PHP Architect

OCTOBER 2004 VOLUME III - ISSUE 10 OCTOBER 2004 VOLUME III - ISSUE 10 www.phparch.com The Magazine For PHP Professionals TM Certification Central 5 Editorial Home turf advantage! 6 What’s New! 59 Security Corner File Uploads By Chris Shiflett 62 Tips & Tricks By John W. Holmes 65 e x i t ( 0 ) ; PHP and the Enterprise by Andi Gutmans and Marco Tabini 9 Row, Row, Row Your Boat ZIP on the Fly with the Streams API by Chung W. Leong 17 Driving Multiple Databases Anywhere by Geoffrey Mondoux 25 Roll Your Own Template by Sérgio Machado 34 Exposing Web Application Data Semantically Using RAP (RDF API for PHP) by Paul Cowles 40 Integrating PHP and OpenOffice Using PHP to Dynamically Manipulate and Convert OO documents by Bård Farstad 47 PHP-GTK and the Glade GUI Builder Building Client Applications with Style by Tony Leake 3 October 2004 ● PHP Architect ● www.phparch.com TABLE OF CONTENTS II NN DD EE XX II NN DD EE XX php|architect Features Departments TM *By signing this order form, you agree that we will charge your account in Canadian dollars for the “CAD” amounts indicated above. Because of fluctuations in the exchange rates, the actual amount charged in your currency on your credit card statement may vary slightly. Choose a Subscription type: CCaannaaddaa//UUSSAA $$ 9977 9999 CCAADD (($$6699 9999 UUSS**)) IInntteerrnnaattiioonnaall AAiirr $$113399 9999 CCAADD (($$9999 9999 UUSS**)) CCoommbboo eeddiittiioonn aadddd--oonn $$ 1144 0000 CCAADD (($$1100 0000 UUSS)) ((pprriinntt ++ PPDDFF eeddiittiioonn)) Your charge will appear under the name "Marco Tabini & Associates, Inc." Please allow up to 4 to 6 weeks for your subscription to be established and your first issue to be mailed to you. *US Pricing is approximate and for illustration purposes only. php|architect Subscription Dept. P.O. Box 54526 1771 Avenue Road Toronto, ON M5M 4N5 Canada Name: ____________________________________________ Address: _________________________________________ City: _____________________________________________ State/Province: ____________________________________ ZIP/Postal Code: ___________________________________ Country: ___________________________________________ Payment type: VISA Mastercard American Express Credit Card Number:________________________________ Expiration Date: _____________________________________ E-mail address: ______________________________________ Phone Number: ____________________________________ Visit: http://www.phparch.com/print for more information or to subscribe online. Signature: Date: To subscribe via snail mail - please detach/copy this form, fill it out and mail to the address above or fax to +1-416-630-5057 php|architect The Magazine For PHP Professionals YYoouu’’llll nneevveerr kknnooww wwhhaatt wwee’’llll ccoommee uupp wwiitthh nneexxtt S ubscribe to the print edition and get a copy of Lumen's LightBulb — a $499 value absolutely FREE † ! In collaboration with: Upgrade to the Print edition and save! For existing subscribers Login to your account for more details. EXCLUSIVE! EXCLUSIVE! † Lightbulb Lumination offer is valid until 12/31/2004 on the purchase of a 12-month print subscription. October 2004 ● PHP Architect ● www.phparch.com EE DD II TT OO RR II AA LL RR AA NN TT SS php|architect Volume III - Issue 10 October, 2004 Publisher Marco Tabini Editorial Team Arbi Arzoumani Peter MacIntyre Eddie Peloke Graphics & Layout Arbi Arzoumani Managing Editor Emanuela Corso Director of Marketing J. Scott Johnson scott@phparch.com Account Executive Shelley Johnston shelley@phparch.com Authors Paul Cowles, Bård Farstad, John Holmes, Tony Leake, Chung W. Leong, Geoffrey Mondoux, Sérgio Machado, Chris Shiflett php|architect (ISSN 1709-7169) is published twelve times a year by Marco Tabini & Associates, Inc., P.O. Box 54526, 1771 Avenue Road, Toronto, ON M5M 4N5, Canada. Although all possible care has been placed in assuring the accuracy of the contents of this magazine, including all associated source code, listings and figures, the publisher assumes no responsibilities with regards of use of the information contained herein or in all asso- ciated material. Contact Information: General mailbox: info@phparch.com Editorial: editors@phparch.com