Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Modern and Secure PHP (SoutheastPHP 2018)

Modern and Secure PHP (SoutheastPHP 2018)

This is not the PHP of old. Learn what's changed in the PHP world over the last few years. Classes, objects, statics, traits, unit testing, composer, password hashing, standards; it's a whole new ballgame.

Ben Edmunds

August 17, 2018
Tweet

More Decks by Ben Edmunds

Other Decks in Technology

Transcript

  1. Who is this guy? Ben Edmunds Open Source Author PHP

    Town Hall Podcast CTO at Mindfulware
  2. Errors try { //error thrown here } catch (Error $e)

    { die($e->getMessage()); } catch (Exception $e) { die($e->getMessage()); }
  3. Errors try { //err or excpt thrown here } catch

    (Throwable $t) { die($t->getMessage()); }
  4. Errors try { //error or excpt thrown here } catch

    (Error | Exception $e) { die($e->getMessage()); }
  5. PDO

  6. PDO $stmt = $db->prepare(‘ SELECT * FROM users WHERE id=:id

    ’); $stmt->bindParam(‘:id’, $id); $stmt->execute();
  7. Traits // grouping without // strict inheritance trait baseUser {

    function getName() { return ‘Jon Snow’; } }
  8. Traits class Post { use Loggable; function get($id) { $this->log('Getting

    post ' . $id); return $this->db->get($id); } }
  9. Closures $input = [1, 2, 3, 4, 5, 6, 7,

    8]; $output = array_filter($input, function($v){ return $v > 5; }); // [6,7,8]
  10. Closures $input = [1, 2, 3, 4, 5, 6, 7,

    8]; $output = array_map(function($n){ return number_format($n * 10, 2) . '%'; }, array_filter($input, function($v){ return $v > 5; })); // ['60.00%', '70.00%', '80.00%']
  11. Anonymous Classes trait Loggable { protected $logger; function setLogger(Logger $logger)

    { $this->logger = $logger; } function log($msg) { $this->logger->log($msg); } }
  12. Anonymous Classes class Post { use Loggable; } $post =

    new Post; $post->setLogger( new class implements Logger { public function log($msg) { echo date('m/d G:i') . ': ' .$msg; } });
  13. Types declare(strict_types=1); function addNums(float $a, float $b) { return $a

    + $b; } addNums(2, "1 week"); // Fatal error: Uncaught TypeError: Argument 2 passed to addNums() must be of the type float, string given
  14. Types function addNums(float $a, float $b) addNums(2, "1 week”); //

    Fatal error: Uncaught TypeError: Argument 2 passed to addNums() must be of the type float, string given
  15. Types function addNums($a, $b) : int { return $a +

    $b; } addNums(1.5, 1); // Fatal error: Uncaught TypeError: Return value of addNums() must be of the type integer, float returned
  16. Types function addNums(float $a, ?float $b) : int { return

    $a + $b??0; } addNums(1, null); // int(1)
  17. Types function addNums(float $a, ?float $b) : ?int { return

    $a + $b??0; } addNums(1, null); // int(1)
  18. Passwords if (password_verify($_POST['pass'], $u->pass)) { if (password_needs_rehash( $u->pass, PASSWORD_DEFAULT ))

    { $u->pass = password_hash( $_POST['pass'], PASSWORD_DEFAULT ); $u->save();
  19. Security //safe defaults class Your Controller { protected $var1 =

    ‘default value’; function __construct() { … } }
  20. Security //safe defaults $something = false; foreach ($array as $k

    => $v) { $something = $v->foo; if ($something == ‘bar’) { … } }
  21. Security function addNums(float $a, float $b) : int { return

    $a + $b; } $something = []; foreach ($array as $v) { $something[] = addNums($v[0], $v[1]) }
  22. Security //escaping input Class myModel extend Model { function save($id)

    { $stmt = $this->query->insert(); $stmt->bindParam(‘:id’, $id); $stmt->execute(); } }
  23. Security //CSRF Protection POST / PUT / UPDATE / DELETE

    behind forms with one-time use tokens
  24. Security //CSRF Protection function generateCsrf() { $token = mcrypt_create_iv( 16,

    MCRYPT_DEV_URANDOM); Session::flash('csrfToken', $token); return $token; }
  25. Built-in Server $ php -S localhost:8000 PHP 5.7.0 Development Server

    started… Listening on localhost:8000 Document root is /home/ben/htdocs Press Ctrl-C to quit
  26. Unit Testing $ phpunit tests PHPUnit 3.3.17 by Sebastian Bergmann.

    Time: 0.01 seconds OK (1 tests, 1 assertions)
  27. Standards PSRs PSR-4: Autoloading PSR-1: Basic Coding Standards PSR-2: Coding

    Style Guide PSR-7: HTTP Message Interface PSR-6: Caching Interface PSR-3: Logger Interface