PHP How To Articles

Drupal xss weakness

2012-01-23T09:03:00.000-08:00

A major flaw in drupal form api is the missing of a real filtering
module. The current filter of drupal runs only at the display of field
content, but not when the field data is saved in the database.
This places in high risk the site admins, that have full access, so
the bad scripts are showing when editing a form, for example a
comment. There is no problem with that, but if the user has a ckeditor
or tinymce active, then it is a risk that the mallitious scripts to be
executed by the web browser, putting in danger the user by sending
private information on mallitious sites.
To solve the problem, i've made a module that filters all xss from all
formes, but be carefull because you might have scripts in one or more
of your nodes, for example google adsense or google map. Those scripts
will disapear if the form is not listed in exceptions.
You can download the module from here!

Making javascript uc_first function

2012-01-22T08:05:00.000-08:00

Solve the drupal 7 problem of css and js aggregation

2012-01-22T08:02:00.000-08:00

Drupal 7 has reached a mature state in it's development so more and
more sites are upgrading to drupal 7.
But this does not mean it is flawless. The other days i installed
drupal on a website and when i enabled css and js aggregation ...
surprize ... all the style and javascript were no more.
The reason was that while drupal tried to aggregate my files, it
couldn't save them to the publuc://css location. Seems like while on
some servers public:// works, on others does not so insted of trying
to use realpath, drupal returns an error in our log:
"The file temp://xxx cannot be copied to public://css/xxx.css"

And no stylesheet/js apears on your site.
I didn't have time to investigate the reason why this happens, but
there is a fix, and this means to edit the includes/file.inc, and in
the last if statement of function file_copy write
$real_source instead of $source
and
$real_destination instead of $destination

or just put another if in the old one so instead of giving that error,
try to copy with real paths instead.

Have fun!

How to programatically change a template file in drupal 6

2012-01-13T10:11:00.001-08:00

When building modules in drupal, you often would like to change the template file of a specific hook, for example page.tpl.php.
Drupal does not have a special function to do this, but you can play with these 2 functiones:

init_theme()

and

theme_get_registry().

For this to work you need to put a code into your menu callback function.
First, we need to build the theme registry:

init_theme();

Now, you can get the theme registry in an array to modify it, like this:

$registry = theme_get_registry();

So in registry we have an array that we can modify in any way we like. For example, the array

$registry['page']

keeps the template name and the location for page.tpl.php.

If we change the location or anything else in this array now, it will take effect only in our custom module, it will not be recorded in the cache.

After we modify what we want here, we save the array by running

theme_get_registry($registry);

That's all, we now have a different template for that hook, that will take effect only on this page.

Singleton design pattern in PHP

2011-07-20T01:03:00.000-07:00

You can find all the information you need on the web if you google singleton design pattern. So I'm not gonna fill your head with all the theory.

I'll tell you how you can implement it.

So, we have a application that lists the products from the database. To do this, we have a class named 'Product'.

class Product{
    public $_data;

    function __construct($id = 0){
        if($id != 0)
            $this->loadProduct($id);
    }

    function loadProduct($id){
        if(!$id) 
            return;
        $this->_data = mysql_fetch_array(
                       mysql_query("SELECT * FROM products WHERE id = ".intval($id))
                );
    }
}

This is a basic method of selecting a product from the database.

Now, if we select the product just once, there's no problem. But if our product appears on more then one part of the site, let's say for meta info, for special products on the right side, instantiating our class for 3 times consumes many resources and time.

The idea is to keep out instances in a static variable, and to use that variable to return the already selected product. Now the program uses less resources and is faster.

