Security Enhancements and Fixes in PHP 5.3.2:

• Improved LCG entropy. (Rasmus, Samy Kamkar)
• Fixed safe_mode validation inside tempnam() when the directory path does not end with a /). (Martin Jansen)
• Fixed a possible open_basedir/safe_mode bypass in the session extension identified by Grzegorz Stachowiak. (Ilia)

Key Bug Fixes in PHP 5.3.2 include:

• Added support for SHA-256 and SHA-512 to php’s crypt.
• Added protection for $_SESSION from interrupt corruption and improved “session.save_path” check.
• Fixed bug #51059 (crypt crashes when invalid salt are given).
• Fixed bug #50940 Custom content-length set incorrectly in Apache sapis.
• Fixed bug #50847 (strip_tags() removes all tags greater then 1023 bytes long).
• Fixed bug #50723 (Bug in garbage collector causes crash).
• Fixed bug #50661 (DOMDocument::loadXML does not allow UTF-16).
• Fixed bug #50632 (filter_input() does not return default value if the variable does not exist).
• Fixed bug #50540 (Crash while running ldap_next_reference test cases).
• Fixed bug #49851 (http wrapper breaks on 1024 char long headers).
• Over 60 other bug fixes.

Other nice improvements with this version include an (almost) up-to-date PCRE library (PHP 5.3.2 includes PCRE 8.00 with the latest version being 8.01) for regular expressions and a number of nice improvements to the filter extension both of which I use very regularly.

Do you, dear reader, keep up-to-date with PHP 5.3 (or 5.2) or are you stuck with steadily aging versions due to restrictive hosting providers?

The (currently undocumentednow documented³) DOMXPath::registerPHPFunctions method is available as of PHP 5.3.0 (it was added to the code base back in December 2006) and allows the use of PHP functions (and static methods) within XPath queries to complement the normal set of XPath functions².

Description

void DOMXPath::registerPHPFunctions ([ string|array $restrict] )

Enables the use of PHP functions as XPath functions.

Parameters

restrict

Use this parameter to only allow certain functions to be called from XPath; it can be either a string (a function name) or an array of function names.

Return Values

No value is returned.

Examples

Note: The following examples load a sample XML document called book.xml with the following contents:

<?xml version="1.0" encoding="UTF-8"?>
<books>
    <book>
        <title>PHP Basics</title>
        <author>Jim Smith</author>
        <author>Jane Smith</author>
    </book>
    <book>
        <title>PHP Secrets</title>
        <author>Jenny Smythe</author>
    </book>
    <book>
    	<title>XML basics</title>
    	<author>Joe Black</author>
    </book>
</books>

Example #1: Call a PHP function in XPath with php:functionString

This example demonstrates the basic use of DOMXPath::registerPHPFunctions by replicating the substring XPath function. The first thing that needs to be done is to register the php namespace with the associated URI http://php.net/xpath. Don’t question it, it just needs to be done!

Next, we call DOMXPath::registerPHPFunctions on our object. If no arguments are used, as in this example, then the range of functions allowed to be called is not restricted—you can call any⁴ function from XPath. I would always advise restricting the functions which can be called, see example 2.

Within our XPath query, we use php:functionString which allows us to name a function and provide some parameters (or indeed, no parameters) to be passed to that function. There are two flavours which can be used here: php:functionString which passes an XML node/attribute as a string and php:function (see example 3) which passes an array of XML node/attribute objects (in DOMElement / DOMAttr / etc. form) to the function . In this example the PHP function substr is called, passing along the book’s title (in string form), an offset of 0 and length of 3. This returns the first 3 characters of the book’s title which is then compared to the string PHP in order to filter our list of books down to those having titles starting with PHP.