Subscriptions: subs@phparch.com Sales & advertising: sales@phparch.com Technical support: support@phparch.com Copyright © 2003-2004 Marco Tabini & Associates, Inc. — All Rights Reserved A s you may know, last month we held our first on- land conference right here in our hometown of Toronto, Canada (I refer to it as an “on-land” conference simply because our actual first conference was php|cruise, which took place onboard a cruise ship). Someone stopped me on the way to lunch one day (note to prospective discussion-starters: never stop Tabini on his way to anything related to food) and told me that he bet I couldn’t wait for the end of the con- ference to find out whether people thought it was a success. Maybe it was the fact that I had not had break- fast and it was one o’clock in the afternoon, but I sim- ply answered, in a sort-of offhand way, that I knew that the conference was a success and I didn’t need anyone to tell me so. The other person looked at me in a funny way—probably thinking that I was some sort of self- centered egomaniac (which is probably not far from the truth—I am a small business owner, after all)—and walked away. The truth, however, is that I actually meant what I said. Once you’ve booked the speakers, reserved the meeting space, fought with the hotel over every little detail and made sure that nobody was going to be asked to sleep in the broom closet, the best you can do is to sit down and watch the event unfurl in front of your eyes—and you’ll know immediately whether you’ve done your job well: if you have, you’ll get some sleep. I am happy to report that I managed eight hours of sleep during every night of the conference (to be fair, I actually overslept one day, but the main advan- tage of holding a conference five minutes from your home is that you can be there by 8AM even if you wake up at 8:15). Naturally, making the conference happen was a team effort, and we couldn’t have done it, had we not had the best speakers around and a surprisingly (in a good way) attentive audience—the number of “defections” that I noticed were very low. In the aftereffects of the conference, I received lots of congratulatory e-mails not only from the attendees, but from the speakers as well (and from significant others, who were all-around happy for the existence of the huge shopping centre right next to the hotel). To all of you, thanks for mak- ing php|w such an enjoyable experience—and see you next year! EDITORIAL Home turf advantage! TM October 2004 ● PHP Architect ● www.phparch.com 6 NNEEWW SSTTUUFFFF What’s New! NN EE WW SS TT UU FF FF PHP 5.0.2 released! “The PHP Development Team is proud to announce the immediate release of PHP 5.0.2 ( hhttttpp::////wwwwww pphhpp nneett//ddoowwnnllooaaddss pphhpp##vv55 ). This is a maintenance release that in addition to many non-critical bug fixes, addresses a problem with GPC input processing. All Users of PHP 5 are encouraged to upgrade to this release as soon as possible.” Some changes include: • Added iinntteerrffaaccee__eexxiissttss(()) and made ccllaassss__eexxiissttss(()) only return true for real classes. • Implemented periodic PCRE compiled regexp cache cleanup, to avoid memory exhaustion. • Added new boolean (fourth) parameter to aarrrraayy__sslliiccee(()) that turns on the preservation of keys in the returned array. Get the latest release from pphhpp nneett . eZ publish 3.5 alpha (unstable) eezz nnoo announces: ” eZ systems is proud to present this first alpha release of eZ publish 3.5. The new version has a lot of new features, but most noticeably, the administration frontend has been completely renewed. Of course, all the bugfixes from the 3.4 branch are incorporated in eZ publish 3.5.” Get more information from eezz nnoo phpMyFAQ 1.4.2 RC2 pphhppmmyyffaaqq ddee announces the release of phpMyFAQ 1.4.2 RC 2. ” This version includes tons of bugfixes. Do not use this version in production systems, but test this version and report bugs!” Get all the info at pphhppmmyyffaaqq ddee Phase 1.0.5 default Freshmeat.net announces: ”Phase is a very small text editor written in PHP. It uses HTML for the inter- face, and is easily customized. It can access any directory that your plat- form allows. Phase was designed