Looking for more information on how to do PHP the right way? Check out PHP: The Right Way

SitePoint PHP Blog:
A Comprehensive Guide to Using Cronjobs
Mar 31, 2016 @ 12:18:47

If you've ever wanted to learn about cron jobs, how to set them up and what kind of functionality they provide then the SitePoint PHP blog has the post for you. In this comprehensive guide to cron you learn about these topics and more.

There are times when there’s a need for running a group of tasks automatically at certain times in the future. These tasks are usually administrative, but could be anything – from making database backups to downloading emails when everyone is asleep. [...] This article is an in-depth walkthrough of this program, and a reboot of this ancient, but still surprisingly relevant post.

They start by going through some of the basic terminology and syntax, where the cron files live and what a typical file format looks like. Also included are instructions on:

  • how to edit the cron correctly (crontab)
  • the structure of each cron entry
  • how to have it run at the time you want
  • editing another user's crontab
  • cron permissions
  • redirecting output

They also talk about executing PHP in a cron job, how to prevent overlaps with a "lock" file . There's also a mention of Anacron as a replacement for cron and a few helpful hints to help you debug when things go wrong.

tagged: cron cronjob tutorial comprehensive guide configuration execution

Link: http://www.sitepoint.com/a-comprehensive-crash-course-into-cronjobs/

Juozas Kaziukenas:
From PHP to Machine Code
Mar 28, 2016 @ 09:41:29

In his latest post Juozas Kaziukenas shares a video of his "From PHP to Machine Code" talk he presented at the PHP UK Conference earlier this year (2016).

I recently gave a talk at a few conferences titled “From PHP to Machine Code”. It explains how compilers and interpreters work in general, where are the performance gains to be found and how I applied all of that to build PyHP. PyHP is a little toy project which showcases the basics of taking source code of a programming language and executing it.

As I mention a few times in the talk, it is completely and utterly useless for practical use, but it’s one of the fundamental skill-sets for any programmer. I think knowing how a bunch of text makes a computer do things at the low level is required knowledge for everyone.

The video of the presentation is embedded in the post or you can watch it directly over on YouTube if you'd like. In it he walks you through the entire process that happens from the time the PHP is executed all the way down to opcodes and bytecodes.

tagged: video presentation phpuk16 conference bytecode compiler machine code execution

Link: https://juokaz.com/blog/from-php-to-machine-code.html

Johannes Schlüter:
References - Still bad in PHP 7
Feb 19, 2016 @ 09:18:45

Johannes Schlüter has a post to his site that talks about references in PHP 7 and how they're "still bad" based on some of his previous findings.

I'm known for telling "Don't use references" (also as video) as those cause different problems (i.e. with foreach) and hurt performance. The reason for the performance loss is that references disable copy-on-write while most places in PHP assume copy-on-write. Meanwhile we have PHP 7. In PHP 7 the internal variable handling changed a lot among other things the reference counting moved from the zval, the container representing a variable, to the actual element. So I decided to run a little test to verify my performance assumption was still valid.

He includes his testing code that calls a function (strlen) in a loop and compares the handling against two methods, one passing by reference the other not. The results are shown in time taken to execute. He compares the results for PHP 5 and PHP 7, noting that PHP 7 is marginally better when passed by value, by-reference is still about the same.

tagged: reference php7 php5 compare value byreference byvalue test benchmark execution

Link: http://schlueters.de/blog/archives/180-References-Still-bad-in-PHP-7.html

Zend Developer Zone:
Developing a Z-Ray Plugin 101
Nov 04, 2015 @ 10:44:13

The Zend Developer Zone has posted a tutorial showing you the basics of creating a plugin for Z-Ray, the tool from Zend that provides details and metrics around the execution of your application.

One of the great things about Z-Ray is the ability to extend it to display any info you want about your app. This is done by creating plugins. In this tutorial I’m going to describe how to create a new Z-Ray plugin. I’ll be supplying code snippets to insert in the various plugin files but of course feel free to replace it with your own code when possible.

