PHP-based file downloads (headers + readfile) let you do stats and auth checks, but the file still flows through PHP's memory/buffers and, under Nginx+fpm, adds extra network IO. The better path: set an X-Sendfile header and let Apache's mod_xsendfile (or the Nginx/Lighttpd equivalents) stream the file straight to the client, bypassing PHP entirely.
with 0 CommentA step-by-step walkthrough for contributing to PHP: fork php/php-src on github, clone your fork, fix the bug, commit (79-char first line, 'Fixed Bug #NNN' for bug reports), and send a pull request. New features/syntax additionally require an RFC and an email to internals@lists.php.net. Note: C89-only, no camelCase, tiny fixes go as patches to bugs.php.net.
with 0 CommentPHP is a compiled language but its compilation does no semantic optimization — it faithfully translates your code to opcodes. So the compiler won't hoist a strlen out of a loop or cache a constant string concat. You have to think about how your code actually executes, because PHP doesn't hand the optimization work to the compiler the way other languages do.
with 0 CommentTaint-0.3.0 milestone release: a PHP extension that detects XSS (tainted strings), SQL injection, and shell injection by tracking taint from $_GET/$_POST/$_COOKIE. It catches cases static analysis can't, like echo $$name, and reports the exact tainted output. Full list of taint-checking, sanitizing, and taint-preserving functions included.
with 0 CommentInspired by the RFC:Taint (which required patching PHP's data structures), I built the Taint extension instead. Enabled via php.ini (not for production), it warns whenever unescaped $_GET/$_POST/$_COOKIE data reaches echo/print/system/exec or SQL/file operations — a runtime complement to static analysis.
with 0 CommentThe 5.3.9 fix for the Hash Collisions DoS introduced a new RCE: at max_input_vars+1, an uninitialized gpc_element_p is dereferenced, and forging x as a string lets it be misread as a HashTable whose pDestructor points to attacker-controlled memory — arbitrary code execution in theory, blocked in practice by ASLR+NX. Fixed in 5.3.10.
with 0 CommentA classic debate: exceptions vs error codes. Error codes have poor information, may force signature changes, and can be silently ignored; exceptions carry rich context and survive without signature changes, but are slightly costlier and risk scattered uncaught exceptions. For small short-lived modules, skip them; for large systems, prioritize extensibility and maintainability.
with 0 CommentWhen a program exits with -1, PHP (and the shell) report 255. Because the exit value lives in the high 8 bits of the 16-bit wait() status and is read as unsigned, -1 wraps to 255. Includes the full table of Linux exit-code conventions (1, 2, 126, 127, 128+n, 130, 255).
with 0 CommentKnowing PHP's history helps you understand the path it took to become what it is today. Reproduced from the PHP Manual: the origins in PHP/FI (Rasmus Lerdorf's 1995 Personal Home Page Tools, written in Perl then C), the leap to PHP 3 (Andi Gutmans and Zeev Suraski's rewrite, extensibility, the recursive acronym PHP: Hypertext Preprocessor, released June 1998), PHP 4 (the Zend Engine, May 2000, HTTP sessions, output buffering), and PHP 5 (Zend Engine 2, new object model, July 2004).
with 0 Comment