How to improve PHP session security

Nice article about session security, I never tried any of session hacking technique but its true as session id is stored in cookies and cookies are stored in user side and also it is passed to server directly anyone in between can sniff or hijack it :)

Go through the article how to protect it.

Useful links

Miscellaneous list

i) 5 cool things you can do with windows and php

ii) 5 great code highlighting plugins for wordpress

iii) 5 sins of PHP

iv) 5 great firefox extensions for twitter

v) Top 5 firefox extensions (for web developers)

vi) 5 ways to optimize mysql inserts

vii) 10 tips for optimizing mysql queries

viii) 5 ways to get more twitter followers

ix) 5 things ie8 got right

x) 5 ways to speedup javascript

xi) Top 5 javascript frameworks

xii) Top 5 free wordpress marketing tools

xiii) Blogger seo tips

xiv) 15 great social bookmarking sites

xv) 5 search engine ranking tips

xvi) Top 5 open source shopping carts

xvii) 10 phpBB seo tips

xviii) 5 tips for improving wordpress seo

xix) 16 Design Tools for Prototyping and Wireframing

Embedding PHP In CSS

Very interesting tutorial just check it out Embedding PHP In CSS

Useful PHP links

This list will be growing, please comment or send me a mail to add more link :)

i) Useful PHP Classes and Components

ii) Open-source PHP applications

iii) How to Install PHP on Windows

iv) A-Z PHP

v) Useful PHP + jQuery Components & Tuts for Everyday Project

vi) The ABC's of PHP

vii) Top 5 php template engines

viii) 10 Advanced PHP Tips To Improve Your Programming

ix) 6 books to master PHP

Auto Increment in Sybase

I had to use auto increment column in Sybase, I found we can use column as identity for it. Then I had a problem as I wanted to know last inserted value or id but I didn’t get answer today I was browsing to find how we can do so I found we can do it using Sybase global variable @@identity.

Example:

An easy way to insert a row into salesdetail after inserting a row into sales is to use the @@identity global variable to insert the IDENTITY column value into salesdetail. The @@identity global variable stores the most recently generated IDENTITY column value. For example:

begin tran
insert sales values ("6380", "04/25/97")
insert salesdetail values ("6380", @@identity, "TC3218", 50, 50)
commit tran
This example is in a transaction because both inserts depend on each other to succeed. For example, if the sales insert fails, the value of @@identity is different, resulting in an erroneous row being inserted into salesdetail. Because the two inserts are in a transaction, if one fails, the entire transaction is rejected

PHP 5.3, Lambda Functions, and Closures

PHP 5.3 will have a lot of exciting new features. One of the most important one for me is the introduction of lambda functions and closures support.

For more information click

Meta Refresh and Referrer Problem

Hi All,

Just came around the problem that when meta refresh is used referrer is cleared by Firefox, IE and some other browser. Just tested on firefox it cleared. The scenario for me is i have to redirect the user after few second, so i used meta refresh, but client complaint he is not getting referrer. So came up with the quick small javascript code.

// delay parameter is in sec.
// url paramter should be full url including http://
// example usage: delayRedirect(2,'http://localhost/test/referrer.php');
function delayRedirect(delay, url)
{
var delaySec = delay * 1000;
setTimeout("window.location.href='"+url+"'",delaySec);
}

Turn OFF Caching for specific file with the help of .htaccess

Was just searching how to turn off cache for some of the file got the code so thought of sharing with you guys.

<# Files ansarahmed.css #>
<# IfModule mod_headers.c #>
Header set Cache-Control "must-revalidate"
<# /IfModule #>
<# /Files #>

Note:- Please remove hashes(#). Blogger is not allowing me to post the code sorry.

Outputting CSV as a Downloadable File in PHP

Nearly every application you could write in for the business sphere in PHP probably requires some sort of data export, most likely in the CSV format.

The easiest way to provide a downloadable file is by altering the headers and echo'ing the file content. In our case:

header("Content-type: text/csv");
header("Cache-Control: no-store, no-cache");
header('Content-Disposition: attachment; filename="filename.csv"');

We want to set our applicable Content-Type so that the browsers associate the file properly. Just relying on the extension doesn't work, even in Windows. The magic is in the third header setting, "Content-Disposition," which informs the browser to download as a separate file (don't open a new window and display a blank page, just display the file download box) and tell the browser the filename is "filename.csv". This way rewrite rules like http://localhost/export/csv/ will result in a download box that declares the file "filename.csv" rather than a randomly assigned name or whatever the current url is.

Into the meat of the CSV export. At the very beginning we need to open up a stream to the PHP output (the same place where echo sends its string content, which is NOT stdout):

$outstream = fopen("php://output",'w');


Next we're going to assume you already have your data packed nicely into an array (or array of arrays) so long as we have a single array per row/line.

The magic comes into play using the build in PHP function fgetcsv(). fgetcsv() takes an array for a single row and outputs it, automatically escaping output according to column and enclosure delimiters!

fgetcsv() requires a file resource as its first parameter and the magic of PHP streams is they act like a file resource (actually a file resource is just a file stream), so we give it $outstream to make fputcsv() echo its output. We fill in the rest of the parameters according to the php.net documentation and voila we have:

header("Content-type: text/csv");
header("Cache-Control: no-store, no-cache");
header('Content-Disposition: attachment; filename="filename.csv"');

$outstream = fopen("php://output",'w');

$test_data = array(
array( 'Cell 1,A', 'Cell 1,B' ),
array( 'Cell 2,A', 'Cell 2,B' )
);

foreach( $test_data as $row )
{
fputcsv($outstream, $row, ',', '"');
}

fclose($outstream);

For more output stream craziness, zaemis from the #phpc IRC channel on freenode shared a code snipped that outputs CSV either to the output buffer OR will return it as a string using some clever streams hackery:

function exportCSV($data, $col_headers = array(), $return_string = false)
{
$stream = ($return_string) ? fopen ('php://temp/maxmemory', 'w+') : fopen ('php://output', 'w');

if (!empty($col_headers))
{
fputcsv($stream, $col_headers);
}

foreach ($data as $record)
{
fputcsv($stream, $record);
}

if ($return_string)
{
rewind($stream);
$retVal = stream_get_contents($stream);
fclose($stream);
return $retVal;
}
else
{
fclose($stream);
}
}

Filter Extension and Function in PHP

Was just going through the ppt and sample code of Tony Bibbs talk on about injection flaws, Cross Site Scripting (CSS) and Cross Site Request Forgeries (CSRF) given by him in Information Security Office (ISO), Came to know about useful Filter Function and Extension(This extension serves to validate and filter data coming from some insecure source, such as user input. ) in PHP.

Find the code and use of Filter function in action in below link
http://devzone.zend.com/node/view/id/1113

Find the documentation in below link
http://www.php.net/manual/en/intro.filter.php