« first day (1845 days earlier)      last day (3109 days later) » 

1:00 PM
@PeeHaa What if I want the cart details before I write to db?
 
@SohailArif Only if you promise to post your actual question
@moh.ABK In that case it will already be available somewhere in your script
 
No I meant from scratch.. I need a tutor.
 
We are not some teachers learning people things.
 
Moment. We have a tut somewhere
 
We are weird ass people helping others xD
 
1:02 PM
I was initially using the mysql_* before... but I was advised to use PDO or MySQLi
 
well atleast I am :-)
 
As long as those "others" are learning...
 
Mysql is deprecated ...
 
@moh.ABK if you put anything else but the IDs into cookies, make sure to give me the url to the store. I will buy everything in it and then change the total to 0 before ordering.
 
1:03 PM
Exactly, I was literally bombarded with comments saying its insecure and you're prone to SQL injections.
I thought let's change the bloody thing.
 
it's not "insecure"
it's as secure as you want it to be.
 
That's what I meant lol
Its only insecure if you don't know how to secure it
 
indeed but you still shouldn't use it anyways XD
it's deprecated.
 
Definitely.. hence why I'm in need of a tutor.
 
And in PHP 7, it's removed.
 
1:04 PM
Yeah I heard that..
 
Customer is at menu page, as he is clicking items that are being added to his cart do I;
1 - create an order in db and save ID to $_COOKIE?
2 - save all items, total etc in cookies and write to DB once confirmed and paid?
@Gordon How can I implement a cart securely
 
@PeeHaa thank you for that link.. I just looked @ it and its quite informative.. do you think I can construct login scripts and registration scripts using that information?
 
@moh.ABK download magento community edition, or oxid or shopware. or used a hosted shop. why do you want to build your own anyway?
 
@SohailArif Yeah
 
Okay, I'll have a go.
 
1:08 PM
@moh.ABK You create a NEW CART in the DB, List the items there, add totals in the that cart.
Save the cart ID in a cookie, upon order, obtain cart id. calculate price, done.
AFK for a few.
 
@MikeM. Is that while customer is still adding and removing and updating qty? And then have querys attached to my add and remove buttons?
 
guys
 
Yup. basically ye.
 
how do I echo the php short array syntax?
$person = [$first => 'Hans', $second => 'Mustermann'];
echo $person[$first];
 
And please don't add cart_items in the same table as carts
 
1:10 PM
morning
 
asperger, why mustermann, you almost got my last name right :-( first name is totally off...
 
@moh.ABK Add to db at every step
 
@MikeM. no idea haha
 
@kelunik yo o/
 
remove mann, add s, and you got my last name right :P
 
1:11 PM
@MikeM. im a psychic!
 
@PeeHaa \o
 
Basically Im trying to figure out how to echo the value of the first key.
I tried $person[$first]
 
reset()
 
and $person[0]
 
How is the db structure?
Order Table - contains orders (final orders)
Items Table - contains items
Cart table? - what will this hold?
 
1:12 PM
or $person[$first]
@moh.ABK cart table will contain the baskets in "draft"
 
@PeeHaa it says the variable is undefined when it clearly has a value assigned to it
Im coming from js so its a mess :D
 
Well clearly it hasn't
No need to star everything that was useful
@Asperger var_dump($var)
 
so its not same as defining an object literal in javascript? var x = {key: value}
 
It is
 
@PeeHaa im so dumb. While the key is defined the variable itself isnt.
 
1:17 PM
> im so dumb.
;-)
 
So ya it displays the value but the variable is still undefined.
Oh man, got a bit confused with all the dollar sign, how array syntax works etc in php . I miss my console.log
It works out after a while :D
 
pfff
Are password hashes decryptable or only brute forcable / rainbowtabled?
 
Neither when done properly
But no definitely not "decryptable"
 
You can't "decrypt" a hash - same as you can't recreate a cow from a beefburger
 
Hashing is one-way
 
1:20 PM
I know.
Just showing someone on skype that.
 
@MarkBaker I'm fairly sure we actually can do just that :P
 
He clearly doesn't believe me XD
xD
 
Does the below 100% secure me from SQL injection?

