Yesterday, I presented and demonstrated SCA for PHP at the Zend/PHP Conference and Expo 2006. You can download the slides here. The session was well attended and I got some good questions at the end. A few people came up asking for the samples I demonstrated (showed how one line of code could be modified to switch from providing a soap/http service to a json-rpc service - I think it's cool, but then I would :-D ).
We are in the process of moving the SCA code into PECL. It will appear in the recently renamed SDO project, which is now called SCA_SDO. I'll put the samples in as part of the move into PECL and blog once this is completed.
I'll blog more about the Zend Conference when I get back...Graham Charters
Service Component Architecture v0.1.0 (alpha) released
We've just made the first release of the Service Component Architecture (SCA) for PHP prototype available.SCA allows you to turn PHP classes into Web services by adding a few simple phpDocumentor-style annotations.SCA will automatically generate WSDL for these services when required. SCA also uses the same annotations technique to allow PHP classes to declare dependencies on other Web services or PHP classes.At runtime it will then 'inject' proxies for these dependencies, which can then be used to call the Web services or classes
Documentation, download package and samples can be found here.A very short whitepaper, which goes through the main concepts of SCA is also available. Our goal is to make this properly open source in the next few weeks, so people can report bugs, submit patches and contribute.We have a phpsoa Google Group where people can discuss SCA and its 'sister' project, SDO.
If you get the chance to give SCA a try, and you have comments/feedback, good or bad, we'd love to hear from you. You can contact us via the Google Group, or via the email addresses for the maintainers of the SDO project.
We recently shipped version 1.0.3 of SDO for PHP
. This was the first version to ship with the C++ SDO library from the Apache Tuscany
open source project - in this case the Milestone 1 release, which was their first packaged version. Currently it's bundled with the SDO for PHP libraries, but as it becomes more stable, we should be able to use Tuscany as an external library too.
Apache Tuscany has both C++ and Java implementations of the SCA specification, as well as SDO. There's a growing community developing lots of exciting new stuff, who post news to http://apache-tuscany.blogspot.com/.
Caroline Maynard[Read More]
Some people who attended my SDO for PHP
talk at php|tek in Orlando wanted to be able to try out the demonstration programs. I've recently uploaded them to CVS
. If you'd like to try them out, copy the whole /scenarios directory under your document root, and browse to it. Some of the commentary is bit terse, so do let us know if you can't make them work or find any problems.Incidentally, we've recently published a new article Streamline working with XML in PHP using Service Data Objects
, which uses the same Half-baked Blog
program shown in the demonstrations to illustrate working with SDOs and XML.
People at the talk had some interesting ideas about how they might use SDOs to solve problems - if you did go home and try them out, I'd be pleased to hear how you got on, and any opinions you'd like to share, positive or negative. I had great time at php|tek, especially hearing about so many diverse areas that people are working in - everyone seems to have something special about their requirements or their environment. I also liked watching the alligators in the lake, and taking my morning swim in the open air (not in the lake).
In recent months we've had some requests from developers who would like to contribute to the SDO for PHP project. We recently added a Contributor License Agreement file to the project, so we can now welcome any developer who would like to be involved. There are instructions in the file about where to send it. Our CLA is based on the Apache CLA, and does not ask you assign the rights to your code, or inhibit you from using it for any other purpose. It simply serves to state the the code is yours to give, and that you do not impose any restrictions on its use.
Caroline Maynard[Read More]
What's the problem?
I recently investigated the values of the PHP and Windows working directory for a variety of environments. My reason for doing so was that I could never quite understand how relative pathnames were resolved, and if you want to write code that will run, for example, both under Zend Studio, from the command line, and Apache, it matters. And it is not surprising that I never understood it either - every environment is different.
PHP working directory
The PHP working directory (from the PHP getcwd() function) will determine how PHP will interpret relative pathnames to PHP functions like PHP’s fopen(), file_get_contents() etc, as well as affect how files are found with include() and require().
Windows working directory
The Windows working directory (obtained with the Windows getcwd() call from direct.h) will determine how relative pathnames are resolved by Windows fopen() calls from within extensions.
Here are the results which illustrate that of the five different environments in which one of our PHP scripts might find itself running, not one of them is the same as any other. In conclusion, be warned: the chances of the Windows and the PHP working directories being the same is slim.
|Environment ||PHP cwd (from PHP’s getcwd()) ||Windows cwd (from windows getcwd() in direct.h)|
|Zend Studio running internal debugger ||location of the script ||C:\Program Files\Zend\ZendStudioClient-5.1.0\bin\php5 |
|Zend Studio running server debugger ||C:\Program Files\Apache Group\Apache2\htdocs ||C:\Program Files\Apache Group\Apache2 |
|php-cli ||same as the Windows cwd|
|normal command line working directory |
|php-cgi ||location of the script ||normal command line working directory |
|Apache ||location of the script ||C:\Program Files\Apache Group\Apache2 |
What does it mean for me
The upshot of this is that you had better be careful which world you are in when you try to do things with files. Here’s something you can usually not do, which you might think you could: use the C library fopen() within an C or C++ extension on a pathname that you were given by PHP. Your PHP script may be able to open the file with PHP’s fopen() but that will be relative to PHP’s working directory and not Windows’. As you see from the table above these are rarely the same.
