Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Writing Portable PHP

Writing Portable PHP

Drew McLellan

February 19, 2015
Tweet

More Decks by Drew McLellan

Other Decks in Programming

Transcript

  1. Listen up! This session is about shipping code into uncontrolled

    environments. It’s about coping with restrictive hosting, old PHP versions, lack of dependancy management and how PHP is working against us. It probably poses more problems than solutions. It may turn into a self-help group.
  2. You can switch. This session probably won’t help if your

    code is deployed with Composer. My tips are of no use to you if your answer to PHP 5.3 is to tell your user to upgrade. If your solution to a missing dependancy is to install the dependancy, I have nothing for you. You can switch rooms, we’re all friends here.
  3. This is common By numbers, the ship-and-deploy-to-bad-hosting model is the

    most common way PHP code is deployed. Despite this, PHP is actively hostile to this way of working.
  4. PHP is architecturally ill- suited for shipping code. Half-baked modularity!

    Configuration without detection! Offloading functionality to host OS! Non-standard as standard!
  5. PHP versions 13 25 38 50 5.2 5.3 5.4 5.5

    5.6 2% 12% 45% 35% 7% - PERCH CMS USERS -
  6. Hosts don’t like to update PHP Historically, PHP updates have

    caused incompatibility with common software. Hosts are nervous to update a server, break sites and anger their customers. But they’re usually happy to move a customer to a newer server with newer PHP on request.
  7. ext/mysql 1. Hosting company tests PHP 7, looks good. 2.

    Deploys PHP 7 on new servers. 3. New customers migrate old sites to new hosting. 4. Sites don’t work. Tech support freaks out. 5. Host considers PHP 7 unsafe, rolls back to PHP 5. 6. Five more years of winter.
  8. Safe mode Deprecated in PHP 5.3, removed in 5.4 Don’t

    rely on being able to keep files outside of the web root. Don’t rely on reading a file unless you created it. cURL requests with follow_location option fail. Non-standard as standard!
  9. Magic Quotes Deprecated in PHP 5.3, removed in 5.4 Was

    a misguided security feature. Designed without considering portability. Continues to me an enormous PITA. Non-standard as standard!
  10. Magic Quotes So we just need to ask PHP if

    magic quotes have been applied to the input… … oh wait. get_magic_quotes_gpc(); get_magic_quotes_runtime(); Configuration without detection!
  11. Mixed PHP versions Your code might run on different PHP

    versions between development and live environments. Web requests and CLI might use different versions. It’s not enough to configure, you have to detect.
  12. Modularity issues Common functionality is provided by optional extensions. Missing

    extensions can’t be dynamically loaded. Core functionality can be disabled. No structured way to test the environment.
  13. Using a database Let’s use a MySQL database! We may

    have mysql, mysqli or PDO. So, mysqli or PDO then. mysqli is optional! PDO is enabled by default from PHP 5.1
  14. PDO + MySQL PDO is enabled by default, but can

    be disabled. PDO’s MySQL driver is optional. Sooooo…
  15. SQLite! “PDO and the PDO_SQLITE driver is enabled by default

    as of PHP 5.1.0.” SQLite DB is just a file, and needs to be kept somewhere safe. PHP provides no mechanism like it does for, e.g. session files.
  16. Manipulating images This is something websites do. PHP is for

    making websites! So PHP can manipulate images, right? Well, we need to talk about that…
  17. GD & Imagick Two common extensions: GD and Imagick Usually

    one or the other, sometimes both or sometimes none. You need code for both: use a library if you can. e.g. http://image.intervention.io
  18. HTTP requests sockets - works! Pretty low level. cURL -

    optional. High level and useful. file_get_contents() - sometimes works. Basic. Libraries?
  19. HTTP libraries Lots of choices - many are just wrappers

    around cURL. Others offer a transport choice, but no detection (e.g. Guzzle) ‘Requests’ looks good in this regard. http://requests.ryanmccue.info
  20. No way to load extensions If something is missing, it’s

    missing. You can’t load it, import it, require it. You just have to deal with it.
  21. Disabling core functionality PHP gives the system admin the ability

    to disable core functionality that is “always” there. Detecting what’s available is impractically cumbersome.
  22. Disabling core functionality <?php if (function_exist(‘curl_init’)) { $ch = curl_init();


    curl_setopt($ch, CURLOPT_URL, $url);
 curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
 $result = curl_exec($ch); } BEWARE!
  23. Disabing other random stuff Remember, sysadmins be crazy. We’ve seen

    GD available, but imagecreatefrompng() simply missing. Good luck out there.
  24. Bad hosting Expect the unexpected! Hosts do crazy things for

    reasons you’ll never understand. Don’t try to understand. Just accept.
  25. Sessions Many shared hosts like to give users their own

    PHP sessions folder. But then leave it up to the user to configure the session_save_path. By default, sessions will start but won’t persist any data.
  26. cURL Some hosts will disable or not install cURL, which

    is their choice. Others will install and enable cURL. A very special third group install and enable cURL and then block it at their firewall.
  27. PHP on Windows PHP on Windows is a real thing.

    It’s used more in development environments than in production. Users will set up WAMP or similar on their Windows desktop, and then deploy to a *nix hosting environment.
  28. Paths PHP expects you to know how to formulate file

    system paths for the host. Sometimes the file system will forgive errors (e.g. slashes vs back-slashes) Sometimes it won’t.
  29. Paths Wrap all your paths so they can be translated

    for the current file system. Then write your paths consistently in one style.
  30. Paths <?php function file_path($path) { if (DIRECTORY_SEPARATOR!='/') { $path =

    str_replace('/', DIRECTORY_SEPARATOR, $path); } return $path; }
  31. Dates Simple date formatting is fraught with danger. strftime() passes

    through to the host OS. Some formatting codes will work with your host OS. Some will completely fail and return nothing, or throw a notice.
  32. Dates I like to define some set formats that I

    think should work broadly, but let the user redefine them for edge-cases.
  33. Watch out for ‘Windows’ Get in the habit of watching

    out for references to Windows in the PHP manual. It will help you spot potential Windows issues, but also is a warning of functionality that gets passed to the host OS. These will often be affected by configuration, not just platform.
  34. File systems and MySQL MySQL is not immune. Don’t mix

    case in object names (e.g. table names). MySQL’s case sensitivity is dependant on the host file system.