« first day (1997 days earlier)      last day (2941 days later) » 

12:27 AM
it somewhat feels good if github tells it's web-users that you they should squash their commits: github.com/blog/2141-squash-your-commits
 
12:45 AM
how can I use php to change something in a javascript file?
 
 
1 hour later…
2:01 AM
good mornings
 
2:42 AM
Morningss
 
 
1 hour later…
3:58 AM
Morning
Hello all, I am trying to protect myself against XSS and I was reading about strip_tags, but what about input_var String Senetize, is that as good as strip_tags?
$username = filter_var($username, FILTER_SANITIZE_STRING); or echo strip_tags($_POST["username"]);
 
moin
 
user6079755
hello
 
user6079755
are you there
 
user6079755
good day
 
user6079755
4:52 AM
i need help with this problem stackoverflow.com/questions/36393392/…
 
'nin
 
user6079755
joe
 
user6079755
anmol
 
user6079755
can any of you help me plz
 
5:08 AM
don't ping random people asking for help @WalterNuñez
 
I've previously called Python the bad child between PHP and C in a chat… :-D
@JoeWatkins morning
 
'nin bob
 
posted on April 04, 2016

New Cyanide and Happiness Comic

 
user6079755
lol
 
5:26 AM
@WalterNuñez can you ask the question, the chat will be here so if someone knows the asnwer to it they will respond back.
 
mornin
 
Morning
if one wants to protect ones site against XSS, is it better to use strip_tags or filter_var, or is there even a better solution. For example:

$username = filter_var($username, FILTER_SANITIZE_STRING);

or

echo strip_tags($_POST["username"]);
 
mornin tereško
 
Hi anyone help me with this error Fatal error: Uncaught exception 'PDOException' with message 'SQLSTATE[42S02]: Base table or view not found: 1146
 
5:34 AM
@astrosixer your SQL query does it point to the correct table in your DB?
 
Wes
morning
 
mornin
 
@Spiderix yes it points to the correct table but its says there's no such table why?
 
What about your database connection string, could something be wrong with that one?
 
5:45 AM
@Spiderix yes i got it. I was given a different dbname. Thanks for pointing out.
 
@astrosixer excellent :)
 
@Spiderix sanitizing is input filtering. strip_tags is output filtering. different concerns.
 
Aha I see, thanks for that @Gordon
 
also, strip_tags doesnt help much for protecting against xss
 
oh?
 
5:54 AM
Consider <some tag="$phpValue"/>. Use $phpValue " onclick="malicious code"><blah foo="
strip_tags will remove the <blah foo part but not the malicious script part
so that leaves you with <some tag="" onclick="malicious code"> then
 
but I am not using onClick inside my button, I use addEventListener
 
what you want is htmlentities() and/or htmlspecialchars()
it doesnt matter what you use specifically. strip_tags doesnt protect well from xss
 
Aha I see
ok so for example $str = "This is some <b>bold</b> text.";
echo htmlspecialchars($str); then when I run it, it will run This is some <b>bold</b> text. Which then makes it difficult to do xss? If I understand it correct
 
it will turn characters with meaning in html to entities, e.g. it will turn " to &quot; and < to &lt; and so on. the browser will render these as the literal characters but they will be meaningless for the html.
 
Ok thanks
 
6:05 AM
echo htmlspecialchars('This is a <b class="foo">bold</b> string.');
--> This is a &lt;b class=&quot;foo&quot;&gt;bold&lt;/b&gt; string.
So you want to do both. Input filtering and output filtering
 
Ok thanks, and input filtering is simply when you are having the user insert something and output is simply when you are displaying the data
I think I am starting to get the hang of this :D
 
yes
 
Hey people, I figured out how to rename an image on upload to directory, but how can i rename it depending on the (mysql) users name ?
 
@AboutLeros select the mysql users name
 
@Gordon yeah that's the part i'm struggling with, i've always found it really complicated to find the current users id and/or mysql row information.
 
6:12 AM
!!xkcd goto
 
unless you highlight why I cannot help you with that
 
@Gordon so i just use a select query to get the current users id or row info?
 
@AboutLeros if you dont have that info elsewhere already, like in a session or something, then yes. if its in the database and you need it in your app, you have to fetch it.
 
