Showing posts with label PHP. Show all posts
Showing posts with label PHP. Show all posts

Thursday, May 24, 2012

When to use array_merge and union operator (+) in PHP?


array_merge

Use array_merge when you want to merge indexed arrays without keys:


Output:


Array Union Operator (+)


Use the union operator when you want to extend an array or override certain key values. A good use case for this is overriding/extending a default settings array with a user defined array (similar to how you would use $.extend while writing a jQuery plugin):


Output:



References


Sunday, December 11, 2011

More love from Shopify

Turns out, apart from t-shirts, open source also pays stickers. The hand-written card is a nice personal touch. It's the little things like this, that go a long way in building a community. Good show Edward my man. Keep it up.




If your a Shopify customer, check out Fliptabify, the easiest way to showcase your products on Facebook and drive traffic to your Shopify store.

Friday, December 09, 2011

Open-source pays t-shirts

Shopify sent me some swag for creating shopify.php, the open source lightweight PHP client for the Shopify API that I built to scratch my own itch. It replaced Shopify's own PHP adapter and is now the officially recommended PHP adapter to use for the Shopify API.




If your a Shopify customer, check out Fliptabify, the easiest way to showcase your products on Facebook and drive traffic to your Shopify store.

Monday, April 25, 2011

Secure (transient) storage of passwords for external APIs that don't support OAuth

My latest project, OboxApps.com, a mobile app suite for LogicBoxes (LB) and Resellerclub (RClub) users, has to deal with the the awkward situation of storing the users credentials to make API calls on their behalf.

Searching turned up some great answers by ircmaxell on how to deal with situations like this:
  1. PHP 2-way encryption: I need to store passwords that can be retrieved
  2. Encoding cookies so they cannot be spoofed or read etc

For increased security, I wanted the storage to be transient (duration of the session) and did not want to store the password on the server. So this is what I came up with:
  • I ask the user for the API credentials over HTTPS.
  • Verify that the creds works by making an API call.
  • Generate a 128 character random salt.
  • Encrypt the password using the random salt with the method used in the Encryption class from answer 1 above.
  • Store the random salt and API username in the session.
  • Send the encrypted password to the client in a secure (HTTPS), httponly cookie.
The API credentials and the encrypted password cookie are transmitted over HTTPS to protect against any kind of sniffing and the httponly property of the encrypted password cookie ensures that client side JavaScript cannot access it through XSS attacks (although it is not supported by all browsers).

Additionally (as suggested by ircmaxell in a private conversation), I could also look at implementing the Secure Cookie Protocol (pdf) for the encrypted password cookie and ensure the salt is sufficiently strong by using a derivation function such as KDF3 on the random salt to prevent or at least curb brute force attacks against the key generator, but I think this is good enough for now.

Monday, July 27, 2009

Renamed Swx to Bombay

Apparently people are using the word Swx to refer to the SWX format (an open-source subset of the SWF format) which has an associated application called SWX PHP that might lead to confusion if I continue calling my project Swx.

Coming up with an alternative name for Swx, for some reason, brought back memories of the time Bombay (the city I live in and a name I loved) was renamed to Mumbai. I was toying around with the idea of calling my project Bombay and liked it a lot, so I went with it.

Friday, July 24, 2009

Routing in Bombay (WIP)

Default routes


Here are some examples that illustrate the default routes I came up with:

Example Request handler function
---------------------------------------
GET / _home()
GET /foo _show()
GET /foo?baz=qux _query()
PUT /bar _save()
DELETE /bar _delete()
POST / _post()
POST /login _login()
GET /users/ users_home()
GET /users/1 users_show()
GET /users/1?baz=qux users_query()
PUT /users/2 users_save()
DELETE /users/2 users_delete()
POST /users/ users_post()
POST /users/poke users_poke()


I chose *_save because it captures both the CREATE and UPDATE semantics of PUT. The other option was *_write() requiring me to use *_read instead of *_show for symmetry but that didn't feel right.

*_query was chosen over *_search and *_filter because its asking semantics is generic enough to be used in many different situation than the locating and removing semantics of the alternatives.

Catchalls


If none of the above handler functions are found, mapper.lib will fall back on the catchall handler functions.

Request fall-back-1 fall-back-2
---------------------------------------------
* /users/1 users_catchall() _catchall()
* /foo _catchall()


Update July 27, 2009: Renamed Swx to Bombay

Thursday, July 23, 2009

Make your time framework, index.php are belong to me!

I've stopped active development on Inertia primarily because developing web applications in it did not feel very PHPish. It felt as if the web application was subservient to the framework instead of it being the other way round.

