« first day (816 days earlier)      last day (4126 days later) » 

1:03 PM
:D
 
user652649
there's a place reserved in hell for the asshole who designed the paypal api
 
@wes I concur
 
@Jasper Hi! How are you doing?
 
@Alex_ios Fine. Debugging some really ugly generated php (you know, that one place where I didn't know how to get things lined out in a good way) but other than that I'm good
 
hey guys, does the <meta name="robots"/> is the same as using robots.txt ?
 
1:19 PM
@Jasper haha. Even I am struggling with my ugly generated code.. lol...
@Jasper Actually I have coded the server side things for my mobile app using php. But now I came to know that it is vulnerable due to the fact that I am using simple mysql queries in my code instead of mysqli or PDO. But I am almost done with my files, but now I have to change these using mysqli.
 
@Badaboooooom Yes, but it's specific to the page where you use it, whereas robots.txt contains site-wide directives
 
@DaveRandom great thanks
 
@Badaboooooom not its different
 
@Alex_ios If you're already escaping things you can move to mysqli (without using prepared statements) almost effortlessly. Prepared statements are a little more work, but nothing too bad either.
 
Hello Friends
any budy use paypal payment gateway
please help me
 
1:25 PM
@Jasper Now actually the original PC site uses mysqli, so it is mandatory to do this too in mysqli. Do I need to have any extra things in my php project in order to make use of mysqli?
 
@wes You have a new rant victim ^^
 
@Badaboooooom loook at this seomoz.org/learn-seo/robotstxt
 
@Alex_ios No, any remotely recent version of php comes with mysqli support. Just use mysqli_* instead of mysql_*
 
@Jasper If you're already escaping things you can move to mysqli (without using prepared statements) almost effortlessly. - unfortunately that's not as true as it could be because people rarely pass there ext/mysql resource around. Which means you either have to make your MySQLi object global and import it into scope (yuck) or re-engineer your architecture to inject it into the right places.
A lot of people seem to think you can basically just replace mysql_ with mysqli_ and it will work, that's not the case.
 
@Jasper I tested with this $check = var_dump(function_exists('mysqli_connect'));
 
1:30 PM
Anyway, if you did that, there wouldn't be much point in the migration - there's more point now that ext/mysql will throw E_DEPRECATED in 5.5, but not much more, it's unlikely to affect most ext/mysql users for at least a couple of years, maybe more. In any case, people who still use ext/mysql are the same people who have error reporting off/very low in dev :S
 
Anybudy help me
 
and echoed $check and it returns on the browser as bool(true)
 
If you don't move towards prepared statements, which involves some real re-engineering, there's really not a lot of point, because it's no more secure and you're not using any of the extended feature set.
 
@DaveRandom error_reporting(E_NONE); // whatever, let's hope this works
2
 
@Lusitanian Ahh yes, the fixed-all-bugs solution.
 
1:32 PM
indeed
 
@DaveRandom I am really unable to get your high technical conversation. So could you please explain me a bit clear than this on how to go with mysqli?
 
@DaveRandom Fair enough. I was passing already passing around an object that abstracted the SQL flavor, so for me changing to mysqli was completely painless. I suppose that was why I felt it was so easy :D
 
@Alex_ios Sorry I've not really been following the conversation, what's your exact question?
 
14 mins ago, by Alex_ios
@Jasper Actually I have coded the server side things for my mobile app using php. But now I came to know that it is vulnerable due to the fact that I am using simple mysql queries in my code instead of mysqli or PDO. But I am almost done with my files, but now I have to change these using mysqli.
10 mins ago, by Alex_ios
@Jasper Now actually the original PC site uses mysqli, so it is mandatory to do this too in mysqli. Do I need to have any extra things in my php project in order to make use of mysqli?
 
@NullPointer I love the Image to CSS converter. Next step, implement transitions to convert .mpg to CSS ;)
Hmm, if that were theoretically possible, which would be larger? The movie, or the hundreds of lines of CSS per frame to generate it?
 
1:38 PM
@Alex_ios OK well first of all, it's no more vulnerable than either of the other two if you do it the right way. The security risk is a very narrow edge-case. However, you should still try to migrate, but you need to learn the API of the new driver first (I recommend PDO, YMMV). What you should concentrate on is understanding why it's potentially more vulnerable, and more importantly learn about SQL injection in general.
 
+1 for PDO, MySQLi is a somewhat convoluted API (imho)
 
Are you using mysql_real_escape_string() properly? Can we see some (short) sample code from your site that performs a database query based on user input?
 
D'oh, found the problem: I had missed the column-name sanatizing when generating my query on one of the field names. However, since it only made the name lowercase, it worked as MySQL is case insensitive on column names. However, the fetched result was an array, of which the keys are case sensitive and as I did use the sanitizing function there, it didn't fetch it correctly...
 