One thing that was throwing me for a long time is that we were passing PHP-working-directory-based relative pathnames into our SDO extension, which was then passing them on to libxml2 which was happily able to open them. It took a while for it to dawn on me (although I had come across it before) that the PHP libxml extension makes a call to libxml2 when PHP starts, and registers its own file handlers, so that any files that libxml2 needs to work with are actually resolved by the libxml extension, against PHP’s working directory and not Windows’. Thus without realising, our extension was working with PHP-based pathnames. Consequently we could pass the filename to libxml2 and it would be fine, but we could not fopen() the file ourselves.
Perhaps everyone else in the world already knew this and I am just catching up :-)
As promised in my previous entry (albeit a little late), here are the SDO slides
I used at the PHP Quebec conference
The conference was very well organised and there were a good number of very interesting talks. They don't appear to be available on the conference site, but Chris Shiflett's blog has a list of quite a few that are available elsewhere.
The SDO presentation was well received, with some very good feedback. The demos went well and were free from "gremlins", with a number of people expressing an interest in getting hold of the code. I'll see about adding them as samples to the SDO package.
Graham Charters[Read More]
Tomorrow I leave for Montreal to attend the PHP Quebec 2006 conference
. It promises to be a really good event, with presentations from many prominent community members, including Rasmus
I myself will be presenting and demonstrating SDO for PHP
, and given I have a 90 minute slot, I thought it might be an opportunity to look into some of the theory. To that end I've been doing a bit of "design pattern archaeology" - hunting for design patterns after the fact. Armed with Martin Fowler's, "Patterns of Enterprise Architecture"
, and with help from other SDO project members, we quickly identified the following four:
- Data Transfer Object: An object that carries data between processes in order to reduce the number of method calls
- Mapper: An object that sets up a communication between two independent objects.
- Unit of Work: Maintains a list of object affected by a business transaction and coordinates the writing out of changes and the resolution of concurrency problems.
- Optimistic Offline Lock: Prevent conflicts between concurrent business transactions by detecting a conflict and rolling back the transaction.
There are others, but there's only so far you can take this kind of activity!
The demos I have show how to use SDO to work with relational and XML data. They include a simple Contacts management application, a noddy Blog/RSS feed, and WSDL generation.
If you're not able to make it to Montreal and are interested in SDO, the docs can be found here
, and I'll post the presentation on this blog after the conference.Graham Charters
At last month's Zend Conference I was fortunate enough to attend Christian Wenz's tutorial on XML and Web services. This covered the use of technologies such as DOM and SimpleXML for working with XML data. As the title of this blog entry suggests, SDO provide a simple way to construct or extend XML documents.
The example below shows an XML schema used by an application which records information regarding quotations people have made (Thanks go to Christian Wenz for the scenario which is from his book entitled, "PHP Phrasebook", SAMS Publishing.). An XML document following this schema will contain a quotes
element containing a number of quote
elements, each of which consists of a phrase
and an author
element and a year
<?xml version="1.0" encoding="UTF-8"?>
<xs:element maxOccurs="unbounded" ref="quote"/>
<xs:attribute name="year" use="required" type="xs:integer"/>
<xs:element name="phrase" type="xs:string"/>
<xs:element name="author" type="xs:string"/>
The code extract below shows how SDO can be used to load the XML schema and a quotes
document and then add a new quote
entry to that document.
1 $xmldas = SDO_DAS_XML::create('./quotes.xsd');
2 $xdoc = $xmldas->loadFromFile('./quotes.xml');
3 $quotes = $xdoc->getRootDataObject();
4 $quote = $quotes->createDataObject('quote');
5 $quote->phrase = $_POST['quote'];
6 $quote->author = $_POST['author'];
7 $quote->year = $_POST['year'];
8 $xmldas->saveDocumentToFile($xdoc, './quotes.xml');
The eight lines of code above do the following:
1. create and configure a new XML Data Access Service (DAS) with an XML schema.
2. use the XML DAS to load and validate an instance document.
3. retrieve the quotes currently contained in the document.
4-7. create a new quote and populate it with information posted from a form.
8. save the quotes (including the new quote) back to the xml file.