$stmt = $dbConnection->prepare('SELECT * FROM employees WHERE name = ?');
$stmt->bind_param('s', $name);

$stmt->execute();

$result = $stmt->get_result();
while ($row = $result->fetch_assoc()) {
// do something with $row
}
 
@MikeM. idiots... idiots everywhere
 
@MikeM. change friends
 
1:22 PM
@moh.ABK How do you create the connection?
 
@PeeHaa ahaha, well I introduced him to PHP and all of this password thingies yet now he tries to argue with me about it :P
 
@MikeM. you're arguing about words, not technicalities
not saying it isn't important, but you just look like condescending now
Never Forget(tm)
that you were this guy too
 
@FlorianMargaine believe me I don't want to get technically with him.
 
@PeeHaa $dbConnection = new PDO('mysql:dbname=dbtest;host=127.0.0.1;charset=utf8', 'user', 'pass');
 
Yes that is safe against sqli
 
1:25 PM
@PeeHaa Gracias
 
Although @moh.ABK
 
I indeed have been, but I learned to accept the fact I was incorrect when getting introduced to password hashing when people blamed me for what I said. (IN THIS CHAT) XD

However, He tries to argue with me for about 3 weeks now.
 
@PeeHaa and against pdo?
 
Are you disabling emulation of prepared statements @moh.ABK
 
Just going to ignore him now xD
 
1:26 PM
@FlorianMargaine Nothing is safe against pdo
 
Yes I am. Using:

$dbConnection->setAttribute(PDO::ATTR_EMULATE_PREPARES, false);
$dbConnection->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
 
\o/
 
@moh.ABK you rulez
 
@FlorianMargaine I don't see you so often anymore in here I think?
 
now go away and conquer the world!
@PeeHaa the window is open, but work has been nicely busy, yeah
I'm having a lot of fun
 
1:27 PM
Good good
 
yup
feels real good
I'm also running 5 concurrent VMs so my pc has some difficulties using chrome too
 
And still CHrome uses the most resources :P
 
@PeeHaa Not if it's closing itselves because of some random bug.
 
@PeeHaa yeah...
 
Which actually happened quite a few times using chrome, open, close, open close.
 
1:34 PM
Any good links/tutorial to prevent Prevent brute force attacks. I tried to do this by creating a table that has a column incremented every time a user attempts to login when it reaches 5 we present an error... Is that all required or is my implementation too simple?
 
@moh.ABK Assuming you are talking about online brute force. I currently do something like:
 
Can someone help me regarding the use of ratchet library for websocket.
 
You pretty much try to increase the time of hashing on your login system, yet block the user from login when they reach x failures.
 
@PeeHaa Yes online brute force. Like attempt logging into facebook 10 times in 2 sec
 
1) log ip + when available userid + success state of the attempt
2) if failed attempts on either userid or ip exceeds 5 in 10 mins -> show capcha
3) if failed attempts on userid exceeds 10 in 1 hour -> lock account
4) if total failed attempts (app global) exceeds 100 in 1 hour show captcha for everybody
 
1:39 PM
youtube.com/watch?v=TCWktCcm28k <- nice song [dutch] - Zij gelooft in mij - Lange Frans & Julia Zahra
 
Having a rule for showing capcha for IP address outside of the current/normal country for login is also useful. Because you almost certainly don't have many valid users in China + Brazil relative to the number of login attempts that come from there.
 
Good point
 
@PeeHaa Sweet
@Danack cheers
 
@Danack really nice point, never thought of that
 
Anonymous
that awkward moment when you log in to your domain registrar gui to find out 3 domains are expired
 
1:49 PM
@PeeHaa I like blocking other accounts. :-)
 
@kelunik Block all you want. The user always has the option to unblock
 
I always truncate my users table upon 1 account failure.
 
It's a small price to pay for freedom security
 
xD
 
@MikeM. lol
 
1:51 PM
@PeeHaa How?
 
