• Overview
  • What is the Yahoo! Open Stack?
    • Developer Tools – YUI, Tutorials
    • YOS SDK for PHP
  • Data APIs – YQL, BOSS …
  • Social APIs – Profiles, Connections, Updates, …
  • Application Platform
    • OpenSocial Support
• How does it all work?
  • Development Workflow
• Building an open application with PHP and YOS
• Common Problems & Solutions
  • CAJA
  • OpenSocial

Before we keep going, if you don’t know what svn hooks are you can read up on them at http://svnbook.red-bean.com/en/1.1/ch05s02.html.  svnbook.red-bean.com is my reference site of choice whenever I need to look up a svn command.

My #1, all-time, greatest in the world, bestest favorite is a svn pre-commit hook to syntax check my PHP code.  There is nothing I hate more than a developer checking in code with syntax errors and breaking qa or stage or even, god-forbid, production.  It’s as easy as setting up the hook to run a script that calls “/path/to/php -l /path/to/file.php” and on failure reject the commit.  This way code that has syntax errors will never make it into SVN.  Now if only open-source projects like ZendFramework did something like this before releasing their code.  To be fair, the syntax errors are in their documentation not in the /library/ files but that’s still pretty dumb & annoying.

Another nice way to use a post-commit hook is to run something like PHP_CodeSniffer against the commit.  CodeSniffer is an awesome PEAR package that scans your file and flags coding standards violations.  It comes pre-packaged with sniffers for the PHPCS, PEAR, Squiz and  Zend.  Set it up to run and if it finds coding standard violations you can have the hook send out nasty little blame messages.    This isn’t something that I’d want to run on pre-commit just in case you really need to get something into production NOW.  But if I hosted an open source project, I’d consider it.

Having minified JavaScript & CSS has become the standard way of serving JS & CSS.  But who really wants to take the time to minify or combine them?  Once again, enter svn hooks.  One of the developers set this up for GameSpot and it has been working great!  Basically it checks the commits against a defined naming standard, file.src.js or file.src.css, and then runs the YUI! Compressor on it and commits in file.min.(js|css).  He also made it check a global.conf in the file’s directory so it came mash up smaller js files into a global.min.js so we serve one file instead of ten.

Of course, let’s not forget about what is probably the most common svn hook; the post-commit email hook.  I like svnmailer better than mailer.py that comes with svn by default.  I think it’s easier to configure/change and to setup rules for how you want the emails to look or where to go.

If you’re using a ticket tracking system like Bugzilla or Trac that doesn’t have its own way of peeking into svn (like JIRA can with this plugin) you can write a post-commit hook to update the ticket when something is committed.  You can see how Trac recommends you do it at http://trac.edgewall.org/browser/trunk/contrib/trac-post-commit-hook.

To help you on the way to creating your own svn hooks, tigris has a few hooks that are distributed with svn.  They can be quite helpful so you should take a look at them.

When I’m dealing with user inputted data where I want to allow HTML I have two concerns. First, I don’t want to allow XSS (some xml parsers think <p kkk=”></p>” closes the <p> tag). Second, the user frequently enters invalid html (e.g., doesn’t close the <a> tag). Fortunately tidy can easily deal with both. The second issue is the easiest to solve by running tidy->cleanRepair() on the html. The first is taken care of by looping through the tidy nodes and rebuilding the html using a whitelist. More about how to do this after the break.

To start, you’ll need to setup your tidy options. I tend to use the following options. The word-2000 option is great because it strips out all of the annoying html, css, etc. that Microsoft Word inserts for its formatting.

Add/Remove these options as it works best for you. I’ve found that these work best for the cleaning & repairing of accidentally invalid HTML. Read the tidy docs for what each of these mean and how they affect what tidy does. Please note that in the above options I include “force-output” so that I can display back to the user what the results of trying to fix the HTML is so that they can fix their input.

If you’re parsing user generated content, usually they are just entering the tags and HTML for the specific content they want posted. This means you’ll need to wrap that input in the <!DOCTYPE>, <HTML> and <BODY> tags before processing it through tidy.