The same task takes 14 lines of code in DOM and in my opinion, DOM code is far less intuitive. I found it more difficult to understand the data structure from the code, because of the generic XML vocabulary of the DOM APIs. However, it is worth noting that the XML Data Access Service requires the existence of an XML schema, whereas DOM does not.
Because SDO knows about the XML schema, it lets you access the elements and attributes directly by name. The same is true of SimpleXML, however SDO can also be used to create new documents from scratch, or in this case, new fragments of XML. SimpleXML is limited in this regard because it only has knowledge of an instance document, rather than the schema. Again, it is worth noting that SimpleXML does not require the existence of an XML schema.
The SDO API does not reveal which names correspond to XML elements and which to XML attributes, but still outputs XML which follows the provided XML schema. Personally, I think this is quite neat, because often the choice to use an element or attribute in schema design is arbitrary and down to personal taste. This article
nicely sums up the feelings I had when I created my first ever XML schema.Graham Charters
I've had a few requests for the SDO
slides used at the Zend/PHP Conference
. A pdf version of the presentation can be found here
The slides give an overview of the main concepts behind SDOs, followed by a few scenarios showing how to use them to work with relational and XML data. As I mentioned in a previous blog
, the presentation could have done with a few more scenarios to address SDO's strengths and the questions which arose, but unfortunately time was short. I therefore intend to use this blog to cover these over time.
If you have any comments or questions on the SDO project
, please let us know.Graham Charters
I presented an introduction to SDO
for PHP at the Zend/PHP Conference and Expo a couple of weeks ago. The session was very well attended and there were some good questions at the end. Overall the presentation went well, but I could have done with more scenarios to address SDO's real strengths and the questions which arose. To continue the discussion and help clarify a few things, I thought I'd blog a little about SDO. So here goes...
One question which came up during the presentation was to do with the Relational Database Access Service and whether it optimizes the SQL queries it creates in order to remove redundancies. The short answer is, "no", but that's simply because it doesn't have to; SDO does the optimization for it.
The first thing to note is that SDOs keep a change summary, however, this summary only holds the information required to re-create the data object's original state, not any intermediate states. This is important when it comes to understanding how the updates are optimized.
Consider an example of a contact database (as described in this article
). The contact database table contains a "shortname" column (e.g. "Fred") and a "fullname" column (e.g. "Frederick Flintstone"). Let's assume we've retrieved a set of contact SDOs from the database into the variable
. We then perform the following four modifications:
// Create and set a new contact.
// The change summary records the fact that the new contact was created.
$new_contact = $result->createDataObject('contact');
$new_contact->shortname = 'Bertie';
// Delete the new contact.
// The change summary entry for the new contact is cleared.
// It's as if 'Bertie' never existed.
// Change the name of the first contact to "Sally Smith".
// Sally was previously called "Sally Barker", so the old
// name is stored in the change summary.
$result->contact->fullname = 'Sally Smith';
// Change the name of the first contact to "Sally Jones".
// The intermediate value of "Sally Smith" is not recorded
// in the change summary.
$result->contact->fullname = 'Sally Jones';
The create and delete cancel each other out and the intermediate value of "Sally Smith" is not recorded, so the resulting change summary would only show that "Sally Barker" had changed her name to "Sally Jones". Consequently, when the Relational Data Access Service is asked to apply the changes back to the database, the only update it would see and perform is the name change.
The resulting SQL UPDATE statement would look like this:
UPDATE contact SET fullname=? WHERE id=? AND fullname=?
with a parameter list of ("Sally Jones", primary key value
, "Sally Barker")
Useful links:SDO for PHP ProjectSDO for PHP documentationRelational Data Access Service documentationGraham Charters
Next week sees the Zend/PHP Conference and Expo
in San Francisco. It promises to be a great experience, with a goodly number of big industry keynote speakers, lots of hands-on tutorials, and three parallel session streams.
I'm presenting an introduction to Service Data Objects (SDO) on the first day which should give people the basic 101-level understanding of SDO and how to use it with XML and databases. I've included a few scenarios to hopefully keep it *real*. I'm really pleased to have been scheduled first on the parallel sessions, so I can then relax and enjoy the rest of the conference :-) .
I'm really looking forward to finally getting to meet members of the PHP community who've helped us in the creation of the SDO project
. The support and guidance we've received throughout has been fantastic.Graham Charters
Finally PHP 5.1 Beta 2 is live. I'm very excited about PHP 5.1 which is another big step for PHP.
Some of the key improvements of PHP 5.1 include:
* PDO (PHP Data Objects) - A new native database abstraction layer providing performance, ease-of-use, and flexibility.
* Significantly improved language performance mainly due to the new Zend Engine II execution architecture.
* The PCRE extension has been updated to PCRE 5.0.