for localhost access in mind (on your PC running Apache with PHP), and thus it has no security built-in.” Grab the latest download from Phase’s soureforge homepage: hhttttpp::////wwwwww vvssyy ccaappee ccoomm//~~jjeennnniinnggss//pphhaassee hhttmmll Cgiapp.class.php 1.4 (Default) What is it? “Cgiapp is a PHP framework for cre- ating reusable web applications. It is a port of the perl module CGI::Application, with a few minor additions. It uses Smarty as its default template engine. It has been tested with both PHP4 and PHP5.” To view the online documenta- tion or to download, check out the project’s homepage at: wweeiieerroopphhiinnnneeyy nneett//mmaatttthheeww//ddoowwnnllooaadd?? mmooddee==vviieeww__ddoowwnnllooaadd&&iidd==1111 October 2004 ● PHP Architect ● www.phparch.com 7 NNEEWW SSTTUUFFFF Looking for a new PHP Extension? Check out some of the lastest offerings from PECL. apd 1.0.1 hhttttpp::////ppeeccll pphhpp nneett//ppaacckkaaggee--iinnffoo pphhpp??ppaacckkaaggee==aappdd APD is a full-featured profiler/debugger that is loaded as a zend_extension. It aims to be an analog of C’s gprof or Perl’s Devel::DProf. WinBinder 0.23.080 hhttttpp::////ppeeccll pphhpp nneett//ppaacckkaaggee--iinnffoo pphhpp??ppaacckkaaggee==WWiinnBBiinnddeerr WinBinder is an extension that allows PHP programmers to build native Windows applications. It wraps a lim- ited but important subset of the Windows API in a lightweight, easy-to-use library so that program creation is quick and straightforward. id3 0.2 hhttttpp::////ppeeccll pphhpp nneett//ppaacckkaaggee--iinnffoo pphhpp??ppaacckkaaggee==iidd33 id3 enables to to retrieve and update information from ID3 tags in MP3 files. It supports version 1.0, 1.1 and 2.2+ (only reading text- and url-frames at the moment). zeroconf 0.1.2 hhttttpp::////ppeeccll pphhpp nneett//ppaacckkaaggee--iinnffoo pphhpp??ppaacckkaaggee==zzeerrooccoonnff Provides an interface for browsing and publishing network services via ZeroConf using Apple's Rendezvous/OpenTalk library. You can browse the network for specific services like database servers (PostgreSQL, Sybase, InterBase), Apple File Sharing, web services via Apache's mod_rendezvous, etc. and dis- cover the IP address and port for each found service. MaxDB™ 7.5.00.18 now available for Linux/AMD x86-64 Mysql.com announces: ”With the new version 7.5.00.18, MaxDB is shipping with 64-bit support for Linux/AMD platforms. MaxDB™ has a long history in supporting 64-bit platforms since 1995, [when] the database structures were adapted to 64-bit requirements to support the DEC OSF/1 platform. Subsequently, MaxDB was ported to the major 64-bit architectures. Since 1997/1998 IBM AIX, HP-UX, Sun Solaris, and FSC Reliant have been sup- ported. With SAP DB 7.4, the next platform joined the club in 2001: Windows (NT) on the IA64 Itanium architecture. Together with the rapid adoption of Linux, Linux on IA64 was supported in 2002 with SAP DB 7.4.03. MaxDB for HP-UX/IA64 recently has been launched and there are further ongoing porting activities for MaxDB on Linux/IBM PowerPC/64, which should become available with the MaxDB 7.6 alpha-Version in late 2004. At the end of the current list of porting targets are MaxDB on Windows/AMD x86-64 and on Windows/Intel x86-64. Summing up, this shows that MaxDB development has always been aware of the 64-bit landscape and has extensive experience with the challenges of these architectures for nearly 10 years.” Get all the latest info from mmyyssqqll ccoomm . October 2004 ● PHP Architect ● www.phparch.com 8 NNEEWW SSTTUUFFFF Check out some of the hottest new releases from PEAR. XML_Parser 1.2.1 hhttttpp::////ppeeaarr pphhpp nneett//ppaacckkaaggee//XXMMLL__PPaarrsseerr// This is an XML parser based on PHP’s built-in xml extension. It supports two basic modes of operation: “func” and “event”. In “func” mode, it will look for a function named after each element (xmltag_ELEMENT for start tags and xmltag_ELEMENT_ for end tags), and in “event” mode it uses a set of generic callbacks. Since version 1.2.0, there’s a new XML_Parser_Simple class that makes parsing of most XML documents eas- ier, by automatically providing a stack for the elements. Furthermore it’s now possible to split the