Inertia was an experiment in how a Resource-Oriented Programming (ROP) Platform would look like and it was an awesome learning experience, but its time to move on.

Sunday, July 05, 2009

Describing Writting your web application using Bombay (take 2)

Scratch that! Screw describing the web application. Just decide for me and tell me what I need to do.


index.php

<?php

require '/path/to/bombay.php';
requires ('mojo');

function _home()
{
echo "Hello World";
}

?>


Trade-off flexibility for minimal cognitive strain and busy work.

Update July 27, 2009: Renamed Swx to Bombay

Friday, June 26, 2009

Describing your web application using Swx (take 1)

Update July 05, 2009: Dropped the idea of describing web applications in favour of minimizing cognitive strain and busy work.
Update June 28, 2009: Added the 4th pattern with default params.


index.php

<?php

require '/path/to/swx.php';
requires ('handlers');

responds_to_requests_like
(
'POST /{handler}',
'/{handler}/[{id}]',
'GET {handler}.example.com:8080 /foobar',
'/.* handler=default,id=1'
);

?>

Sunday, April 12, 2009

Being explicit about "unsafe" function

Update: I've dropped most of the ideas mentioned here.

I'm toying with the idea of prefixing unsafe functions in swx with unsafe_ (example: unsafe_swx_mapper_match). I like how this makes explicit the fact that I'm testing unsafe functions (example: test_unsafe_swx_mapper_match). This is similar to the use of the exclamation (!) suffix in Scheme and Ruby. If this works well, I might do the same in inertia.

Couple of other things you might notice if you haven't done much programming in PHP are the swx in the function names that acts like a namespace for swx and the underscore (_) prefix in some function names (example: _unsafe_swx_mapper_pattern) that marks them as private functions for internal use only.

Monday, July 10, 2006

Random PHP stuff

Here's some random PHP stuff I stumbled upon:

htmlSQL
I had this idea while extracting some data from a website. As I realized that the algorithms and functions to extract links and other tags are often the same - I had the idea to combine all functions to an universal usable class. While drinking a coffee and thinking on that problem, I thought it would be cool to access HTML elements by using SQL. So I started creating this class... SELECT href, title FROM a WHERE $class == 'list'

Nanoweb
Nanoweb is an HTTP server written in PHP, designed to be small, secure, and extensible. ... Thanks to its very modular architecture, Nanoweb can also be used as a framework to develop your own standalone web based applications

PHP "raycaster" 3D renderer
I mentioned recently that I was looking for an interesting PHP project. This evening I remembered an idea I had a while ago to make a 3D renderer in PHP (and if anyone's tempted to ask - "because I can" ). I did a bit of reading on old 3D engines, as I didn't want something modern and slow, and found out that the "raycaster" rendering used in Wolfenstein 3D is ridiculously easy to implement. A few hours later and it's up and running

WinBinder
WinBinder is a new open source extension for PHP, the script programming language. It allows PHP programmers to easily build native Windows applications.


JavaScript interpreters in PHP:
PHP/JavaScript Interpreter
J4P5

Saturday, April 22, 2006

Yahoo unREST

Saying that they use REST is a misnomer. What they actually use is Browserland HTTP.

Case in point:

By default, Yahoo! Web Services return output in XML format. Some, but not all, of the Yahoo! Web Services can also return Serialized PHP. To get output in Serialized PHP format, use the output=php parameter in the request:

http://api.search.yahoo.com/ ImageSearchService/V1/ imageSearch?appid=YahooDemo &query=Madonna&results=1 &output=php


The RESTful way to do this is with an Accept Request header field.

I did point this out to Rasmus during a Web Services BOF at FOSS.in to which he said that it was easier to call it REST than call it HTTP. I don't buy this. A web developer will be much more familiar with the word HTTP (the thingy you see in the address bar of your browser and in the URI I've quoted above from Yahoo!'s own documentation) than with the word REST (an architectural style for distributed hypermedia systems described in a dissertation by Roy T. Fielding).

Now that that's out of my system, I really like what they are doing with PHP, especially this. I'm using Serialized PHP for representations as well in a web application I'm working on using Inertia with the following media type: application/x-serialized-php.

Thursday, March 16, 2006

Tonic

Came across Tonic via Mark's blog. Can't wait to wade through the code! :)

From what I've seen so far, this was very disappointing. I hate templating systems in PHP. PHP is a templating system! Why don't people get this? *sigh*

Man! I gotta find time to work on Inertia. Haven't touched it for a while now but checking out Tonic has got me excited again. :)