@kelunik by mail
 
Hehe atleast no one can get behind other user accounts.. :P
best security ever xD
 
Now that I think about it it would be cool to instead of locking just show random account data
 
Ahahaa actually, what about saying the user logged in, but actually is locked so nothing can be done xD
Nothing can be shown because it would error xD
 
1:57 PM
true rebelz
 
@FlorianMargaine MCV! Or CMV... Or VMC?
 
@ircmaxell why doesn't your blog have the reader mode. Firefox and Safari has the feature. I haven't come across a blog or news site that doesn't allow it. Some websites don't but most tech blogs have it.
Suspect it's something to do with the <content> tag. Not sure
 
@Machavity fack, I have to change my password for SO now, it's in the LIST!!!
DAMNIT!
 
lol
 
no... just no...
 
2:06 PM
posted on November 04, 2015 by nlecointre

/* by Pop */

 
is there a phpunit chat?
 
lol, 5th last password.
 
@Edwin no, unless you mean on IRC
 
Anonymous
Are there programmable (non-smart) wrist watches?
 
Anonymous
Looking for a regular digital watch that runs in any programming language..
 
2:09 PM
What would obama his password be? "IM THA BOZZ"? :P
 
@Gordon ok thanks, I suppose I will try the IRC then.
 
@MikeM. potus44
 
@Gordon :-P
 
@Gordon do you know any phpunit IRC channel?
 
@Edwin There's a Gitter channel and you can connect to Gitter using IRC.
 
2:13 PM
@Edwin as per official website gitter.im/sebastianbergmann/phpunit
 
Afternoon ;-)
 
Isnt it possible to access keys with integers? $obj = ["host" => ''localhost"]
$obj[0]
 
No
 
2:21 PM
I thought so, only values
 
@Asperger that aint an $obj but an $arr
 
You could extract values from an array by offset with something like array_slice, but keys are keys whether they are integers or strings.
PHP arrays aren't vectors.
 
@Gordon thank you very much. Im used to using object literals in javascript. Have to get used to it.
@Sherif I agree.
 
Wait they're scalars?
 
heh
 
2:29 PM
Mornings =) still at work... what do you listen to, while programming.. looking for something for the next hour or so (youtube playlist or spotify or .. etc)
 
@RonniSkansing youtube.com/… - it helps me relax.
 
Thanks =)
 
I run the office playlist, just end up playing mainstream old-school music.
 
wow
this is pretty some brutal guitar (= <3
 
@RonniSkansing My weekly discovery mix, but I want the one from last week back. :-(
@Danack Everything GEMA blocked. ^^
 
2:31 PM
How is Aerys fairing by the way?
 
Abe
@RonniSkansing electronic music - mostly british big beat youtube.com/watch?v=Da1ZdmXidIg start with this for instance
 
@Abe thanks, trying it now \o/
 
@RonniSkansing You should get a sonos in the office!
 
We actually had quite a few but we pulled them down
 
Why?
 
2:34 PM
Because some people prefer no music, whitenoise and etc
 
booo!
 
someone add IPV6_V6ONLY constant to PHP…
 
Worst is, there is alot of noise around where I site, and having some passive radio noise would help not to get too distracted.. buuuut no.. So I guess it's on with the headphones and volume up
@bwoebi did you remove (binary) b"string" from php7 ?
 
no?
 
okay.. I just hoped someone would remove them.. =) maybe I should pull myself together and see if I can extrude it (/me drowns in C/Zend madness)
 
2:39 PM
why?
 
Yea, why?
 
Because they have no use
 
....If you need to deal with an API that has bit level flags, they're pretty useful.
aka TCP packets.
or any other binary protocol.
 
@Danack are you saying there is a difference between 'Hello' and b"Hello" ?
 
Yea, if you don't have a use for them that's one thing, but binary syntax is important.
 
2:41 PM
As I understood it, it really does nothing meaning 'String' === (binary) 'String' === b"string"
Tell me I am wrong =)
 
Wait a minute, you can't do binary literals?
as in ... b1010
bleah, then it is useless
 
... Lisp has that
 
I think ircmaxell told me it was legacy and without any use anymore.. but I might remember wrongly
 
> The PHP language reference describes the distinction between unicode strings and native binary strings, denoted with b'this is a binary string'

It doesn't seem to be a method of representing binary numbers.

