Arm your vuvuzelas: WordPress 3.0, the thirteenth major release of WordPress and the culmination of half a year of work by 218 contributors, is now available for download (or upgrade within your dashboard). Major new features in this release include a sexy new default theme called Twenty Ten. Theme developers have new APIs that allow them to easily implement custom backgrounds, headers, shortlinks, menus (no more file editing), post types, and taxonomies. (Twenty Ten theme shows all of that off.) Developers and network admins will appreciate the long-awaited merge of MU and WordPress, creating the new multi-site functionality which makes it possible to run one blog or ten million from the same installation. As a user, you will love the new lighter interface, the contextual help on every screen, the 1,217 bug fixes and feature enhancements, bulk updates so you can upgrade 15 plugins at once with a single click, and blah blah blah just watch the video:) (In HD, if you can, so you can catch the Easter eggs.)

Source : http://wordpress.org/development/2010/06/thelonious/

Here I will use PHP and MySQL examples for its wide usage and also I’m much more comfortable with it.

Here is a basic PHP code that most developers will come up with to access the MySQL DB and get the record of a particular username submitted from a form in our website.

<?php
# Get posted username value
$userName = $_POST["usname"];
# MySQL query string to get the record of the user
$queryStr = "SELECT * FROM users WHERE usname = '$userName'");
# Output the string for debugging
echo $queryStr;
# Execute the MySQL query
$result = mysql_query($queryStr) or die(mysql_error());
?>

For example if the username that was submitted is nazly the code will output the following query and execute it.

SELECT * FROM users WHERE usname = 'nazly'

While the query works perfectly and returns the record of that particular user, a attacker can exploit this code by injecting SQL using the submission form.

For example if the attacker submits ‘ OR ‘t’='t instead of the username the query will be formed like this.

SELECT * FROM users WHERE usname = '' OR 't'='t'

When this query is executed, it will return all the records in the database since t=t will be TRUE always. The impact it will have on the website will be depend on the code after executing the query. But the important thing is someone can make the query behave differently than what we actually expected from it.

It can become deadlier than that if someone submits the following instead of the username
a’;DROP TABLE users; SELECT * FROM userinfo WHERE ‘t’ = ‘t
The query for the above value will look like this

SELECT * FROM users WHERE usname = 'a';
DROP TABLE users;
SELECT * FROM userinfo WHERE 't' = 't'

If the above query is executed, it will delete the whole users table. Similarly an attacker can inject any type of SQL code to modify/delete your tables in the database.

It is a huge security flaw in your code but newbies and even some experienced developers don’t understand the depth of problem. So developers should make sure to take precautionary measures against it.

In PHP you can use the mysql_real_escape_string() function for this task. This function will escape any special characters in the string to be used in a SQL statement.

<?php
# Get posted username value by escaping special characters
$userName = mysql_real_escape_string($_POST["usname"]);
# MySQL query string to get the record of the user
$queryStr = "SELECT * FROM users WHERE usname = '$userName'");
# Output the string for debugging
echo $queryStr;
# Execute the MySQL query
$result = mysql_query($queryStr) or die(mysql_error());
?>

If you try to inject SQL to this example, it will have no affect to the Database since the use of this function

If you are a developing a Wordpress plugin for your website, you must make sure to protect the site against SQL injection as well. Since Wordpress has its own class for database manipulation you should use the methods available in Wordpress.

The escape() function in the WPDB class is much similar to using the standard mysql_real_escape_string() function.

<?php
function myWpPluginFunc($usName){
    global $wpdb;
    $u = $wpdb->escape($usName);
    $wpdb->query("SELECT * FROM users WHERE usname = '$u'");
}
?>

But there is a better option available in Wordpress. Rather than escaping individual values you can format the SQL statement and then use the prepare() function in the WPDB class to escape the special characters. The syntax is similar to using sprintf(). Using the prepare() function, the developer is sure that all values are escaped. So less chance for errors.

<?php
function myWpPluginFunc($usName){
    global $wpdb;
    $qstr = $wpdb->prepare("SELECT * FROM users WHERE usname = %s", $usName);
    $wpdb->query($qstr);
}
?>

For more check out Data Validation in Wordpress.

I wish MySQL functions in PHP had a similar function like WordPress’s prepare()

When you use PHP’s built-in mail() function with the basic parameters, the email is sent out in plain-text.

