iBlog - Ilia Alshanetsky

Beware of the default Apache 2 config for PHP

ilia@ilia.ws (Ilia Alshanetsky) — Mon, 30 Aug 2010 14:52:24 -0400

About a week ago, I was doing some upgrades on my development machine and came across a rather nasty issue when it comes to how .php(s) files are associated with PHP in Apache. It seems that a number of distros including Gentoo (which is what I was using) are using the following configuration directive to make the PHP module parse PHP files:



<IfModule mod_mime.c>

       AddHandler application/x-httpd-php .php

       AddHandler application/x-httpd-php-source .phps

</IfModule>

The non-obvious problem with the above is that it will allow not only "file.php" to be treated as PHP scripts, but also "file.php.txt", which means that any file containing ".php" in its name, no matter where in the filename, would be treated as a PHP script. This of course creates a rather nasty security hole, since many upload file validation tools, only check the final extension. Consequently allowing the user to by-pass the validation, by simply prefixing another "harmless" extension like .txt, .pdf, etc... to the filename, but still get the code to execute.

To mitigate this problem you should instead use the following configuration, that would only pick-up of files ending with a .php extension.



<IfModule mod_mime.c>

       AddType application/x-httpd-php .php

       AddType application/x-httpd-php-source .phps

</IfModule>

The difference between the two configurations being that the original uses AddHandler (bad) and the latter uses AddType (good).

PHP Excel Extension 0.8.6

ilia@ilia.ws (Ilia Alshanetsky) — Fri, 27 Aug 2010 07:56:00 -0400

PHP Excel Extension 0.8.6

The 0.8.6 version of the Excel extension was released and is now available for download. This version was updated to contain LibXL 3.0 support which introduces Excel 2007/2010 read/write support, which means that this extension can now read and generate any Excel file. Support for XSLX (2007/2010) format can be enabled by passing "true" as the 3rd parameter to the ExcelBook() construtor.

GitHub: http://github.com/iliaal/php_excel/
Source: http://github.com/downloads/iliaal/php_excel/php-excel-0.8.6.tar.bz2

PHP Excel Extension 0.8.5

ilia@ilia.ws (Ilia Alshanetsky) — Wed, 11 Aug 2010 15:27:02 -0400

The 0.8.5 version of the Excel extension was released and is now available for download, it contains a number of small build fixes, which makes it possible to compile it against all versions of PHP (5.2,5.3,trunk). The Win32 compilation was also fixed and thanks to Kalle, PHP 5.3 win32 binaries are now available for download as well.

GitHub: http://github.com/iliaal/php_excel/
Source: http://github.com/downloads/iliaal/php_excel/php-excel-0.8.5.tar.bz2
Win32 Binaries: http://github.com/downloads/iliaal/php_excel/php-excel-5.3.zip

PHP Excel Extension

ilia@ilia.ws (Ilia Alshanetsky) — Sun, 01 Aug 2010 14:06:11 -0400

Since I broke my right hand 3 weeks ago while biking, I found myself with a lot of spare time :/. It is amazing just how limited your ability to do things becomes when you can only use one hand. So, to stave off the boredom, I've been slowly toiling away on a PHP Excel extension that I intend to use at work, which I've finally gotten ready for release today.
You can find it on github at: http://github.com/iliaal/php_excel.

Continue reading "PHP Excel Extension"

Google Docs Backup Script

ilia@ilia.ws (Ilia Alshanetsky) — Mon, 21 Jun 2010 11:19:07 -0400

We are starting to use Google Docs quite a bit more at work and unsurprisingly the question of backup and offline availability comes into play. As part of the backup strategy we also wanted to capture incremental versions of the documents (on a daily basis) in the event we needed to go back to the prior versions.

To this affect I whipped up a small (120 lines) PHP script that will retrieve all your Google documents and save them to a local directory, in the event the document was created/updated in the last 24 hours, thus ensuring snapshot support. Each file name is prefixed with Ymd (Year,month,day) prefix to ensure name uniqueness and provides an easy way to spot similar files or files that were created/updated on the same day. The script has just two dependancies, cURL and Simplexml extensions, which most PHP 5.0+ installs should have.

I am publish the script for anyone with similar needs to use/improve under the BSD license...

Enjoy.

Update

I've made a few improvements to the script, some of which have been suggested by Philip (thanks), and since this looks to be an envolving project I've put it into GitHub.

Git Repository: http://github.com/iliaal/Google-Docs-Backup

Here are the list of changes:
Continue reading "Google Docs Backup Script"

APC & Memcache the High Performance Duo Slides

ilia@ilia.ws (Ilia Alshanetsky) — Sat, 12 Jun 2010 07:18:17 -0400

My slides from the APC & Memcache the High Performance Duo talk at Dutch PHP Conference are now up and can be downloaded from here.

Thanks everyone for listening.

APC & Memcache the High Performance Duo Slides

ilia@ilia.ws (Ilia Alshanetsky) — Sat, 12 Jun 2010 07:18:17 -0400

My slides from the APC & Memcache the High Performance Duo talk at Dutch PHP Conference are now up and can be downloaded from here.

Thanks everyone for listening.