They start by describing how Z-Ray shows its data and offering two options - the default panel or a custom panel. They choose the custom panel and show you how to:

  • create the template for the panel
  • make the module directory and zray.php
  • and Modules.php file to define the plugin

There's also a section on how the Z-Ray plugin traces through the execution of your application, illustrating with a DummyClass. They include the code to set up the Trace and define which methods and actions to watch. Finally they relay this information back out to the custom panel view via Javascript collection and the code to show the results.

tagged: zray plugin custom performance dummyclass execution tracer tutorial

Link: http://devzone.zend.com/6826/developing-a-z-ray-plugin-101/

Creating flamegraphs with XHProf
Jul 30, 2015 @ 10:08:27

The Platform.sh blog has a post showing you how to create flamegraphs with XHProf for your application's execution and overall performance. A "flamegraph" is just a different sort of graph stacking up the execution times for the methods and functions in your application so they look more like a "flame" than just numbers.

One of the most frequent needs a web application has is a way to diagnose and evaluate performance problems. Because Platform.sh already generates a matching new environment for each Git branch, diagnosing performance problems for new and existing code has become easier than ever to do without impacting the behavior of a production site. This post will demonstrate how to use a Platform.sh environment along with the XHProf PHP extension to do performance profiling of a Drupal application and create flamegraph images that allow for easy evaluation of performance hotspots.

While they show it at work on a Platform.sh instance, the method can be altered slightly to work with your own application with the right software installed. Their example uses the brendangregg/FlameGraph library to do the majority of the graphing work. He shows how to have the code switch on XHProf during the execution and where to put the file for later evaluation. They include the resulting directories and files created from the execution and how to view the resulting (SVG-based) graphs directly in a browser.

tagged: xhprof flameframe execution performance graph tutorial platformsh

Link: https://platform.sh/2015/07/29/flamegraphs/

Lorna Mitchell:
Code Reviews: Before You Even Run The Code
Jun 02, 2015 @ 09:50:01

Lorna Mitchell has posted a list of helpful tips to perform good code reviews on submissions before even trying to run the code for correctness.

I do a lot of code reviewing, both in my day job as principal developer and also as an open source maintainer. Sometimes it seems like I read more code than I write! Is that a problem? I'm tempted to say that it isn't. To be a good writer, you must be well-read; I believe that to be a good developer, you need to be code-omnivorous and read as much of other people's code as possible. Code reviews are like little chapters of someone else's code to dip into.

She offers several tips you can follow to make the reviews you do more effective including:

  • Ensuring you understand the change
  • Are the changes where you'd expect?
  • Does the commit history make sense
  • Evaluate the diff to ensure the changes themselves are valid

She only then recommends trying out the code. Following the suggestions above can help ferret out issues that may be hidden by just running the code and not fully looking into the changes.

tagged: code review suggestion list opinion before execution

Link: http://www.lornajane.net/posts/2015/code-reviews-before-you-even-run-the-code

Qandidate.com Blog:
Fault tolerant programming in PHP
Jul 17, 2014 @ 10:44:04

The Qandidate.com blog has a new post today looking at fault tolerant programming in PHP applications. Essentially, this means writing your code so that error conditions are handled gracefully and with as little impact as possible.

In your application, every time you call an "external" service you are vulnerable to the failure in that service. That either might be a third party API being down, your database being unresponsive or unexpected errors from the 3rd party library you are using. With many developers and companies being interested in composing applications out of microservices at the moment, guarding for failures because of broken dependencies gets even more important.

