After a long time, today i came across (again) the Minutes Php Developers Meeting , now seen of course, on the light of new knowledge i’ve accumulated since ( not a lot , but some ).

On the list of discussed/accepted/declined matters, that i just re-read, what hit my attention was the decision made to add an opcode cache (APC) to the std distribution. I think it is going to be very interesting and practical.

APC is a well-written, well-maintained Pecl package. I have implemented already in a couple of solutions, and it is definitely worth the trouble of setting it up.

Another thing was the merging of the Hardened-PHP patch into the std distro, and a few other measures, as follows.

[...]

Discussion: We went over the features that the patch offers, and discussed whether we might want to include them in stock PHP. One of the points that came up was the allow_url_fopen setting we currently have in PHP. Many ISPs disable it because of sound security reasons for remote paths with include(), but unfortunately by turning this setting off they are also turning off the possibility to use fopen(“http:…”) f.e. This is why we want to split this option into two settings.

Conclusions:

1. We want to include the patch’ real-path fix.
2. We want to include the protection against HTTP Response Splitting attacks (header() shouldn’t accept multiple headers in one call).
3. We split allow_url_fopen into two distinct settings: allow_url_fopen and allow_url_include. If allow_url_fopen is off, then allow_url_include will be off too.
4. We enable allow_url_fopen by default
5. We disable allow_url_include by default

[...]

The decision to make header() not accept multiple values in one cal, is already a step ahead, but i hope it is going to be followed by some serious PCREs.

Quoting from wikipedia’s HTTP Response Splitting Attack:

http://example.tld/redir.php?id=%0d%0aSet-Cookie%3A+some%3Dvalue

I hope my point is clear.

And then, at the end, there’s the ifsetor() issue and the modifications made to the ternary operator ( ie: removal of the requirement for the middle parameter).

In my humble opinion, the way it is going to be , it’s so much more complicated ( speaking of clear, easy-readable code).

Example:

$foo = $_GET['foo'] ?: 42;

What about :

$foo = ($a===$b)? 41 : 42;

How’s this going to be evaluated?

In the end, let’s keep in mind that, these discussions happened back in 2005, on a theoretical basis.

From then, most-likely a few things have changed, and there’ll be much more to talk.

As i mentioned in one of my previous posts, i had scheduled to take the Zend Certification on Friday the 23rd of march, which i did.
That date was chosen , not because i could not do it any earlier, but because i could not do it any later. Zend will stop the PHP4 test on the 31st of march 2007.

Of course from the beginning it was a must using the official Study Guide and Practice Tests book,
which seemed to be quite a good deal.

The Study guide covers some of the major topics in php development, starting from the basics and array, strings, pcre, stream programming etc.

The guide contains not too much information, which , cuts both ways. First: you won’t need to much time to go through it. Second: that’s not all the information you will need, to pass the test.

Do not be fooled !! Even though the Booklet starts of by telling you what php tags are, this is not for people who have not written a line of php in their life. Chapters and topics will get very complicated and very soon , as you go on reading. They will nee you to have the background knowledge.
On the other hand, even if you are not taking the test, this material is written by a group of php experts that will put light on many edgy points in developing, so it might be a quite good read.

The exercise book, will cover basically everything you learned on the Study Guide + extra material. The presence of this extra material, confirms what i wrote earlier, about the fact that the guide will not teach you everything that you need to know.

Two things will help a lot: Experience, ability to memorize ( php manual always at hand).

By this point, I think that the exercise book is a lot tougher ( in some topics ) than the test itself,

After a couple of white nights, gallons of coffee, and a staggering amount of random information stored in my head ( ) went and took the exam.

Now, i know the test is supposed a real-life one, but it isn’t.
Today, one of the biggest tools that a php developer has at hand, is the (well structured) PHP Manual.
I think the exam concentrates too much on asking ie: the correct order of input and output of array_merge_recursive, but also not giving you a chance to write a single line of code, or have a case study etc…

One of the good things of the approach that this test has, is that by the end of your studying time (if you did it properly ), regardless if you pass or not, you will code much faster and you will need the manual way less.

All these things said, i don’t have a real problem with the way that the preparation and the test works.

The only thing that quasi-bugs me, is the fact that the only passing grade is PASS.
I’m definitely not talking about myself here but, there are some people out there , who are proper php gurus, and probably should not be evaluated the same as somebody who barely passed it.
I mean, maybe it’s just the formulation GRADE: PASS.
Could be ‘ Congratulations, you succeeded.. etc etc’.

So yesterday, i passed the ZEND Php Certification test ( with a positive grade that i would love to know specifically ) in Rome Italy.