Tag Archives: html

Inline Scripts with Zend_View_Helper_InlineScript

javascript, micro tutorial, PHP, zend framework, , , , , , , ,

Once I’ve posted about Zend Framework and script injections into the view of the app. However back than I didn’t mentioned the way the scripts can be injected on whatever place into the markup. This job’s done by Zend_View_Helper_InlineScript and that’s only an abstraction over the HeadScript.

However thus the PHP code goes quite clean and maintainable.

$scripts = $this->view->inlineScript();
$scripts->appendFile('/scripts/production.js');

This is quite interesting because in the case of multiple scripts you can chain them into this:

$scripts = $this->view->inlineScript();
$scripts->appendFile('/scripts/production.js')
            ->appendFile('/scripts/development.js')

But that’s not everything. Although it looks very pretty and clean, PHP gives you the correct syntax of something like this:

$scripts = $this->view->inlineScript();
$scripts
            ->appendFile('/scripts/production.js')
            ->appendFile('/scripts/development.js')

And that’s particularly good when it comes to fast switching between production and development scripts includes.

$scripts = $this->view->inlineScript();
$scripts
 //        ->appendFile('/scripts/production.js')
            ->appendFile('/scripts/development.js')

You’d ask why I’d to comment my script includes. Because as it appears to be fashionable the JavaScripts are concatenated and compressed. This gives you performance benefits on the client side when downloading and executing the script. So it’s usual to have one compressed/minified and several development scripts. That’s why this commenting strategy is very useful.

Detecting POST Requests in Zend Framework

micro tutorial, PHP, zend framework, , , , ,

Pure PHP

Pure phpiers are using used to something like detecting a submit in the _POST array.

if (isset($_POST['submit']) { ... }

Of course for this you’ve to be sure the HTML contains an submit type element with name attribute equal to “submit”.

The Zend Framework’s Way

Simply replace the line above with:

if ($this->getRequest()->isPost()) { ... }

This is way better than the first example. It detects the request method, not an array element!?

How to Sanitize User Input in PHP?

micro tutorial, PHP, , , , , , , ,

It’s a question almost every PHP developer asks yourself. By me the most simple way to sanitize the user input is to save everything in the database with no loosing of tags or whatever HTML markup and than on displaying this on the client side to strip_tags if needed.

In example when saving a HTML formatted text you can use simply the htmlspecialchars method

$description = htmlspecialchars($_POST['description']);

Than you can be sure everything’s in the database, but it’s not actually HTML. Thus you don’t have any tags at all in the database field.

When you show this in the client side and you’d like to strip some tags, i.e. to keep only the <a> tag you can do this:

echo strip_tags(htmlspecialchars_decode($description), '<a>');

That’s the most simple way to keep everything as the original source. By me it’s better to keep whatever HTML markup there is on the input.

CSS word-wrap to Wrap Long Words

web development, ,

So you have a very very long word in some HTML element:

verylongwordverylongwordverylongwordverylongwordverylongwordverylongwordverylongwordverylongwordverylongwordverylongwordverylongwordverylongwordverylongwordverylongwordverylongwordverylongwordverylongword

As you can see what we miss is line breaks. This is a rare situation, but it may occur when you paste links or something. So the question is how to fix it.

Pure CSS needed

Simply add a fixed width and word-wrap.

width:400px;
word-wrap:break-word;

Now the result is obvious:

verylongwordverylongwordverylongwordverylongwordverylongwordverylongwordverylongwordverylongwordverylongwordverylongwordverylongwordverylongwordverylongwordverylongwordverylongwordverylongwordverylongword

Secure Forms with Zend Framework

micro tutorial, PHP, zend framework, , , , , , , , , , ,

Maybe the correct title is not “with Zend Framework”, but “with PHP”, because the general approach I used is purely PHP and no Zend Framework dependency is used. However let me mention that ZF allows you to build forms with Zend_Form, which gives you an abstraction over the HTML forms with many goodies like validation, filtering and protection.

Zend_Form and Zend_Form_Element_Hash

Although the technique I’m using is doing the same thing, note that in ZF there’s a Zend_Form_Element_Hash which generates and validates the form, thus protecting you from CSRF attacks. The thing is that I didn’t use it because the form I’m protecting is not generated with Zend_Form, and I cannot benefit from everything ZF is giving to me. However you can easily reproduce the basic strategy with every form and every framework till it’s written in PHP.

What’s the solution?

It’s pretty simple and it’s described many many times around the web, simply generate a random hash, a possible solution is to use uniqid in combination with mt_rand and md5, thus you’d get quite strong hash.

Step two is to pass this generated hash, also stored in the session in a hidden value of the form. Of course now the most asked question is: but that’s visible to the source and thus everybody will have a valid hash.

There’s the trick. OK everybody will have a valid hash, but on submit the hash is validated against the SESSION variable, and as you know the session is specified between the browser (client) and the web server. Although the attacker may have a valid hash he must execute the attacking script from the same domain, possibly with the same browser, which makes the task rather difficult.

An Example

Let me show a breve example, it may help make things clearer.

1. First step – start the session

<?php
session_start();
?>

2. Second step – validate the form against the $_SESSION and generate a valid token

<?php
if (isset($_POST['name']) && $_POST['token'] == $_SESSION['token'])
    echo $_POST['name'];
else
    echo 'dont hack';
 
$_SESSION['token'] = md5(uniqid('test', true));
?>

3. Third step – make a form

<form method="POST" action="">
<input type="hidden" value="<?php echo $_SESSION['token'] ?>" name="token" />
<input type="text" name="name" value="stoimen" />
<input type="submit" name="submit" />
</form>

Demo here.

For more to test this you may try to make the same form somewhere else on the web and to point the action to http://www.stoimen.com/projects/php.secure.forms/! Without the session validation it’s absolutely sure you can post on the attacked server.

P.S. Now I’ve to admit that this have nothing to do with Zend Framework, however it’s good practice and thus may be used with every framework.