parser from the handler object, so you do not have to extend XML_Parser anymore in order to parse a document with it. I18Nv2 0.8.0 hhttttpp::////ppeeaarr pphhpp nneett//ppaacckkaaggee//II1188NNvv22// This package provides basic support to localize your application, such as locale based formatting of dates, numbers and currencies. In addition, it attempts to provide an OS independent way to sseettllooccaallee(()) and aims to provide language and country names translated into many languages. LiveUser 0.13.1 hhttttpp::////ppeeaarr pphhpp nneett//ppaacckkaaggee//LLiivveeUUsseerr// LiveUser is a set of classes for dealing with user authentication and permission management. Basically, there are three main elements that make up this package: • The LiveUser class • The Auth containers • The Perm containers The LiveUser class takes care of the login process and can be configured to use a certain permission con- tainer and one or more different auth containers. That means that you can have your users’ data scattered amongst many data containers and have the LiveUser class try each defined container until the user is found. For example, you can have all website users who can apply for a new account online on the webserver’s local database. Also, you want to enable all your company’s employees to login to the site without the need to cre- ate new accounts for all of them. To achieve that, a second container can be defined to be used by the LiveUser class. You can also define a permission container of your choice that will manage the rights for each user. Depending on the container, you can implement any kind of permission schemes for your application while having one consistent API. Using different permission and auth containers, it’s easily possible to inte- grate newly written applications with older ones that have their own ways of storing permissions and user data. Just make a new container type and you’re ready to go! Currently available are containers using: PEAR::DB, PEAR::MDB, PEAR::MDB2, PEAR::XML_Tree and PEAR::Auth. HTTP_Request 1.2.3 hhttttpp::////ppeeaarr pphhpp nneett//ppaacckkaaggee//HHTTTTPP__RReeqquueesstt// Supports GGEETT//PPOOSSTT//HHEEAADD//TTRRAACCEE//PPUUTT//DDEELLEETTEE , Basic authentication, Proxy, Proxy Authentication, SSL, file uploads etc. Services_Weather 1.3.1 hhttttpp::////ppeeaarr pphhpp nneett//ppaacckkaaggee//SSeerrvviicceess__WWeeaatthheerr// Services_Weather searches for given locations and retrieves current weather data and, dependent on the used service, also forecasts. Up to now, GlobalWeather from CapeScience, Weather XML from EJSE (US only), a XOAP service from Weather.com and METAR/TAF from NOAA are supported. Further services will get includ- ed, if they become available, have a usable API and are properly documented. O ne thing about PHP that I’ve always found inter- esting is how much it resembles a real human language. It is extremely flexible. It has a few quirks and irregularities (that tend to drive beginners to the language crazy). And it has an enormous “vocabu- lary” that is constantly growing. The last time I checked, PHP has somewhere in the neighborhood of 3,500 functions. At times, browsing through the PHP manual can feel like reading the dictionary. You will come across func- tions you never knew existed, even if you are a experi- enced coder, much like fluent English speakers would find such words as ‘idempotent’ or ‘spoonerism’ in the OED. Whereas learning these obscure words probably won’t do much for your English prose, though, on more than one occasion I have stumble across func- tions that made major impacts in projects I worked on. In this article, I will share with you one of these discov- eries: the PHP Streams API. Having a Life Offline On our web site, we have a large collection of training materials designed to help people who are trying to learn foreign languages. These are highly interactive HTML pages that make heavy use of graphics and audio. The materials are contained in a database-driven content management system written in PHP. A feature that many of our users have requested is the ability to download multiple lessons in a single ZIP file. Because some of them often travel to places in the world