@Gordon I have a session, but how do you "get" it?
 
6:18 AM
!!docs sessions
hmpf. @Jeeves seems to be sleeping
anyways, look up the docs for session handling please
 
ok, looking now
 
morning
 
holly shit
 
morning
 
I was just now told, that phpmyadmin is more secure, because it is a webapp and not a desktop app
 
6:29 AM
:P
 
@tereško sure it is. desktop apps are on your PC and may be stolen. Web apps live in the... the cloud
 
lies
there are no computers, it's just someone's cloud
 
:/
 
There are no cloud or computers, it's just someone's something
 
They are just the matrix's glitch.
 
Or maybe this is all a dream, and soon we will wake up as cavemen!
 
@Epodax True dat
 
I thought you're all a part of my dream
 
Wes
 \o
(=)===
  |\     guitar windmill
4
sorry. i just noticed i got paid. i can afford to pay this month's bills!
 
6:52 AM
inb4 guitar windmill cogedolf
 
yuk ... monday ...
 
Wes
\o
 
7:05 AM
\o/
 
@tereško I was mind-blown by this
never gonna do soft-deletes anywhere anymore, even if I already know that they are an anti-pattern :P
 
@Ocramius was that about snapshots?
I am kinda learning about something similar on the file-system level in ZFS
 
@tereško detailed auditing of an entire DB, with the ability to run native queries against past data at any point in time with near-0 overhead
so yeah, quite mind blowing
in general, I don't see myself ever going back to MySucks
err, MySQL
 
7:15 AM
in all these years I have only twice worked in a company, where that was an option
 
@PaulCrovella there you go: git.php.net/…
 
@bwoebi well that just lovely. the service here is amazing :D
 
@PaulCrovella hehe
 
Hey all. When I upload an image to my database if I don't select a file it adds a " into the images table under img. I already did a check if it is null that it cannot add it but still it adds a " and I can't really see why. This is my uploadImage function: pastebin.com/iYGep3dM
 
please, don't save iimages in a database
 
7:28 AM
this sounds like it must be wrong ... but it's not wrong ...
 
@tereško I moved back to doing that. Much simpler
 
also, the socket is shutdown ... I dunno what's happening there ... any ideas @bwoebi ?
 
I know, but the other way kept giving me some weird permission issue and since the assignment said nothing about how to store an image I went with the easy way.
or the way I know :D
 
Works perfect for projects that don't need silly scaling
 
@JoeWatkins errr, context?
 
7:29 AM
the link there
 
@JoeWatkins what lin … oh, the "this" is linked
 
yeah
it's strange, right ?
 
Wes
what's your opinion on optional parameters in constructors? i'm not sure i should have them just because it would be more comfortable. $a = new Baz(44); $a->setOptional($optional); vs $a = new Baz(44, $optional);
 
I can see everything happening that should be happening ...
 
@JoeWatkins yeah… the weird part is especially that it works on OS X but not linux
I'd guess it's a detail with BSD sockets
which is quite outside of PHPs control
 
7:34 AM
yeah agree ...
would like to be able to explain why it behaves like that though ...
@Wes just be sensible ... one or two optional parameters, fine, 10 optional parameters where you have to pass in a magical sequence of null and -1 to get some behaviour, fuck that ...
 
10 parameters period, optional or not, is probably indicative of a problem
 
@bwoebi well, fuck linux. Your webserver should be running FreeBSD anyway :D
 
yeah agree ... but you see what I'm getting at ...
 
haha :-D
 
but, if you are using mysql, you probably should be putting it on a linux box, because of kernel-level optimization
 
Wes
7:38 AM
makes sense. but the wise me is telling the dumb me that i shouldn't have optional parameters in constructors at all... although sometimes...
 
@Wes can the wise you explain why?
 
Wes
@PaulCrovella the wise me thinks constructors should ask only for dependencies, not for optional stuff
 
well ... I'm pretty sure that if you asked Bob or Nikita to produce a paper proving (in the mathematical, theoretical sense) that writing software in PHP is a bad idea, they could do it ...
so just be sensible ... we don't really care about facts over here @ php ...
 
