Skip to content

Commit

Permalink
Merge pull request codeguy#495 from jrfnl/Fix-inconsistenties-in-menu
Browse files Browse the repository at this point in the history
Fix inconsistenties in menu
  • Loading branch information
philsturgeon committed Dec 9, 2014
2 parents e84f63a + 7e000f5 commit 93a3f81
Show file tree
Hide file tree
Showing 21 changed files with 235 additions and 184 deletions.
87 changes: 0 additions & 87 deletions _posts/07-01-01-Databases.md
Original file line number Diff line number Diff line change
Expand Up @@ -13,94 +13,7 @@ Native drivers are great if you are only using _one_ database in your applicatio
MySQL and a little bit of MSSQL, or you need to connect to an Oracle database, then you will not be able to use the
same drivers. You'll need to learn a brand new API for each database — and that can get silly.

## MySQL Extension

The [mysql] extension for PHP is no longer in active development, and is [officially deprecated as of PHP 5.5.0]
[mysql_deprecated], meaning that it will be removed within the next few releases. If you are using any functions that
start with `mysql_*` such as `mysql_connect()` and `mysql_query()` in your applications then these will simply not be
available in later versions of PHP. This means you will be faced with a rewrite at some point down the line, so the
best option is to replace mysql usage with [mysqli] or [PDO] in your applications within your own development schedules
so you won't be rushed later on.

**If you are starting from scratch then absolutely do not use the [mysql] extension: use the [MySQLi extension][mysqli],
or use [PDO].**

* [PHP: Choosing an API for MySQL][mysql_api]
* [PDO Tutorial for MySQL Developers][pdo4mysql_devs]

## PDO Extension

[PDO] is a database connection abstraction library — built into PHP since 5.1.0 — that provides a common
interface to talk with many different databases. For example, you can use basically identical code to interface with
MySQL or SQLite:

{% highlight php %}
<?php
// PDO + MySQL
$pdo = new PDO('mysql:host=example.com;dbname=database', 'user', 'password');
$statement = $pdo->query("SELECT some\_field FROM some\_table");
$row = $statement->fetch(PDO::FETCH_ASSOC);
echo htmlentities($row['some_field']);

// PDO + SQLite
$pdo = new PDO('sqlite:/path/db/foo.sqlite');
$statement = $pdo->query("SELECT some\_field FROM some\_table");
$row = $statement->fetch(PDO::FETCH_ASSOC);
echo htmlentities($row['some_field']);
{% endhighlight %}

PDO will not translate your SQL queries or emulate missing features; it is purely for connecting to multiple types of
database with the same API.

More importantly, `PDO` allows you to safely inject foreign input (e.g. IDs) into your SQL queries without worrying
about database SQL injection attacks.
This is possible using PDO statements and bound parameters.

Let's assume a PHP script receives a numeric ID as a query parameter. This ID should be used to fetch a user record
from a database. This is the `wrong` way to do this:

{% highlight php %}
<?php
$pdo = new PDO('sqlite:/path/db/users.db');
$pdo->query("SELECT name FROM users WHERE id = " . $_GET['id']); // <-- NO!
{% endhighlight %}

This is terrible code. You are inserting a raw query parameter into a SQL query. This will get you hacked in a
heartbeat, using a practice called [SQL Injection]. Just imagine if a hacker passes in an inventive `id` parameter by
calling a URL like `http://domain.com/?id=1%3BDELETE+FROM+users`. This will set the `$_GET['id']` variable to `1;DELETE
FROM users` which will delete all of your users! Instead, you should sanitize the ID input using PDO bound parameters.

{% highlight php %}
<?php
$pdo = new PDO('sqlite:/path/db/users.db');
$stmt = $pdo->prepare('SELECT name FROM users WHERE id = :id');
$stmt->bindParam(':id', $_GET['id'], PDO::PARAM_INT); // <-- Automatically sanitized by PDO
$stmt->execute();
{% endhighlight %}

This is correct code. It uses a bound parameter on a PDO statement. This escapes the foreign input ID before it is
introduced to the database preventing potential SQL injection attacks.

* [Learn about PDO]

You should also be aware that database connections use up resources and it was not unheard-of to have resources
exhausted if connections were not implicitly closed, however this was more common in other languages. Using PDO you can
implicitly close the connection by destroying the object by ensuring all remaining references to it are deleted, i.e.
set to NULL. If you don't do this explicitly, PHP will automatically close the connection when your script ends -
unless of course you are using persistent connections.