<?php
$dom = new DOMDocument;
$dom->load('book.xml');
 
$xpath = new DOMXPath($dom);
 
// Register the php: namespace (required)
$xpath->registerNamespace("php", "http://php.net/xpath");
 
// Register PHP functions (no restrictions)
$xpath->registerPHPFunctions();
 
// Call substr function on the book title
$nodes = $xpath->query('//book[php:functionString("substr", title, 0, 3) = "PHP"]');
 
echo "Found {$nodes->length} books starting with 'PHP':\n";
foreach ($nodes as $node) {
	$title  = $node->getElementsByTagName("title")->item(0)->nodeValue;
	$author = $node->getElementsByTagName("author")->item(0)->nodeValue;
	echo "$title by $author\n";
}
?>

The example will output something like:

Found 2 books starting with 'PHP':
PHP Basics by Jim Smith
PHP Secrets by Jenny Smythe

Example #2: Restricting the functions available to XPath

To restrict the functions made available to XPath, provide either a string containing the name of the single function that you wish to allow or an array of strings containing function names as the restrict parameter (note: static methods can also be used, e.g. “Classname::method“). If functions were added with restrict and a function is called in XPath which is not one of them, an E_WARNING will be raised stating Not allowed to call handler ‘function()’ (where function is the name of the function that cannot be called).

<?php
$dom = new DOMDocument;
$dom->load('book.xml');
 
$xpath = new DOMXPath($dom);
 
// Register the php: namespace (required)
$xpath->registerNamespace("php", "http://php.net/xpath");
 
// Register PHP functions (no restrictions)
$xpath->registerPHPFunctions("strtoupper");
 
// Get first book's title in uppercase
$title = $xpath->evaluate('php:functionString("strtoupper", //book[1]/title)');
echo $title;
 
// Try a function not in our restrictions list
$fail = $xpath->evaluate('php:functionString("strtolower", //book[1]/title)');
 
?>

The example will output something like:

PHP BASICS<br />
<b>Warning</b>:  DOMXPath::evaluate() [<a href='domxpath.evaluate'>domxpath.evaluate</a>]: Not allowed to call handler 'strtolower()'. in <b>example2.php</b> on line <b>18</b><br />

Example #3: Passing DOM objects using php:function

Up to now, the examples have both used php:functionString. As mentioned above, instead of passing a string value to the PHP function it is possible to pass along an array of DOM* objects to manipulate them as you please by using php:function.

<?php
$dom = new DOMDocument;
$dom->load('book.xml');
 
$xpath = new DOMXPath($dom);
 
// Register the php: namespace (required)
$xpath->registerNamespace("php", "http://php.net/xpath");
 
// Register PHP functions (no restrictions)
$xpath->registerPHPFunctions("example3");
 
function example3($nodes) {
    // Return true if more than one author
    return count($nodes) > 1;
}
// Filter books with multiple authors
$books = $xpath->query('//book[php:function("example3", author)]');
 
echo "Books with multiple authors:\n";
foreach ($books as $book) {
    echo $book->getElementsByTagName("title")->item(0)->nodeValue . "\n";
}
?>

The example will output something like:

Books with multiple authors:
PHP Basics

Summary

Just to quickly summarise everything, here is a quick run-down. In PHP, make sure to register the php namespace (with the URI http://php.net/xpath) and then register your PHP functions (whether core, extensions or user-defined) or static methods with DOMXPath::registerPHPFunctions. In XPath, use php:functionString or php:function to call the PHP function.

If you have made use of this feature, or want to know more, then do feel free to comment. Thanks for reading.

Footnotes

1. http://php.net/dom
2. http://schlitt.info/opensource/blog/0704_xpath.html
3. The documentation page, when it gets written, will beis available at http://php.net/domxpath.registerphpfunctions
4. In truth, some functions are not suitable such as those that return non-scalar values (and cannot be cast to one) which XPath will not understand.

Original Comment (#112314)

Hi Christian, thank you for the article. I would like to share a few comments if I may.

You seem to create the interface (ICrypter) almost without considering why an interface might be necessary. The article skirts around the reasons why an interface might be handy, instead preferring to mention that any class which implements a given interface must adhere to it (other than, “there will be an error!”). It is far outside the realm of a simple blog comment to delve into this subject so I can only suggest that readers take it upon themselves to build their own understanding of interfaces in general and in PHP. There is a lot of great information out there (for a recent insight into the subject, see http://www.brandonsavage.net/why-interfaces-rock/ ).