@JoeWatkins not me
 
Wes
lol
 
7:41 AM
But Nikita perhaps
 
@bwoebi we would still need you to explain it :D
 
haha
 
morning
 
'nin
 
moin
 
7:46 AM
@JoeWatkins looked it up, it's definitely just a difference in behavior. On BSD kernel space buffer is emptied when shutdown(sock, SHUT_RD) is called, on Linux it's just rejecting further packets
 
wntfx ?
 
NaB
Also note the wording of the man page differing receives (referring to recvmsg & co) vs. receptions (referring to data packets)
 
doc bug ?
 
possibly
 
should be mentioned in docs I think, it's surprising ...
 
7:49 AM
feel free
 
also surprising that I'm just hearing about this today
 
@JoeWatkins because it practically makes no difference
 
yeah but why has nobody noticed ?
 
Because it didn't make their code misbehave?
 
well, I guess you wouldn't
yeah, ordinary code would not behave different ... I guess ...
 
7:51 AM
I've actually used that function, but then I also didn't do any further read calls
 
yeah, you wouldn't ...
 
8:09 AM
Mornin' 11!
!!admin list
 
DaveRandom, kelunik, Ronni Skansing, Félix Gagnon-Grenier, Joe Watkins, bwoebi, tereško, Florian Margaine, Danack, NikiC, Levi Morrison, Gordon
 
@bwoebi so I can't change the news file manually ?
 
@JoeWatkins sure you can??
 
Huh, no @PeeHaa?
 
oh ... I thought is was generated from commit messages, if you have the driver setup ...
so I can just change it like normal code now, in 7.0 and then merge into master ?
 
8:13 AM
sure, if you have the driver setup.
 
I just done it ... it's under "manadatory git settings" on the wiki ... I didn't know it was mandatory ...
overused word is meaningless ...
 
hehe … it's mandatory to use the word mandatory in mandatory contexts :-P
 
ahhh... semantic satiation
 
ThW
8:29 AM
Morning
 
8:43 AM
Moin!
 
o/
 
@PeeHaa Can you add a special list for non-admin messages? :-(
 
hmm ... @Ocramius am I correct in getting the impression that IBM's DB2 is actually the top-dog among RDBMS?
 
@tereško it has a lot of features, but it behaves differently from deployment environment to deployment environment
 
hmm
 
8:55 AM
same thing deployed on linux, windows or db2 => different SQL syntax
 
that's kinda true for MySQL too , regarding table names
 
oh yeah
their CaseSensITIVitY compliance is awesome
 
:D
btw, there is a lecture matching those slides of yours:
... not sure about how good it actually is (I am highly biased against ORMs)
 
Yeah, I saw Magnus at Confoo
he's awesome
 
tl;dw?
 
9:00 AM
2 hours ago, by Ocramius
@tereško I was mind-blown by this
slides
 
tl;dr?
 
@Gordon basically a replacement for all the soft-delete and auditing frameworks we have out there
in ~100 Lines of PSQL
 
I glanced over it briefly and saw something about history tables. that's it?
 
I will just wait for bi-temporal tables
 
@Ocramius I'm curious, do you know about datomic?
 
9:01 AM
@Jimbo What you mean?
 
@FlorianMargaine never heard of it
@Gordon yes, pretty much
 
Morngin
 
@Ocramius ok, thanks
 
Mogguh!
 
@PeeHaa I'm not an admin on here, but I want to do the Jeeves tweet thingy
 
9:09 AM
!!admin add 736809
 
User added to the admin list.
 
done
 
There is actually a person named Jeeves...
 
I would advise to rename !!admin to !!trusted, to minimize confusion
 
9:12 AM
moin
 
moin moin
 
moin moin moin
 
'N 'n 'n 'n
 
@Patrick Nice collection you got there :)
 
9:18 AM
The whole purpose of software development is to collect stickers. That's how you win the game.
9
 
@Patrick so the laravel sticker is there where only you can see it?
 
@DaveRandom Oh, then I'm totally losing...
 
:P
 
@SergeyTelshevsky that one is on the front of the monitor. who needs to see what he codes when he has laravel?
 
Yeh I'm pretty low in the league tables
 
9:19 AM
@Ocramius datomic.com
 
to be honest I dented my brand new laptop on the first day and had to cover it up... That's how it started at least
 
Which sticker?
 
