« first day (1740 days earlier)      last day (3222 days later) » 

2:02 PM
How can I check that a user input (text) fits into a MySQL TEXT-Type field?
 
@chozilla strlen?
Also is there any text that wouldn't fit in it?
Not sure what mysql thinks is TEXT
 
My first though was to use strlen() and not mb_strlen() since TEXT seem to have a byte rather than a actual character length specification.
@PeeHaa encoding?
Does anyone know if i have to check for the actual bytes of the message rather than the string length?
 
@Jimbo Does it actually say your branch is behind, or does it say that your local repo has one item to pull, to be up-to-date with the remote repo?
@chozilla strlen does the bytes, not character length. It's 'safe' to use on binary data, include unknown character sets.
 
@chozilla Bytes, because there's a two bytes length prefix for TEXT columns, so you can save up to 255*255 bytes.
 
@Danack This branch is 1 commit behind master
After clicking PR + Merge buttons on Github
 
2:08 PM
posted on July 22, 2015 by kbironneau

/* by Noctu */

 
@chozilla strlen() counts for bytes, not the characters
 
@iroegbu I don't get what this is supposed to be, presumably it's not the actual .htaccess?
 
@Jimbo public repo?
 
@PeeHaa text is 65k bytes
 
@Jimbo Yes, because it doesn't contain the merge commit yet.
 
2:10 PM
@Danack Noep :(
 
@Feeds Or in other words, "Using a framework"
 
@DaveRandom No, that's not the actual file I'm working on. I just have a lot of redirects similar to that line, about 70 of them...
 
@iroegbu If you show the actual file it might be easier to help
 
So even when I specify the TEXT field to use 4byte encoding, on the php side I check with strlen() to get the text broken up into single byte characters and then it should fit?
 
(in private gist or similar if you like)
 
2:12 PM
@chozilla length of mysql text fields is always intended in bytes, not characters
 
Is a = &b[i]; more optimal than a = b + i; or something?
 
@DaveRandom pastebin.com/FQnnU4Pu I'm frustrated
thanks
 
@chozilla The size of a TEXT field is measured in bytes. It is charset-aware for the purposes of searching and sorting etc, but for storage the charset has no impact, it only cares about the size in bytes
 
Or is it only a question of readability
 
2:16 PM
@iroegbu suggest refactoring the application to use a single front controller and a proper router, that .htaccess is probably a lost cause...
 
thought as much... Thanks.
 
@DaveRandom, @RonaldUlyssesSwanson so strlen() is still useful just not for what the name might indicate ;) - I guess cutting the userstring at exactly n-bytes might result in broken characters. How do i cut the end of the string to have a exact length but have no remaining half-multibyte characters?
 
@chozilla string in php is a byte sequence. why do you want to cut the string to know the length?
 
@chozilla Do you really want to truncate the data? I'd just return an error and let the user shorten the string.
 
@chozilla I think you need mb_strlen and mb_substr
 
2:24 PM
mysql wont store "half characters" if that's what you are asking, will trim the text on the last valid character it fits
 
nevermind ... you talking mysql not php
 
user895378
I'm seeing xdebug not report code coverage for magic __destruct() instance methods ... anyone else observed this (shot in the dark)?
 
@rdlowrey just wondering… are these maybe only called after coverage end? (when cycle collector is run/shutdown sequence initiated)?
 
user895378
@bwoebi That was my first thought but it doesn't report the coverage even when I manually invoke $obj->__destruct() inside the test
 
Tangent, but it definitely shouldn't even be possible to do that
 
2:33 PM
@DaveRandom … for testing, obviously ;-D
 
Yeh but even so, that's the sort of thing that could leave all sorts of stuff in a very unstable state
 
@rdlowrey meh, no idea then. I see nothing obvious why they shouldn't…
 
user895378
Also: debugging segfaults is annoying when they only occur inside the phpunit run and the same code doesn't cause the segfault in a regular non-phpunit script.
 
Can anyone guess what that could be? pastebin.com/4MqNdBuK
 
@DaveRandom +1
 
2:42 PM
@rdlowrey what's the segfault related to?
 
user895378
Actually in this case it's zend_mm_heap corrupted ... it might be an xdebug problem though ... checking now
 
@rdlowrey okay, these usually aren't too easy.
@rdlowrey try running with valgrind and USE_ZEND_ALLOC=0
 
user895378
@bwoebi Actually, yeah. It's an xdebug error. Disappears if I disable xdebug.
 
what it the best php blog to khow about php?
 
