左手代码右手诗
The usual Nginx + PHP cgi setup sets SCRIPT_FILENAME in the config file with a regex match (The PATH_INFO Problem with Nginx (PHP/fastcgi)). Today Xiaodun found a security hole in this approach.
Say you have http://www.laruence.com/fake.jpg. Craft the following URL and you can see the binary contents of fake.jpg:
http://www.laruence.com/fake.jpg/foo.php
Why does that happen?
with 0 CommentHow PHP5 objects are actually laid out in the Zend Engine: the zval and its zend_object_value, the integer handle into the global object store, what zend_object and zend_class_entry hold, mangled property names behind public/private/protected, and the 23 standard object handlers plus magic methods.
with 0 CommentI used to be confused about prototype inheritance versus identifier lookup in the JavaScript prototype chain.
For example, with the following code:
function Foo() {};
var foo = new Foo();
Foo.prototype.label = "laruence";
alert(foo.label); //output: laruence
alert(Foo.label);//output: undefined
with 0 Comment
How PHP resolves the file to load for require/include: the candidate directory list built from include_path and the current script's directory, the order in which those candidates are tried, and why directory-relative paths are resolved against the current working directory instead.
with 0 CommentRecently my company organized a PHP secure programming training, part of which touched on MySQL's "SET NAMES" and mysql_set_charset (mysqli_set_charset):
it said to prefer mysqli_set_charset over "SET NAMES". The PHP manual mentions this too, but it never explains why.
Several friends have asked me this question lately. Why, exactly?
Enough people asked that I figured it was worth writing a post devoted to the subject.
PHP variables come from two places: the code itself and the outside world (GET/POST/DB), and their lifetimes differ. This article traces the whole lifecycle of GET data, from php_request_startup and php_hash_environment through php_default_treat_data, php_strtok_r and php_register_variable_safe, showing how a query string is turned into the $_GET array.
with 0 Comment