They describe a situation where data is coming from an external source (an inventory service) and a timeout or connection failure occurs. They propose a sort of "circuit breaker" to be put in place to protect the application, fail fast on error and maybe even retry until the request is successful. They also point out a library from oDesk, Phystrix, that allows for fault tolerant execution through a wrapper that traps errors and deals with them instead of just breaking. This is the first part of a series, so in part two they'll show the library in use along with the React HTTP client.

tagged: fault tolerant application phystrix library execution failure

Link: http://labs.qandidate.com/blog/2014/07/14/fault-tolerant-programming-in-php/

Lorna Mitchell:
PHP 5.6 Benchmarks
May 19, 2014 @ 09:32:18

Lorna Mitchell has put together a set of benchmarks for PHP 5.6 comparing them to the three previous minor versions, PHP 5.5, 5.4 and 5.3 based around the same setup as her previous benchmarks of PHP 5.4.

A while ago I did some benchmarks on how different versions of PHP perform in comparison to one another. This isn't a performance measure in absolute terms, this was just benchmarking them all on the same laptop while it wasn't doing anything else, and averaging the time it took to run the benchmark script. Recently I ran it again for versions PHP 5.3 through PHP 5.6 and I thought I'd share my results.

There's a steady drop in execution time over the series of versions, with PHP 5.6 coming in the shortest. She also includes the actual numbers of the results in case you'd like to chart them out yourself.

tagged: php56 benchmark previous version execution time

Link: http://www.lornajane.net/posts/2014/php-5-6-benchmarks

Chris Jones:
Tracing Silex from PHP to the OS with DTrace
Nov 06, 2013 @ 12:31:23

Continuing on with his look at using DTrace in with PHP, Chris Jones has a new post in the series showing how to add traces to Silex-based applications, including sample output.

In this blog post I show the full stack tracing of Brendan Gregg's php_syscolors.d script in the DTrace Toolkit. The Toolkit contains a dozen very useful PHP DTrace scripts and many more scripts for other languages and the OS. For this example, I'll trace the PHP micro framework Silex, which was the topic of the second of two talks by Dustin Whittle at a recent SF PHP Meetup. His slides are at Silex: From Micro to Full Stack.

He includes a brief guide to getting the DTrace support up and running based on instructions in a previous post based on some pre-build Oracle linux packages. He links to the latest DTrace Toolkit and the downloads page to get the latest version of Silex. He sets up a super-basic Silex application (one route, "hello") and shows how to run the DTrace against it. His sample output shows both the PHP files being called and the functions/methods called inside them resulting in an output over a thousand lines long.

tagged: silex dtrace trace execution oracle package toolkit tutorial

Link: https://blogs.oracle.com/opal/entry/tracing_silex_from_php_to

Composer still susceptible to remote code execution via MITM
Oct 03, 2013 @ 11:26:15

In this recent post to Reddit.com, a point is brought up about the popular PHP package manager, Composer about it being susceptible to a common attack called the "Man in the Middle". This issue on the project's Github repository talks more about it:

Composer runs code from HTTP sources without validating the source of the download or the code downloaded. As such, trivial man-in-the-middle attacks through any number of vectors (dns, networking, local server exploit, etc) will result in execution of code of an attackers choosing at the userlevel of the user running composer. (Typically a developer account)

Replace getcomposer.org for a given network perspective by replacing it with a malicious http instance (eg by changing the DNS locally, at the lan, at an isp or hosting provider dns resolver, or globally or equally easily by replacing a route to the legitimate server (eg arpspoof)) . The http server instance is configured to serve a malicious /composer.phar and a /version url that produces random data. When users run self-update, the malicious code will be downloaded and run as the user that is executing the self-update command.

As of yet some patches and ideas have been proposed to correct this issue, but it hasn't been resolved and is currently listed as a "blocker" on the project. One suggestion, signing packages, seems to be the front-runner in the current discussion, something that package managers for other languages have already implemented (like npm for Node.js and pip for Python).

tagged: composer package manager remote code execution attack maninthemiddle mitm

Link: http://www.reddit.com/r/PHP/comments/1nkmw8/composer_still_susceptible_to_remote_code/