@rdlowrey in that case just give up and wait a few hours for perfect 7 coverage^^
 
user895378
2:44 PM
@bwoebi this.
 
Dear Anthony,

I have seen one of your video on Youtube.
I am a Digital Media Anti-Piracy Expert and I would appreciate your expertise on the vulnerability of PHP applications.

Question:
a music pirate site use a PHP application to download mp3.
e.g: xxxxxxxxxx/dl.php?id=46189873
- Is it possible to  hack the code and locate the real server and the full real Uri of the mp3 file?
- How much would it cost me in order you show me how to locate it?

NB: I don't have a particular interest to know the real source location of this example xxxxxxxxxx, it's just an example to know if you wou
2
 
user895378
> Is it possible to hack the code
 
ummmm. yea. no.
 
@ircmaxell I just don't know what to say. I'm out of ideas of troll/sarcasm for that..
 
user895378
You should ask if he also wants to digitally zoom in by a factor of 1000x without pixellation and raster quality loss.
 
2:46 PM
@ircmaxell hahahahahahaha :D
 
@ircmaxell sigh @Fabor stop the spam
 
Hey Anthony, there's this girl... Anyway, can you hack a facebook account for me?
 
user895378
@nikita2206 lulz
 
> the full real Uri
/dat html redirect
 
@nikita2206 you know, facebook frontend is all based on PHP …
 
2:47 PM
Curious, who is YYYY @ircmaxell or doing them a solid by hiding it?
 
@bwoebi so we can contribute some backdoor in the HHVM and hack it
 
@nikita2206 nice idea!
 
Ah, I know!!
@ircmaxell just publish this in your blog/somewhere in the public Internet without scrambling company/person name
fair enough punishment :p
 
no
 
I knew you would say it :(
 
2:49 PM
Self-proclaimed experts are everywhere.
 
user895378
@Fabor I'm sure he's just changing names to protect the innocent ignorant.
 
Guy doesn't sound so innocent. Was curious if it was a real competitor.
 
those "anti-piracy" guys are being too bold last time..
 
@ircmaxell what do you intend to respond?
 
I believe the standard response to such things rhymes with "Duck Cough"
 
2:54 PM
Ugh, it's annoying to me to see that kind of thing. Makes us more legit actual AP guys look like we're on the same level. "Digital media Anti-Piracy Expert"
 
I would ask him if he would kindly drop his title from the signature (since he has no clue) if i help him to understand what his legal possibilities are....
 
423
 
851
 
007
 
423: Locked (WebDAV; RFC 4918)
 
user895378
2:59 PM
@Fabor FWIW you're the only legitimate AP person I've ever encountered.
 
@Fabor What do "legitimate" AP people do?
I didn't realize there was such a thing
 
@ircmaxell if i filter user input page-number of a website with ctype_digit() and do not use any prepare statement and use utf8, is that safe?
 
Well there's facets of Gov't which are budgeted to fight AP.
And with any service that requires people to actually do the work. So companies start up.
 
@NeelIon considering overflow? then yes. But any reason to not use prepared statements?
 
hi all
 
this is my select query
SELECT custId,cust_nm,cust_add,cust_mob,
DATE_FORMAT(cust_marrige,'%d-%m') AS cust_marrige,
DATE_FORMAT(cust_dob,'%d-%') AS cust_dob
FROM cust
WHERE cust_dob like '".$date."%'"
 
@AwalGarg actually ctype_digit is for adding extra security layer. I want to know that how much effective that function is to prevent sql-i
 
i have problem in where condtion
any one tell me where is my mistake
this is value of $date = date('d-m');
SELECT custId,cust_nm,cust_add,cust_mob,
DATE_FORMAT(cust_marrige,'%d-%m') AS cust_marrige,
DATE_FORMAT(cust_dob,'%d-%') AS cust_dob
FROM cust
WHERE cust_dob like '".$date."%'"
 
@NikiC In simple terms a person who owns copyright on content will want a service to send DMCAs and so on on their behalf to protect that content from piracy. That's what AP companies do.
 