where there is no easy access to the Internet (or where access to American web sites is blocked), they wanted to have offline versions of our lessons that they could burn onto a CD-ROM and take with them. My initial thought on how to implement this was to save the pages, along with the associated media files, to a temporary folder, then spawn an external program to compress them. I realized quickly, though, that this was unworkable. A single package could contain hun- dreds, sometimes thousands of files. Writing them all to disk would simply take too long. Either the web brows- er would drop the connection for lack of network activ- ity, or our user would run out of patience and click can- cel. Any reasonable solution therefore must involve cre- ating the ZIP file using PHP. ZIP on the Fly ZIP is a relatively straightforward file format. At Zend.com, you can find an excellent article by John Coggeshall that describes how to create one from with- in a script; I will, therefore, refrain from going into much detail here. A ZIP file consists of two major parts: the data segments and the central directory. A data segment is the compressed contents of a file sand- wiched between a header and a trailer. For each file in the archive there is a data segment. The central direc- October 2004 ● PHP Architect ● www.phparch.com 9 FF EE AA TT UU RR EE Row, Row, Row Your Boat ZIP on the Fly with the Streams API by Chung W. Leong PHP: 4.3.0+ OS: N/A Other software: N/A Code Directory: streams REQUIREMENTS In human languages, the meaning of words tends to change over time. The word “porcelain” traces its root to “porcus”—Latin for pig. Functions in PHP also have a way of acquiring capabilities beyond what their names sug- gest. Once upon a time, the “f” in [fopen()] had stood for “file.” Nowadays, [fopen()] can open many other things. [...]... 2004 ● PHP Architect ● www.phparch.com About the Author ?> With over eight years of programming and project experience, Geoffrey Mondoux is a Project Manager and Developer at Hostworks Incorporated (hostworks.ca) as well the owner and operator of SacredCore (sacredcore.net) To Discuss this article: http://forums.phparch.com/180 23 Can’t stop thinking about PHP? Write for us! Visit us at http://www.phparch.com/writeforus .php. .. confused) It can contain letters, numbers, dashes, plus signs, and periods (but not underscores) Contrary to the recommendation in RFC 1738, protocol names in PHP are case sensitive October 2004 ● PHP Architect ● www.phparch.com Listing 5 1 < ?php 2 3 class FunctionStream { 4 var $position; 5 var $data; 6 7 function stream_open($path, $mode, $options, &$opened_path) 8 { 9 $url = parse_url($path); 10... $l) { 5 $root = “func://GetPage”; 6 AddURL($list, “$root/lesson .php? lession=$l”); 7 AddURL($list, “$root/intro .php? lession=$l”); 8 AddURL($list, “$root/glossary .php? lession=$l”); 9 10 for($i = 1; $i Chung Wing Leong is a senior programmer at the National Foreign Language Center at the University of Maryland His interest is in languages, both of the human and computer varieties When not coding in PHP, he watches corny Polish soap operas to... about the connection This is the same information that PEAR::DB uses, so for more detail, see the PEAR::DB documentation for connecting, at: October 2004 ● PHP Architect ● www.phparch.com http://pear .php. net/manual/en/package.database.db.in tro-connect .php The setFetchMode() configuration method allows you to change the type of record sets returned to you, by passing in one of the PEAR::DB result set options... $root = “http://localhost”; 28 AddURL($list, “$root/lesson .php? lession=$l”); 29 AddURL($list, “$root/intro .php? lession=$l”); 30 AddURL($list, “$root/glossary .php? lession=$l”); 31 32 for($i = 1; $i 10 11 12 ”>... the Native Template engine! October 2004 ● PHP Architect ● www.phparch.com Listing 8 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 . Style by Tony Leake 3 October 2004 ● PHP Architect ● www.phparch.com TABLE OF CONTENTS II NN DD EE XX II NN DD EE XX php| architect Features Departments TM. print subscription. October 2004 ● PHP Architect ● www.phparch.com EE DD II TT OO RR II AA LL RR AA NN TT SS php| architect Volume III - Issue 10 October,