Leaking PHP all over the place... don't they have a pill for that?

Facebook has a code leak, or at least it did for several hours due to a server being misconfigured. Facebook, like a lot of other Web 2.0 sites use PHP. PHP not being a compiled language sits in source code form on the server waiting to be interpreted instead of executed like the output of other languages (C++ for example)... which means that if you can get the web server to not interpret the code before serving it or you can get into the web root by some other means outside the the web server (FTP, remote terminal, etc.), you can view all the source code.... the "secret sauce" is out!

Luckily, there are some simple rules of thumb and settings that can stop this from happening. A good blog post to read on the subject was written by Nic Cubrilovic over at his blog.

Some folks have done a quick critique on the released code. For me personally, it's nice to get confirmation that a big site like Facebook is also using the Smarty template engine. They don't seem to be as object oriented as my code though... I wonder if this is intentional, for speed perhaps, or just a legacy framework that never was updated?

Don't let PHP leakage happen to you.

WAMP rocks!

I have now officially spent way too many hours trying to get PHP to talk to MySQL. I've read several "how to" (example) sites and I still get a bunch of errors that state that my extensions (which aren't on by default upon installation) can't be found. I've installed and uninstalled several times.... if I can't get the most simplistic things to run on an operating system I've very familiarity with, this exercise does not give me a warm fuzzy feeling about launching this thing on a Linux box. So I decided to go with WAMP.

For you unfamiliar with this, WAMP stands for Windows Apache, MySQL and PHP. It installs very nicely into a directory called wamp off the root of my C drive and with the exception of having to modify the httpd.conf file (I want Apache to run off port 8080 since I'm still running IIS on this box) it was ready to go. The only thing missing was the MySQL GUI tools which I prefer over SQLiteManager that comes bundled with WAMP.

Next I'm going to tackle Smarty and Zend Framework.

The tools

I've been using Microsoft's programing and platform tools for many years. My previous start up (I'll refer to as "Company X") is completely based Microsoft technology (with the exception of some Flash on the front end). A small farm of Windows 2003 servers, running IIS .NET applications written in C# with a gigantic Microsoft SQL server behind the whole thing. This, along with bandwidth, costs us a small fortune in licenses. I've been thinking about getting my Microsoft Certified Professional Developer certification for years... I just wish I could get a bit of a kickback from them on the certification costs considering how many zillions of dollars I've made them over the years (Bill, are you listening!!!)

I'm not a stick in the mud, but I have to admit I have been a bit wary of "Open Source" tools over the years. I remember the good old days of trying to get a few programmers to work together without management. You got an interface only a geek could love written in code no one could read and God help you if you found a bug.

But since Microsoft ain't givin' it away, open source is the way to go. Let's just see how far I can stretch my Microsoft based technical skills before they snap.

I've chosen to write my application in PHP on an Apache web server with a MySQL back end. PHP seems very similar to "classic" Microsoft ASP pages and I've started to read about the Zend Framework that should remove spaghetti code from the start. I'm familiar enough with Apache to be able to configure it and get it up and running and MySQL has gone from a neat little toy to quite a powerful database. MySQL adding stored procedures as a feature on the 5.x pushed me over the edge on doubting this platform (sure the other fancy features like clusters, large scale database, monitoring tools, etc. are important... but if your database can't even create stored procedures then you are not a REAL development platform in my humble opinion).

I'm not quite ready to jump ship from my trusty Windows operating system quite yet. I have installed Apache, MySQL and PHP on my woefully underpowered home computer. Linux will have to wait until my brain stops throbbing.


Web Server (Apache): $0

Programing Language (PHP): $0

Database (MySQL - Community Version with GUI tools): $0


Total cost of project to date: $7.99