My second day at the PHP North West Conference 2011 kicked off with Paul Lemon’s ‘Feeling Secure?’ talk.

Paul used succinct code samples and made a point of covering the basic attack methods, assuming no great depth of knowledge for some and the need to re-iterate its importance to the rest of us. For each attack type, variant methods were demonstrated that perhaps would have been unfamiliar to some – this was certainly borne out during the Q&A session. Paul had far more topics to cover and hopefully there’ll be an extended security presentation at a future conference.

Following this I attended Walter Ebert‘s talk on URL design. Walter had gone to some trouble to locate examples of good practice in human-readable, RESTful web addressing as well as some neat workarounds for common problems – for example url handling routines for those long descriptive links that email clients break when they wrap text.

Finally I listened to Richard Backhouse talk about compiling PHP to .NET using open source tool Phalanger. Richard covered the background to his company’s adoption of the approach, client considerations, use cases and opportunities for mixing languages & libraries for a best-of-both approach.

Take Away

I tend to take away both strong themes and important (though sometimes small) messages from conferences that stick with me, influencing the design decisions and production routes on current and future projects. They’re not always from a favourite or most enjoyable presentation, but they highlight the event’s greater whole.

Laura Beth Denker‘s Saturday track 1 talk emphasised the need to retain practicality and perspective in software production (in particular, testing). Yes we have the tools, but are we using them effectively, are we curtailing our own faculties in favour automated methods, do we put enough trust in our collaborators?

The major frameworks has a strong showing, but Alistair Stead and Paul Lemon provided timely reminders of those areas that still require careful thought and action – response times, the right caching techniques regardless of chosen technology, the importance of validation and knoweldge of protocols and security basics.

Finally, Ian Barber‘s keynote brings all this together – the tools exist to allow you to contribute to great developments and create new ones. Use the right tools for right purpose and keep a keen eye on what’s around you – in programming, and in the wider world.

PHPNW11 was all about (as @Elblinkin put it) ‘Keyboard, mouse and You’.

Saturday morning kicked off with keynote speaker Ian Barber‘s revealing tour of the small steps that made great software even better, and the ways that diverse personal interests, hobbies and a willingness to ignore conventional wisdom led to innovations that we in turn can build upon and contribute to.
Having a broad range of work and hobby interests, I could only agree with Ian on his belief in cross-fertilisation of ideas and approaches, and it was good to be reminded that being interested and aware is often more effective than aiming high.

Starting off Track 1, Enrico Zimuel introduced the new features and architecture of Zend Framework 2 followed by Sebastian Bergmann‘s talk on PHP Testing tools. Sebastian compared the various approaches and features of the most ubiquitous and newly released tools including his own project PHPUnit , the Atoum framework and the behaviour / scenario driven BeHat.

In the afternoon I attended Alistair Stead‘s track 2 talk about the Varnish reverse proxy cache. In addition to presenting Varnish’s impressive capabilities, Alistair examined the pitfalls of adding multiple cache layers, configuration gotchas, as well as privacy and security concerns in good depth.

Track 2 continued with Stefan Koopmanschap‘s introduction to the recently released Symfony2 framework. For those of us with experience of prior releases, Symfony2 appears to differ significantly and will take some getting used to. The Bundles approach follows the components theme running through the conference this year.

The final talk in track 1 was Laura Beth Denker‘s ‘Are your tests really helping?’. After informing the crowd that her company pushed code every 20 minutes or so, you would have expected a breakdown of intensive automated test routines, but what was presented was a practical approach involving well organised unit testing; having faith in fellow developers and trust in the external services (and if you don’t have faith or trust, you should probably replace both) in order to reduce the need for extensive integration and functional testing.

PHPNW11 continues today, Sunday 9th October. Feedback for talks can be read and provided on JoindIn.

The Object form helpers looked particularly useful, so for my first production development I aim to use them wherever possible. These helpers allow you edit objects directly, simplifying the update process back in your actions.

sample form in editformSuccess.php template:

and in actions.class.php:

The update code uses the fromArray method to update any properties of your object it holds data for, received from your form. Adding fields to your form doesn’t require changes to the action.

I got into difficulties when it came to setting a boolean field for my object, called “IsPublished”. Wishing to stick with the Object form helpers I investigated the Object_select_tag, however this has a different use altogether – allowing you to grab properties of other objects to match with your current object. The classic example being choosing an author from the authors object to match up to a post object.

I still wanted to save a property for my object, but I didn’t want to have it select from the object, or grab values from other objects. Further searches revealed I wasn’t alone in wondering how to set default selected values and generally get to grips with object_select_tag.

Mixing Object and Form helpers seemed the best solution, using select_tag for my boolean field. However this meant I wasn’t using the Object helper exclusively, so would it still work with fromArray?

The form code generated looked promisingly simple, so I tried a mix of object_input_tag and select_tag in my editformSuccess.php template:

Note the highlighted property in select_tag. My Object Property is called “IsPublished”. To object-generate a plain text input field I’d have used:

So my current field value would be retrieved, and the Object helper generates form fields using BasePeer::TYPE_FIELDNAME which in turn is used in my fromArray method to update the Db.

Normally one would use select_tag with internal field names (BasePeer:: TYPE:PHP_NAME) and write more action code to marry them up before a save(), however here I have to add my database field name into my view code.

Tethering your templates to your database schema is a route no-one should go down. So the internal name should be converted to the Db name on-the-fly in your template. The Peer classes have a function for this, and its public. The following call converts your usual internal field name for you, ready to drop into your select_tag:

You could assign this in your action, but it works just as well in the template:

A final step would be to migrate this into a function higher up that so as to make templates a little prettier when editing.

Positive so far.

Next I need to make the names more variable, and perhaps cache them and generate random permutations. Accessibility remains a concern.

dragndrop-captcha

I couldn’t find anything that would get me the index of the current displayed post, so this does the job:

userpostindex_v1

Once in The Loop, it counts the current author’s other, older posts to arrive at the index for the current post, ignoring private posts, attachments and the like.

My own implementation is only in text for now, the idea ccoming from the more stylish treatment of the edition number flash on AListApart‘s homepage.

Then I thought it might be nice to display the user’s basket on all relevant pages, as a courtesy. This was easier than I’d thought. I simply add a new MVC and merge it’s results.

I have a master array of values matching each area of my template, I array_merge it with that which I receive from View to populate the page. If a user is logged in, a new step merges the user info MVC set with the main View prior to overwriting the defaults. This handles and returns all their account/basket details neatly into a sidebar, all without breaking the rules or setting up problems for later.

Fiddling with Scriptaculous earlier today I had an idea for a CAPTCHA mechanism. Cycling through the $_POST array in PHP gives you the form data, in order of submission.Scriptaculous’ sortable feature allows you to change order of items in a List, so adding an image with corresponding hidden input field gives you a basic puzzle to satisfy the CAPTCHA requirement.

Still comes with all the same accessibility problems most mechanisms have (with the added JS requirement), but saves the need for image generation.This version *can* use any naming convention for the images and input field names, they’re generated and checked by an array so don’t need to be numerically ordered – which could be a giveaway.

Started the day reading a mail from someone about my mod_change_username thingy for Phorum. Decided it was high time I address the rather tight restriction on username formats (tighter than Phorum’s own).

Tested it with Phorum 5.1.15 while I was at it – and barring some anomalies in the upgrade it seems to work as expected. V1.2 now available in the downloads section.