Zend PHP Certification Study Guide- P11

12 7090 ch11 184 7/16/04 8:45 AM Page 184 Chapter 11 Security What is the purpose of the open_basedir directive? A To indicate the directory that include() calls will use as a base B To restrict file open access to a specific directory C To set the working directory D To allow additional file open access than that granted by safe_mode Answer B is correct Answer A is incorrect because the behavior of include() is unchanged Answer C is incorrect because the working directory does not depend on open_basedir Answer D is incorrect because open_basedir is not affected by whether safe_mode is enabled 10 Which of the following activities can safe_mode help prevent? A Browsing the filesystem with a specially crafted PHP script B Writing a Bash shell script to read session data C Browsing the filesystem with a specially crafted Perl script D Accessing another user’s database Answer A is correct because you’ll only be able to browse files that have the same ownership as your PHP script Answers B and C are incorrect because safe_mode cannot affect scripts written in other languages Answer D is incorrect because safe_mode does not attempt to prevent database access Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark 13 7090 ch12 7/16/04 8:44 AM Page 185 12 Debugging and Performance M AKING MISTAKES IS HUMAN, and so is fixing them In your day-to-day programming adventures, it’s inevitable to introduce bugs in your PHP code, especially when you’re writing very complex applications with tens of thousands of lines of code spread across tens of files When you’re prototyping an application, being able to avoid common programming mistakes is important to ensure that your code will be well-written from the very start In this chapter, we’ll provide you with some guidelines on writing efficient code, debugging faulty scripts, and identifying bottlenecks when performance becomes an issue for both you and your clients Terms You’ll Need to Understand n n n n n n n Bug Coding standard Code readability Comparison operators Performance Caching Portability Techniques You’ll Need to Master n n n n Writing readable code Proper commenting Comparing heterogeneous data Debugging Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark 13 7090 ch12 186 7/16/04 8:44 AM Chapter 12 n n n n Page 186 Debugging and Performance Identifying and preventing performance bottlenecks Preventing performance issues Improving database performance Using content and bytecode caching Coding Standards Writing your code in a structured manner is, perhaps, the smartest decision you can make Although there aren’t any predefined coding standards that everyone in the programming community recognizes as better than the rest, deciding from the very beginning on a set of conventions will go a long way toward helping you make fewer mistakes Documenting your code is particularly important.To make this job—probably at the top of the Ten Most Hated Tasks of programmers worldwide—a bit easier, you can even use one of the many automated tools available on the market, such as PHPDocumentor, which can extract documentation directly from your code if you structure your comments in a particular way Regardless of how you introduce them in your applications, good comments and documentation will make sharing your code with other members of your team easier, as well as make sure that you’ll remember what it does when you get back from that threeweek vacation Remember, preventing bugs is much better than hunting for them Extra whitespace and empty lines, although unimportant as far as the functionality of your code is concerned, can be an extremely valuable tool for writing better code: if ($foo == ‘bar’) { $i = 0; /** * foreach loop, get the content out of it */ foreach ( … ) { } } By separating your code into logical groups, your source will be cleaner and easier to read Also, indenting each line according to the code block it belongs to helps you figure out immediately what the structure of your script is Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark 13 7090 ch12 7/16/04 8:44 AM Page 187 Coding Standards Flattening if Statements Consider the following snippet of code: if ($is_allocated) { if ($has_been_mangled) { if ($foo == 5) { print “foo is 5”; } else { print “You entered the wrong data!”; } } else { return false; } } else { return false; } As you can see, the many nested if statements here cause the code to look very busy and difficult to read An easy way to improve the situation consists of “flattening” your if statements so that you can achieve the minimum level of indentation without compromising either the functionality of your code or its performance.The preceding script, for example, could be rewritten as follows: if (!$is_allocated) { return false; } if (!$has_been_mangled) { return false; } if ($foo == 5) { print “foo is 5”; Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark 187 13 7090 ch12 188 7/16/04 8:44 AM Chapter 12 Page 188 Debugging and Performance } else { print “You entered the wrong data!”; } This approach gives you a better structure with fewer levels of nesting so that your code is easier to understand Note that the type of operations performed is pretty much the same as before—and the elimination of two else statements will make the code easier to parse for the interpreter Splitting Single Commands Across Multiple Lines One of the great things about PHP is that it doesn’t require you to write a single statement all on one line of code In fact, any statement can be split across an arbitrary number of lines without any change in its functionality—provided, of course, that the split doesn’t take place in the middle of a text string.This is particularly useful when you have a complex line of code that spans a large number of characters: $db->query(“select foo, bar, mybar as foobar from tbl1 where tbl1.mybar=’foo’”); This database query is split over several lines.The main advantage here is that you can immediately see what the query does, which tables are involved, and which conditions you are placing in the where clause If the same query had been placed all on the same line, understanding its purpose would have taken a lot more effort, and the risk of introducing new bugs by modifying it would have been greater Concatenation Versus Substitution If you are inserting data into a long string—such as a database query—you can use the concatenation operator, but doing so often limits your ability to read the query properly: $db->query (“insert into foo(id,bar) values(‘“.addslashes($id) “‘,’”.addslashes($bar).”’)”); On the other hand, you could just use one of the you: printf() functions to the job for $db->query(sprintf(“insert into foo(id,bar) values(‘%s’,’%s’)”, addslashes($id), addslashes($bar) )); Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark 13 7090 ch12 7/16/04 8:44 AM Page 189 One Equal, Two Equals, Three Equals As you can see, the entire statement is now a lot easier to read, although you will lose some performance by switching to sprintf() from the concatenation operator, which is native to the PHP interpreter and doesn’t require the execution of any external libraries The literals in the string passed to sprintf() will be substituted with the values of the parameters passed afterwards in the order in which they appear in the call Combined with the ability to split your commands over several lines, this approach can enhance readability to a large degree Choose Your Opening Tags Carefully Mixing PHP and HTML code is one of the characteristics of PHP that make it both easy to use and powerful, although it’s easy to abuse this capability and come up with code that is difficult to read When writing code for an application that could run on heterogeneous systems, it’s always a good idea to be very careful about which opening tag styles you use In Chapter 1, “The Basics of PHP,” we mentioned that there are several of them, but only the canonical tags are fully portable Short tags (which include the echo tag