So how you setup the array for tag validation is pretty much up to you. The format I used looks a lot like this:

The auth_level is a filter that I have in place to only allow users with a certain amount of access, such as internal staff, to use that attribute. As you probably already know, attributes like onmouseover are an easy gateway to XSS exploits. As you add new elements to the tag rule definition you just need to update the validate function in order to validate against it.

You may have noticed that I’m using the deprecated HTML attributes instead of putting all of this in a “style” attribute. I’ve found that most users don’t know CSS styles and are familiar with the old-style HTML attributes. If you force your users to use styles you’ll have whole other validation routine to ensure exploits are not in the CSS.

Note: Please don’t just copy/paste this code into your code and use it. I’m quite positive there are bugs and typos all throughout. Oh, and no, this is not the code used by the sites I work on. It is similar but definitely not the same.

RSVP here: http://php.meetup.com/139/calendar/8911737/

The blurb from ZendCon08:
Terry Chay, the original PHP Terrorist, is well known for his criticism and ridicule of the Ruby on Rails framework. He criticizes, mocks, and f-bombs his enemies into surrender. In this discussion, Terry will share his ideas and thoughts on making frameworks better.

Map to CNET Networks, Inc.
When you arrive, please look for the PHP Meetup sign pointing you to the conference room. Please RSVP if you are attending so that I can prepare enough snacks and beverages.

Look forward to seeing you there!

This event can be found at:
http://php.meetup.com/139/calendar/8911737/
http://www.facebook.com/event.php?eid=39294579201
http://upcoming.yahoo.com/event/1195581/

Title: PHP::$unicode->i18n()

Description:
PHP 6 brings fully functional and mature Unicode support to the Web world. This talk will cover all the layers of the PHP (bread)/Unicode (butter)/i18n (jam) sandwich. Come and find out how to work with locales, use collation to compare and sort strings, and format numbers, currencies, and dates for any country in the world. Bring your appetite because the toasty goodness is waiting.

When: Thursday, July 10th, 2008 at 7pm
Where: CNET Networks: 235 2nd St, San Francisco, CA  94518

You can RSVP on the SF PHP Meetup’s site or just show up.  I always like it when people RSVP so that I know how much food to buy.  But it isn’t a prereq or anything.

EDIT: I just saw that Terry mentioned PB&J and I like the idea.  So PB&J it is; plus the usual chips, sodas, candy, etc. of course. 

Must Have:

• Expert PHP skills, bonus for RoR
• 5-7 years of real world experience engineering web solutions for LAMP stacks
• Strong relational DB knowledge (table optimization, query optimization)
• Ability to prioritize and lead multiple simultaneous projects effectively
• Excellent understanding of OO software engineering concepts
• Ability to arhitect solid, scalable, extensible solutions for SE needs
• Excited by working on high-level design and architecture
• Comfortable mentoring junior engineers
• Expereince with formal release processes
• Strong verbal, written, analytical and communication skills

Bonus for:

• Admin experience with MySQL, Apache, SVN
• Background developing in a more structured language (C, C++, Java, etc)
• At least 3 years experience in high-traffic/high-availability web sites
• Strong UI experience with javaScript and AJAX using mootools or other JS Frameworks
• Experience with following technologies: Memcached, Smarty, SOLR, Lucene, Zend Framework

If you think you have what it takes, head over to our Jobs site and apply: https://careers.cnetnetworks.com/joblist.html

If you want to discuss the job in more detail first, please don’t hesitate to send me an
at michael[
]tougeron[
]cnet[
]com.

After the keynotes, I decided to start off with the Testing PHP/MySQL Applications with PHPUnit/DbUnit session by Sebastian Bermann. I know I should already be using PHPUnit, but honestly I’ve never gotten around to it. I’m hoping that this will give me the kick in the ass that I need to start.

The first thing that Sebastian wanted us to note is that the PHPUnit listed on SourceForget.net is not the real PHPUnit. I kind of thought that weird and confusing. You’d think by now that he could get that old project de-listed.