If you understand how and why to escape user input, changing your database driver should be a relatively trivial task - it's just refactoring code.
@Jasper Make all identifier names lower case is the answer to that. Always treat everything as case sensitive and it will work anywhere. As soon as you rely on something being case insensitive you've destroyed portability.
 
@DaveRandom Speaks the truth :) I moved from mysql (was using it for quick development) to mysqli - and now I won't go back simply because the prepared statements are fantastic. No more escaping, it's really really simple!
 
1:46 PM
@Jimbo If you compress the css there may not be much in it. MASSIVE fidelity loss though, and maintaining audio sync would be pretty much impossible.
 
@DaveRandom That was the entire intention, but since the column names were based on user (that is: library user, not end user) input that can be uppercase in other places, I had to do it with a sanitizing function rather than just changing literals. The problem was that because it worked partially, the problem ended up showing up in a really difficult place.
 
@DaveRandom Yeah. I did some search for it. When user tries to insert some apostrophes or something like '1' in the fields, the sql queries take it as a escape, true respectively.
There would be chances of getting the data though the user hasn't entered any valid credentials.
 
@Jasper Just strtolower() everything all the way through. Am I reading it right that you are allowing users to define database identifier names???
 
@DaveRandom Gonna show my snippet.
 
@DaveRandom Yup. I already even have a function that encapsulates the strtolower, which allows me to change the sanitizing process in a single place.
 
1:48 PM
@Alex_ios Wait, an escape? Are you using MSSQL? Or do you mean string terminator?
@Jasper Holy crap dude, never let users define identifier names. Use a relational table to map strings to generic column/table/whatever names of your choosing.
 
@DaveRandom The users that can define database identifier names are library users, in other words the one building a website. Not end users (the ones visiting the site)
 
SELECT [standardsCompliance] FROM [dbo].[rdbms] --no results
 
@Jasper I would still be very surprised if that's the best way to do it.
 
@DaveRandom Nope. I am using mysql. I just said that to let you know that I just did search about the injection.
 
OK cool :-)
 
1:52 PM
@DaveRandom When building a database abstraction layer?
Seems sort of unavoidable to me :P
 
Hard to say further without knowing the specifics.
 
@DaveRandom Can you please look at this
?
 
Hey. I've using cacti system for monitoring and creating graphs. Each graph has a small button - save as CSV. When clicking on that CSV, browser prompts for download for that file. Is there anyway to get content of that CSV from PHP script without downloading that file? Or just download that file in specific directory?
 
@tereško for you:
3
Q: What is the model in MVVM for?

Robert StrauchI have read several articles, tutorials and blog posts about the MVVM pattern. However there is one thing I don't understand. Taking the three "layers": Model View View Model As far as I have understood MVVM the model contains the "raw" data, e.g. a name and address in case of a Student class...

I don't understand MVVM at all.
 
@Jasper Can you too look at my code?
 
1:56 PM
model is the one ching that does not change in all of the MVC-inspired patterns
 
@Alex_ios You aren't escaping $stateid...
 
@Dezigo how is your project?
 
@Alex_ios Seems like your DB_CONNECT class isn't really a class, it's just a function dressed up as a class - you don't use $db anywhere else in the code and you never call any methods, so presumably you've just put a connection routine in __construct()? Also it's things like this that need to be escaped. So you'd do (at worst) $stateid = mysql_real_escape_string($_POST['stateid']);
 
@Oyeme now, i'm working with bootstrap, css/ , nothing interesting
 
@DaveRandom Nice type cast (at worst) $stateid :D
 
2:01 PM
@Oyeme so, what are you doing now?
 
@PeeHaa $a = (drunkard) PeeHaa; $b = (annoyance) Lusitanian;
 
:P
No need for casting there ;)
 
^^ that
 
@Dezigo i'm writing the documentation about the old project.
 
@DaveRandom Basically, the lib user provides a file With a datatype definition that contains a number of lines with on each line a type and a name. From it a php class is generated with getters and setters for each of the properties. It also provides a system through which a class adhering to a certain interface can add functionality to the generated class during its compilation. Using that system, the classes are prepared for a Object/Database mapping.
 
2:04 PM
@DaveRandom At worst?? So, does putting mysql_real_escape_string really solve the sql injection?
 
The idea is that you work very naturally with objects instead of with SQL. If you want I can show you a code sample of how you would use the thing if you want
 
@Alex_ios Yes and no, but for the purposes of this conversation, we'll go with yes (the cases where it doesn't are extremely narrow).
Side note, @all has anyone ever actually had the situation where SQL injection is still possible despite escaping? (even if you never issued a SET NAMES have you ever even used one of the charsets that make it possible?)
 
