« first day (4422 days earlier)      last day (750 days later) » 

08:27
Guys any idea which one is my local computer port and which one is the port on the docker container?
I think the left one is my local computer port, am I right?
08:39
@Shafizadeh Maybe this answers. &tldr; Yes.
thx
Also, I want to install phpmyadmin, do you know should I install it inside which container? MySQL, PHP, Nginx?
you can run phpmyadmin as a standalone container. Just add it to your docker-compose file
ah I see ..
got it
09:04
What is the best way to store payment information for booking application?
- users should be pay, extend(pay extra), cancel(full refund), shorten booking date(partial refund) etc.

when using different payment gates. with auth/capture set up.
Hello all,
need small help from all of you
Hey ZMAX
i'm trying to connect to ldap using php script
and I am getting error
ldap_bind(): Unable to bind to server: Can't contact LDAP server
did you try the docs here and checked out the first answer?
https://www.php.net/manual/en/ref.ldap.php
so I tried to check fsocketopen()
and i did this
$fp = fsockopen("www.abcdef.com", 80, $errno, $errstr, 20);
if (!$fp) {
echo "$errstr ($errno)<br>";
} else {
$out = "GET / HTTP/1.1\r\n";
$out .= "Host: www.abcdef.com\r\n";
$out .= "Connection: Close\r\n\r\n";
fwrite($fp, $out);
while (!feof($fp)) {
echo fgets($fp, 128);
}
fclose($fp);
}
now I am getting this error
ERROR: 32608 - Unable to find the socket transport "ldaps" - did you forget to enable it when you configured PHP?
can anyone help me on this?
I looked into this
11
Q: PHP Warning: ldap_bind(): Unable to bind to server: Can't contact LDAP server

Pascal BayerI've following problem with my php script: PHP Warning: ldap_bind(): Unable to bind to server: Can't contact LDAP server in .... ldap_connect() says "Success" but ldap_bind() fails, how to fix that issue?

@user1594831 I looked php manual
ldap_bind() function
09:17
I dont think I am the best person to help. I havent worked with LDAP and php :(
thats not what I get when I run this script? did you change parts of this code for privacy?
yes I placed the hostname and port no in this code
09:45
Hey, has anyone here created management applications?
I have a time clock log table and want to see if anyone had advice for columns I might be missing. I have id(int), user_id(int), created_at(date/time), updated_at(date/time), lunch_break(bool), scheduled_break(bool).
I am debating if that lunch_break(bool) should be lunch_break_start(time), lunch_break_end(time) or just put that in a different DB table and leave the bool in the main log table
10:01
@user1594831 If you mean card number, you shouldn't store it at all.
@CupOfJava You can have id, user_id, break_type_id, created_at, updated_at.
But is there anything extra that I am missing or I am overthinking a simple time log...
10:22
Seeing the question, I'd make break_types table where I would have lunch_break, schedules_break, any_other_type_of_break, which seems consistent to me. Having scheduled_break(bool), lunch_break_start(time), lunch_break_end(time) is not consistent. Consistency is what you need if you want application to be easy readable and maintainable. With offered fields (before any change) it's hard to say what to add or what to remove.
On the other hand, if scheduled_break is just a flag and not some kind of time period, plus if there is lunch_break as only type of break ever will be used, then you can go with what you debated.
11:01
@TimWolla If you have / find time, care to look once more over the Proposed Date Errors document? I've looked at all comments and more code now. I think we might have to postpone this for 9 though. -- and particularly, I'd like another comment on the "broken CSPRNG" exception/error comment.
 
2 hours later…
13:27
@Tpojka that makes sense, thanks
 
1 hour later…
14:35
With PHP security for small web apps (no frameworks), where should I focus my time when it comes to app security? At the moment, I am new to PHP app security. I am looking to buy the PHP architect book on the topic. But what is the 80/20
@Vinn PHP security is not much different than other languages (although you don't have to worry about memory safety for the most part). Don't trust user data unless it has been properly validated and encoded / escaped, and operate on assume-deny not an assume-permit basis
You should be looking to use a framework though, even if it's something as minimal as symfony http kernel.
14:51
Got it.
so data validation is the main thing, right?
Validation is a significant bit of it, but encoding is equally important if not more so. Something that can just be data in one context (e.g. a variable from a POST / GET request) can be executable instructions in another context (e.g. an SQL statement). If you don't properly encode information as it passes between contexts then a malicious user can pass instructions to other parts of your services you don't want
Good point. But isnt php dynamically typed?
by encoding what do you mean
If you receive a string from a POST request that is "HELLO" that's a piece of data, a string in memory assigned to a varible like $foo. If you then use it in an SQL statement like so: SELECT * FROM users WHERE name='$foo' then you're giving that string instructional context within the context of SQL
Because imagine the person posts "' OR '1'='1" now your SQL statement would read:

SELECT * FROM users WHERE name='' OR '1'='1'
To protect yourself you have to properly encode the data for the new context, you have to take the data and change it into a form that restricts the instructions to just "this is a piece of data" in SQL that usually means "escaping" certain characters that mean special things such as "this is the end of the data, go back to processing instructions"
In SQL we do it using a backslash, and the sql statement becomes:

SELECT * FROM users WHERE name='\' OR \'1\'=\'1'
Those \' are now considered literal values for a single quote, not instructions
The same goes for outputting to HTML, if you don't escape data that you're outputting then that data could be interpreted as instructions. In this case we escape it using htmlspecialchars
15:14
Really good advice, thank you mark
:)
Remember, you don't have to be crossing context boundaries into other protocols for data to become instructions within PHP itself if you do something silly enough e.g.: require $_GET['page'];
15:59
@Vinn a bit old, but still relevant: paragonie.com/blog/2017/12/…
16:10
@MarkR did you find anything?
well, anything half-decent.
16:40
As much as I'm not particularly fond of the people who run the major frameworks in PHP, at least they aren't ....this: world.hey.com/dhh/the-waning-days-of-dei-s-dominance-9a5b656c
17:38
@Danack hm. I've seen worse, though I agree that there's a bit too much of an undertone in it.
18:09
That he's still this butthurt over his employees pointing out that making fun of people with non-anglosaxon names is kind of not great, is also not great.
 
2 hours later…
19:50
@Danack We ended up going for Phinx and then Trowski worked some magic on it to come up with a new command line interface. It's not perfect but it's good enough, and maybe when time allows we'll put a bit of department time into creating a PR to improve its API tooling.
@MarkR cool.
In other news, when people complain about BC breaks in future, I suggest we direct them to try the TypeScript and NPM packaging environment
 
2 hours later…
21:43
@Danack there I can agree
22:19
@Derick Yeah, I've put a ToDo to have another look.
@Danack You can unpin my RFC Votes message, all of them technically concluded. @bwoebi will need to announce the results, though :-p

« first day (4422 days earlier)      last day (750 days later) »