Facebook has a code leak, or at least it did for several hours due to a server being misconfigured. Facebook, like a lot of other Web 2.0 sites use PHP. PHP not being a compiled language sits in source code form on the server waiting to be interpreted instead of executed like the output of other languages (C++ for example)... which means that if you can get the web server to not interpret the code before serving it or you can get into the web root by some other means outside the the web server (FTP, remote terminal, etc.), you can view all the source code.... the "secret sauce" is out!
Luckily, there are some simple rules of thumb and settings that can stop this from happening. A good blog post to read on the subject was written by Nic Cubrilovic over at his blog.
Some folks have done a quick critique on the released code. For me personally, it's nice to get confirmation that a big site like Facebook is also using the Smarty template engine. They don't seem to be as object oriented as my code though... I wonder if this is intentional, for speed perhaps, or just a legacy framework that never was updated?
Don't let PHP leakage happen to you.
Showing posts with label PHP. Show all posts
Showing posts with label PHP. Show all posts
Saturday, August 11, 2007
Wednesday, July 25, 2007
Taking advantage of the Feebies!
I'm getting to the point with my project where I need to start testing the ability of my code to send of emails. I tried using the SMTP/POP3 services associated with my Gmail account, but I found it to be incompatible with both the native mail function and PEAR mail objects in PHP. What I needed was a mail server for my domain.
I originally thought about using EC2 (the Elastic Computing Cloud) from Amazon for hosting and I may still do so in that my architecture is designed to load balance out to child servers once a user logs into a main web server, but what I need right now is a cheep Linux web and mail server.... and I found it!
As you recall, I bought a template from TemplateMonster.com for my project's look and feel. The email I received which explained how I could access the template I had purchased also listed some "bonus offers", including 1 year free hosting from Globat.com. After looking around the Globat site to get details on their capabilities I signed up using the coupon from Template Monster.
For security, in additional to a credit card, Globat uses a system where an automated system calls you up to confirm your phone number. You press a web form button and a voicemail robot calls you up 30 seconds later on the phone number you provided during registration and reads off a three digit code, you type that number in the web form and you are informed that your site will be provisioned very soon and that you'll be receiving an email with your new server information shortly. So I waited... and waited... and waited... finally I went to bed, assuming it would be provisioned overnight.
The next morning I woke up to find nothing. I opened a trouble ticket with Globat billing and soon received an email back saying that I would have to fax a copy of my credit card and drivers license to them. I thought my website was being provisioned, but I guess not. I faxed the front of my credit card and drivers license to the phone number provided. Meanwhile, I received a second email stating that in order to provision my website I would need to fax both the front AND BACK of my credit card and my drivers license to a completely different fax number. Now I was confused.... I was just about to fire off another email when, KABOOM, a email came in with my provisioning info (URLs, password, etc.).
So, besides the provisioning hoops they make you jump through, I have been pretty happy with their service. I don't have terminal access to the web server, but I can FTP and use their control panel to control my server (MySQL, email accounts, etc.) My only hiccup so far was finding out that they use port 587 instead of the standard port 25 for SMTP... I had to use their online chat system to speak to a help desk person to figure this out as this information is not mentioned anywhere in their FAQs or online help.
Web Hosting (1 year from Globat.com): $95.40 + $19.99 setup - TemplateMonster.com coupon = $0
Total cost of project to date: $59.99
I originally thought about using EC2 (the Elastic Computing Cloud) from Amazon for hosting and I may still do so in that my architecture is designed to load balance out to child servers once a user logs into a main web server, but what I need right now is a cheep Linux web and mail server.... and I found it!
As you recall, I bought a template from TemplateMonster.com for my project's look and feel. The email I received which explained how I could access the template I had purchased also listed some "bonus offers", including 1 year free hosting from Globat.com. After looking around the Globat site to get details on their capabilities I signed up using the coupon from Template Monster.
For security, in additional to a credit card, Globat uses a system where an automated system calls you up to confirm your phone number. You press a web form button and a voicemail robot calls you up 30 seconds later on the phone number you provided during registration and reads off a three digit code, you type that number in the web form and you are informed that your site will be provisioned very soon and that you'll be receiving an email with your new server information shortly. So I waited... and waited... and waited... finally I went to bed, assuming it would be provisioned overnight.
The next morning I woke up to find nothing. I opened a trouble ticket with Globat billing and soon received an email back saying that I would have to fax a copy of my credit card and drivers license to them. I thought my website was being provisioned, but I guess not. I faxed the front of my credit card and drivers license to the phone number provided. Meanwhile, I received a second email stating that in order to provision my website I would need to fax both the front AND BACK of my credit card and my drivers license to a completely different fax number. Now I was confused.... I was just about to fire off another email when, KABOOM, a email came in with my provisioning info (URLs, password, etc.).
So, besides the provisioning hoops they make you jump through, I have been pretty happy with their service. I don't have terminal access to the web server, but I can FTP and use their control panel to control my server (MySQL, email accounts, etc.) My only hiccup so far was finding out that they use port 587 instead of the standard port 25 for SMTP... I had to use their online chat system to speak to a help desk person to figure this out as this information is not mentioned anywhere in their FAQs or online help.
Web Hosting (1 year from Globat.com): $95.40 + $19.99 setup - TemplateMonster.com coupon = $0
Total cost of project to date: $59.99
Tuesday, June 26, 2007
Smarty wasn't so hard...
Smarty is a template engine for PHP.