@Oyeme oh,, is it boring? . I miss hard programming
 
@DaveRandom Okay. Thanks. What about the class(which is not actually a class) that you were talking about? Can you please check it if I pasted it?
 
@Alex_ios I can, but I can also imagine what it will look like without seeing it :-P - and I already know that for the way you code currently works, you might as well just convert it to a standard function (or even just put the code in the global scope of db_connect.php). I imagine you are using it as a global file to hold the connect variables and the connection routine - you should put config and logic in different places.
 
2:10 PM
@Jasper Is this to me?
4 mins ago, by Jasper
The idea is that you work very naturally with objects instead of with SQL. If you want I can show you a code sample of how you would use the thing if you want
 
@Alex_ios Nope, it was a continuation of the message before it, which was to @DaveRandom
 
@Alex_ios , the mysql_* API is by design broken
you should not be sending the logic and data with a single query
 
@Jasper OK so it's a (fairly) one-shot code generation tool rather than something that gets fired up at application run time? In that case it does sound more acceptable than the way I interpreted it at first. Either way, my point about simply normalising the case all the way through still stands - just put a note in your docs that says "all identifiers will be converted to lower case" and it's job done. It's harmless to do so and it forces avoidance stupid practices like using distinct casing.
 
@DaveRandom DB_CONNECT
lol.... My php code is always expected by others. But I can't expect how I would code this...
 
user895378
I wish PHP would introduce a native immutable datastructure like tuples ...
 
2:19 PM
@tereško I didn't get you. Can you please explain me in detail on this ?
8 mins ago, by tereško
you should not be sending the logic and data with a single query
 
@DaveRandom Yep. I intend to do Just-In-Time Compiling (though I'll possibly disable compiling all together when in "production mode"). I prefer to allow case for class and Property name, so it'd be only for the sql that it's lowercased. Which is what I was already doing. I just missed a spot (and because MySQL was being kind, it didn't get caught until a much harder place to debug...)
 
@Alex_ios read about prepared statements
 
posted on January 09, 2013 by Liip

Symfony CMF: what is left todo? Just as Fabien did in his "Symfony 2.2 Schedule Update" I would first like to wish everyone a happy 2013. But as Fabien did, I also want to get back to business now too. Over the holidays several people in the community have been quite busy. Especially Emmanuel and Daniel have been pushing things forward. As a result the SonataAdminBundle integration has been i

 
@tereško Nope. :(
 
@Alex_ios OK well the destructor make that a little more sensible/useful than I imagined :-P - but I would remove the constructor so you have to explicitly call connect() and capture the return value so you can pass it explicitly to database function calls (doing this will also make your straight-through conversion to MySQLi considerably easier).
@Alex_ios Never use root to connect to the database in an application. Ever.
 
2:30 PM
@Leigh the Meta suggestion would make providing a URL to the right documentation mandatory if you want to close the question for that reason. It would be like closing as a duplicate, only that the original item is an external link and not a SO question.
 
I have [1, 2, 17] and I have ˙[2 => A, 17 => B, 1 => C]` I need [A, C, B] (values based on keys from values from first array), it's urgent :P
 
@Jasper Class and function/method names are case insensitive in PHP anyway, so if you use getters/setters then case sensitivity is not an issue.
@webarto :-P array_values(array_intersect_key($target, array_flip($search)));
 
@DaveRandom So 1337
 
morning .....
 
@DaveRandom I could, but I don't want to. I also don't think that allowing details of how sql works to influence things so much further down. The idea is that the generating of a php class merely one thing you can do from a datatype file, that making the php class a Storable is only one of the things you can do with the php class and that the SQLStore is only one type of Store (which is an interface for storing Storables)
 
2:40 PM
Morning folks
 
Morning
 
Afternoon @Sharlike
 
Just insert the acceptable greeting for your time zone :)
 
@Jasper Since you are already auto generating code (which I consider a little yuck) you could implement it as __get(), you can just lowercase the prop name and stored the data internally in an array, also with lowercased keys. Bonus of that (since these are objects that represent result sets) is that properties can be made read only by not implementing a write routine with __set()
 
@DaveRandom I feel like I adhered to UGT
even if coincidentally
 
2:47 PM
@Pekka웃 Yea I can see that never working, and becoming a maintenance nightmare as links go dead or functionality changes and the manual no longer reflects the correct answer.
 
guys anyone knows if is possible to disable the preview image in fb,g+ share popup?
or to say that better, "to use a fixed image, not allowing users to choose one"
 
@webarto Ow wait hang on is the ordering significant there?
 
@DaveRandom Generating code is most definitely a little yuck, and once I was doing I have started going a bit overboard with it (eg. my Store and SQLStore are generated so they can have staticly typed returns for the Storable fetching methods ...in php), but I do like the advantages they bring me.
 