The article doesn’t state anywhere (though it will be mightily obvious when a reader tries to use the code) that MCrypt is required. Readers, see http://php.net/mcrypt.requirements and http://mcrypt.sourceforge.net/

With regards to the list of “supported algorithms from php.net” it would have been nice to have a source cited for reference. See http://php.net/mcrypt.ciphers

The remarks about Base64 encoding/decoding values seems a little odd. Why would you automatically want to do this? Your argument is that the encrypted value might not be URL-safe but that is only an issue if the encrypted value is being placed in an URL. If you do need to use the encrypted value in an URL then it would make more sent to encode the value only when it needs to be. Base64 is not the only available option for making such a value URL-safe (the functions urlencode and http_build_query to name a few).

It also puzzles me that you use the trim function on the Base64-encoded value since there will not be any whitespace present to be trimmed! The same goes for trimming the decrypted value since there may be important whitespace which really should not be trimmed.

The article itself does not elude to why this helper class might be useful. Your comments state there will be a follow-up article with a more practical demonstration but sure it would have been nice to include a very brief situation and code example where this type of encryption/decryption is of particular benefit.

I guess that is enough writing for a blog comment! Congratulations on publishing your first article on Nettuts+ and I look forward to your next ones.

The above is my comment, copied verbatim (with the links manually added since Wordpress didn’t want to do that). Someone probably just missed by comment in the queue, so whether it appears on the Nettuts+ site or not remains to be seen. Either way the full comment is available here for reference.

Edit: between publishing this (at 8:22pm) and now (10:45pm) the comment got approved and is up on the Nettuts+ website. Guess I was just slightly too quick out of the blocks in republishing it here.

On the plus side, for those who have yet to take the plunge into using PHP 5.3, this iterator has been part of the core of PHP as of 5.1.0 so there is a much greater chance of actually being able to use it right now. Bear in mind that the SPL is supposed to work together with its component parts so if iterators are a foreign concept, some of this post might be a little unclear but it is not the purpose of this post to outline iterators in PHP.

As eluded to above, the InfiniteIterator comes in useful when you have an existing Iterator (anything that implements that interface; a directory listing (DirectoryIterator), a file (SplFileObject), an array (with ArrayIterator), and so on) and wish to iterate over its contents again and again.

An InfiniteIterator Example

Here is a basic example that I wrote for the documentation. Note that a LimitIterator is used to restrict the values which are iterated over (otherwise the loop would go on forever!).

<?php
$arrayit  = new ArrayIterator(array('cat','dog'));
$infinite = new InfiniteIterator($arrayit);
$limit    = new LimitIterator($infinite, 0, 7);
foreach($limit as $value)
{
    echo "$value\n";
}
?>

This example outputs something along the lines of:

cat
dog
cat
dog
cat
dog
cat

Can you think of any more useful instances where the InfiniteIterator might come in useful?

Here’s the summary

• Just because it’s not the latest and greatest version, it doesn’t mean it’s not good
• Just because you don’t understand something, it doesn’t mean you shouldn’t embrace it
• There’s nothing stronger than a bond between those who care
• It takes all kinds to make the ‘verse go ’round
• Use only what you need
• A good team is nothing without good leaders

Building on the idea of open data tables, I made a very quick table (see it on GitHub) which plugs into Feedburner’s API and allows us, with a few different options, to grab data about a specific Feedburner feed by using queries like select * from feedburner.feed where uri="cowburn"¹.

Querying against the table

Since the table is just my own, and not part of the main collection of contributed tables, we have to tell YQL about its location before we can do any queries on it. To do that, simply use use pointing to the url of the XML file: use "http://github.com/salathe/yql-tables/raw/master/feedburner/feedburner.feed.xml";

Once YQL knows about the table, we can query against it (by default the table name is constructed from the file name, feedburner.feed.xml means we use feedburner.feed as the table name). The table is set up to allow three different methods of grabbing the feed data.

