Wicked Cool PHP: Real-World Scripts That Solve Difficult Problems

220 Pages·2008·5.226 MB·English

by  William Steinmetz, Brian Ward

7766 TTIIMMEE--SSAAVVIINNGG,,
WW II CC KK EE DD CCOO OO LL
PPRROOBBLLEEMM--SSOOLLVVIINNGG
PPHHPP SSCCRRIIPPTTSS
WW PP HH PP
II
CC
PHP is an easy-to-use scripting language perfect for • Harness SOAP and other web services
quickly creating the web features you need. Once you R E A L - W O R L D S C R I P T S T H A T S O L V E
• Create an online poll, e-card delivery system, KK
know the basics of how the language works, wouldn’t it
and blog D I F F I C U L T P R O B L E M S
be great to have a collection of useful scripts that solve
those tricky problems and add interesting functionality But it’s not all fun and games. Security is a big concern EE
to your site? We thought so, too. when programming any web application, so you’ll learn
how to encrypt your confidential data, safeguard your DD W I L L I A M S T E I N M E T Z W I T H B R I A N W A R D
Instead of starting at “Hello, world!”, Wicked Cool PHP
passwords, and prevent common cross-site scripting
assumes that you’re familiar with the language and jumps
r—yiogtuhhrte wi nma tooys ttth hcreoo muggomhoo dsn mlsytau wrftf .ic sAhoefntdefigr-f ouyrroa uPti HolePna srocnpr ittpihoetsn —sF AayQnodus ’ltolh fwe l ioaferrkt asDctytrainpcatksms t.io cA fwnitd ey boy uocruo ’olnlw tleenna tnr nde oehdeossw.n ’tt oh acuvset otom ibzee dailfl foicfu tlht.e C C C O VV EE RR SS IPO HN PS 6
of forms, all the way to complex database-backed scripts. Learn the secrets of the craft from two experienced OO 5 A n d