@Jasper lol, maybe PHP is not the language for you :-P
 
@DaveRandom I just want keys of the second array ordered as the first one :) (ordered by it) Using two simple loops solves it, I'm just not fluent with plethora of array functions :P
 
2:57 PM
@DaveRandom One of the things that is pretty amazing is how you can say at the compilation stage that you want your generated classes to be Observable, give them an object that knows how to do make them Observable and suddenly they are Observable
 
Why location.reload(); does not work in iPhone Web Apps?
 
@webarto OK well firstly your example output does not follow the ordering of your example input (should be CAB) and secondly your input array should already be in that order if it's indexed, so you could just array_intersect_key(). Have you got some real sample data?
 
@DaveRandom I want to use that technique a lot more than I do now, so for example I have a function that instantiates a javascript object with the same content as the php object which can be added to the generated classes, but this functionality resides in a file that's in a module you don't even have to install if you're not doing an ajax application.
 
guys why does sharing shorten links on facebook doesn't returns a preview ?
omg sorry i'm wrong
 
@DaveRandom I'm sorry, I'm terrible at explaining...
$id = Departments::idsFor(['L1', 'L2', 'L3', 'Sales', 'Billing']);
var_dump($id); # 1 (L1), 2 (L2), 4 (Sales), 5 (Billing), 17 (L3)
$id = Departments::idsFor(['L1', 'L2', 'L3', 'Sales', 'Billing']);
var_dump($id); # 1 (L1), 2 (L2), 17 (L3), 4 (Sales), 5 (Billing)
If you want to retrieve ID based on Name, from database, you will get them back ordered by ID (primary key). I want them back in order as specified.
$results = $query->execute();
foreach($results as $result)
  $_departments[$result->short_name] = $result->id;

foreach($departmentNames as $departmentName)
  $_ids[] = $_departments[$departmentName];

return $_ids;
This works OK, I was just thinking is there a leet way of doing it :)
I'm sure this is covered by some array_ function :)
 
3:08 PM
WTF
 
wat
 
I have no internet at home. Cell internet don't work, cable don't work
I woke up and thought the world had ended...
 
Who said it didn't?
This is all just a dream.
 
@ircmaxell WE ARE ALL DOOMED
 
@ircmaxell hehe
 
3:13 PM
Is there a assertEqualsStrict ?
 
@webarto assertIdentical?
 
@ircmaxell Thanks :) Just to check if order of both input arrays is the same.
 
assertSame?
 
assertIdentical n'existe pas
 
3:16 PM
@webarto Can't you just ksort() it or am I missing something?
 
eigh...
assertSame it is...
 
@DaveRandom Maybe. It's just that if you put a little effort into it you can usually make things statically typed in php, but you're getting into trouble when you need to create objects of generated classes. Maybe I should just make the (SQL)Store non-generated, but I actually prefer the current $store->get<Type>Collection() over guessing what to fetch from an argument (which I am currently even planning on making an optional argument)
 
@Jasper Yeh see even the way you've written that looks sort of like generics, which is very much a statically typed language feature. I'm of two minds about it myself, but a lot of people who (seem to) know what they are talking about will say "just get over yourself and embrace the loose typing"
 
@DaveRandom But I've chosen to write it like generics just because that makes it clear without any further explanation :P
 
3:26 PM
Hello everyone.
 
@Jasper Yeh but it betrays what you really want, which is static typing. Ironically what you want is the least static way to use static typing. I mean PHP is completely generic.
 
Can someone tell me if it is possible with PHP to download an image after clicking a link instead of clicking the link, seeing the picture, rightclick and save as..
 
@Dezigo nice one
 
@Ladineko header('Content-Disposition: attachment; filename="image.jpg"');
 
3:28 PM
@DaveRandom Cheers lad.
 
Does anyone know if a small htaccess can slow the load of a website?
 
@MikeBoutin I dont think so.
 
@MikeBoutin No. Unless your htaccess is a spider web of code
 
@MikeBoutin Theoretically yes. In practice not my very much. htaccess does give the server a lot more to think about though.
 
yes, a htaccess will slow the load
but trivially on a single request
 
3:31 PM
i just check if the IP adresse is one of the 10
 
the effect is more prominent on large scale sites with large numbers of requests per second
The file stat required to see if one exists becomes the limiting factor
 
@DaveRandom The thing is, I get that point and it's probably also what I am going to do in another part of the whole library (collection). However, it actually makes a whole lot more sense to me to do $store->getTopicCollection($condition, $resolver) ($resolver manages ordering and resolving of references) and have $resolver be optional than to do $store->getCollection($condition, $resolver) and end up having to guess what to return from $resolver's type
 
Even if you don't have an htaccess, having AllowOverride set to anything other than none can slow the request down a little.
 
which is why high performance servers like lighttpd and nginx don't use them (by default at least)
 