* [Learn about PDO connections]


[mysql_deprecated]: http://php.net/migration55.deprecated
[mysql_api]: http://php.net/mysqlinfo.api.choosing
[pdo4mysql_devs]: http://wiki.hashphp.org/PDO_Tutorial_for_MySQL_Developers
[SQL Injection]: http://wiki.hashphp.org/Validation
[Learn about PDO]: http://php.net/book.pdo
[Learn about PDO connections]: http://php.net/pdo.connections

[pdo]: http://php.net/pdo
[mysql]: http://php.net/mysql
[mysqli]: http://php.net/mysqli
[pgsql]: http://php.net/pgsql
[mssql]: http://php.net/mssql
28 changes: 28 additions & 0 deletions _posts/07-02-01-Databases_MySQL.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,28 @@
---
isChild: true
title: MySQL Extension
anchor: mysql_extension
---

## MySQL Extension {#mysql_extension_title}

The [mysql] extension for PHP is no longer in active development, and is [officially deprecated as of PHP 5.5.0]
[mysql_deprecated], meaning that it will be removed within the next few releases. If you are using any functions that
start with `mysql_*` such as `mysql_connect()` and `mysql_query()` in your applications then these will simply not be
available in later versions of PHP. This means you will be faced with a rewrite at some point down the line, so the
best option is to replace mysql usage with [mysqli] or [PDO] in your applications within your own development schedules
so you won't be rushed later on.

**If you are starting from scratch then absolutely do not use the [mysql] extension: use the [MySQLi extension][mysqli],
or use [PDO].**

* [PHP: Choosing an API for MySQL][mysql_api]
* [PDO Tutorial for MySQL Developers][pdo4mysql_devs]


[mysql]: http://php.net/mysql
[mysql_deprecated]: http://php.net/migration55.deprecated
[mysqli]: http://php.net/mysqli
[pdo]: http://php.net/pdo
[mysql_api]: http://php.net/mysqlinfo.api.choosing
[pdo4mysql_devs]: http://wiki.hashphp.org/PDO_Tutorial_for_MySQL_Developers
74 changes: 74 additions & 0 deletions _posts/07-03-01-Databases_PDO.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,74 @@
---
isChild: true
title: PDO Extension
anchor: pdo_extension
---

## PDO Extension {#pdo_extension_title}

[PDO] is a database connection abstraction library &mdash; built into PHP since 5.1.0 &mdash; that provides a common
interface to talk with many different databases. For example, you can use basically identical code to interface with
MySQL or SQLite:

{% highlight php %}
<?php
// PDO + MySQL
$pdo = new PDO('mysql:host=example.com;dbname=database', 'user', 'password');
$statement = $pdo->query("SELECT some\_field FROM some\_table");
$row = $statement->fetch(PDO::FETCH_ASSOC);
echo htmlentities($row['some_field']);

// PDO + SQLite
$pdo = new PDO('sqlite:/path/db/foo.sqlite');
$statement = $pdo->query("SELECT some\_field FROM some\_table");
$row = $statement->fetch(PDO::FETCH_ASSOC);
echo htmlentities($row['some_field']);
{% endhighlight %}

PDO will not translate your SQL queries or emulate missing features; it is purely for connecting to multiple types of
database with the same API.

More importantly, `PDO` allows you to safely inject foreign input (e.g. IDs) into your SQL queries without worrying
about database SQL injection attacks.
This is possible using PDO statements and bound parameters.

Let's assume a PHP script receives a numeric ID as a query parameter. This ID should be used to fetch a user record
from a database. This is the `wrong` way to do this:

{% highlight php %}
<?php
$pdo = new PDO('sqlite:/path/db/users.db');
$pdo->query("SELECT name FROM users WHERE id = " . $_GET['id']); // <-- NO!
{% endhighlight %}

This is terrible code. You are inserting a raw query parameter into a SQL query. This will get you hacked in a
heartbeat, using a practice called [SQL Injection]. Just imagine if a hacker passes in an inventive `id` parameter by
calling a URL like `http://domain.com/?id=1%3BDELETE+FROM+users`. This will set the `$_GET['id']` variable to `1;DELETE
FROM users` which will delete all of your users! Instead, you should sanitize the ID input using PDO bound parameters.

{% highlight php %}
<?php
$pdo = new PDO('sqlite:/path/db/users.db');
$stmt = $pdo->prepare('SELECT name FROM users WHERE id = :id');
$stmt->bindParam(':id', $_GET['id'], PDO::PARAM_INT); // <-- Automatically sanitized by PDO
$stmt->execute();
{% endhighlight %}

This is correct code. It uses a bound parameter on a PDO statement. This escapes the foreign input ID before it is
introduced to the database preventing potential SQL injection attacks.

* [Learn about PDO]

You should also be aware that database connections use up resources and it was not unheard-of to have resources
exhausted if connections were not implicitly closed, however this was more common in other languages. Using PDO you can
implicitly close the connection by destroying the object by ensuring all remaining references to it are deleted, i.e.
set to NULL. If you don't do this explicitly, PHP will automatically close the connection when your script ends -
unless of course you are using persistent connections.