@DaveRandom no, it's the purpose of development conferences
 
@tereško and laptops
 
I actually don't like stickers on anything - they dont age well
oh, it's nice the first week, but after 6 months those stickers start look like something died on that device
 
9:32 AM
@FlorianMargaine seen the website, didn't look further yet
 
prominent speakers should rent out sticker placements on their laptops.. kinda like nascar
 
Hi anyone how to pass value with url while redirecting using header()
 
This looks like fun
 
@Jimbo I investigated something similar perhaps 3-4 years ago, was going to be really expensive
 
9:35 AM
"magical notation is magical" ... that looks promising
 
I'm so fucking terrible at git ... I'm going to go back to my cave, only code for myself ... we don't care about change logs .... they can all say "is better, k thnx" ...
 
hi anyone know?
 
@Ocramius because this, as far as I know, is built-in datomic:
35 mins ago, by Ocramius
@Gordon basically a replacement for all the soft-delete and auditing frameworks we have out there
 
9:44 AM
@JoeWatkins Message tweeted.
 
@PeeHaa ...
very php ... but fix it fix it fix it ...
 
WHat did I break?
 
look at tweet ...
 
oh lol
At least it&#39;s safe :D
 
hehe
 
9:50 AM
@Jimbo $420(+ import tax) + £32 (RPi3) + £25 (good USB battery pack) - that's pretty much in affordable range
hm, +antennas
 
@Leigh But effectively you'd be getting free... 3g, right?
 
Hello
Can i update a _SESSION[] on site B from site A through AJAX?
 
No and no
 
Hm.. I have a website A which holds a cart object in the session and when going to checkout it creates a order and goes to website B where the checkout is happening. Now on website B you can update quantity of a cart-item, but I need to sync that quantity with the cart object session from website A. Any suggestions how? I can also load the order info into the cart object on website A, but then I need something to recognize the visitor.
 
@Jimbo No... those rubber ducky antennas are going to be 2dB at best (so you're talking wifi range). And you'd still need to have an upstream SIP connection for calls
 
10:01 AM
And I cant do that only on IP, because then everyone on the same network will have the same cart data loaded into their session. I could combine IP + browser but still too high probability that more than 1 will get that cart info loaded into their session. :( help
 
@Karem site A <-> database <-> site B
 
@Karem Normally this is done by passing around a token
 
Or some sort of inter-server session API which wouldn't be great
 
@Gordon Already doing this but only when proceeding to checkout, site A communicates with database (to create the order).
 
@Karem also, "something to recognize the visitor"-> cart/access/session token/id send in headers?
@Karem so? let site B read the order then
 
10:12 AM
Hmm i just thought of a solution: When proceeding to checkout, generate a token (and save to session)/or just use sessionid -> save it together with the order in db -> Site A can now use this to find the right order and load this into the cart session (which then will have the updated quantity in it)
Great that would work just fine. Thanks for quickly opening up my thoughts :P @PeeHaa @Gordon
 
!!admin list
 
Joe Watkins, tereško, Ronni Skansing, bwoebi, kelunik, DaveRandom, Florian Margaine, Félix Gagnon-Grenier, NikiC, Levi Morrison, Jimbo, Danack, Gordon
 
In order of who went to the toilet last
 
Hehe
 
lol
 
10:17 AM
lol
 
"does anyone know how to install PHP on my WordPress?" http://chat.stackoverflow.com/transcript/11?m=13056023#13056023
2
TheTaoOfRoom11
 
@Jimbo WOAH
 
I wanted to re-use that account, but I didn't have the credentials anymore
 
Morning all
 
10:21 AM
'Nin
 
moin
 
@Jimbo what happens when I tell Jeeves to tweet that? /cc @PeeHaa? Will it RT it or will it just tweet the tweet?
 
It should just tweet it
 
Hi All, In unix is there a way to separate two options.... Say i want to separate two option "readtimeout=100" and "-N" without putting space in them. If i want to create a command like wget readtimeout=100#AnythingOtherThanSpace#-N. Is it possible to do
 
@Tarun why?
 