<IfModule mod_rewrite.c>
Options +FollowSymlinks
RewriteEngine on

RewriteCond %{REMOTE_HOST} !^***\.***\.***\.***
RewriteCond %{REMOTE_HOST} !^***\.***\.***\.***
RewriteCond %{REMOTE_HOST} !^***\.***\.***\.***
RewriteCond %{REMOTE_HOST} !^***\.***\.***\.***
RewriteCond %{REMOTE_HOST} !^***\.***\.***\.***
RewriteCond %{REMOTE_HOST} !^***\.***\.***\.***
RewriteCond %{REMOTE_HOST} !^***\.***\.***\.***
RewriteCond %{REMOTE_HOST} !^***\.***\.***\.***
RewriteCond %{REMOTE_HOST} !^***\.***\.***\.***
RewriteCond %{REMOTE_HOST} !^***\.***\.***\.***
it's my htaccess
 
3:32 PM
@MikeBoutin Via a Require/Allow From directive or mod_rewrite?
Right, mod rewrite
Use Allow From/Require directives (as appropriate to Apache version)
 
i ahve to write deny all before?
is that right
 
mod_rewrite can severely impact performance if not used properly. Minimum 2 iterations (unless your version if new enough that you can use [END])
@ircmaxell Deprecated in 2.4, FYI
 
i want to redirect all who aren't authorized
so do allow from is ok?
 
introduced in 2.1, deprecated in 2.4... Great...
 
3:35 PM
lol
 
@MikeBoutin deny all, then allow the IP addresses you want
 
@ircmaxell but how can i redirect the one's blocked
 
@ircmaxell New unified Require syntax is much nicer though, brings it all into line with other auth methods, which makes sense (to me, at least)
There is a mod_authz_compat module for BC as well
 
@MikeBoutin This would require handling via mod_rewrite I'd say.
 
W00T! I have a minimal forum running on my home made framework. It's very minimal and held together by duct tape in the many places where the framework is still lacking, but still: it's running!
 
3:38 PM
It seems like the header attribute downloads it as soon as the file is loaded... But this is what i have

$s.= '<p><a href="'.$lightboximagepath.'"><img src="/style/download.png" class="downloadimage" /></a></p>';

The <a> tag contains the link to the picture... as soon as its clicked i need to see a download running.
 
@Jasper Hey, congrats!
 
@hakre Thanks!
 
How can i combine the
header('Content-Disposition: attachment; filename="image.jpg"');
with the <A> as a onclick event?
 
@DaveRandom As you know, I'm starting to hate Apache more and more - I've been using nginx for a while personally, but I now consider most of my dayjob working with legacy software
 
@Ladineko You need to send the header with the image file itself, not in the document with the link. If you are linking to the file directly you need to configure the web server to send the header with the file (this can be done with htaccess on Apache)
 
3:43 PM
@DaveRandom I see.... Will check what we can fix for that
 
A programmer had a problem. He thought to himself, "I know, I'll solve it with threads!". has Now problems. two he
4
 
@Leigh In general, agreed. However I do have a sort of affection for Apache, there's a reason it's still serving a large portion of the internet, I do secretly hope that someone will come along who can wrestle the project back under control and make it a viable proposition for competing with the new kids on the block. That f*cking stupid config file must go though, arguably a complete rewrite is what's required.
 
@DaveRandom The reason it's still there is because people don't want the hassle of making sure their apps work under something better, they're happy to chug along with an old version of something horrible.
 
@ircmaxell lol
@Leigh No arguments there, I was more referring to the fact that there is (was) a reason why it got so popular in the first place. They've just lost their way.
 
@ircmaxell How awesome :D
I have decided I am not going to do unit tests, but write tests with 100% coverage using another strategy. Is there a testing framework you guys would recommend?
 
3:57 PM
@Jasper php unit
 
@Jasper you could try behat, but since your focus is still on testing, maybe just stay with PHPUnit?
just because it has Unit in the name does not mean it isn't a general purpose testing tool.
 
@MikeBoutin Might be easier to bin the htaccess completely and do the check/redirect in PHP
 
@DaveRandom Sorry, there was a network issue here.
 
@igorw @Oyeme In the realm of PHP Unit testing frameworks PHPUnit is the way to go over SimpleTest?
@igorw Thanks, I'll check behat out while keeping PHPUnit in mind
 
Anonymous
Why is variable variable $$ is a bad thing?
 
4:04 PM
@Jasper zend2 and symfony2 use php unit for testing.
 
@Alex_ios I've forgotten where we were up to :S
Grrr... bug in ff-cv-pls, no idea what's causing it. Got a nasty feeling it's DOM-closure event handler memory leak, which is going to be very hard to track down :-(
 
2 hours ago, by DaveRandom
@Alex_ios OK well the destructor make that a little more sensible/useful than I imagined :-P - but I would remove the constructor so you have to explicitly call connect() and capture the return value so you can pass it explicitly to database function calls (doing this will also make your straight-through conversion to MySQLi considerably easier).
2 hours ago, by DaveRandom
@Alex_ios Never use root to connect to the database in an application. Ever.
 
