Articles

There is a script knocking about on the internet at the moment that allows an attacker to run some code that will bring your Wordpress blog to its knees. This will more than likely cause your host to get annoyed as well.

What it does it performs a trackback request to the file wp-trackback.php, but it sends a massive (over 200,000 characters) string that Wordpress will take at face value and accept as a legitimate trackback. The first time this is run Wordpress will write it to the database, but the every time after that it will run a select query to see if the trackback exists. Even though this isn't a legitimate trackback Wordpress will still process it on every request, causing a massive overhead as each large string is processed.

One solution is to simply stop access to the offending file by using an Apache rule in your .htaccess file to prevent all access to this file.

Last weekend saw the second annual PHPNW conference, and it was an excellent conference. There were some 200 people attending the event and we got to see some interesting and informative talks. When I arrived at the talk I received a bag with some brochures in it as well as a KitKat (which I ate for breakfast) and a years subscription to PHP|Architect. Everyone at the conference was also fed very well for lunch and dinner and Sun sponsored a free bar at the end of the first day, which was nice.

What I thought I'd do is go through each of the talks that I attended and copy in my responses from the joind.in reviews that I have been posting during the week, but also embellish them with further thoughts and comments. Also, joind.in seem to have deleted one or two of my reviews so I will have to write them from scratch anyway.

The instanceof operator is used in PHP to find out if an object is an instantiated instance of a class. It's quite easy to use and works in the same sort of way as other operators. This can be useful to controlling objects in large applications as you can make sure that a parameter is a particular instance of an object before using it. Lets create a couple of classes as examples.

class Shape
{
}

class Circle extends Shape
{
}

Now, to find out if a variable is an instance of the Shape class create the object and then use the instanceof operator on the object. The following code returns true.

When writing PHP class or function (basically any file containing only PHP code) files you might have learnt to write them something like this:

<?php 
class Users
{
}
?>

However, did you know that the second bracket is optional? The following class file is perfectly legal:

<?php 
class Users
{
}

This practice is actually a good thing to do for a very good reason, it will stop any white space appearing at the bottom of your files, which can cause header errors. In fact, missing out the second brace is part of the Zend Framework coding standard for this very reason, so it is a good habit to get into.

As part of debugging a bit of code I needed to know the longest possible field lengths that a record contains. You might need to know this if you are performing a database migration. The following query returns a field, along with the length of the string, and orders the results by the number of characters in that string.

SELECT field, CHARACTER_LENGTH(field) as fieldCharacterCount
FROM table
ORDER BY fieldCharacterCount DESC

Finding the next day of the week from a given date can involve some complicated loops and if statements. In PHP it is made quite easy through the use of the strtotime() function. This function, which is part of the PHP core since version 4, can take just about any string representation of the time and convert it into a Unix timestamp.

The most common use of strtotime() is to convert a string into a time. Here are some random examples, the first two convert a date and the second two print more or less the same, but (obviously) will change with time. I say more or less as the "now" parameter will return the current timestamp whereas the "today" parameter will return the timestamp from the beginning of the current day.

When validating a password it is easy enough to make sure that the password is of a certain length, but what happens if you want to make sure that the password has at least one number, or contains a mixture of upper and lowercase letters? I recently had to validate a password like this and so I created a password validation class that allows easy validation of a password string to a set of given parameters, but also allow these parameters to be changed when needed.

Download the Password class here.

The Password class takes a set of parameters, which can be altered at runtime, and uses these to validate a password. To run the password validator with default parameters do the following:

Netbeans is a great IDE and with every version lots more features are introduced that make it even better. One thing that I like to use is the code templates, which have been available from version 6.5. Code templates allows you to type a simple command and get a section of code. What commands you can use depend on what version of Netbeans you are using and which programming language you focused on. As a PHP developer I usually download the PHP version, which comes with a set of PHP code templates. To try one out go into a PHP file in Netbeans and enter if followed by a tab. Netbeans will automatically change this into the following:

A simple way to convert a string into a set of variables is through the use of the explode() and list() functions. list() is a language construct (not really a function) that will convert an array into a list of variables. For example, to convert a simple array into a set of variables do the following:

list($variable1, $variable2) = array(1, 2);

In this example $variable1 now contains the value 1 and $variable2 contains the value 2. This can be adapted to use the explode() function to take a string and convert it into a set of variables. An example of this in use might be when dealing with addresses, simply explode the string using the comma and you have a set of variables.

$address = '123 Fake Street, Town, City, PO3T C0D3';
list($street, $town, $city, $postcode) = explode(',', $address);

You can now print out parts of the address like this:

I quite often find myself needing to know how long a string is, especially when testing form validation or when trying to write a page description. I therefore like to have this little tool to help me by simply counting the number of characters in a given string.

Use the JavaScript text length tool here.

The tool uses a single form with a textarea and a text box. The textarea has onkeyup and onkeydown events which causes it to call a function that counts the number of characters and enters this into the text box.