@NeelIon Stop
 
3:06 PM
@NeelIon Well the function itself doesn't have anything to do with preventing SQL Injection...
 
@Fabor ugh
 
@NeelIon prepared statement and bound parameters period
 
@PrashantBhatt Don't use string matching, match against the component parts of on the date directly
Also marriage has two "a"s in it
 
@Fabor And by "send" you of course mean "send lots of completely bogus requests based on completely dumb and way too simple heuristics"
 
You can write a constant function which returns the empty string and use it to filter all user input as well... if that's what you want.
 
3:08 PM
@DaveRandom than wat should i do
 
Also there's really no need to abbreviate column names, it isn't 1991 any more
 
@DaveRandom maarige?
 
E_CRAXY_DUTCH
 
@NikiC Negative. Sending false DMCAs is a serious issue. Lawsuits ahoy! We have to be certain of infringing content in order to submit a DMCA
 
@DaveRandom I remember some discussion we had about aliases...
 
3:09 PM
@Fabor You must be the only one
 
:D
 
@PeeHaa if an user is unable to input anything without digit so how a hacker will be able to use sql injection?
 
"Accidentally" sending false DMCAs is clearly not a serious issue
 
Aliases for the purposes of a query are very different to pre-aliasing the column names when defining the table :-P
 
@NikiC We take a lot of pride in what we do. We go through stringent verification processes to ensure our accuracy. Can't speculate on other companies.
 
3:10 PM
@PrashantBhatt WHERE Year(cust_dob) = ? AND Month(cust_dob) = ?
 
@NeelIon Because you will screw it up in some case and 1337haxorz only need 1 entry
 
@DaveRandom ok
let me try..
 
@DaveRandom What is this 1991?
trollololol
 
lel
 
3:12 PM
@PrashantBhatt Sorry, should be WHERE Month(cust_dob) = ? AND Day(cust_dob) = ? but you get the idea
 
@DaveRandom marriage has two ass in it?
 
@Fabor If you take your stuff seriously, that's good. Clearly other AP companies don't. They seem to think checking whether a page contains some words is enough to infringe their precious porn.
 
@NikiC It sounds like you have some particular instance in which you are referring?
 
@PeeHaa i will absolutely use prepare statement, but is that function add some extra layer of security?
 
3:15 PM
Worth noting AP companies only protect content of their clients. Land a big client like "Marvel" you protect all Marvel stuff. Our predominant focus is music.
 
@DaveRandom in or condition i can use for marriage date or not?
 
Which are you can tell means the more clients, the more DMCAs you can send the better you look stats wise. Hence why bigger numbers !== better company for us.
 
TIL that array_map() supports `null` as callback, and it’s not what you’d expect: http://goo.gl/NdQWQo #php
so confusing...
 
@PrashantBhatt Yes, all you are doing is extracting the relevant components of the dates, it doesn't affect the logic in any way
 
@DaveRandom ok thanks
 
3:18 PM
 
@Ocramius Isn't this the documented behavior?
 
@DaveRandom it's work properly thanks again
 
Where Takedown Piracy LLC is sending DMCAs for a GitHub repo containing "wicked" in the name and other such things.
 
anyone have idea about bitbucket
 
3:21 PM
@DaveRandom u have idea about bitbucket?
 
going to a php meetup now. see you guys and girls tomorrow ^^
 
user895378
@chozilla have fun :)
 
@Ocramius wow
 
@ScottArciszewski ancient
 
3:24 PM
I mean, I'm surprised that you discovered PHPs zip function only now!
 
@NeelIon No
 
@PeeHaa thank you for answering my stupid questions :)
 
Not even stupid :)
 
Anonymous
speaking of the whole zip thing.. Why do you need to create a temp file when creating a zip from an array?
 
3:28 PM
@NeelIon Also note that now that you have it in your db you can retrieve it and e.g. display it in a insecure way
 
@NikiC Just poor take down. That'd never happen from us.
 
@PeeHaa oh ya
 
@AwalGarg it is, but basically, according to PHP, null === function () { return func_get_args(); }; in that context
because.
 
@Ocramius well, what did you expect then???
 
user image
9
 
3:36 PM
:P
An error, or the identity function?
 
@Ocramius it… is the identity function?
it returns everything just as it was passed in
 
@PeeHaa does htmlspecialchars() enough to prevent xss attack?
 