Installing PHPUnit is fairly simple. It is not hosted off the standard PEAR channel, but by a quick extra command you can get access to it.
pear channel-discover pear.phpunit.de
pear install phpunit/PHPUnit

By setting up a reusable testing environment with PHPUnit you’ll be able to do automatic execution of your test code. This would be good for things like over night tests of the latest code commits. If a test fails, the developer team can be immediately notified. Be sure to enforce strict separation between production and testing environments. The last thing you want to happen is to have your test cases somehow break production.

Setting up a test case can be as simple or complex as you need it to be. You setup a class for each element/object you need to test. Each test case is a member function of this class where you assert value comparisons. While the documentation examples are best, here is a very simple example:

<?php
class BankAccountTest extends PHPUnit_Framework_TestCase {

    public function testBalanceIsInitiallyZero() {
        $ba = new BankAccount;
        $this->assertEquals(0, $ba->getBalance());
    }
}
?>

Where things can now start to get interesting is when you use the database extension to PHPUnit. The DBUnit extension was ported from jUnit by Michael Lively Jr.

DBUnit uses PDO to talk to a default SQLite database. However, a database it not required as it can emulate a database in memory or via XML. It also works with MySQL, but if the tests are written in a way that is compatible with SQLite, then the tests can be faster by about 20%.

Once of the nice things about how DBUnit works is how it puts the db into a known state between each test run. This means it avoids problems with one test case corrupting the db for other tests. By using its ability to import/export data to/from XML datasets, your db tests will run reliably and accurately.

Like with PHPUnit, DBUnit has assert methods like “assertTableEquals(expected, actual)” and can use PHP arrays for comparison. This can be good for comparing records in the database. e.g., The db gets updated via a PHPunit test and you then do a DBUnit test to verify the action.

A quick example of a DBUnit test case:

<?php
class BankAccountTest extends PHPUnit_Extensions_Database_TestCase {
    protected $pdo;

    public function __construct() {
        $this->pdo = PHPUnit_Util_PDO::factory($dsn);
        BankAccount::createTable($this->pdo);
    }

    protected function getConnection() {
        return $tihs->createDefaultDBConnection($this->pdo, 'mysql');
    }

    protect function getDataSet() {
        return $this->createFlatXMLDataSet('/path/to/seed.xml');
    }
}
?>

Anway to the topic at hand…

April’s PHP Meetup is looking like it will have another great turn out. The group just keeps growing and growing. Our average attendance for the last two months have been over 70 people! I still have a hard time believing that this many shy, techie geeks like me actually show up.

April’s topic will be run by Dustin Whittle from Yahoo! and will be about the symfony framework. He’ll be doing a brief overview of the framework and then walk people through setting up a site. If you’re planning on attending, bring your laptop and code along with us.

Terry has had a strong presence in the last couple of meetups; they probably wouldn’t have been successes without him.  This talk should be pretty interesting and should draw a good sized crowd.

On a side note, what’s up with meetup.com lately and their email system?  It used to be I’d email the group and it’d arrive in my inbox a few minutes later.  Still nothing.  Weird.

It was nice to meet Cal Henderson, I love his book about site scalability “Building Scalable Web Sites: Building, scaling, and optimizing the next generation of web applications” I highly recommend buying it if you haven’t already. Of course I didn’t want to be a groupie or anything so I didn’t tell him that. Wanted to though.

I didn’t get an opportunity to talk with Andrei; I didn’t recognize him (stupid eyes) and it was too noisy to really hear his introduction. I a bit too shy to try to re-introduce myself.

Surprisingly Terry Chay was quite quiet. Didn’t stop the speakers from cussing for him. Really glad he introduced me to Lucas though. That was a big help.

Speaking of Lucas, he’s working on a new talk and wants to try it out before going to the conferences with it. He’s thinking about bringing it to the PHP Meetup in the next couple of months to see how it goes. I hope that happens, bringing more well known PHP names to the group will help take it to the next level.