To do this for our class, we need a static method, called by default (so other programmers know what is about) "getInstance".

class Product {
    static $_instances;
    
    public $_data;
    
    private function __construct($id = 0){
        if($id != 0)
            $this->loadProduct($id);
    }
    
    public function loadProduct($id){
        ...
    }
    
    public static function getInstance($id){
        if(!array_key_exists($id,self::$_instances)
               || !(self::$_instances[$id] instanceof self) ){
            self::$_instances[$id] = new self($id);
        }
        return self::$_instances[$id];
    }
}

So we have a static variable $_instances declared in the class. We do this because we might need that variable to be visible across the class, for other methods like one that checks if that product is already instantiated. This helps if you want to be sure that the product is not listed twice in the site - like once in the product listing page, and twice in the column that shows the special offers.

I put the constructor private to make sure another instance of the class cannot be made.

This is a very useful method, but not for all objects. It is useful for the database class (in combination with factory design patters, which I'll explain at another time), for session class (this too is better with factory), for product class, basically for any class that might be used all over the site. It is not very useful at a pagination class for example.

Have fun

How to fit an image in a rectangle area in PHP using GD

2011-06-23T00:38:00.000-07:00

Have you ever had a fixed space in your design, and you must put an image that fits exactly there, while preserving the aspect ratio? Well, this is what i'll explain in this article.
Let's say we have this image:

To fit this image in a 100x100 box while keeping the image aspect ratio, we have 2 options:
The first (and most used) is to resize and crop it.

If we have a image resource $img :

$w = imagesx($this->_img);
$h = imagesy($this->_img);

$nw = 100;
$nh = 100;

$fw = $nw;
$fh = $nh;


$nh_ = ( $h * $nw )/ $w;

$fit = true;
if($fit === true ){
 if($nh_ < $nh){
  $fh = $nh;
  $fw = ( $w * $nw )/ $h;
 }else{
  $fw = $nw;
  $fh = ( $h * $nh )/ $w;
 }
}else{
 if($nh_ > $nh){
  $fw = ( $w * $nh )/ $h;
  $fh = $nh;
 }else{
  $fw = $nw;
  $fh = ( $h * $nw )/ $w;
 }
}

$tmp=imagecreatetruecolor($fw,$fh);

imagecopyresampled($tmp,$img,0,0,0,0,$fw,$fh,$w,$h);
$img = $tmp;
uset($tmp);

If we have the $fit variable set to true, then ve have this picture resized to a rectangle that can hold a 100x100 px square. If we set the $fit variable to false, we will have the image that will fit in a 100x100 px square. In both cases, the image is not yet a 100x100 px square. If we take our image, in the first case, is a rectangle with 100px height, in the seccond is a rectangle with 100px width. Now, to make it 100x100 px, we have to crop it. To do that, we center it, then crop it to the exact size:

// we recalculate the image size, because it is different now
$w = imagesx($img);
$h = imagesy($img);

// we calculate the x and y position of the point that we will use to start cropping
// so that we can fit a 100x100px square
$x = ($w - $nw)/2;
$y = ($h - $nh)/2;

After the calculations are over, we start cropping:

// we make a 100 x 100 px image
$tmp = imagecreatetruecolor($nw,$nh);
// we create a color value for the background
$clr = imagecolorallocate($tmp, 255,255,255);
// we fill the image with our background
imagefilledrectangle ($tmp, 0, 0, $nw, $nh, $clr);

// we resample the image
imagecopyresampled($tmp, $img, 0, 0, $x, $y, $nw, $nh, $nw, $nh);
$img = $tmp;

Now $img is an image resource with a 100x100 px image in it, that we can do aditional opperations, or display it.

Using a transparent PNG image as watermark in PHP

2011-06-21T05:14:00.000-07:00

Sure there are plenty of scripts on the internet that does this thing ... but very few explain this.

