PHP

There are 25 posts filed in PHP (this is page 4 of 5).

Using PHP_SELF Safely and submitting forms to the same page

I’ve lost count of the number of times i’ve seen this bit of HTML / PHP:

">

Looks pretty harmless doesn’t it, but it is a pretty dangerous shortcut to use. Imagin I get a user to visit the page the form is on by following this link, maybe hiding it in a short url:

http://example.com/formpage.php?">

where I’ve added some html into the url which contains a script tag.

I could use this method to grab all your cookies and log in as you, or send ajax requests back to the site on your behalf. All very frightening. The quick solution is to turn html characters into their harmless entities using the php function htmlspecialchars. So the code would be

But wait! The best way to submit to the same page with a form is to use and empty action attribute. It’s valid and it works.

Don’t believe me? Go tell Jesse. He also wrote about empty action attributes.

[carousel keywords=”php” tag=”fetchit-21″]

Writing a PHP Coda Plugin

Sound like a right pain in the arse? It’s surprisingly simple actually….

The steps to creating a simple locally run php Coda plugin:

You must have php installed and running locally.
Start the plugin file with theses lines:

#!/usr/bin/php -q

(no space between < and ?php)  Where /use/bin/php is the path to you local php install  Continue reading →

Facebook Preload FQL Help

Facebook have a beta feature on their platform api called Preload FQL. It allows you to specify an FQL call to take place before the request for the page is made from your servers. This could save a full round trip of api request if you’re clever about it.

Well the wiki article is quite large but misses a few points I thought it worth noting…

Continue reading →