| SitePoint Sponsor |
I don't know if it's in here (can't remember seeing it anyway), but this:
is more preferred thanCode:SELECT author, title, description FROM content
even when you are selecting everything anyway. This is because if you don't, your RDBMS will have to look for the columns first, and then select the content from then, but now, it just selects the content right away, which is slightly fasterCode:SELECT * FROM content.
Even with 20 rows?
About the server load, you can directly fopen and fread the content of /proc/loadavg intead of executing a external app which can slow things down...
Speed & scalability in mind...
If you find my reply helpful, fell free to give me a point
That's not the reason why it shouldn't be used. If you SELECT * and expand your table later, you also query rows you don't need.Originally Posted by Kilroy
I don't know if it's in here (can't remember seeing it anyway), but this:
is more preferred thanCode:SELECT author, title, description FROM content
even when you are selecting everything anyway. This is because if you don't, your RDBMS will have to look for the columns first, and then select the content from then, but now, it just selects the content right away, which is slightly fasterCode:SELECT * FROM content
THat's just another reason not to use it
I'm not convinced that using the * wildcard is an altogether bad thing. Certainly, it has its limitations, but it does what it does and it is standard SQL.
You use it when you want to select every column in a table. It works perfectly for that. If you just want to select specific columns, list those specific columns. No big deal.
Using your unpaid time to add free content to SitePoint Pty Ltd's portfolio?
I know it does what it does, I'm just saying that it is slower (although not always noticeably).
not if there's a GROUP BY clause
I didn't see much about style stuff, but in case anyone may be interested, I came up with this as a style preference.
I should note I am no php expert, I just found this worked for me. If anyone has comments, please post
I tend like to do this with my MySQL statements:
Things to mention about my reasoning, the first and last line of the statement are commented out of MySQL but are used if you need a quick echoPHP Code:$sQuery = "\n # <pre>\n".
"\t # comments about statement \n".
"\t SELECT * FROM tblTable1 \n".
"\t # comments about statement \n".
"\t LEFT JOIN tblTable2 \n".
"\t\t USING(FirstID) \n".
"\t # comments about statement \n".
"\t LEFT JOIN tblTable3 \n".
"\t\t USING(SecondID) \n".
"\t # comments about statement \n".
"\t WHERE tblTable1.FirstID = ".$iPassedID."\n".
"\t ORDER BY tblTable1.FirstID \n".
"# </pre> \n";
That way if I do a quick echo at the front of my query variable, it looks very readable in the browser. And since I'm placing "\t" and "\n", it even looks ok when you view html source (not to mention how it looks if you need to run the query on the command line.HTML Code:#<pre> and #</pre>
Also note that I'm placing a MySQL comment before each major part of the query. Along with that, I attempt to place a tab stroke in the php to keep the "\t" aligned visually in the code.
ie
Thirdly, I prefix my table names with "tbl" and database names with "db". Depending on your styles this can be "tbl_" and "db_". It just helps in those odd moments of late nights and lots of coffee.PHP Code:// note that I put a tab stroke for the line that has \t
// and 2 tab strokes for the \t\t line
"\t LEFT JOIN tblTable3 \n".
"\t\t USING(SecondID) \n".
Finally, (for those not used to this) my variables are using a method loosely based on what is called "Hungarian Notation". Even though my variable types are dynamically set, I would like to make sure of what kind of variable it is when I'm knee deep in code.
So, for strings I prefix it with an 's' (ie $sStringVariable), integers it's an 'i' (ie $iInteger), etc. This is not a perfect solution to every variable but, as long as you have a documentation of what the prefix stands for, it should be fine.
In closing, note that I have put it all in one variable. This doesn't have to go this way you could to something like:
But doing so would cause a slight rework of how I placed tabs for the different lines (see above);PHP Code:$sQuery = "\n # <pre>\n";
$sQuery .= "\t # comments about statement \n";
$sQuery .= "\t SELECT * FROM tblTable1 \n";
...etc....
Hope this is useful to someone
-Ernie
PS - to mr harry fuecks: love your books, articles, site (phpPatterns). I just wish I new what you know to get my sites going better
Hi
I am building a site using php and mysql and one need userword an password to view the content, but i've problem of how to prevent on from going straight to the protected pages without being auntheticated. What i need is that when one tries to do that he should be directed to the login page.
please help
bye
Protected page
LoginPHP Code:session_start();
if (isset($_SESSION['user'])) {
header('Location: login.php');
} else {
//display page
}
.. or something like thatPHP Code:session_start();
if ($_REQUEST['username']=='myuser' && $_REQUEST['password']=='mypass') {
$_SESSION['user'] = 'myuser';
} else {
die('invalid username or password');
}
Adam
Philip,
Two things (which might be answered further up or down this huge thread, but anyhow)
It means that a function works on the original variable (by reference) - not a copy (by value). So if you change that variable within the function it changes outside too.