Oh right. Well, yes, those things ^^
 
@ircmaxell That's going on our whiteboard, along with the Two Difficult Problems in Software Development: 1) Cache invalidation, 2) Naming things, and 3) Off-by-one errors.
 
No, just it's in local host. That's why. Even to test in the local host, we shouldn't use root? @DaveRandom
 
4:12 PM
@Oyeme those are some strong references indeed
 
@Charles I had a lot: 9 women can't make a baby in a month
1 in a million is next tuesday
Rules of Optimization:
1. Don't Do It!
2. (experts only): Don't Do It Yet!
 
@ircmaxell Totally stealing that one. Gonna put it in big fat red letters on a sign above the three-out-of-four-dead RAID 10 drives I keep on my desk to remind me.
 
@Alex_ios I would say no, if only to get yourself in the habit of setting up users with the correct permissions.
 
Good morning everyone =o). I have a quick question if anyone knows. PHP.net's downloads page has checksums for the source archive files. Since PHP is on GitHub I want to grab the archive file from there, but is there a way to verify it? Previously I had to extract the checksum from the download page.
 
@Charles exactly
 
4:15 PM
Always, for everything, no matter what you are doing and who you think will be using it, start with no permissions and add the required ones. If you leave it open and some haxxor gets in and screws you over, you'll wish you had done it. The trick is to shut the stable door before the horse bolts.
@crypticツ git maintains it's own checksum/data validation system
Commit ids are just checksums of the repo IIRC
 
@DaveRandom so if I download the archive over HTTPS I should be ok from tampering and also potential botched downloads? I don't want to wait 3hrs for it to compile on my shoddy host to find download was bad. =oP
 
@crypticツ Oh right, you mean you're not actually using git but downloading from the github website?
 
@DaveRandom yes
 
Source code? (presumably, since downloads functionality has been burninated :-( )
 
user895378
I've been trying to incorporate some concepts of functional programming into various PHP code, but I'm a little confused. In the absence of state and assuming full referential transparency, would it be a bad thing to new up an object like the following ...
 
user895378
4:21 PM
function parse(ParseState $state = NULL) {
    if (!$state) {
        $state = new ParseState;
    }
    // ...

    return clone $state;
}
 
@DaveRandom I basically have my bash script grab this file or whatever version I want github.com/php/php-src/archive/master.zip unpack it and run compilation on it. But need file validation before compile begins.
 
user895378
^ I'm thinking of something like that because you have to have a starting place, right? The initial state has to come from somewhere?
 
@webarto seems to have forgotten how markdown works.
 
user895378
Or am I not understanding a fundamental concept somewhere?
 
@rdlowrey I call that Lazy Dependency Injection. and I do it all the time
 
4:22 PM
@DaveRandom No, it was just xampp . So, it was by default given username as root. So, I left it as same.
 
@rdlowrey What is the purpose of cloning an object that is about to go out of scope and be destroyed anyway?
 
@Charles because it may not be going out of scope (if it was passed in as a param, for example)... but ideally there would be a better way of handling that
 
user895378
@Charles Since there's no native immutable data structures in PHP you have to fake it ... clone is a nice way to do it if the immutable structure you're using is an object
 
if (!$state) {
    $state = new ParseState;
} else {
    $state = clone $state;
}
 
@rdlowrey why do you to clone the existing object?
 
4:23 PM
@Alex_ios Well yes, every MySQL instance starts with a user called root, which should remain (it's the superuser account). But for every client/application, you should create a new user than only has access to the appropriate db/tables and actions.
 
user895378
I'd really like to see a native immutable structure in PHP like Python's tuples
 
@rdlowrey as would I, but the parser concerns are daunting
 
user895378
@Oyeme I'm experimenting with functional programming concepts ... there shouldn't be any side effects (e.g. state that exists outside the scope of the function)
 
just a way to remove the PHP stress?
 
@DaveRandom Okay. I didn't get this. if you don't mind, can you please explain me this in detial? this statement --> but I would remove the constructor so you have to explicitly call connect() and capture the return value so you can pass it explicitly to database function calls
 
4:26 PM
@crypticツ Right well since that zip comes directly from the repo I don't think you need to worry about it. Theoretically it would be spoofable by hijacking your DNS but it's pretty unlikely - but if there is a way to validate the received data when you do that I am not aware of it. Bare in mind that the checksum you were validating against would also have to be retrieved from GH so would be equally spoofable.
 