PHP developers with Wicked Cool PHP.
Wicked Cool PHP contains a wide variety of scripts
OO
to process credit cards, check the validity of email ABOUT THE AUTHORS
addresses, template HTML, and serve dynamic images
William Steinmetz is the author of LAN Party: Hosting
and text. The 76 easily implemented scripts will also LL
the Ultimate Frag Fest (Wiley) and co-author of Paint
teach you how to:
Shop Pro for Dummies (IDG). He is the webmaster
• Send and receive email notifications and editor of StarCityGames.com, where traffic has PP
quadrupled as a result of the changes he designed
• Track your visitors’ behavior with cookies and
and implemented, all using PHP. HH
sessions
Brian Ward is the author of How Linux Works, The Book
• Override PHP’s default settings
of VMware, and The Linux Problem Solver (all from No PP
• Manipulate dates, images, and text on the fly Starch Press).
W S
I T
T E
H I
THE FINEST IN GEEK ENTERTAINMENT™ $29.95 ($32.95 CDN) W NM
A E
w w w . n “oIs LtAaYr cFhLA.cT.o”m LANGUAGES/PHPPROGRAMMINGSHELVE IN: RD TZ
®
This book uses RepKover—a durable binding that won’t snap shut.
Printed on recycled paper
www.it-ebooks.info
www.it-ebooks.info
WICKED COOL PHP
www.it-ebooks.info
www.it-ebooks.info
WICKED COOL PHP
Real-World Scripts That
Solve Difficult Problems
by William Steinmetz
with Brian Ward
®
San Francisco
www.it-ebooks.info
WICKED COOL PHP. Copyright © 2008 by William Steinmetz with Brian Ward.
All rights reserved. No part of this work may be reproduced or transmitted in any form or by any means, electronic or
mechanical, including photocopying, recording, or by any information storage or retrieval system, without the prior
written permission of the copyright owner and the publisher.
Printed on recycled paper in the United States of America
12 11 10 09 08 1 2 3 4 5 6 7 8 9
ISBN-10: 1-59327-173-5
ISBN-13: 978-1-59327-173-2
Publisher: William Pollock
Production Editor: Megan Dunchak
Cover and Interior Design: Octopod Studios
Developmental Editor: Tyler Ortman
Technical Reviewer: Scott Gilbertson
Copyeditor: Linda Recktenwald
Compositor: Riley Hoffman
Proofreader: Jeanne Hansen
Indexer: Karin Arrigoni
For information on book distributors or translations, please contact No Starch Press, Inc. directly:
No Starch Press, Inc.
555 De Haro Street, Suite 250, San Francisco, CA 94107
phone: [phone]; fax: [phone]; [email protected]; www.nostarch.com
Library of Congress Cataloging-in-Publication Data
Steinmetz, William.
Wicked cool PHP : real-world scripts that solve difficult problems / William Steinmetz and Brian
Ward. -- 1st ed.
p. cm.
Includes index.
ISBN-13: 978-1-59327-173-2
ISBN-10: 1-59327-173-5
1. PHP (Computer program language) I. Ward, Brian, 1972- II. Title.
QA76.73.P224S74 2008
005.13'3--dc22
2005033702
No Starch Press and the No Starch Press logo are registered trademarks of No Starch Press, Inc. Other product and
company names mentioned herein may be the trademarks of their respective owners. Rather than use a trademark
symbol with every occurrence of a trademarked name, we are using the names only in an editorial fashion and to the
benefit of the trademark owner, with no intention of infringement of the trademark.
The information in this book is distributed on an “As Is” basis, without warranty. While every precaution has been
taken in the preparation of this work, neither the author nor No Starch Press, Inc. shall have any liability to any
person or entity with respect to any loss or damage caused or alleged to be caused directly or indirectly by the
information contained in it.
www.it-ebooks.info
B R I E F C O N T E N T S
Introduction.................................................................................................................xiii
Chapter 1: The FAQs of Life—
The Scripts Every PHP Programmer Wants (or Needs) to Know.............................................1
Chapter 2: Configuring PHP...........................................................................................19
Chapter 3: PHP Security.................................................................................................33
Chapter 4: Working with Forms......................................................................................45
Chapter 5: Working with Text and HTML.........................................................................59
Chapter 6: Working with Dates......................................................................................81
Chapter 7: Working with Files........................................................................................91
Chapter 8: User and Session Tracking...........................................................................103
Chapter 9: Working with Email....................................................................................119
Chapter 10: Working with Images................................................................................129
Chapter 11: Using cURL to Interact with Web Services ...................................................141
Chapter 12: Intermediate Projects.................................................................................155
Appendix...................................................................................................................183
Index.........................................................................................................................185
www.it-ebooks.info
www.it-ebooks.info
C O N T E N T S I N D E T A I L
INTRODUCTION xiii
1
THE FAQS OF LIFE—THE SCRIPTS EVERY
PHP PROGRAMMER WANTS (OR NEEDS) TO KNOW 1
#1: Including Another File as a Part of Your Script .......................................................2
What Can Go Wrong? ...............................................................................3
#2: Highlighting Alternate Row Colors in a Table .........................................................4
Hacking the Script .......................................................................................5
#3: Creating Previous/Next Links ...............................................................................7
Using the Script.........................................................................................10
#4: Printing the Contents of an Array ........................................................................11
#5: Turning an Array into a Nonarray Variable That Can Be Restored Later ..................12
What Can Go Wrong? ..............................................................................12
#6: Sorting Multidimensional Arrays.........................................................................13
Hacking the Script .....................................................................................14
#7: Templating Your Site with Smarty .......................................................................14
Installing Smarty ........................................................................................14
A Brief Smarty Tutorial ..............................................................................15
What Can Go Wrong? ..............................................................................16
Hacking the Script .....................................................................................17
2
CONFIGURING PHP 19
Configuration Settings and the php.ini File ................................................................20
Locating Your php.ini File ...........................................................................20
#8: Revealing All of PHP’s Settings ...........................................................................21
#9: Reading an Individual Setting ............................................................................21
#10: Error Reporting ..............................................................................................22
Common Error Messages ...........................................................................23
#11: Suppressing All Error Messages .......................................................................24
#12: Extending the Run Time of a Script ...................................................................24
What Can Go Wrong? ..............................................................................25
#13: Preventing Users from Uploading Large Files .....................................................25
#14: Turning Off Registered Global Variables ...........................................................25
#15: Enabling Magic Quotes ..................................................................................26
What Can Go Wrong? ..............................................................................26
#16: Restricting the Files that PHP Can Access ..........................................................26
What Can Go Wrong? ..............................................................................27
#17: Shutting Down Specific Functions .....................................................................27
#18: Adding Extensions to PHP ...............................................................................27
Adding PHP Extensions ..............................................................................28
Installing Extensions with a Web-Based Control Panel ....................................29
What Can Go Wrong? ..............................................................................32
www.it-ebooks.info
3
PHP SECURITY 33
Recommended Security Configuration Options...........................................................35
#19: SQL Injection Attacks .....................................................................................35
#20: Preventing Basic XSS Attacks ..........................................................................37
#21: Using SafeHTML ............................................................................................38
What Can Go Wrong? ..............................................................................39
#22: Protecting Data with a One-Way Hash .............................................................40
Hacking the Script .....................................................................................41
#23: Encrypting Data with Mcrypt ...........................................................................41
Hacking the Script .....................................................................................43
#24: Generating Random Passwords........................................................................43
Using the Script.........................................................................................44
4
WORKING WITH FORMS 45
Security Measures: Forms Are Not Trustworthy ...........................................................45
Verification Strategies .............................................................................................46
Using $_POST, $_GET, $_REQUEST, and $_FILES to Access FormData .......................47
#25: Fetching Form Variables Consistently and Safely ................................................47
#26: Trimming Excess Whitespace ...........................................................................47
#27: Importing Form Variables into an Array ............................................................48
#28: Making Sure a Response Is One of a Set of Given Values ...................................51
Hacking the Script .....................................................................................51
#29: Using Multiple Submit Buttons ..........................................................................52
#30: Validating a Credit Card .................................................................................52
Using the Script.........................................................................................54
Hacking the Script .....................................................................................55
#31: Double-Checking a Credit Card’s Expiration Date ..............................................55
Using the Script.........................................................................................56
#32: Checking Valid Email Addresses ......................................................................56
#33: Checking American Phone Numbers ................................................................57
5
WORKING WITH TEXT AND HTML 59
#34: Extracting Part of a String ................................................................................59
Hacking the Script .....................................................................................61
#35: Making a String Uppercase, Lowercase, or Capitalized ......................................62
What Can Go Wrong? ..............................................................................62
#36: Finding Substrings ..........................................................................................63
What Can Go Wrong? ..............................................................................64
#37: Replacing Substrings ......................................................................................64
What Can Go Wrong? ..............................................................................65
#38: Finding and Fixing Misspelled Words with pspell ...............................................65
Working with the Default Dictionary ............................................................66
Adding a Custom Dictionary to pspell ..........................................................68
What Can Go Wrong? ..............................................................................69
viii Contents in Detail
www.it-ebooks.info