Optimization Mistakes Slides (Dutch PHP Conference)

ilia@ilia.ws (Ilia Alshanetsky) — Fri, 11 Jun 2010 06:00:37 -0400

My slides for the "Common Optimization Mistakes" at the Dutch PHP Conference are now available here.

Thanks everyone for listening, I wish there was a little bit more time to allow for questions...

Scalar Type Hints are Here!

ilia@ilia.ws (Ilia Alshanetsky) — Thu, 20 May 2010 16:15:05 -0400

About an hour ago, something I've been fighting for almost 2 years happened. The Scalar Type Hinting patch for PHP (the one I wrote almost a year ago) has been adjusted for PHP's trunk tree and committed by Derick.

Thanks to Derick for taking the time (when I didn't) to prep the patch for trunk and make this happen

DevConf Slides

ilia@ilia.ws (Ilia Alshanetsky) — Mon, 17 May 2010 04:35:35 -0400

The slides from my talk at DevConf in Moscow are now up and can be downloaded here.

Probably the biggest, or at the very minimum the 2nd biggest audience I've had a PHP Conference and the first time I had to give a PHP talk in Russian (with occasional slippage into English ;-p).

Seemed to go pretty well.

ConFoo PHP 5.3 == Awesome! Slides

ilia@ilia.ws (Ilia Alshanetsky) — Thu, 11 Mar 2010 09:06:20 -0500

Finally managed to upload my slides from my ConFoo PHP 5.3 == Awesome! talk.
Slides

Thanks for all the attendees, especially those who asked questions

My Thoughts on HipHop

ilia@ilia.ws (Ilia Alshanetsky) — Tue, 02 Feb 2010 16:47:46 -0500

To paraphrase Marco Tabini if you work with PHP you must be doing so in a pretty deep cave to have not heard of HipHop for PHP and the fervor around it the prior to its official announcement this morning by Facebook.

I had a fortune to be part of the small group of PHP community people who were invited to take a peak at its technology prior to its official release in January. And I must admit it had been quite amusing to read some of the conjectures people were making about what it actually, given how off the mark most of their guesses were.

So what is HipHop?

In the tersest of terms HipHop is a tool that converts PHP code into C++ code that when combined with a PHP compatible engine and extensions (ports of some native PHP extensions Facebook uses) library also written in C++ can be compiled using GCC into a binary. This binary can then be ran on a command line or as a web server daemon that utilizes libevent. According to Facebook this can speed up applications by up to 50%, which is a pretty impressive improvement.

It is not entirely surprising that world's largest PHP deployment, such as Facebook would look at solution that would allow them to halve their not inconsiderable count of servers or double capacity. Releasing this solution as Open Source is I think a great idea, and big kudos to Facebook for doing so.

From a technical perspective the PHP optimization approach of converting PHP into a compiled language is not a completely new one, Roadsend compiler, a commercial product has been around for a few years now and has been doing that with some degree of success. That said it is not a trivial task and from an engineering perspective presents a fairly tricky development challenge, especially when you want to allow regular, off-the-self scripts to work. Perhaps more importantly, HipHop not a theoretical solution, "for you to test", it actually works, with most of the Facebook's servers running it and doing it well, on millions of lines of converted PHP code on daily basis, very impressive.

At this point you are probably thinking, that if it is so great and it works, I'll deploy it on my servers as soon as I can get my hands on the source code. Well, unfortunately things are not quite so simple, there are few technical and deployment challenges you need to overcome.
Continue reading "My Thoughts on HipHop "

Speaking at Confoo

ilia@ilia.ws (Ilia Alshanetsky) — Tue, 26 Jan 2010 08:16:19 -0500

I will be speaking again this year at PHP Quebec conference, which has now been renamed to Confoo and covers many more topics then just PHP, which should make things even more interesting. With over 100 talks things looks to be an amazing conference, my own talk with cover PHP 5.3 awesomeness

Igbinary, The great serializer

ilia@ilia.ws (Ilia Alshanetsky) — Thu, 19 Nov 2009 11:05:41 -0500

If you are using PHP, chances are that at some point you needed to serialize PHP data, whether it was transparently done for you inside the PHP's session handler or directly so that complex PHP data types (objects & arrays) could be stored in DB or files, most people have done this.

The default way of doing it is via a native PHP serializer, which creates a clear-text version of the data, which if you are serializing a fair bit of information ends up being rather verbose (read: BIG). This means that you end up having to store more data in memory, read more data from disk, etc... all of which slow down your application. As I was reading docs on Andrei's new memcache extension (memcached) I came across a binary serialization extension called Igbinary written by Sulake Dynamoid Oy. This extension promised much more optimal serialization routines by using binary, rather then a clear text format. Sounded, good so I decided to run a few benchmarks on it.

Continue reading "Igbinary, The great serializer"

APC & Memcache the High Performance Duo Slides

ilia@ilia.ws (Ilia Alshanetsky) — Wed, 21 Oct 2009 17:03:08 -0400

My slides from the "APC & Memcache the High Performance Duo" talk are now online and can be found here.

In the slide I mentioned that memcache is available of *NIX only, which thanks to at least two attendees I know to be incorrect. It appears that there is a working (albeit old, circa 2006) memcache win32 version, which you can find here:
http://jehiah.cz/projects/memcached-win32/

Once you install it, you'd need to compile memcache PHP extension on win32 and then you should be set.