@Ocramius you clearly never tried $inversed = array_map(null, ...$array);?
 
Anonymous
@Fabor lol
 
@NikiC turns out the most important feature of vardiadic and unpacking is unpacking… I only rarely need variadics (and func_get_args() would do too easily), but unpacking is really nice to use sometimes.
(and …[&$var] really nicely sneaks references in, especially for __call etc.)
 
user895378
3:43 PM
@bwoebi said no one. Ever.
 
@rdlowrey I said something wrong? :-D
 
user895378
I've never had an actual good use for references outside of test cases.
 
user895378
Is coveralls.io broken or is it just me?
 
@rdlowrey look in Aerys/lib/Body.php at the $cur variable.
 
user895378
@bwoebi okay -- that's basically the exact same way I use it in the test cases I mentioned.
 
3:46 PM
But well, that really just is to circumvent the lack of real closing over of the Closures in PHP.
 
user895378
Speaking of, any progress on your ~> sperm operator RFC?
 
@bwoebi yes, the confusion is with the multiple parameters, which is very confusing for mapping operations as well :)
It is useful, it's just a bit of a WTF
 
@rdlowrey I wait for a good time to push it to internals.
 
@Ocramius It's pretty standard behavior for multimap functions. See also Python for example
 
3:48 PM
@rdlowrey in 6 weeks we'll branch off master, means I'll look at pushing it to internals in like a 2-3 weeks
 
@rdlowrey perhaps.....we should work on the name?
 
@Danack Or use ==>
 
@Danack Officially it's the short Closure operator
but I like how it's colloquially called sperm operator^^
(It wasn't my idea nor intended in any way… but a bit fun never is bad^^)
 
user895378
I'm pretty sure "sperm operator" was my doing ... I hope people know it's just a joke :)
 
3:53 PM
^^
 
@NikiC yar
 
@rdlowrey Well, the "spaceship operator" got through with that being the official name, so... who knows
 
OpenSSL - proud creators of heartbleed and friends. No thanks. — Eugen Rieck 16 mins ago
I'm not sure if I should parse this as sarcasm or sincerity...
 
@NikiC at least other languages called it spaceship too, no?
 
user895378
@ScottArciszewski That kind of comment reeks of "I don't really know anything about what's going on, I just heard about openssl having problems so I'll sound in-the-know by trashing it."
 
3:57 PM
So what does the sperm operator for ??? Do you use if with a DIC to create dependants?
 
@Danack PHP is out of it's adolescent years nowadays and there is no need to throw tantrums to show how it's so "different" from Hack.
 
@rdlowrey There's a definite subtext to your work, DICs and sperm...
 
Speaking of array_map() - what's 137 code?
 
I would prefer the ==> syntax. I meant that the poor choice of syntax in the current RFC is a good distraction for people who instinctively find problems with RFCs to glob onto, so that it can be 'fixed' easily, rather than having them be against just the whole RFC.
 
4:05 PM
posted on July 22, 2015 by kbironneau

/* by Eric */

 
@AlmaDo 137 - 128 == 9 == SIGKILL
 
ah, yep
 
@DaveRandom oooh cool
 
Forgot what to subtract, yep
 
Deprecate the _ (underscore) alias of gettext and make it the "underscore operator" -- $f = $x _ $x * 2;
 
4:07 PM
Strictly it's if ($exitCode & 0x80) { $exitSignalNo = $exitCode & 0x7f; }
 
@Danack genius ^^
 
got it. Sandbox stuff. It's working
$ php -r 'var_dump($z = array_map("array_replace_recursive", $x = [[[&$y, &$x], [&$x, &$y]], [[&$x, &$z], [&$y, &$z]], [[&$z, &$y], [&$z, &$x]]], $y = [[[&$x, &$z], [&$z, &$y]], [[&$y, &$x], [&$z, &$x]], [[&$y, &$z], [&$x, &$y]]]));' 2>/dev/null | wc -l
797464
 
blushes
 
I say _ should be an alias for floor()
 
One more level gives 1305850 - not sure why it's not recognizing it earlier, but that doesn't matter
 
4:10 PM
@Danack The only danger is that instead you'll start a religious bikeshedding war instead...
 
So long as Bob doesn't get involved in that....it would likely have the effect of tiring his opponents out while they beat each other up....
 
