Development

Sometimes PHP novices attempt to make cleaner or more legible code by copying predefined variables to variables with shortened names prior to working with them. This actually results in doubled memory consumption (when the variable is altered) and therefore slower scripts. In the following example, if a user had inserted 512KB worth of characters into a textarea field this would result in nearly 1MB of memory being used.

$title = strip_tags($_POST['title']);
echo $title;

This operation can be performed inline, – avoiding the memory overhead.

echo strip_tags($_POST['title']);

Twitter is a service for friends, family, and co-workers to communicate and stay connected through the exchange of quick, frequent answers to one simple question: What are you doing?

PHP Twitter is a (wrapper)class to communicate with the Twitter API written by Tijs Verkoyen. Download page is available here

A quote from the author (and he’s not wrong) The class is well documented inline. If you use a decent IDE you’ll see that each method is documented with PHPDoc. There is also a tutorial available here

So, to sum up, these links should kickstart your twittering ability from PHP (and your website).

Happy tweeting!

A few changes in PHP 6:

This post is mainly about what is removed (and will no doubt break countless scripts out there)

• magic quotes
• register_globals
• register_long_arrays
• safe_mode

magic_quotes


// Assuming magic_quotes is on
$sql = "INSERT INTO USERS (USERNAME) VALUES $_GET['username'];


// Using proper parameterised query method (MySQL)
$statement = $dbh->prepare("INSERT INTO USERS (USERNAME) VALUES ?";
$statement->execute(array($_GET['username']));

Obviously the get_magic_quotes_gpc() function will no longer be available.

register_globals

// a security hole because if register_globals is on the value for user_authorised can be set by a user sending
// them in the query string
// i.e www.example.com/index.php?user_authorised=true
if ($user_authorised){
// show all the data
}

// Being specifc
function is_authorised{
if (isset($_SESSION['user'])){
return true;
}else{
return false;
}
}
$user_authorised = is_authorised();

register_long_arrays

Using deprecated registered arrays:

// Echo the name of the user value given on the query string
// http://www.example.com/index.php?username=notgood
echo "Welcome, $HTTP_GET_VARS['username']";

Using $_GET

// Using the supported $_GET array instead
echo "Welcom, $_GET['username']@;

safe_mode
This was originally to ensure that the owner of a file being operated on matches the owner of the script that is executing. It was originally a way to attempt to handle security when operating on a shared server environment (like many ISPs would have) It is outside the scope of this blog to document the numerous functions affected by this change, so consult your documentation.