@ircmaxell Can you explain why? :)
 
Who is this axel. It seems my name is just gambled. :P
 
@crypticツ The use of HTTP(S) pretty much guarantees your data won't get corrupted in transit because it's based on TCP. As long as you check for download errors and you use a half-way sane HTTP client, you should be safe.
 
@webarto Well, you're still mutating the original object if you don't do it that way ;-)
 
@crypticツ None of this would protect you from MITM attacks, so make sure you are validating the SSL cert.
 
4:30 PM
@ircmaxell The solution to the annotations problem: restrict it to things INSIDE a class only :)
 
@DaveRandom, ok will do, thanks for the info and help! =o) bye all.
 
@Alex_ios Right, so instead of calling connect() in __construct(), remove the __construct() method (or at least remove the $this->connect() line) and make it so that your code does $connector = new DB_CONNECT(); $db = $connector->connect(); - and then later on when you run a query, do mysql_query($query, $db); - like I say if you do this it will make it a lot easier to do a flat migrate to MySQLi because you will have to write your code to ensure that the connection is injected.
 
@LeviMorrison It would make things a LOT simpler
 
The extended solution: remove @ from the PHP language, then add it back in to only mean annotations.
:)
 
@LeviMorrison actually, that's trivial once we move to exceptions instead of dumb errors...
 
4:33 PM
I'm pseudo serious.
We're not ready to do that yet, if ever.
 
user895378
FWIW, I've been playing with inter-process communication using proc_open and the error messages generated by native functions can actually be really helpful when you have a pipe open to read from a process's STDERR stream. I never thought I would encounter a situation in which PHP's error triggering system would make sense to me, but it does there.
 
user895378
^ I feel dirty for even saying that
 
@DaveRandom Okay. Thank you very much for your suggestions. I am off. Have to leave. See you later.
 
As for other annotation symbols: use *
 
@all Cya later.
 
4:37 PM
*Foo([1,2,3]);
 
@rdlowrey you should
@LeviMorrison as am I...
 
After all, * is an annotation symbol . . .
 
@LeviMorrison To denote what sorry? A replacement for @?
 
@DaveRandom People don't like @ for annotation because it's difficult to distinguish between an annotation and a suppression of an error.
Personally I don't have much use for annotations outside of a class declaration, and ass such it would cause no problems.
It does cause problems when outside of a class declaration though.
 
Yeah, if we limited it to just methods, it would be trivial to implement
dam, functions ruin everything
 
user895378
4:40 PM
And then there are people who hate error suppression AND hate annotations. I've been advocating for the removal of @ (\x40) from ASCII 2.0, but no one ever listens.
 
Are we talking about a built-in annotation parser for php? Has that been revived?
 
@MikeB The discussion has been revived, yes.
I have the feeling that yet again it will die only to be brought up in a year or two.
@rdlowrey :)
 
guys how to protect directory with user and pass?
htaccess?
 
@Badaboooooom Probably not
 
htpasswd
 
4:44 PM
how so?
oh great
thx
 
user895378
I blame Apache for making people think it's a good idea to spread application logic between their actual code and their webserver text configuration files.
 
htaccess auth is crappy, it takes pretty much all of the control away from PHP, people end up buggering about with exec() just to change a password.
 
@LeviMorrison Exciting - who do I have to bribe to move things along :D
 
Even if you are just going to use basic auth, implement it in PHP ffs, it's not hard.
 
i created a .htpasswd and putted inside this myuser:$apr1$5rPP6rZD$.LhJk992VikgZofSia.x1/
but i'm using nginx
not apache
 
4:48 PM
@Badaboooooom OK so the .htaccess option is out anyway. See the link I posted.
 
uhm need php no other way? :P
no simple separated file ? :P
 
user895378
5 mins ago, by rdlowrey
I blame Apache for making people think it's a good idea to spread application logic between their actual code and their webserver text configuration files.
 
Aren't you using PHP anyway?
@rdlowrey +1
 
yep but i need to edit the index.php file of my application :/
i was looking for a-side solution
:P
 
@MikeB Awww you spoiled the fun. If you don't tell them, they'll never know it's possible to Do It Wrong™ in nginx as well :-(
 
user895378
4:53 PM
@DaveRandom IMHO it's similar to using stored procedures with your DB instead of putting the relevant logic into your domain model code. Will you get a slight performance boost from storing the logic at the DB level? Maybe. But is maintenance way easier if your application logic only exists in your application? Definitely.
 
@MikeB thanks man
oh guys about unix chmod
is this ok?
chmod -R 775 myfolder
?
 
user895378
Your application should encompass all of the logic needed to make it function. You shouldn't need to "denormalize" that into the web server level and database persistence level except in the most extreme performance environments ...
 
@rdlowrey Agreed. It has really annoyed me in the past that you can't invoke an external script or do IPC with triggers in the most popular RDBMSs without a load of buggering about. Although I guess even that is subbing the logic out to the DB.
 