Let's use this function:

function watermark($jpgimage, $pngimage){
        $image= imagecreatefromjpg($jpgimage);
        $watermark = imagecreatefrompng($pngimage);

        $ww = imagesx($watermark);
        $wh = imagesy($watermark);

        $iw = imagesx($image);
        $ih = imagesy($image);

        // watermark position
       $x = ( $iw - $ww ) / 2;
       $y = ( $ih - $wh ) / 2;

        imagealphablending( $image, true);

        imagecopyresampled($image, $watermark, $x, $y, 0, 0, $ww, $wh, $ww, $wh);

        imagealphablending($image, false);
        imagesavealpha($image, true);
        return $image;
}

This function puts a PNG watermark on a JPG picture while saving the alpha channel, and returns an image resource.

To do this, we first create an image resource from the jpg image and another one from the png(the watermark).

$image= imagecreatefromjpg($jpgimage);
$watermark = imagecreatefrompng($pngimage);

After that, we take the images x and y sizes and calculate the watermark position.

        $ww = imagesx($watermark);
        $wh = imagesy($watermark);

        $iw = imagesx($image);
        $ih = imagesy($image);

        // watermark position
       $x = ( $iw - $ww ) / 2;
       $y = ( $ih - $wh ) / 2;

Then, we set the blending mode to true and add the watermark:

        imagealphablending( $image, true);

        imagecopyresampled($image, $watermark, $x, $y, 0, 0, $ww, $wh, $ww, $wh);

Finally, we set the blending mode false and save the alpha channel information for transparency:

imagealphablending($image, false);
imagesavealpha($image, true);

That's it. We return the image resource for further manipulation.

Calculate the distance using lattitude, longitude and ZIP codes in MySQL

2011-06-16T01:40:00.000-07:00

So, assuming we have a table:

ZIP_CODES
zip_code | lattitude | longitude

We take this zip code from NY
$zip = 10001
$lat = 40.750742
$lon =-74.52976

What we need is the Earth radius (6371 km).

If we need to search the zip codes that are in a 10 km area, we could use this 'small' sintax:

2 * 6371 * ATAN2( (SIN( ( ($lat - lattidude) * PI() / 180 ) / 2 ) * SIN( ( ($lat - lattidude) * PI() / 180 ) / 2 ) + SIN( ( ($lon - longitude) * PI() / 180 ) / 2 ) * SIN( ( ($lon - longitude) * PI() / 180 ) / 2 ) * COS(lattitude) * COS($lat)) , ( 1 - (SIN( ( ($lat - lattidude) * PI() / 180 ) / 2 ) * SIN( ( ($lat - lattidude) * PI() / 180 ) / 2 ) + SIN( ( ($lon - longitude) * PI() / 180 ) / 2 ) * SIN( ( ($lon - longitude) * PI() / 180 ) / 2 ) * COS(lattitude) * COS($lat)) ) ) < 10

For this calculation, i used the harvesine formula to calculate the great-circle distance between two points (the shortest distance over the earth's surface - ignoring any hills).

This formula remains particularly well-conditioned for numerical computation even at small distances – unlike calculations based on the spherical law of cosines.

Hope this helps.

How to calculate age in MySQL

2011-06-16T01:24:00.000-07:00

When programming, you hit yourself with many problems, that apparently are very simple, but require a rather difficult syntax.

On a site, i found a small problem - to calculate the age of the person and see if that person is between 2 selected ages.

For that, i used the MySQL DATE_FORMAT function and NOW function like this:

DATE_FORMAT(NOW(), '%Y') - DATE_FORMAT(dob, '%Y') - (DATE_FORMAT(NOW(), '00-%m-%d') > DATE_FORMAT(dob, '00-%m-%d'))

Where 'dob' is the date field for date of birth.
Explanation:

DATE_FORMAT(NOW(), '%Y') - DATE_FORMAT(dob, '%Y')

This returns the difference between the birth year and the current year.
To make this function work if the user has not celebrated his birth date this year, we must decrease one. So we do:

DATE_FORMAT(NOW(), '00-%m-%d') > DATE_FORMAT(dob, '00-%m-%d')

This operation returns 1 if the user has not reached his birth date, and 0 otherwise.

Hope this will help you.