First, PHP has an internal function called function_exists() which lets you see if a function is already declared.  With namespaces and objects this isn’t a very big deal so many people don’t know about this little function, but when a built-in function comes and goes, it can be a lifesaver.

Second, PHP lets you declare a function that has global scope if you are inside a function that has global scope.

If we put them together, we have a few lines we can include before we process any headers that will declare getallheaders() if it does not exist. If it does exist, nothing changes.

if (!function_exists('getallheaders')) {
    function getallheaders() {
    $headers = [];
    foreach ($_SERVER as $name => $value) {
        if (substr($name, 0, 5) == 'HTTP_') {
            $headers[str_replace(' ', '-', ucwords(strtolower(str_replace('_', ' ', substr($name, 5)))))] = $value;
        }
    }
    return $headers;
    }
}

This idea was shamelessly lifted from the user contributed comments at http://php.net/manual/en/function.getallheaders.php. Thanks joyview at gmail dot com

Did you find this post useful or have questions or comments? Please let me know!

The post HOWTO use PHP getallheaders() under FastCGI (PHP-FPM, nginx, etc.) first appeared on Brain Goo.

By default, RHEL and OL do not provide mcrypt or libmcrypt packages for the 6.x release. Subsequently, they don’t provide PHP5 mcrypt modules either. Many PHP apps including PHPMyAdmin and Magento make use of the better crypto support of libmcrypt.

So how do you install it? You have to build it.

Part 1: Building libmcrypt

Part 1, Step 1: Install your build environment
libmcrypt is written in C++ so you need a C++ compiler.
sudo yum install gcc-c++.x86_64
That will install the compiler and dependencies.

Part 1, Step 2: Get the software
Download it here: http://sourceforge.net/projects/mcrypt/files/
Remember, download libmcrypt, not mcrypt.

Part 1, Step 3: Pick a location and unpack it
Most people install software in to the default location, but I’m going to install in to somewhere that isn’t owned by root just to illustrate how to separate your custom app components from the OS.
mkdir /myappserver
cd /myappserver
cp /path/to/download/libmcrypt-2.5.8.tar.bz2 /myappserver/
bunzip2 libmcrypt-2.5.8.tar.bz2
tar xf libmcrypt-2.5.8.tar
mv libmcrypt-2.5.8 libmcrypt-install

Part 1, Step 4: Build it!
cd libmcrypt-install
./configure --prefix=/myappserver/libmcrypt-2.5.8 --exec-prefix=/myappserver/libmcrypt-2.5.8 --disable-posix-threads
make
make install


Part 1, Step 4: Make a Symlink
In order to make life easier for upgrades later, symlink libmcrypt to the version you built. This will let you compile a new version later and simply move the symlink. Anything else you build against this package will only need to know about the symlink.
ln -s /myappserver/libmcrypt-2.5.8/ /myappserver/libmcrypt

You have successfully installed libmcrypt. You can move it from server to server by simply copying /myappserver/libmcrypt-2.5.8/ to any other machine.

Part 2: Building the PHP Module
Building the PHP module can be done in one of two ways.

1. Build your own PHP and copy the module to an existing PHP installation
2. Build your own PHP and use it

I’m not going to do a full tutorial on building PHP here (Option 2). Just note that the steps are the same as Option 1, but instead of copying the extention in to your PHP installation, compile PHP with all the modules you need, then install and use the PHP you built.

Option 1: Build your own PHP and copy the module to an existing PHP installation

Part 2, Option 1, Step 1: Install your build environment
PHP is written in C so you need a C compiler.
sudo yum install gcc.x86_64
That should give you everything you need to compile PHP.

Part 2, Option 1, Step 2: Get the software
MAKE SURE YOU DOWNLOAD THE PHP VERSION THAT MATCHES YOUR INSTALLATION
Download it here: http://us3.php.net/downloads.php

For this tutorial, I used PHP 5.5.13

Part 2, Option 1, Step 3: Pick a location and unpack it
I’m going to use a non-standard location since I’m just building the software. I’m not going to use it from here.
mkdir /myappserver
cd /myappserver
cp /path/to/download/php-5.5.13.tar.bz2 /myappserver/
bunzip2 php-5.5.13.tar.bz2
tar xf php-5.5.13.tar
cd php-5.5.13

Part 2, Option 1, Step 4: Build it!
./configure --prefix=/myappserver/php-5.5.13 --exec-prefix=/myappserver/php-5.5.13 --with-mcrypt=/myappserver/libmcrypt
make

Note the --with-mcrypt=/myappserver/libmcrypt option. This points to the symlink above. If you need to upgrade libmcrypt later or rebuild the module for any reason, you don’t need to worry about what version of libmcrypt you have, just use the symlink!

You should now be able to find your module in /myappserver/php-5.5.13/ext/mcrypt

Part 2, Option 1, Step 5: Use it!

• Copy the mcrypt directory above in to the ext directory in your PHP installation.
• Restart your Apache server

Test it with a little PHP code:
<?php
extension_loaded('mcrypt') ? print 'Mcrypt is working' : print 'Mcrypt is not working';
?>

Did you find this post useful or have questions or comments? Please let me know!

The post HOW TO Install mcrypt for PHP on RedHat Linux 6 and Oracle Linux 6 first appeared on Brain Goo.