The danger of using register_globals lie in instances like this
Now if $user_ok is open to change from the outside through the url as it is with register_globals on, I could just type in:PHP Code:if ($user_ok)
reveal_everything();
http://mysite.com/secret_page.htm?user_ok=1
...and voila! I could pass by the "secutiry". Had I locked down register_globals, such a hoax would not work. The user_ok from my url would only be specifically available as $_GET['user_ok'] and do no harm.
This is a *very* primitive (and unlikely) example, but it might clarify the problem. Usually security hazards with register_globals are much more subtle, but many older scripts using globals from the url can be extremely open to scams. Particularly open source ones, where everybody can find the basic inner constructs of your code.
Hope this helps
Martin
This is my favorite few lines of debug code. Allows humans to easily read the contents of an array.
PHP Code:// debug - prints a nice formatted array, only need to pass it the name of the array
function print_format_array($array_name) {
echo '<pre>';
ksort($array_name);
print_r($array_name);
echo '</pre>';
} // end func
Unless you are using a variable in your string, do not use regular " brackets to surround it.
Example:
$sVarBad = "this is a bad example, ill explain why in a second.";
$sVarGood = 'this is a bd example, Ill explain why in a second.';
Why the second is beter, speed wise: In PHP, if your string is encased with regular quotes, it will search every word for a possible variable to interchange. Why would you want to delay it anymore than needed?
Why the second is better, security wise: As I just said in my last paragraph, it searches each one of those for a variable to interchange. So if a user malaciously declares a variable, which you shouldnt allow anyways, it could basicly turn this simple one-liner into a buffer overflow. Simply, they could take over your system.
Any questions/debates?
When a user declares a variable then I let him do whatever he pleases to do. The variable won't be evaluated when the text is being inserted, so it will still be $whatever . You would have to eval() the text, but of course you know that you shouldn't ever run eval() on user input.
And about your buffer overflow: PHP takes care of memory management itself, unlike C++.
Yea, the eval function is something I left out, it would be required. But they always could end the current line and maybe insert an sql statement or whatnot. Or even force it to include a remote file for something such as password stealing.
-Chase-
You know, there is actually a reason for functions like addslashes() and mysql_escape_string() .
When you eval() USER INPUT, then yeah, sure. But don't start complaining on this forum when your users abuse the fact that you used eval() on their input.
This is moreof a format tip, but as a programmer I find that when i create a big application im going to be upgrading and editing and re-developing over and over again, it helps to make versions for separate parts of your code.
As an example... I created a search engine, I have several different sections of code that come into play when producing results after a search... each individual peices of code are commented before & after. Before i have a good 2 lines describing what the function does... then i create the version number of the code. Whenever i pass by this code during editing, i can add onto the list of "things i want this code to do in the future" then when i eventually add these features i make the code "version 0.2" or "version 2.1" or whatever placement im at.
This method of coding helps for a few good reasons:
1) you can separate your code, it makes it alot more neat...
2) it forces you to know what goes where
3) why its there
4) what it does
5) what variables are used and/or defined.
I made an interesting discovery today.
An if-statement like this:
is slower than (I don't know what to call it) inline-if's:PHP Code:if($val == 1){$req = 'yea';}else{$req = 'no!';}
My test files:PHP Code:$req = $val ? 'yea' : 'no!';
PHP Code:// File 1 :"inline-if's"
<?php
// Start timer
$mtime = microtime ();
$mtime = explode (' ', $mtime);
$mtime = $mtime[1] + $mtime[0];
$starttime = $mtime;
$val = 1;
$req = '';
$req = $val ? 'yea' : 'no!';
$req = $val ? 'yea' : 'no!';
[repeat from line 11 to 6478]
// End timer
$mtime = microtime ();
$mtime = explode (' ', $mtime);
$mtime = $mtime[1] + $mtime[0];
$endtime = $mtime;
$totaltime = round (($endtime - $starttime), 5);
echo $totaltime;The average parsing-time of the first file is 0.00614.PHP Code:// File 2: normal if's
<?php
// Start timer
$mtime = microtime ();
$mtime = explode (' ', $mtime);
$mtime = $mtime[1] + $mtime[0];
$starttime = $mtime;
$val = 1;
$req = '';
if($val == 1){$req = 'yea';}else{$req = 'no!';}
if($val == 1){$req = 'yea';}else{$req = 'no!';}
[repeat from line 11 to 6478]
// End timer
$mtime = microtime ();
$mtime = explode (' ', $mtime);
$mtime = $mtime[1] + $mtime[0];
$endtime = $mtime;
$totaltime = round (($endtime - $starttime), 5);
echo $totaltime;
The average parsing-time of the second file is 0.01138.