@Badaboooooom If you are going to go down that route you should use wiki.nginx.org/HttpAuthDigestModule instead
@Badaboooooom OK in what respect? It's a valid command that should work (although I kinda doubt you want to set the execute bit on every file in a directory) but in what context should it be "OK"?
 
5:27 PM
Rasmus, Derick and Julian agree fully with my point, and Stas argues it...
 
@ircmaxell I can never remember how to login to the php.net site to delete user comments.
 
reaffirms my reply that he's being an asshole (still in draft)
 
Help?
 
posted on January 09, 2013 by Anthony Ferrara

This week, we're going to talk about the topic of Dependency Injection in Object oriented code (specifically PHP). You don't need a fancy container to do it, it's actually quite simple to do manually! Check out the video: Read more »

 
5:28 PM
Now that is what I call a beautiful login page.
 
@ircmaxell Bookmarked. Thanks.
 
:-D
 
^ Has to be a lie.
Unless he allocated a HUGE memory size, anything that takes that long to iterate on would crash.
 
@LeviMorrison: care to review my rant: gist.github.com/2974832918a531756f3e
 
And the difference is only about 2x in any case in all my tests.
 
user895378
5:40 PM
lol ... anything that starts with "Would you shut up with this rhetoric already?" has all the makings of an epic win.
 
@LeviMorrison all is relative ....
class SlowCount extends ArrayObject {
    public function count() {
        usleep(50);
        return parent::count();
    }
}
 
user895378
The better point would be to say, "Hey, remember in programming 101 when they said optimize your loops? They weren't kidding."
 
$ php -r '$a = array_fill(0, 1000000, 10000); $m = microtime(true); for ($i = 0; $i < count($a); $i++) {} var_dump(microtime(true) - $m);'
float(0.99659085273743)
$ php -r '$a = array_fill(0, 1000000, 10000); $m = microtime(true); for ($i = 0, $n = count($a); $i < $n; $i++) {} var_dump(microtime(true) - $m);'
float(0.096997022628784)
order of magnitude here
 
Well, at least on my system it's only about 2x
 
Holy crap, didn't expect that much difference
 
5:42 PM
However.
He's claiming 19 seconds compared to .2
 
1 000 000 iterations.
 
That's not just an order of magnitude . . .
 
$ php -r '$a = array_fill(0, 1000000, 10000); $m = microtime(true); for ($i = 0; $i < count($a); $i++) {} var_dump(microtime(true) - $m);'
float(0.16114211082458)
$ php -r '$a = array_fill(0, 1000000, 10000); $m = microtime(true); for ($i = 0, $n = count($a); $i < $n; $i++) {} var_dump(microtime(true) - $m);'
float(0.03874397277832)
and that's with xdebug disabled
 
why is that upvoted x5
 
It's clearly exaggerating though.
Tempted to edit.
 
5:43 PM
@LeviMorrison Probably had a whole bunch of other stuff running when he tested, nothing takes 19 seconds to iterate from memory alone. Possibly paging issues as well.
 
@LeviMorrison I'd edit a note that it's a real effect, but the magnitude is greatly exadurated
 
*exaggerated
 
@ircmaxell That sounds good, because it is just not necessary to use count in each iteration, that is what variables are for.
 
@ircmaxell I'd remove about 25%-30% of the words in general. Nothing specific is out of line, but in general I'd say it's just too long, even for a rant.
 
5:44 PM
Many users fear variables I have no clue why. I like them.
 
@LeviMorrison fair enough...
 
Also, in my tests on the subject, a foreach vs cached for loop is negligible UNLESS you don't include the key value in your loop. Then it's faster.
I'll link the code in a moment.
 
@LeviMorrison cut out a few paragraphs, and sent
 
more black hot strong, real hot nice coffee :)
 
5:48 PM
@LeviMorrison we probably should introduce a NO-CAPS in beginning sentences filter.
 
Note that you shouldn't use the results listed on ideone.
Get it locally and run it.
 
@LeviMorrison sizeof()... :-X
 
@ircmaxell It originated from a user note on the sizeof page.
The code did.
 
@ircmaxell +1 for calling BS on meaningless, overly-dramatic statements
You can't substitute emotion for reason
 
1
Q: PHP comparing boolean with integer

tr3quart1stavar_dump((int) true); // returns 1 var_dump(true > 0); // returns true var_dump(true > - 1); // returns false var_dump(1 > - 1); // returns true Can somebody explain me in detail what the results of those two above are because it is comparing boolean with integer and as a newbie it is...

hi all
 
5:54 PM
@ircmaxell That's why I don't follow internals
 
what does var_dump mean? — tr3quart1sta 21 mins ago
 

« first day (816 days earlier)      last day (4126 days later) »