<?php
mail("user@mydomain.com", "This is the Subject", "Hello World");
?>

To send out HTML Emails using the built-in mail() function, you will require to add another parameter where you can specify the headers of the email. Here I will add some additional headers to send out a proper a Email with a from address as well. The additional headers should be separated with a CRLF (\r\n).

<?php
#Specify a From Address
$addHeaders = "From: webmaster@ourwebsite.com" . "\r\n";
 
# Set the content-type to send out the email in HTML format
$addHeaders .= "MIME-Version: 1.0" . "\r\n";
$addHeaders .= "Content-type:text/html;charset=iso-8859-1" . "\r\n";
 
# Mail Body consists HTML tags
$mailBody = "<h1>Hello World</h1>
                 <strong>Example: </strong>How to send a HTML Email";
 
mail("user@mydomain.com", "This is the Subject", $mailBody, $addHeaders);
?>

In most of the cases there will be a requirement to embed images into HTML since the particular Email template will consists logos, photos etc.

There are actually two ways to do this.

1. You can specify absolute paths to the images on your site.
2. You can attach images into the message and link it with a special URI.

For the first method I will use the built-in mail() function itself.

<?php
#Specify a From Address
$addHeaders = "From: webmaster@ourwebsite.com" . "\r\n";
 
# Set the content-type to send out the email in HTML
$addHeaders .= "MIME-Version: 1.0" . "\r\n";
$addHeaders .= "Content-type:text/html;charset=iso-8859-1" . "\r\n";
 
# Mail Body consists Images with an absolute URI
$mailBody = "<h1>Hello World</h1>
                 <strong>Example: </strong>How to send a HTML Email with images
                 <img src=\"http://www.mydomain.com/images/photo.jpg\" />";
 
mail("user@mydomain.com", "This is the Subject", $mailBody, $addHeaders);
?>

But this method has few drawbacks. Most of the Email clients do not allow displaying images from absolute URLS coz someone can track the people who will be opening this Email. Its a privacy issue, and you can enable to display images from absolute URLS in your Email client. But you can’t expect every user who will be checking this email to have this option enabled. So the best option is to use the second method.

Using the built-in mail() function to attach images and link it with a special URI can be a painful process in my opinion. It is possible but maintaining that code can be a real pain if the Email templates have to be modified over and over again.

PHPMailer is a life saver when it comes to sending Emails using PHP. Though the built-in mail() function fulfills most of our requirements, special cases like SMTP authentication, attaching files, embedding images can be done effectively and easily with PHPMailer without doing any modification to the Server settings.

You need to download the PHPMailer library files from here first.
The following code explains how you can send Emails with inline images. I added the code for SMTP authentication as well.

<?php
require_once('class.phpmailer.php');
 
require_once("class.smtp.php"); 
 
$mail = new PHPMailer();
 
# Follwing code segment uses a SMTP server to send email
# Comment this segment if you don't wish to use a SMTP server
# Use a SMTP Server
$mail->IsSMTP();
# SMTP Server address                  
$mail->Host = "smtp.mydomain.com"; 
# SMTP Port
$mail->Port = 25;
# Enable debug for SMTP (Only for testing purposes)
# 1 = errors and messages
# 2 = messages only
$mail->SMTPDebug = 1;              
 
# From address and Name                                            
$mail->SetFrom("user@mydomain.com", "User Display Name");
 
# Message Subject
$mail->Subject  = "Message Subject"; 
 
# Enable HTML Email
$mail->IsHTML(true); 
 
# Embed Images into the Email Body
# Attach file logo.jpg and give it an identifier name 'logo'
$mail->AddEmbeddedImage('logo.jpg', 'logo', 'logo.jpg'); 
# Attach file photo.jpg and and give it an identifier name 'photo'
$mail->AddEmbeddedImage('photo.jpg', 'photo', 'photo.jpg'); 
 
# Use the identifier in the special URI format to link with the attached image
$mail->Body = "<h1>Hello World</h1>
                <img src=\"cid:logo\" />
                   <img src=\"cid:photo\" />";
 
# alternate text if the Email client doesn't support HTML
$mail->AltBody="This is text only alternative body.";
 
# Add recipients of the email
$mail->AddAddress("you@yoursite.com");
$mail->AddAddress("you@anothersite.com");
 
# Send out the email 
if(!$mail->Send()){  
    #if Email failed to send
    echo "Email not sent";
    #Debug purposes only
    echo $mail->ErrorInfo;
}
else {
    # If Email was successfully sent out
    echo "Email sent";
}
?>

I have started to write an article series on PHP which will be featured in an online magazine which is scheduled to be launched soon. I will post more details about it soon.