I tested this on WinXP SP2, Apache 1.3, PHP 4.3.5, localhost.
This is not really groundbreaking, but for performance-freaks like me, it is definatly interesting. Plus, the first method is much more readable(especially when you have 5 lines one after another).
I personally find the ternary operator much easier to read for short declarations.I made an interesting discovery today.
An if-statement like this:
is slower than (I don't know what to call it) inline-if's:PHP Code:if($val == 1){$req = 'yea';}else{$req = 'no!';}
My test files:PHP Code:$req = $val ? 'yea' : 'no!';
PHP Code:// File 1 :"inline-if's"
<?php
// Start timer
$mtime = microtime ();
$mtime = explode (' ', $mtime);
$mtime = $mtime[1] + $mtime[0];
$starttime = $mtime;
$val = 1;
$req = '';
$req = $val ? 'yea' : 'no!';
$req = $val ? 'yea' : 'no!';
[repeat from line 11 to 6478]
// End timer
$mtime = microtime ();
$mtime = explode (' ', $mtime);
$mtime = $mtime[1] + $mtime[0];
$endtime = $mtime;
$totaltime = round (($endtime - $starttime), 5);
echo $totaltime;The average parsing-time of the first file is 0.00614.PHP Code:// File 2: normal if's
<?php
// Start timer
$mtime = microtime ();
$mtime = explode (' ', $mtime);
$mtime = $mtime[1] + $mtime[0];
$starttime = $mtime;
$val = 1;
$req = '';
if($val == 1){$req = 'yea';}else{$req = 'no!';}
if($val == 1){$req = 'yea';}else{$req = 'no!';}
[repeat from line 11 to 6478]
// End timer
$mtime = microtime ();
$mtime = explode (' ', $mtime);
$mtime = $mtime[1] + $mtime[0];
$endtime = $mtime;
$totaltime = round (($endtime - $starttime), 5);
echo $totaltime;
The average parsing-time of the second file is 0.01138.
I tested this on WinXP SP2, Apache 1.3, PHP 4.3.5, localhost.
This is not really groundbreaking, but for performance-freaks like me, it is definatly interesting. Plus, the first method is much more readable(especially when you have 5 lines one after another).
I doubt there's any 'real' performance difference in normal apps, though, as I generally assume that PHP treats both constructs similarly. 9 times out of 10, though, if you're worried about optimizing an if statement, your algorithm sucks.
Or it may just be thorough optimization
Here's a quick coding tip I've learnt the hard way:
If your foreach loop only seems to execute once even though you know there is more than one item in the array, check that you haven't got too keen with semi-colons:
This is valid code, but doesn't do what you think it should!PHP Code:foreach ($array as $item);
{
echo $item;
}
Possibly a good argument for the alternative braces layout:
Hope this saves someone some timePHP Code:foreach ($array as $item) {
echo $item;
}
Last edited by Fonant; Jun 3, 2005 at 06:16. Reason: Changed formatting for code segments
www.fonant.com - Quality web sites
Something I found very useful.
You can simple declare $_GET variables in your code, without having to link to a new page with <a href.
This can come very handy. Lets say you have script A, which displays query results. Next to that you want to show a graph,
dynamicly created in script B, depending on the query results in combination with a year.
You could do something like this:
With this, first you look for a valid variable in the URL. If none set, the current year will automaticly be chosen.PHP Code:isset($_GET['year']) && is_numeric($_GET['year']) ? $_GET['year'] = $_GET['year'] : $_GET['year'] = date('Y');
echo '<img src="path.php?year='.$_GET['year'].'">'
It makes sense, but one may overlook this possibility
Indeed a decent argument for using the alternate brace layout, but I still find the first one easier to read when matching braces.Here's a quick coding tip I've learnt the hard way:
If your foreach loop only seems to execute once even though you know there is more than one item in the array, check that you haven't got too keen with semi-colons:
This is valid code, but doesn't do what you think it should!PHP Code:foreach ($array as $item);
{
echo $item;
}
Possibly a good argument for the alternative braces layout:
Hope this saves someone some timePHP Code:foreach ($array as $item) {
echo $item;
}
I tend to always use this function on all data that the user can change, because mysql_real_escape_string adds a slash infront of \x00, \n, \r, \, ', " and \x1a. It also does changes depending on the character set of the mysql database you have.
Note: this will use the last database connection you have used, or will try and open a connection, else it will bring up an error.Code:function purify ($string) { if (get_magic_quotes_gpc()) { $string = stripslashes($string); } $string = mysql_real_escape_string($string); return $string; }
http://uk.php.net/manual/en/function...ape-string.php
Last edited by Ethernet-Summit; Aug 2, 2005 at 09:54.
If you have formated text files,(tab delimited, or csv), it is convenient to use phpmyadmin to do batch insert.
Posting Permissions
Bookmarks