* [Learn about PDO connections]


[pdo]: http://php.net/pdo
[SQL Injection]: http://wiki.hashphp.org/Validation
[Learn about PDO]: http://php.net/book.pdo
[Learn about PDO connections]: http://php.net/pdo.connections
Original file line number Diff line number Diff line change
Expand Up @@ -42,7 +42,7 @@ That is a good start. Put those two items in two different files and you've got

Create a class to place that method in and you have a "Model". Create a simple `.php` file to put the presentation
logic in and you have a "View", which is very nearly [MVC] - a common OOP architecture for most
[frameworks](/#frameworks_title).
[frameworks](/#frameworks).

**foo.php**

Expand Down
File renamed without changes.
2 changes: 1 addition & 1 deletion _posts/08-04-01-Compiled-Templates.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ isChild: true
anchor: compiled_templates
---

## Compiled Templates {#compiled_templates}
## Compiled Templates {#compiled_templates_title}

While PHP has evolved into a mature, object oriented language, it [hasn't improved much][article_templating_engines] as
a templating language. Compiled templates, like [Twig] or [Smarty]*, fill this void by offering a new syntax that has
Expand Down
6 changes: 6 additions & 0 deletions _posts/15-01-01-Documenting.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
---
anchor: documenting
title: Documenting your Code
---

# Documenting your Code {#documenting_title}
41 changes: 0 additions & 41 deletions _posts/15-01-01-Resources.md

This file was deleted.

6 changes: 4 additions & 2 deletions _posts/17-01-01-PHPDoc.md → _posts/15-02-01-PHPDoc.md
Original file line number Diff line number Diff line change
@@ -1,8 +1,10 @@
---
anchor: phpdoc
isChild: true
title: PHPDoc
anchor: phpdoc
---

# PHPDoc {#phpdoc}
## PHPDoc {#phpdoc_title}

PHPDoc is an informal standard for commenting PHP code. There are a *lot* of different [tags] available. The full list
of tags and examples can be found at the [PHPDoc manual].
Expand Down
49 changes: 0 additions & 49 deletions _posts/16-01-01-Community.md

This file was deleted.

5 changes: 5 additions & 0 deletions _posts/16-01-01-Resources.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
---
anchor: resources
---

# Resources {#resources_title}
9 changes: 9 additions & 0 deletions _posts/16-02-01-From-the-Source.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
---
isChild: true
anchor: from_the_source
---

## From the Source {#from_the_source_title}

* [PHP Website](http://php.net/)
* [PHP Documentation](http://php.net/docs.php)
16 changes: 16 additions & 0 deletions _posts/16-03-01-People-to-Follow.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,16 @@
---
isChild: true
anchor: people_to_follow
---

## People to Follow {#people_to_follow_title}

* [Rasmus Lerdorf](http://twitter.com/rasmus)
* [Fabien Potencier](http://twitter.com/fabpot)
* [Derick Rethans](http://twitter.com/derickr)
* [Chris Shiflett](http://twitter.com/shiflett)
* [Sebastian Bergmann](http://twitter.com/s_bergmann)
* [Matthew Weier O'Phinney](http://twitter.com/mwop)
* [Pádraic Brady](http://twitter.com/padraicb)
* [Anthony Ferrara](http://twitter.com/ircmaxell)
* [Nikita Popov](http://twitter.com/nikita_ppv)
8 changes: 8 additions & 0 deletions _posts/16-04-01-Mentoring.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
---
isChild: true
anchor: mentoring
---

## Mentoring {#mentoring_title}

* [phpmentoring.org](http://phpmentoring.org/) - Formal, peer to peer mentoring in the PHP community.
19 changes: 19 additions & 0 deletions _posts/16-05-01-PHP-PaaS-Providers.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,19 @@
---
isChild: true
anchor: php_paas_providers
---

## PHP PaaS Providers {#php_paas_providers_title}

* [PagodaBox](https://pagodabox.com/)
* [AppFog](https://appfog.com/)
* [Heroku](https://devcenter.heroku.com/categories/php)
* [fortrabbit](http://fortrabbit.com/)
* [Engine Yard Cloud](https://www.engineyard.com/products/cloud)
* [Red Hat OpenShift Platform](http://openshift.com)
* [dotCloud](http://docs.dotcloud.com/services/php/)
* [AWS Elastic Beanstalk](http://aws.amazon.com/elasticbeanstalk/)
* [cloudControl](https://www.cloudcontrol.com/)
* [Windows Azure](http://www.windowsazure.com/)
* [Google App Engine](https://developers.google.com/appengine/docs/php/gettingstarted/)
* [Jelastic](http://jelastic.com/)
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
---
isChild: true
anchor: frameworks
anchor: frameworks
---

## Frameworks {#frameworks_title}
Expand Down
Loading

0 comments on commit 93a3f81

Please sign in to comment.