1. Up-to-date Statistics

If just the feed name is provided then only the most up-to-date information about that feed will be returned. Feedburner does not let you get stats about today, so the most recent data will always be from yesterday. So select * from feedburner.feed where uri="cowburn"¹ gives one result containing yesterdays statistics; subscriber count (circulation), the date, the number of hits the feed got and the reach of the feed.

2. Get last n days of stats

If you’re after more than just the latest figures, simply add a days clause to the where portion of the query: … where uri="cowburn" and days="7"²

3. Get a specific set of dates

If the last n days is too recent for you, there’s also the option of passing along a range or series of dates with, conveniently enough, a dates clause. This value follows the format for formatting date ranges of the Feedburner API. So to select feed data between July first and seventh from 2009 you would simply add … where uri="cowburn" and dates="2009-07-01,2009-07-07"³

Note that you cannot combine the days and dates in the same query as that would be silly.

Adding Subscriber Count to the Blog

To add the subscriber count to the page (next to the “subscribe” link in the header), just takes a few lines of JavaScript (I used jQuery) to pull a JSON-formatted response back from YQL. The console even automatically creates an URL for you to copy and paste in the section entitled “The REST query“.

The actual jQuery/JS code is not particularly noteworthy, all it does is prepare the URL to the YQL API, asks that URL for some JSON and then parses the response into a HTML span tag which is injected within the “subscribe” link of the navigation. This blog post is more about the data table, than grabbing JSON and injecting elements into the DOM (which is super-easy with jQuery anyway). Would you like that process described a bit more thoroughly? My feed widget with YQL and jQuery post shows you some actual code.

Well that’s all there is to say really. If you want to use the Feedburner data table then by all means feel free—it’s up there on GitHub so you can link to the file or fork and make your own changes.

Footnotes

1. Try select * from feedburner.feed where uri="cowburn" in the YQL console
2. Try select * from feedburner.feed where uri="cowburn" and days="7" in the YQL console
3. Try select * from feedburner.feed where uri="cowburn" and dates="2009-07-01,2009-07-07" in the YQL console

P.S. I promise (with crossed fingers just in case) that the next blog post will not be about YQL!

INSERT/UPDATE/DELETE

Now we can have a full CRUD stack to play with enabling use to write to the web in addition to the reading we’ve had thus far! If you’re failing to see the juiciness, think that you can now do INSERT INTO web.service (a, b, c) VALUES ("a", "b", "c") where web.service can be pretty much any open API (bit.ly and twitter examples are in the documentation) or, to put it plainly, pretty much any web site which accepts user input.

post/put/delete methods on the y.rest() method

A huge thank you for this since, tied into the above on I/U/D, this enables us to push back data to the web. I asked for this back in May since I needed it to log into a website via a POST request, saving cookies for the main request after login.

Json table now accepts top-level arrays.

A small bug fix but particularly useful for me. See my YQL forum post on this bug which arose due to my trying to query a delicious.com JSON feed.

Anonymous Functions

Put plainly, an anonymous function is a function without a name. That’s all, there’s nothing magic or particularly technical about it. There are a few ways to create an anonymous function in PHP; up until PHP 5.3 came around the usual way was to use create_function (see fig. 1) which takes a couple of arguments as strings and spits out a function, in PHP 5.3 we’re allowed to create anonymous functions looking much more like normal function definitions (see fig. 2).

Fig. 1: Anonymous function with create_function

<?php
$square = create_function('$x', 'return $x*$x;');
echo $square(2); // 4
?>

Fig 2: Anonymous function as of PHP 5.3

<?php
$square = function($x) {
    return $x * $x;
};
echo $square(2); // 4
?>

I hope you’ll agree that the latter is a much nicer way (visually) of defining an anonymous function, quite apart from the more logical and performance-related (see comment #4) aspects of using it.

Closures

A closure is a (anonymous) function that is aware of its context. For all intents and purposes, think of them being anonymous functions which know about some variables which weren’t defined within them. In geeky language, they are functions which close over (hence “closure”) free variables, the latter being variables which are not local nor arguments to the function. It is easier to see with an example, I think.