PHPMailer

Even though PHP's mail() function has been the No.1 choice for me to send an email, but PHPMailer is the ideal choice when I have to attach a file or send an email through a SMTP server with authentication.

php user class

This is a new addition to my list of classes. I haven't played around it yet, but php user class seems to be a cool class to manipulate users (login, logout, register, etc.) in web applications.

Magpie RSS

Magpie RSS can be used to parse RSS feeds.

htmlSQL class

This is one of the classes I came across recently. Its really cool. Using the htmlSQL class we can access HTML values by an SQL like syntax. Amazing ha?

Smarty

Smarty has always been my choice for a Template Engine.

StringParser_BBcode

BBcode is the best way to allow users to add bit of spice to their posts in forums, blogs etc. As a developer converting the BBcode to HTML can be bit of a tough job but StringParser_BBcode can do that for you.

easyFormProc

easyFormProc is a class that I developed that will create and handle all the process of the elements in a form. The processes include form posting, validation and retrieving the posted values. I have added few common validation functions. Custom functions can also be added.

jQuery

jQuery is a JavaScript Library that simplifies the way we write JavaScript. Handling events, performing animations, and adding Ajax interactions to web pages never been easier. This is a new addition to my list and I'm loving each an every moment of it.

tinyMCE

tinyMCE is a platform independent web based Javascript HTML WYSIWYG editor. It is a real life saver when it comes to developing CMS Applications that requires average users to update content.

These OpenSource projects really help a great deal in our developments. Specially when it comes to PHP, there will be always a solution already written by someone for our problem. So no need to re-invent the wheel. I would like to hear from you on PHP/Javascript projects that you have used/tried/heard during your development so it allows us to share what we know

Now when we got to the stage of launching the site, I had to repeat all the installation on a live server as they don't come with ffmpeg or ffmpeg-php pre installed. Hosting Companies seem to charge big bucks to get these installed in their servers. So we went for a Virtual Dedicated Server which had root access. It was a Cent OS 4 box and this is how I was able to get ffmpeg and ffmpeg-php installed on it.

Switch to working directory

cd /usr/local/src

Download the source files needed

wget <a href="http://www3.mplayerhq.hu/MPlayer/releases/codecs/essential-20061022.tar.bz2" target="_blank">http://www3.mplayerhq.hu/MPlayer/releases/codecs/essential-20061022.tar.bz2</a>
wget <a href="http://rubyforge.org/frs/download.php/9225/flvtool2_1.0.5_rc6.tgz" target="_blank">http://rubyforge.org/frs/download.php/9225/flvtool2_1.0.5_rc6.tgz</a>
wget <a href="http://easynews.dl.sourceforge.net/sourceforge/lame/lame-3.97.tar.gz" target="_blank">http://easynews.dl.sourceforge.net/sourceforge/lame/lame-3.97.tar.gz</a>
wget <a href="http://superb-west.dl.sourceforge.net/sourceforge/ffmpeg-php/ffmpeg-php-0.5.0.tbz2" target="_blank">http://superb-west.dl.sourceforge.net/sourceforge/ffmpeg-php/ffmpeg-php-0.5.0.tbz2</a>
wget <a href="http://downloads.xiph.org/releases/ogg/libogg-1.1.3.tar.gz" target="_blank">http://downloads.xiph.org/releases/ogg/libogg-1.1.3.tar.gz</a>
wget <a href="http://downloads.xiph.org/releases/vorbis/libvorbis-1.1.2.tar.gz" target="_blank">http://downloads.xiph.org/releases/vorbis/libvorbis-1.1.2.tar.gz</a>

Extract the Source files

bunzip2 essential-20061022.tar.bz2; tar xvf essential-20061022.tar
tar zxvf flvtool2_1.0.5_rc6.tgz
tar zxvf lame-3.97.tar.gz
bunzip2 ffmpeg-php-0.5.0.tbz2; tar xvf ffmpeg-php-0.5.0.tar
tar zxvf libogg-1.1.3.tar.gz
tar zxvf libvorbis-1.1.2.tar.gz

