In PHP 5.2.x, invokeArgs throws "Invocation of function who() failed" when the target declares a by-reference parameter, while call_user_func works. The cause is no_separation in zend_call_function.
with 0 CommentBefore PHP 5.3 the only ways to pass a callback were a function name string or the return value of create_function. This post walks through how create_function works internally, then looks at how PHP 5.3's Closure objects bind external variables as static properties.
with 0 CommentToday, Tank asked about this regex:
/<script>.*?</script>/is
When the string to be matched is longer than 100014, it will not produce the correct result:
$reg = "/<script>.*?</script>/is"; $str = "<script>********</script>"; //length greater than 100014 $ret = preg_replace($reg, "", $str); //returns NULL
Does a regex impose a length limit on the string it matches?
with 0 CommentThe usual Nginx + PHP cgi setup sets SCRIPT_FILENAME in the config file with a regex match (The PATH_INFO Problem with Nginx (PHP/fastcgi)). Today Xiaodun found a security hole in this approach.
Say you have http://www.laruence.com/fake.jpg. Craft the following URL and you can see the binary contents of fake.jpg:
http://www.laruence.com/fake.jpg/foo.php
Why does that happen?
with 0 CommentHow PHP5 objects are actually laid out in the Zend Engine: the zval and its zend_object_value, the integer handle into the global object store, what zend_object and zend_class_entry hold, mangled property names behind public/private/protected, and the 23 standard object handlers plus magic methods.
with 0 CommentI used to be confused about prototype inheritance versus identifier lookup in the JavaScript prototype chain.
For example, with the following code:
function Foo() {};
var foo = new Foo();
Foo.prototype.label = "laruence";
alert(foo.label); //output: laruence
alert(Foo.label);//output: undefined
with 0 Comment
How PHP resolves the file to load for require/include: the candidate directory list built from include_path and the current script's directory, the order in which those candidates are tried, and why directory-relative paths are resolved against the current working directory instead.
with 0 CommentRecently my company organized a PHP secure programming training, part of which touched on MySQL's "SET NAMES" and mysql_set_charset (mysqli_set_charset):
it said to prefer mysqli_set_charset over "SET NAMES". The PHP manual mentions this too, but it never explains why.
Several friends have asked me this question lately. Why, exactly?
Enough people asked that I figured it was worth writing a post devoted to the subject.