@AlmaDo that looks… fun?!???! wtf…
@Danack (shuuuut uuuup ^^)
 
user895378
I say aliases should go away completely.
 
@rdlowrey I agree, provided that signature proxies are introduced for functions that were written by the drunk and careless.
 
4:19 PM
hehe
 
*ahem*-array_map-*ahem*
*ahem*-parse_str-*ahem*
 
user895378
I can deal with the inconsistent parameter ordering ... it's the ugly by-ref params and signatures with umpteen arguments that drive me nuts.
 
@rdlowrey I can't tolerate either.
Probably the former moreso than the latter, actually.
(needle, haystack), (collection, predicate)
 
user895378
I can't figure out how to reproduce this xdebug error in a regular script outside of phpunit ...
 
I can't figure out how to reproduce.
22
 
4:27 PM
@rdlowrey why do you try to?
 
user895378
@bwoebi I'd like to pass along a bug report to Derrick if I can.
 
@rdlowrey I've just completed the PHP 7 coverage… just try that instead then.
[don't forget to fetch newest master if you want to try it…]
 
125
Q: Which 2015 technologies were correctly predicted by Back to the Future II?

PraxisThis year is not only the 30th anniversary of the Back to the Future  franchise as a whole, but is also the year in which Back to the Future II  is set. Which technologies that exist in 2015 (at least as prototypes) were correctly predicted by Back to the Future II ? To clarify, I am looking ...

 
@Ocramius key: in that context
 
^^ May be old news, but a good read
 
4:33 PM
Like we have functions with default parameters... so I am not sure why you find it surprising.
 
user895378
@bwoebi remind me which switch I need for phpdbg when I --disable-all?
 
user895378
Nevermind: --enable-phpdbg
 
4:48 PM
named parameters where shot down right?
 
nevermind ... I found it.
I wish call_user_func_array assigned parameters by name if given an associative array.
 
@Orangepill I don't think they were proposed for 7.
 
I found the 5.6 proposal but it doesn't look like it ever got out of draft.
 
Yeah, we agreed that we rather shouldn't have them in PHP
 
5:05 PM
 
I've seen worse
It drives me bonkers when people use eval for stuff like that. Even more bonkers than just using eval in general. Because what's the point?
 
@Orangepill It's all fun and games until someone injects a bad argument in there. Then it's just games
 
@rlemon that rainbow text thing is pretty amazing
 
5:26 PM
I'm sure there exists out there a problem that can only be solved with eval but I haven't run across it yet.
 
Orangepill: Any problem that eval claims to solve can be solved by creating, include()ing, and then unlinking a file... all from within a function that can't touch the other local variables in the function/method that called it ;P
I call it a marginally sandboxed eval()
(also, if anyone is actually crazy enough to do this, use a ramdisk)
 
@ScottArciszewski you can also include from a user defined stream... but all of that is just wolf in sheeps clothing... it's eval but without the keyword
 
yep :P
there are some ugly ways you can do it
 
@PeeHaa awww tanku
 
a caching autoloader (memcached + eval() with an include fallback) is a neat idea
but if reading php scripts from the filesystem is your bottleneck, congrats
 
5:33 PM
@rlemon :)
 
Too bad ff has no clip text
 
hi guys. Just trying to execute a curl command on git bash
 
@scott I had a toy project that was using a custom stream wrapper to include a template file as the body of a closure
 
but it does not give any response
 
5:38 PM
@rlemon I don't even know what an FF is...
Although chrome is also acting like a moron lately
 
@rahulserver add a -v in there to get more info on what is happening
 
@Orangepill thanks.
let me try
ahh http status 400
thanks a lot @orangepill
you saved a lot of effort!
 
no problem
 
@PeeHaa Fire..Fox?
 