10:23 AM
You haven't lived until you've dropped a production database. http://chat.stackoverflow.com/transcript/11?m=14824554#14824554
 
@Gordon tweet the tweet. However... twitter.com/EleventyJeeves/status/716280354550779904
@Gordon there are probably more cases I didn't properly implement. Like I have no idea / haven't tested what happens with images
Also I have a todo list of things that are non optimal
 
+via
 
Yes that too
 
-> #hashtag translation
 
i have a Car object that has tags, when i want to save the "tags" attribute of the object is a plain array store in MySQL text column, and i also put the object in elastic search for searching the Cars object.. it this an unusual approach to store/search the object, since ElasticSearch handles searching. Could it better to store in tables car->car_has_tags->tag ? *tags are not unlimited maximum is set to 10tags ..
 
10:30 AM
Really? Python room built their salad language? sopython.com/salad
 
!!lick test
 
!!lick *
 
what does lick command do??
 
It helps you lick computers
 
return one of these apparently, but doesnt work
const RESPONSES = [
    "Eeeeeeew",
    "That's sticky.",
    "At least buy me a drink first."
];
 
10:32 AM
@Gordon actually i forgot to put space while writing code for it and hence my query is not executing. I have defined value of readtimeout in config file. I was thinking if i could suffix something with the value of readtimeout that could make my query valid. I need to do this hack for sometime.
 
@Gordon I don't think it accepts params yet
!!lick
 
@Tarun how about putting the space instead?!
 
Ooorrr it just doesn't work :P
 
:D
 
!!lick lick
 
10:33 AM
@Gordon php parse_config function removes the trailing space
 
!!lick my-pc
We want the lick command!!!!!!!!!!
 
@Tarun well, apparently you are generating something from the parse_config, so make sure you generate it properly instead of hacking the value in the parse_config
 
BTW, isn't there any way I can upload an image in the mobile version of the chat?
 
!!version
 
v1.1.0
 
10:45 AM
Is that safe?
What's the best way to clean user inputs in php?
 
Eval?
 
@JoeWatkins hows the typed properties RFC coming along? Will this be going to vote soon?
 
@LeeDavis implementation problems, will be coming back to it this week sometime ...
 
Cool. Was the "mixing typed property declarations" thing solved?
 
@Saitama Yeah, I couldn't include as it needs to refer to local files to that file, not ones on the cdn.
Unless I'm being really stupid
 
10:48 AM
not yet @Lee
 
@JoeWatkins One declaration per line seems like the most obvious solution.
 
@Leigh Serious.
 
it's safer than being stabbed in the face ...
2
 
10:49 AM
Not often you get to see eval() and remote file inclusion on the same line
 
What's a better way of doing it then?
 
What are you actually trying to do?
 
@JoeWatkins @Gordon Test rode the Ducati on the weekend
 
@Leigh Getting a script from our server, then once the client server has loaded it, it pulls data from local files and outputs a site template, with the data filled it from their local files.
 
@Jimbo was there more glory than you imagined, or just the right amount of glory ?
 
10:53 AM
@MattCowley Why not just give that script to the client and include it locally?
 
@Leigh The idea is to protect the script from the client, so they can't modify it, or break it, or distribute it etc.
 
They're downloading it from you. They can do all of those things
 
@Jimbo which one? the xdiavel?
 
@JoeWatkins Actually, there was an adequate amount of glory
@Gordon Panigale 959
 
ah
 
10:56 AM
excellent ...
 
@Leigh Less easily, as our clients wouldn't probably know how to, as they don't have the direct source.
 
how long until it's at home ?
@MattCowley you're not making sense ...
 
@MattCowley imho, distribute your source, protect it with a LICENSE, if they distribute it, sue them.
 
or saas
 
On an inline-4 600cc, there's a big 'kick' when you get into the 7-9k rev range, the power band. But it can catch you out, and I actually find myself going "come on, come on, come on.. there we go". With the Ducati, being almost a litre bike, it's not completely mental, very manageable (honestly feels more beginner friendly imho!) and it's very smooth - just like you're in the power band at all times, no scary 'kick'
Haven't ordered yet, put the RR on auto trader first :)
 
10:58 AM
Or that. Generate all of the templates/whatever on your servers, and serve them up as an archive download
 
@Leigh Yeah, but I want the client to able to simply and easily edit their settings, so they have it in structured files on their server.
 

« first day (1997 days earlier)      last day (2941 days later) »