The notation "is available since PHP 5.2.1. However, it will only have effect as of PHP 6.0.0"
apparently that manual page has been deleted.
 
Abe
@Sherif yes you can, since php 5.3 something
$x = 0b1111;
 
2:45 PM
> "binary string" is what we have in php right now - a sequence of bytes, which (as opposed to C language) can also include nul byte. This is (or will be, as of php6) different from unicode strings, which are sequences of two-byte characters.
 
@Abe Ohh, you need a 0 infront of it
 
lolz.
 
I knew it was added somewhere
 
hello just wondering if anyone could help me with a small magento issue i keep occuring
 
Abe
b"" binary string would make sense only if "" were unicode strings
 
2:46 PM
So it is the same as a normal string right?
 
Abe
yes, afaik
 
btw
I got vaction in bout 45 min
and going to tenerife the next week
\o/
 
Abe
@RonniSkansing i wouldn't remove it, i want to believe there is still a small chance to get that :B
 
@Abe well just send people to php.net/manual/en/language.types.type-juggling.php and tell them the part about binary string is important
 
Abe
lol why is that still in the manual
 
2:49 PM
@andho I don't support stealing of content...
 
@ircmaxell I'm not sure what you mean
I don't support any kind of stealing though
;)
 
If you use reader mode, sure you do
 
@Danack uhm, did they want to introduce UTF-16 in PHP 6?
 
yes.
That's one of the reasons it failed.
 
@ircmaxell I get what you mean
 
2:58 PM
...this isn't google.
 
@bwoebi yes, store all non-binary strings in UTF-16, and convert on output
 
@ircmaxell UTF-16 is something halfway between UTF-8 and UTF-32… :-/
 
Maybe 1/3 between :p
 
16/32 = 0.5
 
@bwoebi it's fixed two-byte-per-glyph. Which is extremely advantageous for internal representations.
 
3:00 PM
I'll let you sit and think about how silly you've been
 
@kelunik why did you use www.domain.com as common name for your letsencrypt cert?
 
Because I typed that first probably, don't know.
 
k
 
@ircmaxell … but there are glyphs which have a codepoint not representable in 16 bits…
 
I thought there might have been an actual reason for it
 
3:02 PM
@bwoebi how does python do it?
 
Will issue a few other certs probably, got more subdomains whitelisted now. Seems like they're whitelisting many domains now or like being active in their forum has really some advantage.
 
@ircmaxell I have no idea what python does.
 
@PeeHaa related, I thought about writing an acme implementation in PHP at some point
 
@Leigh Same here.
 
@ircmaxell I just mean… codepoints from astral planes are represented as two UTF-16 byte pairs… which is weird.
 
3:03 PM
@bwoebi store strings as utf16
 
@kelunik would be great to bundle with aerys, really
 
That's the idea, not bundled, but as an addon.
 
@ircmaxell My point is… I see no advantage of using utf-16 in favor of utf-8… because you still have dynamic sizes because astral planes.
 
My todo list for when I finally have a stable place to live again is far too long
you'll probably get to it first :p
 
But on the other side, I think a small program doing its job well is preferable instead of bundling another component into every server, see community.letsencrypt.org/t/…
 
3:08 PM
@bwoebi I don't think ghosts have anything to do with it.
 
@Danack not sure if troll or seriously misunderstood.
 
The astral plane, also called the astral world, is a plane of existence postulated by classical (particularly neo-Platonic), medieval, oriental and esoteric philosophies and mystery religions. It is the world of the celestial spheres, crossed by the soul in its astral body on the way to being born and after death, and generally said to be populated by angels, spirits or other immaterial beings. In the late 19th and early 20th century the term was popularised by Theosophy and neo-Rosicrucianism. The Barzakh, olam mithal or intermediate world in Islam and the "World of Yetzirah" in Lurianic Kabbalah...
 
@Leigh acme?
as in php library?
 