Create a directory for codecs & import them

mkdir /usr/local/lib/codecs/
mv essential-20061022/* /usr/local/lib/codecs/
chmod -R 755 /usr/local/lib/codecs/

Install SVN/Ruby

yum install subversion
yum install ruby
yum install ncurses-devel

Get the latest FFMPEG/MPlayer from the subversion

svn checkout svn://svn.mplayerhq.hu/ffmpeg/trunk ffmpeg
svn checkout svn://svn.mplayerhq.hu/mplayer/trunk mplayer

Fix few Lib issues for next steps

Add this line in /etc/ld.so.conf

/usr/local/lib

then run

ldconfig -v

Compile LAME

cd /usr/local/src/lame-3.97
./configure
make
make install

Compile libOGG

cd /usr/local/src/libogg-1.1.3
./configure
make
make install

Compile libVorbis

cd /usr/local/src/libvorbis-1.1.2
./configure
make
make install

Compile flvtool2

cd /usr/local/src/flvtool2_1.0.5_rc6
ruby setup.rb config
ruby setup.rb setup
ruby setup.rb install

Compile MPlayer

cd /usr/local/src/mplayer
./configure
make
make install

Compile FFMPEG

cd /usr/local/src/ffmpeg
./configure --enable-libmp3lame --enable-libogg --enable-libvorbis --disable-mmx --enable-shared
echo '#define HAVE_LRINTF 1' >> config.h
make
make install

Finalize the codec setups

ln -s /usr/local/lib/libavformat.so.50 /usr/lib/libavformat.so.50
ln -s /usr/local/lib/libavcodec.so.51 /usr/lib/libavcodec.so.51
ln -s /usr/local/lib/libavutil.so.49 /usr/lib/libavutil.so.49
ln -s /usr/local/lib/libmp3lame.so.0 /usr/lib/libmp3lame.so.0
ln -s /usr/local/lib/libavformat.so.51 /usr/lib/libavformat.so.51

Few tasks before compiling FFMPEG-PHP

yum install automake
yum install autoconf
yum install libtool

Compile FFMPEG-PHP

cd /usr/local/src/ffmpeg-php-0.5.0
phpize
./configure
make
make install

Add FFMPEG-PHP as an extension of PHP

Add this line to your php.ini file (Check the correct path of php.ini)

extension=ffmpeg.so

Restart Apache to load FFMPEG-PHP

service httpd restart

Check if FFMPEG-PHP is loaded correctly

Create a file called phpinfo.php in your webroot and add the following code

1
2
3

<?php
phpinfo();
?>

Run this page using your browser and if you see a section on ffmpeg then everything is installed and working.

What is Cake?

Cake is a rapid development framework for PHP which uses commonly known design patterns like ActiveRecord, Association Data Mapping, Front Controller and MVC. Our primary goal is to provide a structured framework that enables PHP users at all levels to rapidly develop robust web applications, without any loss to flexibility.

Initially it looked too complicated but once I sat down and read through the manual I was good to go. After reading couple of tutorials I was more on track and started doing little little stuff on my local machine.

Here are couple of tutorials that helped me to get going with CakePHP.

The Cake Blog Tutorial

Cook up Web sites fast with CakePHP

After developing few sample applications I figured out the advantages of using a Framework. Here are some of the features I love in CakePHP. I'm still in the early stages so it will be a very short list of what I have gained so far.

MVC Pattern

The MVC pattern is heavily implemented in Cake. It lets us separate our Model, Controller and View. So our application can be broken down and the code becomes more maintainable.

Read More about MVC Pattern

Scaffolding

I really like the scaffolding feature in Cake. It quickly lets us build CRUD operations of our application with very minimal amount of coding based on the design of the database. When I say minimal amount I meant it only required me to declare the variable called $scaffold in my controller. Thats it. Of course there is very less amount of flexibility using Scaffolding but its really a handy way to get a prototype model going.

Bake Script

Bake is a command line PHP script that will auto magically generate a model, controller and views based on the design of the database. After running the bake script, files are generated and written to the file system. Then we can start doing modification to those files which can be a handy method for starters.

I will post more on this topic when I get familiarized with it. Your comments on CakePHP will help me a great deal in learning more about this framework.