5:45 PM
Never heard of it ;)
 
hello
 
not surprised. it is a sub-par browser that pretends like it is 'modern'
 
how to count duplicate values and echo that values which is in database using php mysql
anyone know
hi PeeHaa
 
that question is too broad @madu
 
6:00 PM
lol
 
then how to print that values in php
 
print fn?
 
write your code here codepad.viper-7.com/iqbc5q
@iroegbu
and me the new link
 
don't use mysql_query learn about PDO or MySQLi
 
ok thats the old project we cant change all files to mysqli
its has 100 of files
what my questing is we have cars
 
6:12 PM
also, examples on this page
 
i am working on taxi projects so one driver will have mini car and another driver will have same mini driver so i want to count duplicate values
and print
 
@RonaldUlyssesSwanson Socket Transmitted Document
 
all car types are inone column driverprofilescartype
 
23 mins ago, by Orangepill
@madu https://dev.mysql.com/doc/refman/5.1/en/counting-rows.html
 
6:19 PM
not working
@iroegbu
i am getting only value at once
 
> not working
means nothing
 
i have 1 numbers for 7 colums
but its showing only 1
SELECT driverprofilesdevicetype FROM driverprofiles GROUP BY driverprofilesdevicetype
i used like taht
 
if SELECT COUNT(*) ... returns 1 then, there's only 1 row returned by your query
 
but
i want to count the duplicate values
 
write your query as normal then use COUNT() to count
 
6:24 PM
how i used use like this select count(driverprofilesdevicetype ) from driverprofiles where
driverprofilesdevicetype >0
is it write
i want to get if the value more than one
i want to get values which is same and print the coutn value
@iroegbu
but not working
 
So it's the joke about the programmer which got out with a hot chick
 
i got it
 
^^ the hot chick, the joke or the code?
 
but how to print
i run the script in phpmyadmin
how to get the value in php
 
Do you know any setter DI Resolver ?
 
6:30 PM
@VeeeneX like this
 
@iroegbu i used like this
 
Oh God Auryn does everything....
 
but its not should count value
@iroegbu
 
@madu Please use PDO
 
@VeeeneX Actually it doesn't do scopes/contexts - but that's a good thing.
 
6:31 PM
its not should count value
 
17 mins ago, by iroegbu
also, examples on this page
do you open any of the pages at all?
 
@Danack What scopes do you mean? Sorry I'm still new :D
 
yes mysql query is working in phpmyadmin then how to write in php
 
Tom
Is anyone here familiar with twilio?
 
6:34 PM
@Danack Mine is instantiation context aware...
I think it's a good thing.
 
@Danack So it will be done via comment, right? Wau interesting, this should be included in PHP!
 
"this should be included in PHP" - ......no.
 
I mean Auryn should be included in PHP
 
user895378
I've been down the context-aware dic route and I just don't think it's a tradeoff worth making ...
 
Why?
 
6:35 PM
@rdlowrey Really? I haven't done exhaustive perf tests, but I don't think mine is unusable.
The implementation is also... easier? Save for cyclic dependency checks.
I just don't check for them :-}
 
user895378
I don't care about perf. I just don't think an injector should be that complicated -- I'd rather it not be able to do all the things.
 
@rdlowrey I'll link you a 0.1 once I have it sorted, would be very keen on your feedback
 
user895378
But it's definitely more of a preference than a right/wrong thing.
 
What about to make an extension of it in C? Then it can gain speed...
 
Well, when I say context I mean:
Foo : instance of Foo
Foo > Bar : instance A of Bar
Bar : instance B of Bar
Instantiating Bar will give you B unless it's a dependency of Foo when you'll get A
@rdlowrey ^^
I solved it with recursion rather than path-stacks, but meh. Big traces look more enterprisey when shit breaks.
 
6:40 PM
So I can understand would a Session Scoped injector request attempt looking in the users' session for a serviceable dependency prior to creating and returning one
 
@Orangepill Presumably........but tbh the whole thing is just really hard to figure exactly what should happen.
 
user895378
I can't think of a good reason why you'd want to store anything other than scalar data in a session
 
@rdlowrey I think it's not so much that, it's that i) They're using it in a background task thingy, which also has access to sessions ii) the task runs continually and processes lots of requests iii) their DIC is already 'SessionAware' and so it's really easy for something to get accidentally access one session from an inappropriate request.
e.g. setRequest in here
 
concept seems interesting ... but you can accomplish roughly the same thing with a delegate now right... factory pulls information out of the supplied session and makes a session relevant instance
 
Wau, that's a lot of code :D
 
6:48 PM
Also known as a big ball of shite that violates the guide of stateless services. Which is an easy problem to solve if you have actual control over your code, and can just do the scopes/contexts programatically
 

« first day (1740 days earlier)      last day (3222 days later) »