> For other uses, see Astral plane (disambiguation).
 
> "The planes above plane 0 (the Basic Multilingual Plane), that is, planes 1–16, are called “supplementary planes”,[1] or humorously known as “astral planes”"
 
3:12 PM
yep.
 
@PeeHaa the letsencrypt client protocol
 
> Automated Certificate Management Environment
I see
 
I'm going home.
Done with and for today .,. :-P
 
The client being the actual tool that request / revokes new certs from them I assume?
 
Well, I'm learning CMake.
 
3:23 PM
@PeeHaa yes.
 
@kelunik How do they validate owners btw? The usual mail to postmaster@ or something like that?
The only thing I could find is:
 
@PeeHaa Nope, mainly HTTP requests for ./well-known/acme-challenge, but there are other options as well, e.g. DNS based.
 
tnx
 
Mails are harder to automate.
 
Tru
 
3:29 PM
Ok, dont laugh for what I am going to do now..........
syntax error, unexpected '$x' (T_VARIABLE), expecting function (T_FUNCTION)
when testing on my XAMP
Im thinking of posting a question.
Oops possibly missing a bracket there
 
@Asperger i) Use an IDE ii) paste php stuff on 3v4l.org not a Javascript editor.
 
@Danack ya crazy huh? I googled but didnt find anything equivalent to jsfiddle
 
No closing } at the end of method smaple() in class Test
 
ya, noticed. Pretty bad mistake. Could destroy an entire online community...just one damn closing }
 
136
A: Is there a PHP Sandbox, something like JSFiddle is to JS?

GordonThe Runkit extension aims to provide a PHP Sandbox: Instantiating the Runkit_Sandbox class creates a new thread with its own scope and program stack. Using a set of options passed to the constructor, this environment may be restricted to a subset of what the primary interpreter can do and pro...

 
3:34 PM
:)
 
@Asperger eval.in / 3v4l.org / codepad.viper-7.com
 
Well as they say: Googling evolved into a profession of its own lol
 
It sucks that you can't google for symbols…
 
There's symbolhound.com but it sucks
 
@MarkBaker what I dont get is why Undefined property: Test::$start
When test is clearly an extension of Main. Main has the variable stored in a protected static variable. Should be accesible
 
3:42 PM
Can some help me with this question stackoverflow.com/questions/33525183/…
 
So any idea if this is right? eval.in/463098
created a new Main stored in a variable x. Then created a sub class that extends x.
 
Something like $this->start is looking for an instance variable, a static variable !== an instance variable
 
This is a bit off-topic, but I would appreciate anyone who has used CMake before to check this answer and provide feedback:
0
A: How to detect c++11 support of a compiler with cmake

Levi MorrisonIn CMake 3.1 the proper way to do this is to use the CXX_STANDARD property for a given target. For example, given this simple example using auto (named main.cpp): #include <iostream> #include <memory> int main() { auto num = 10; std::cout << num << std::endl; return 0; } The fol...

 
Even if it would work, the mysqli_connect would be empty or not? since I didnt specify the new object I created
 
when i am trying to update data using this method, displaying could not convert to string pdo statement object error
public function updateData($query,$array){
$this->query_str = $query;
$this->placeholders_array = $array;
$pdo_stmt = $this->prepare($this->query_str);
$pdo_stmt->execute($this->placeholders_array);
}
Why?
$obj->updateData($sql,array(':id'=>$old_revid));
 
3:50 PM
Stepping through the code with a debugger would tell you why.
 
@Danack what i am doing wrong? i am trying to fix this for 2hours.
 
What you'r doing wrong is that you're not stepping through your code with a debugger.
 
@Danack ok man, thanks.
 
4:20 PM
I think switching to CMake may be a good move for PHP. I need to learn more CMake stuff before I attempt it, though.
Aside from simplifying some of our configure stuff, it would allow easier IDE integration which makes code exploration and refactoring much easier.
 
