So, now it is settled, I want to stay inside the corporate firewall, but I want each application isolated from the next, and by the way, there is no budget for any of this. I posted about three PaaS providers a while back, and started thinking that what I really needed was PaaS, but I needed to be able to host the PaaS environment inside a corporate LAN. Off to search the web. Surprisingly, there were not just a ton of viable results in that search. Even more surprising...hard to find one with a "download here" button. No matter how I searched though, one company & product kept popping up: Stackato by ActiveState. The words "Free Micro Cloud" were a very encouraging sign. So let's take this thing for a spin and see just how easy it is...

He walks you through the installation process - downloading the VMs, setting up the initial configuration and how to use the command line tool to deploy your own applications (several come preconfigured though). He also includes an example configuration (YAML) you can use to configure custom applications and some sample code showing a database connection.

Welcome back to the fourth part of the "PHP's Source Code for PHP Developers" series, in which we'll cover how PHP arrays are internally represented and used throughout the code base.

He starts with an obvious foundation: "everything's a hash table" (even properties, classes and yes, arrays). He describes what a hash table is and talks about two of the most commonly used versions of it in the PHP source - HashTable and Bucket. He gets into their usage a bit and compares this to the corresponding PHP code that uses a standard array.

In the previous part ircmaxell explained where you can find the PHP source code and how it is basically structured and also gave a small introduction to C (as that's the language PHP is written in). If you missed that post, you probably should read it before starting with this one. What we'll cover in this article is locating the definitions of internal functions in the PHP codebase, as well as understanding them.

He starts with a basic example - a string function, strpos. He shows a handy searching trick to help find the actual function definition and which matches should be given priority. He lays out a typical skeleton of a PHP function definition and gets into some detail as to what this particular function does (in C). He briefly mentions the Zend Engine functions and a look ahead to finding classes and methods.

Back in September, Socorro received a security bug relating to the method we were using for processing inputs for the duration of certain reports. The vulnerability included a proof of concept, with an alert box popping up on production when the link was followed. [...] I was quite surprised at the root cause of the vulnerability. We had opted to compare the incoming data against a known set of valid values - a common practice when whitelisting certain inputs. [...] As expected, when this [example] code is tested, a string of '3' and an integer of 3 work equally well, and a string of '5' and an integer of 5 fail equally.

This automatic casting that PHP does internally caused another issue as well - if the string passed in even started with a valid number from their whitelist set, it still passed.

At first we thought this surely had to be a bug in PHP. However, Laura Thomson told me "If comparing two values, type juggling is performed first, which means that the string is converted to a number. This is done by taking the first number found in the string. So this may be confusing/a quirk/a gotcha, but it isn't a bug." And she's right: this isn't a bug per se, but it's certainly an interesting "gotcha."

There are a lot of talks today about "Built-in web server" [for PHP] RFC by Moriyoshi Koizumi. There is a nice discussion on Hacker News (and 2 threads on reddit: here and here). So, here's couple of cents from me.

Alexey agrees with the suggestion and notes it'd be a welcome addition to the PHP toolset. He also reminds developers that it wouldn't (and shouldn't) be used in production.

PHP is one of the most popular scripting languages used to develop applications on the web today. As a result, internet.com has a multitude of PHP resources throughout our network of websites. Here are some of our best PHP resources, along with some featured tutorials and out-of-network resources that you may not know about.

The grouping of links also include external resources like the main PHP site and Zend's website.

The issue Derick pointed out:

In PHP 5.3 this would alias the class Interval in the namespace PEAR::Date to the class Interval. For now, this code would work just fine. However, if PHP would introduce a class "Interval" at some point in the future (and PHP can do this as it owns the global namespace) then the above code would suddenly stop working.

Greg's patch makes it possible to "override" the internal class if need be, making it so that code currently working wouldn't break. All it takes is to "use" is like you normally would and and the magic happens behind the scenes.

I was wondering today why use mbstring rather than iconv in Dokeos, and honestly I didn't remember exactly why I had chosen mbstring in the past, but finding information about the *differences* between the two. [...] Searching a bit more, I found a PPT presentation from Carlos Hoyos on Google.

Essentially, it boils down to how the library is integrated - mbstring is bundled and iconv is pulled from an external source. So, if you're looking for maximum portability, he recommends mbstring.

If you try to get informations about parameters from methods of internal classes - forget that. Examining several internal classes my key findings are: either there is no information about parameters available and the reflection API says the method does not have any parameters, or the information about the parameter is wrong.

He includes code examples along side the output from the script to illustrate his point.

he bad news: mysqlnd might have bugs. How to report and debug these bugs - using mysqli_debug() - is subject of this posting.

They step you through the process for finding out what's causing the problems (internal versus external debugging) and how to make client traces with the mysqi extension to make it even easier for the developers to track down the problem. They also suggest a few things to send along with your bug report - like the PHP code calling it or the SQL you're using to select/update/insert/delete the data from your database.