* Many more improvements including lots of new functionality & many bug fixes, especially in regards to SOAP, streams and SPL.
* See the bundled NEWS file for a more complete list of changes.
Everyone is encouraged to start playing with this beta, although it is not yet recommended for mission-critical production use.[Read More
I feel like singing something Doctor Suessish:
- "Oh, the fun you will have
When you code up a style
And your friends' screens explode;
Boy, then try to smile!"
Or perhaps a limerick:
- "A Web-whacker hight Diplodonicus
Promised styles to amaze and astonish us.
But when the pages he drew
Were an unrelieved blue,
His smile became risus sardonicus!"
And that just about blew my creativity diode for the day.
What it's about is fighting with CSS to come up with arrangements and placements of large elements (images, sidebars, et cetera) that work in a) wildly different window sizes, and b) wildly different browsers. I've had to descend to making the CSS files dynamic, so they could adjust parameters according to things like the browser information. And, of course, I'm doing this by making them PHP scripts.
Perfectionist though I may be (although I doubt you'd ever be able to tell from my office at home), this is one of those all-too-numerous cases in which "right" is going to have to wait upon "good enough." I'll twiddle the styles until it looks the way I want it to do, and maybe some year I'll come back and do the styles right.
And, as usual, my perfectionism means that the scripts are too prototypical to show anybody; I'm too ashamed of their hacky kludgery. But perhaps one day..
The week before last I was in Montreal, Quebec, Canada for PHP Quebec Conference 2005. One of the presentations I gave was about using PHP scripts instead of normally static files like
robots.txt, and it gratifyingly raised a couple of eyebrows.
robots.txt a dynamic file can have a definite impact on performance, but it lets you answer queries a little more specifically. For example, three nasty types of robots are:
- Those which scan without even asking for
- Those which request
robots.txt and either ignore it or use its information to crawl through areas which it explicitly forbids; and
- Those which look at the various clients defined in
robots.txt and then come back disguised as one with more access.
I'm not sure if there actually are any Type III robots out there, but if I can think of it I'm sure some perp somewhere already has as well.
robots.txt is a dynamic file, it can handle Type III malbots by only responding with a single client's permissions those of the client to whose request it's responding. Type I malbots might be caught through the use of spider traps, and Type II can be identified by putting spider traps into a forbidden area and noting that the malbot requested
robots.txt. The fact that it asked for the file and then fell into a trap in a forbidden area is a dead giveaway. :-)
The nasty part of the whole process is reliably identifying the perp. In these days of cable and DSL providers handing out DHCP addresses, labelling a particular IPA as being a perp is only valid until the address is assigned to someone else. And identifying by client identification (the
User-Agent request header field) is unreliable because it's easily spoofed and often good software is used to do bad things.
Of course, sometimes the client ID is a dead giveaway, such as
User-Agent: EmailSiphon, or the IPA might be in a fixed range known to be assigned to people of debatable virtue, but for the most part a lot of eyeballing is going to be necessary to settle on rules. The area is fallow for enhancing the response scripts to understand client/IPA combinations, requests per time t, and other heuristics. And I'm even working on some of those. :-)
One of the concepts that are most difficult for new Web developers to fully grasp, is just how dangerous it is to trust user input. Just in the last week, there've been around a dozen or so different reports of vulnerabilities found in Web applications - mostly all of them revolve around unchecked user input. Because of PHPs dominance in the Web application development world, many of the vulnerable applications were ones written in PHP, which hurt PHPs security track record, even though its not the language which is at fault (the same applications, written in any other language would have suffered from the same vulnerabilities).
The challenge of validating user input is not a simple one. The key to meeting this challenge is attention to details combined with knowledge.
At the end of the day - nothing other than the developer herself can ensure that an unsanitized piece of data finds itself as a part of a filename, and sometimes even a database query, which is why paying close attention to what goes where is important.
But that's actually not enough. Few people fully understand just how little of the Web environment can be trusted. Nowadays, most developers know that you cannot rely on GET or POST variables
to have the values you expect (even if they're inside hidden form values) - but how many of them know that you cannot trust any $_SERVER variable that begins with HTTP (e.g., $_SERVER["HTTP_REFERER"])? These can be fully (and easily) spoofed by the remote users, and must not be trusted. Same goes with cookies - they may not be easily visible for or editable by the average user, but as they're saved on the client-side - a 'malicious hacker', or even down to earth script kiddies, can easily set them to their heart's content. And how about $SERVER_NAME ($_SERVER["SERVER_NAME"]), which actually depends on the Host: header sent by the remote user, and can therefore be spoofed under certain circumstances?
Paraphrasing agent Mulder's immortal words, 'Trust Nothing'.
Interesting links:PHP Security ConsortiumMore on trusting (or not trusting) user inputZeev Suraski