YEAASSH =] home from work and vacation! [=
 
0
Q: Laravel Chumper Datatables Post AJAX update

kiroboI am trying to use Chumper datatables in my project. Now I have a column with delete row. Basically, which deletes a row if you click it. But when you click it, it, there's a connfirmation dialogue box which asks if you're sure to delete it. Now it works if I do not use any AJAX call after firs...

Can somebody please help here!
 
4:38 PM
hi i am having a problem with this, the repsonse data is showing under chrome tools, but the data isnt drawing the graph any idea's?
http://pastebin.com/7n3eArxt
 
@iCeptic how have you debugged it?
 
using chrome tools, i get a json response
 
yea, but have you console.log(eachVariableYouHave) or stepped it via. the debugger?
btw
using numbers over 32bit values seems a great way to do underhanded coding in php
 
4:53 PM
@LeviMorrison Does CMake exist on all the platforms that PHP is currently compilable on?
Sounds like a big job btw.
 
@Danack It's not a matter if CMake exists on that platform but rather if it can target it.
But I would assume it runs on all platforms it targets.
CMake is intentionally a cross-platform build system. My understanding is that it is more portable than autotools.
 
@Ronnie Skansing thanks i realised that i wasnt using a event handler for reponse.done so data wasnt being handled correctly
 
5:10 PM
I want to avoid passing around full PSR-7 style Response objects. What is a decent name for a value object that contains i) A status code ii) some headers to set iii) A body implementation?
 
window.location = "{{URL::route('deleted.success') .'/'}}" + id;
What am I even reading
 
Shite.
 
posted on November 04, 2015 by nlecointre

/* by charliemini */

 
@Jimbo nice
@LeviMorrison what about Scons?
 
I have no experience with it. I have never encountered it, and I build software from source as part of my day job, so that's saying something.
Looks like it really focuses on ease-of-use.
It doesn't look like it supports nearly as many configuring options compared to CMake.
 
5:30 PM
Uhm… wtf are HTTP/2 TLS requests also starting with a PRI * sequence? Isn't that a bit redundant as we have alpn_protocol?
 
user895378
5:48 PM
@bwoebi yes, it is redundant. But it makes sharing the same parser code for all requests easier :)
 
@rdlowrey I have that issue… Browsers reject HTTP/2 in case the server allows TLS v1.1 or lower
not sure how to fix…
 
Anyone else having issues with the PCRE JIT?
 
@marcio there are enough related bug reports in our bug tracker…
 
user895378
@bwoebi There's really no way around it ...
 
user895378
Major browsers have supported TLS1.2 since early 2014
 
5:52 PM
@rdlowrey Suggestion: Make TLS v1.2 the default, disable HTTP/2 in case the user added lower versions?
 
user895378
So I mean ... the easiest thing to do is just require TLS1.2 in your server
 
@rdlowrey In that case, kelunik.com:1337 will only support TLS 1.2 and support HTTP/2.0
 
user895378
I'm fine with both of those, personally
 
user895378
I mean, the whole point of TLS is to ensure things are safe.
 
user895378
Supporting old browsers is a secondary concern to security IMO
 
5:53 PM
@bwoebi Other way round. Default to TLS1 and enable HTTP/2 when only TLS1.2 is configured.
 
@kelunik well, nah. What's the point there?
 
@bwoebi I think enabling it by default was a bad move. Remember that segfault with no bt? It was caused by it.
BTW, finally could reproduce outside phpunit 3v4l.org/qbjZj
 
@marcio that explains why I couldn't repro, because I have the jit turned off :-D
 
it was very tricky, you have to: 1) be inside a namespace 2) be iterating over a RegexIterator 3) call preg_replace() with the exact same pattern used on RegexIterator
 
@marcio o.O
 
5:56 PM
@bwoebi Will kill not just a few devices otherwise, see ssllabs.com/ssltest/analyze.html?d=kelunik.com
TLSv1.1 doesn't matter, any client that supports 1.1 does also support 1.2.
I don't understand why it's listed in "modern" here: wiki.mozilla.org/Security/Server_Side_TLS#Modern_compatibility
 
I bet it's something with the PCRE cache, but had not enough time to debug.
 

« first day (1845 days earlier)      last day (3109 days later) »