So, I decided to leverage a post by Mike Naberezny from a while ago about streams. The idea is all his; I just modified it to work with Zend Framework's Zend_View the way I wanted it to.   His method uses a slightly different output format - instead of using a normal echo statement to push out the escaped output, it uses a special syntax using the "@" sign as a shortcut to the call to escape(). He includes the code you'll need to make it work in your ZF install and explain it a bit (including where the real key lies - in stream_popen).
575210
Popular posts from PHPDeveloper.org for the past week:PHP-Coding-Practices.com: How I Turned A Slow Array Sort Into A Quick One Using Quicksort AlgorithmZend Developer Zone: PHP Abstract Podcast Episode 4: Planning ProgrammingWeb Development Blog: Save bandwidth with PHProxy and ip2nationJob Posting: Assembleron Ltd Seeks PHP 5/MySQL/Ajax Developers (Reading, UK)PÃ¡draic Brady's Blog: Complex Views with the Zend Framework - Part 6: Setting The TerminologyThe Bakery: Four New Articles - Load Balancing, Request Info, UUID Behavior & Upload ThumbnailsCommunity News: PEAR Installer version 1.6.0 releasedChristopher Kunz's Blog: Building PHP with cURL and libmysqlclient5DevShed: Working with Prepared Queries with PDO Objects in PHP 5Secunia.com: rPath update for gd, php, php-mysql, and php-pgsql
55523
The latest weekly summary for the PHP mailing lists has been posted over on the Zend Developer Zone. This week, discussions included:  Sandboxed semaphores Focus on *printf [continued] PHP 5.2.1 RC2 and PHP 4.4.5 RC1 It's all in the HEAD  Descriptions of each of the headings are provided, including code and a "short version" for those on the run.   Be sure to check back each week for a new summary.
621693
Continuing on from an earlier discussion about the Zend Framework and form submission and handling, Alexander Netkachev has come back to talk a bit more about the Controller/Action approach.   I have a few discussions here about the question I opened a couple of days ago:  how the standard form processing is related to the Controller/Action idea and how developers that are creating sites with the standard Folder/Page approach can use Zend Framework's Controller/Action approach.   What came out of the discussions were three points - use the Controller/Action model to your advantage, use your own forms but use RewriteRouter to make them work, or use the Folder/Page mentality instead.
415712
To set things right about a misquote on Slashdot, Zeev Suraksi has posted this long statement mentioning what he really said and a few more personal opinions.   I've just been misquoted on Slashdot, as if I said there are no security problems in PHP itself, and that I instead point my finger only at inexperienced developers. If you read the original article on Heise Security, you'll see that I have not said anything of the sort. [...] I believe this is the belief of most others on the security team, but I'm only speaking on behalf of myself and do not represent them.   He also covers five more points pertaining to the article and the situation:  Where the bugs/problems lie with problems in PHP Why there are security problems in web PHP applications Why the current security level can be partially blamed on the language itself An admission that yes, there are security problems in PHP And the track record the PHP developers have had in fixing these issues  There's much more than just these brief highlights here, so I encourage you to head on over and check out the full post for yourself.   There are some other opinions on the matter from a few others out there too:  cyberlot's blog Zend Developer Zone's post Tony Bibbs' blog
572982
In a new post to his blog today, Matthew O'Phinney dives in to some of the more advanced features that the Zend_Form component of the Zend Framework has to offer.   I've been working on  for the past few weeks, and it's nearing release readiness. There are a number of features that Cal didn't cover in his DevZone coverage (in part because some of them weren't yet complete) that I'd like to showcase.   These additional features include internationalization, element grouping and array support. He looks at each of these, including some sample code where needed, and shows you how they can be useful to you and your ZF application.
14983
Developer.com has a new tutorial posted today dealing with a specific use of one of the more popular PHP frameworks currently, the Zend Framework, and using it to create multi-lingual websites from Jason Gilmore.   Despite my best attempts I'm unable to speak this array of languages, but as a Web developer I wanted to create the most efficient means for hosting a multi-lingual support site, and then work with native speakers to translate the English material. Because the support site runs the Zend Framework, naturally I wondered whether some sort of translation component was available, and sure enough a quick perusal of the Zend Framework website turned up Zend_Translate. In this brief tutorial I'll document how I'm using the Zend Framework to make my website available to the world.   Jason breaks up the article into two main sections - an introduction to using the Zend_Translate component and examples of it in action (including the creation of CSV files to trade out the translations.
540441
Aaron Wormus is back today on the Zend Developer Zone with another in his "Hidden Gems" series. This time, he takes a look at the "Zend Plumbing", those bits of connective code that help you make your Zend Framework applications work.   The functionality that he covers in this article are some of the min parts that a lot of ZF coders use every day and might not know it:  the Zend class (providing a suite of helper methods) built in Wrapper functions:  loadFile loadClass loadInterface isReadable dump exception  the Zend registry  Each of these is briefly described with some sample code for the loadFile, loadClass, exceptions and the Registry to give you an idea of how to use it all. As always, you can check out the Zend Framework website for all the details on each of these functionality bits.
628744
In a a new post to his blog today, Padraic Brady mentions a component of the Zend Framework that's fallen into the wayside in favor of a Zend-sponsored OpenID component, Zend_Service_Openid. Despite this setback, he still plans on helping with its resurrection, maybe just in a different form.   After posting some questions to the mailing list before adding any additional formal proposals, I have learned another OpenID library for the Zend Framework is also in progress within Zend.   The upshot of this, given it's a Zend sponsored library, is that I feel like there's little choice but to abandon my own version of a proposal for the framework. So it's status is "withdrawn" at this moment as is Zend_Service_Yadis, being a linked proposal. The library itself is not being abandoned, far from it as it has always been my intention to release it under a New BSD License and that plan is not wavering.    He talks about some of the thoughts going through his head of the choice that Zend made and how his library approached the OpenID authentication issues.
536363
Matthew O'Phinney has posted the slides from a New York PHP User Group meeting that Mark de Visser (of Zend) and he spoke at:   Mark presented information on Zend's development stack and toolset (which I entirely missed, as I was still in transit), and I came in to give an overview of Zend Framework.   Matthew posted the slides right to his blog. They're in a browser-based slideshow system that will launch wen you double-click on the index file.
66953
Chris Hartjes has posted again about the "rebirth" of a Zend Framework component he's worked on - the Zend_Service_Audioscrobbler.   So, dear readers, I received some nice emails and comments from those you have used Zend_Service_Audioscrobbler, along with having a nice email conversation with Wil Sinclair from Zend.   He still wants to "rip things up and start over", but has decided on a slightly different route - mapping the older function calls to the new ones via a __call catch and including a message stating that the older function call would be deprecated.
397724
Padraic Brady has put together a very comprehensive post on his blog today about using the Zend_Feed component of the Zend Framework to help with the aggregation of content from other sites (like RSS and Atom feeds).   In this entry I explore Zend_Feed from the perspective of someone aggregating RSS and Atom feeds with a view to building a database of uniquely identified content for later presentation in a "Planet" style application. [...] In fact all we create here is a simple command line script to aggregate content frequently (e.g. just set up cron to run it every hour or so) into a database for later presentation.   He guides you through each step of the way:   Setting Up Database And Models The Aggregator Script Foundation Using Zend_Feed to get common data for RSS/Atom entries Putting It All Together   There's plenty of code (and SQL to insert) in the post and he explains each point well, helping to make the development process smoother. There's even a summary section to toss in a few extra bits of information just in case you missed them along the way.
126013
On Dynamically Typed today, there's a new posting concerning the PHP Atom Server.