Downloaded 38 times
![Filter library examples $email = filter_input(INPUT_POST, 'name', FILTER_VALIDATE_EMAIL); $age = filter_input(INPUT_POST, 'age', FILTER_VALIDATE_INT); $url = filter_input(INPUT_COOKIE, 'url', FILTER_VALIDATE_URL); $raw_msg = filter_input(INPUT_POST, 'msg', FILTER_UNSAFE_RAW); $options = array('options'=> array('min_range'=>7, 'max_range'=>77)); $age = filter_input(INPUT_POST, 'age', FILTER_VALIDATE_INT,$options); filter_has_var(INPUT_POST, 'submit') is same as isset($_POST['submit'])](https://image.slidesharecdn.com/phpbestpractices-091031140123-phpapp02/75/Php-Best-Practices-37-2048.jpg)
Php Best Practices
- 1. PHP Best PracticesBangalore PHP Users Meetup 31 st October 2009 http://www.meetup.com/Bangalore-PHP-Users
- 2. Overview About thistalk Coding Standard Documentation Sub Version General Practices
- 3. About this talkCommon good practises for coding PHP Tips for clean PHP code How to avoid common mistakes Tricks and Tips Tools to ease your work
- 4. Use a CodingStandard
- 5. Why use codingstandard? Consistency Readability Maintainability Collaboration
- 6.
- 7. Learn from othersDon’t invent your own standard. All the issue has been debated to death. Use an established standard Stick to an standard you establish, don’t mix
- 8. What choices exist?PEAR Coding Standards http://pear.php.net/manual/en/standards.php Zend Framework Coding Standards http://framework.zend.com/manual/en/coding-standard.html eZcomponents Coding Standards http://ez.no/products/ez_publish/documentation/development/standards/php
- 9. Some Zend Frameworkstandards Derived from PEAR standards One class, one file Underscore in class name map to directory separators: Zend_Controller_Action: Zend/Controller/Action.php
- 10. Some Zend Frameworkstandards Naming conventions: Class name are MixedCase – Zend_Pdf Method name are camelCase - filterInput() Constants are ALL_CAPS – SET_TIME Properties and variables are camelCase Private and protected member are _underscorePrefixed
- 11. Some Zend Frameworkstandards Layout Conventions: No closing ?> tag for files containing only code Indentation: spaces only, no tabs;4 spaces per level of indentation No shell style comments(#) Keep lines no more than 75-80 characters long
- 12.
- 13. Any tool tocheck coding standards? PHP_CodeSniffer is one such tool: PHP_CodeSniffer is a PHP5 script that tokenises and "sniffs" PHP, JavaScript and CSS files to detect violations of a defined coding standard. Your own coding standards. Subversion integration http://pear.php.net/manual/en/package.php.php-codesniffer.php
- 14. PHP_CodeSniffer Example Defaultuses PEAR style coding standard
- 15.
- 16.
- 17. Documentation Documentation isthe most boring work Don't have time!
- 18. Documentation You don’thave time to code? Re-read your code 6 month after you wrote it! Think about people who have to use your code Code should communicate its purpose The better the names, the fewer comments.
- 19. What choices exist?Source Documentation phpDocumentor http://phpdoc.org Doxygen http:// www.stack.nl/~dimitri/doxygen / End User Documentation DocBook http://www.docbook.org/
- 20. Documentation phpDocumentor Derivedfrom Javadoc, written in PHP. phpDocumentor tags are the most used standard for generating documentation from php source code Other documentation generators, such as Doxygen, support these same tags. Don’t invent your own tags. Supported by a number of different IDEs. Zend Studio is perhaps the most prevalent. Command line or web interface. Not only HTML, but also .chm or PDF
- 21.
- 22.
- 23.
- 24.
- 25.
- 26. Why do Ineed it? How do i know if somebody did something? How do others know i did something? How do i get my updates from others? How do i push my updates out to others? Do we have the old version? What changed?