Smarty was relatively easy to install compared to PHP / MySQL without using WAMP. Luckily someone had already installed the package on Windows and there is a link to his instructions right at the top of the "Quick Install" page. My only issues were that the package came only in a tar file instead of a zip file (I found an open source product to open the tar files called 7-Zip) and the instructions for windows installation had a slight typo (the cache and compile directories were different in the demo than in the installation instructions).
I quickly read through the documentation. It seems pretty straight forward. I look forward to using Smarty for the presentation interface of my new site.
Template Engine (Smarty): $0
Total cost of project to date: $7.99
Smarty was relatively easy to install compared to PHP / MySQL without using WAMP. Luckily someone had already installed the package on Windows and there is a link to his instructions right at the top of the "Quick Install" page. My only issues were that the package came only in a tar file instead of a zip file (I found an open source product to open the tar files called 7-Zip) and the instructions for windows installation had a slight typo (the cache and compile directories were different in the demo than in the installation instructions).
I quickly read through the documentation. It seems pretty straight forward. I look forward to using Smarty for the presentation interface of my new site.
Template Engine (Smarty): $0
Total cost of project to date: $7.99
Monday, June 25, 2007
WAMP rocks!
I have now officially spent way too many hours trying to get PHP to talk to MySQL. I've read several "how to" (example) sites and I still get a bunch of errors that state that my extensions (which aren't on by default upon installation) can't be found. I've installed and uninstalled several times.... if I can't get the most simplistic things to run on an operating system I've very familiarity with, this exercise does not give me a warm fuzzy feeling about launching this thing on a Linux box. So I decided to go with WAMP.
For you unfamiliar with this, WAMP stands for Windows Apache, MySQL and PHP. It installs very nicely into a directory called wamp off the root of my C drive and with the exception of having to modify the httpd.conf file (I want Apache to run off port 8080 since I'm still running IIS on this box) it was ready to go. The only thing missing was the MySQL GUI tools which I prefer over SQLiteManager that comes bundled with WAMP.
Next I'm going to tackle Smarty and Zend Framework.
For you unfamiliar with this, WAMP stands for Windows Apache, MySQL and PHP. It installs very nicely into a directory called wamp off the root of my C drive and with the exception of having to modify the httpd.conf file (I want Apache to run off port 8080 since I'm still running IIS on this box) it was ready to go. The only thing missing was the MySQL GUI tools which I prefer over SQLiteManager that comes bundled with WAMP.
Next I'm going to tackle Smarty and Zend Framework.
Saturday, June 23, 2007
The tools
I've been using Microsoft's programing and platform tools for many years. My previous start up (I'll refer to as "Company X") is completely based Microsoft technology (with the exception of some Flash on the front end). A small farm of Windows 2003 servers, running IIS .NET applications written in C# with a gigantic Microsoft SQL server behind the whole thing. This, along with bandwidth, costs us a small fortune in licenses. I've been thinking about getting my Microsoft Certified Professional Developer certification for years... I just wish I could get a bit of a kickback from them on the certification costs considering how many zillions of dollars I've made them over the years (Bill, are you listening!!!)
I'm not a stick in the mud, but I have to admit I have been a bit wary of "Open Source" tools over the years. I remember the good old days of trying to get a few programmers to work together without management. You got an interface only a geek could love written in code no one could read and God help you if you found a bug.
But since Microsoft ain't givin' it away, open source is the way to go. Let's just see how far I can stretch my Microsoft based technical skills before they snap.
I've chosen to write my application in PHP on an Apache web server with a MySQL back end. PHP seems very similar to "classic" Microsoft ASP pages and I've started to read about the Zend Framework that should remove spaghetti code from the start. I'm familiar enough with Apache to be able to configure it and get it up and running and MySQL has gone from a neat little toy to quite a powerful database. MySQL adding stored procedures as a feature on the 5.x pushed me over the edge on doubting this platform (sure the other fancy features like clusters, large scale database, monitoring tools, etc. are important... but if your database can't even create stored procedures then you are not a REAL development platform in my humble opinion).
I'm not quite ready to jump ship from my trusty Windows operating system quite yet. I have installed Apache, MySQL and PHP on my woefully underpowered home computer. Linux will have to wait until my brain stops throbbing.
Web Server (Apache): $0
Programing Language (PHP): $0
Database (MySQL - Community Version with GUI tools): $0
Total cost of project to date: $7.99
I'm not a stick in the mud, but I have to admit I have been a bit wary of "Open Source" tools over the years. I remember the good old days of trying to get a few programmers to work together without management. You got an interface only a geek could love written in code no one could read and God help you if you found a bug.
But since Microsoft ain't givin' it away, open source is the way to go. Let's just see how far I can stretch my Microsoft based technical skills before they snap.
I've chosen to write my application in PHP on an Apache web server with a MySQL back end. PHP seems very similar to "classic" Microsoft ASP pages and I've started to read about the Zend Framework that should remove spaghetti code from the start. I'm familiar enough with Apache to be able to configure it and get it up and running and MySQL has gone from a neat little toy to quite a powerful database. MySQL adding stored procedures as a feature on the 5.x pushed me over the edge on doubting this platform (sure the other fancy features like clusters, large scale database, monitoring tools, etc. are important... but if your database can't even create stored procedures then you are not a REAL development platform in my humble opinion).
I'm not quite ready to jump ship from my trusty Windows operating system quite yet. I have installed Apache, MySQL and PHP on my woefully underpowered home computer. Linux will have to wait until my brain stops throbbing.
Web Server (Apache): $0
Programing Language (PHP): $0
Database (MySQL - Community Version with GUI tools): $0
Total cost of project to date: $7.99
Subscribe to:
Posts (Atom)