The Filter capabilities in PHP 5.3 and above are very powerful and save a ton of effort, but the passing of flags to various filter functions is described minimally as a “bitwise disjunction of flags”. This means you need to pass a bitwise conjunction of flags.

Here’s the english translation:
Pass a pipe-separated list of flags.

That’s it. You need to use the logical ‘OR’ to create a parameter the parser will understand.

If you want to use filter_var() to sanitize $string with FILTER_SANITIZE_STRING and pass in FILTER_FLAG_STRIP_HIGH and FILTER_FLAG_STRIP_LOW, just call it like this:

$string = filter_var($string, FILTER_SANITIZE_STRING, FILTER_FLAG_NO_ENCODE_QUOTES | FILTER_FLAG_STRIP_HIGH | FILTER_FLAG_STRIP_LOW);

That’s it. Nothing magical.

The same goes for passing a flags field in an options array in the case of using callbacks. Here is an extended version of the example from php.net:

$var = filter_var($string, FILTER_SANITIZE_SPECIAL_CHARS,
array('flags' => FILTER_FLAG_STRIP_LOW | FILTER_FLAG_ENCODE_HIGH));

Did you find this post useful or have questions or comments? Please let me know!

The post HOW TO Use Multiple Filter Flags in PHP Filter Functions first appeared on Brain Goo.

This is very useful for things like password generators.

To see how to do this in Python, check out this post: …howto-create-a-random-alpha-numeric-string-in-python

To see how to do this in Perl check out this post: …howto-create-a-random-alpha-numeric-string-in-perl


<?php
function makeID($size = 6) {
    global $makeIDpool;
    $makeIDpool = array_merge(range(0,9), range('a','z'), range('A','Z'));
    $append = function ($value){ global $makeIDpool; return $makeIDpool[rand(0,count($makeIDpool) - 1)]; };
    return implode('', array_map($append, range(0,$size - 1)));
}
?>


Example:

This code sample:


print makeID().'<br />';
print makeID(10).'<br />';
print makeID(20).'<br />';
print makeID(1).'<br />';


Will print something like this:

KNHtkn
2z8ksLDSkp
bfn5X5jF5dTZ3itt9HWy
q

Did you find this post useful or have questions or comments? Please let me know!

The post HOWTO: Create a random alpha-numeric string in PHP first appeared on Brain Goo.

The problem lies in escaping characters in your SQL queries. Do I addslashes()? Is magic_quotes_gpc enabled?

My quick-and-dirty solution is the following function:


function request_cleanup()
{
  if(get_magic_quotes_gpc() == 0)
  {
    foreach($_REQUEST as $req_key => $req_value)
    {
      $_REQUEST[$req_key]=addslashes($_REQUEST[$req_key]);
    }
  }
}


By calling that function on every page that deals with inserting content in to the database, I know will will get my content escaped correctly.

Of course it escapes all submitted content, including that which isn’t going in to the database so don’t forget to stripslashes() when you are working with data that doesn’t need it.

Example:

request_cleanup();

print "Your note was: $confirmation";


The post Quick Character Escaping in PHP first appeared on Brain Goo.

WARNING!  As of this writing, this information pertains to the 2.x branch of phpBB.  I strongly recommend you upgrade to the latest phpBB.  As of April 28, 2009 that version is 3.0.4.  Please see http://phpbb.com

NOTICE: I have an updated phpBB patch for the 3.0.x version of phpBB.  Please search this blog for phpBB or look at the phpbb category for more tips and tricks.

In your active template file profile_add_body.tpl find the line:

<!-- Visual Confirmation -->

ABOVE that line, add:

<!-- BOT HACK -->
   <tr>
      <td class="row1"><span class="gen">Are you a robot? *</span></td>
      <td class="row2"><select class="post" name="imarobot">
      <option value="yes">yes</option>
      <option value="yes">of course</option>
      <option value="nope">Humans choose this one</option>
      </select> <span class="gen">Bot buster... choose the right one.</span></td>
   </tr>
<!-- BOT HACK -->

In your forum file includes/usercp_register.php find this section of code:

   else if ( $mode == 'register' )
   {
      if ( empty($username) || empty($new_password) || empty($password_confirm) || empty($email) )
      {
         $error = TRUE;
         $error_msg .= ( ( isset($error_msg) ) ? '<br />' : '' ) . $lang['Fields_empty'];
      }

AFTER that part, add this:

// BOT HACK
         if ( empty($HTTP_POST_VARS['imarobot']) )
         {
            die('NO BOTS');
         }
         else
         {
            if ($HTTP_POST_VARS['imarobot'] != 'nope')
            {
               die('NO BOTS');
            }
         }
// BOT HACK

And there you go.

The post Stop spam-bots in PHPBB 2.x. Cheap, easy BOT stopper first appeared on Brain Goo.

Remember, never trust data submitted by site visitors. Sanitize the heck out of it.

Jelly and Custard has an excellent explanation of PHP Header Injection when using the PHP mail() function.

http://www.jellyandcustard.com/2006/02/24/email-header-injection-in-php/

http://www.jellyandcustard.com is an excellent PHP blog.

The post PHP Header injection first appeared on Brain Goo.