- 27. What choices exist?Distributor Source Control: Developers works on their own repositories and share changesets Git Darcs Arch Non-Distributed Source Control Developer work on local checkouts, and check in to a central repository Subversion
- 28. Please enter commitmessage
- 29. General Practices EssentialINI Settings My Top Two PHP Security Practices
- 30.
- 31. Set magic_quotes =Off There are three php.ini settings that relate to magic_quotes: ; Magic quotes ; ; Magic quotes for incoming GET/POST/Cookie data. magic_quotes_gpc = Off ; Magic quotes for runtime-generated data, e.g. data from SQL, from exec(), etc. magic_quotes_runtime = Off ; Use Sybase-style magic quotes (escape ' with '' instead of \'). magic_quotes_sybase = Off Example:- “This is my code’s string” gets converted to “This is my code\’s string”
- 32. Set error_reporting =E_ALL | E_STRICT STRICT messages will help you to use the latest and greatest suggested method of coding, for example warn you about using deprecated functions. Available since PHP 5.0 Production: display_errors = Off log_errors = on error_log = path/logs/php_error.log
- 33. Set short_open_tag =0 If you want to use PHP in combination with XML, you can disable this option in order to use <?xml ?> inline. Otherwise, you can print it with PHP, for example: <?php echo '<?xml version="1.0"?>'; ?> Safe to use <?php ?> tag Might be deprecated, But no news yet on php.net Good practice is to use <?php ?> tag
- 34. No direct accessto the php.ini Use htaccess directive: php_flag php_flag is reserved for boolean values, like register_globals and magic_quotes_gpc. example:- php_flag register_globals Off php_value php_value for things that are not boolean, like error_reporting and error_log. example:- php_value error_log /var/www/logs/php_errors.log
- 35. My Top TwoPHP Security Practices Top Two PHP Security Practices, expressed in four words: Filter input Escape output - Chris Shiflett
- 36. Filter Input Don'ttrust external data, The rule #1 of every developer Should be "Filter All Foreign Data" With the delivery of PHP 5.2.0, this got a lot easier, because PHP included, by default, the Filter library. Manual - http:// www.php.net /filter Downloads - http://pecl.php.net/get/filter Filter homepage - http://pecl.php.net/filter
- 37. Filter library examples$email = filter_input(INPUT_POST, 'name', FILTER_VALIDATE_EMAIL); $age = filter_input(INPUT_POST, 'age', FILTER_VALIDATE_INT); $url = filter_input(INPUT_COOKIE, 'url', FILTER_VALIDATE_URL); $raw_msg = filter_input(INPUT_POST, 'msg', FILTER_UNSAFE_RAW); $options = array('options'=> array('min_range'=>7, 'max_range'=>77)); $age = filter_input(INPUT_POST, 'age', FILTER_VALIDATE_INT,$options); filter_has_var(INPUT_POST, 'submit') is same as isset($_POST['submit'])
- 38. With properly filteredinput, you're already pretty well protected against malicious attacks. The only remaining step is to escape it such that the format of the input doesn't accidentally interfere with the format of the SQL statement. INSERT INTO MyTable (MyColumn) VALUES ('My Dear Aunt Sally's Picnic Basket') Escaping Output
- 39. Escaping Output Usededicated escaping function provided by the database interface: MySQL mysql_real_escape_string() PostgreSQL pg_escape_string() pg_escape_bytea() SQLite sqlite_escape_string() Other databases ADOdb, qstr function - http://adodb.sourceforge.net/ PEAR, quote function - http://pear.php.net/ http://shiflett.org/blog/2006/jan/addslashes-versus-mysql-real-escape-string
- 40. Questions? Thanks foryour attention
- 41. Contact Slides willbe on slideshare http://slideshare.net/ansarahmed Contact options Email:ansarahmed8@gmail.com/ansarahmed_8@yahoo.co.in Blog: http://ansarahmed.blogspot.com Follow me on twitter: @ansarahmed @phpbangalore