Without Closure

Lets say that we need a function to add three to a number (overly basic, I know). That’s easy.

<?php
$add_3 = function($x) {
    return $x + 3;
};
echo $add_3(10); // 13
?>

Now if we wanted another function to behave similarly but instead it should add 4 to the supplied number, we could just as easily create a new anonymous function to do the job.

<?php
$add_4 = function($x) {
    return $x + 4;
};
echo $add_4(10); // 14
?>

If, however, you wanted to do that for a series of different additions then things could get very repetitive, very quickly! If only we could dynamically create an anonymous function to do what we wanted: enter the closure.

With Closure

We can define an anonymous function (it needn’t be anonymous but lets keep on theme) which returns anonymous function based on arguments supplied to it. Remember our definition of a closure above, specifically making use of ‘free’ variables, that is what our $value_to_add is in the example below.

<?php
$add = function($value_to_add) {
    return function ($x) use ($value_to_add) {
        return $x + $value_to_add;
    };
};
 
$add_3 = $add(3);
$add_4 = $add(4);
 
echo $add_3(10); // 13
echo $add_4(10); // 14
?>

A more practical example

As fun as silly adding examples are, there will be undoubtedly someone who has been reading everything above (good job getting this far!) and cannot see a practical use for all of this. Since le Tour de France is on, lets have a play on words and have an example on cycling (over a series of values).

Cycling with Closures

<?php
// Cycle factory: takes a series of arguments
// for the closure to cycle over.
function cycle() {
    $items = func_get_args();
    // Create closure using the supplied list of arguments
    return function() use (&$items) {
        // Get current item
        $current = each($items);
        // Rewind if at the end of the list
        if ($current === FALSE) {
            reset($items);
            $current = each($items);
        }
        // Return the current item
        return $current['value'];
    };
}
 
// Create our list of CSS classes to cycle over
$class = cycle('odd', 'even');
// List of adjectives, why not
$taste = cycle('vile', 'yummy', 'delicious');
 
// Our list of items to be formatted into a pretty HTML list
$items = array('apple', 'banana', 'cherry', 'date', 'elderberry', 'figs');
 
?>
<ul>
<?php foreach ($items as $item) : ?>
	<li class="<?php echo $class() ?>"><?php echo $item ?> are <?php echo $taste() ?></li>
<?php endforeach ?>
</ul>

That example would provide the following output:

<ul>
	<li class="odd">apples are vile</li>
	<li class="even">bananas are yummy</li>
	<li class="odd">cherries are delicious</li>
	<li class="even">dates are vile</li>
	<li class="odd">elderberries are yummy</li>
	<li class="even">figs are delicious</li>
</ul>

Well, it’s a little bit more practical anyway! Have you been playing with closures and/or anonymous functions too?

Go download and play with the new features available such as namespaces, LSB, anonymous functions and closures along with many more bug fixes, additions and improvements.

My favourite addition at the moment is the improvements made to the DateTime extension with new classes such as DatePeriod (for iterating over dates/times) and DateInterval and additions to the DateTime class such as DateTime::createFromFormat and DateTime::add (and sub).

The anonymous functions will also be very useful where one might previously use create_function (or a normal non-anonymous function) in particular for callbacks to other functions/methods.

<?php
echo preg_replace_callback('/[A-Z]/', function ($match) {
    return str_rot13($match[0]);
}, 'Uello Jorld!');
?>

So, download it and have an explore.

Easy enough, XPath contains (pardon the pun, see later) some nifty functions which can act on nodes and their values to be used in conditional checks like I needed. I’ve been using the technique outlined in this post for a very long while (usually with XPath in PHP) and originally stumbled upon the basic idea from How to map CSS selectors to XPath queries (Thanks ever so much!) Today’s use of it prompted this blog post.

For example, to grab any li elements with a class of active (and only that one class) out of the document it would be easy enough to use:

//li[@class="active"]

Now, as I said that will only grab the list items which have that specific class like <li class="active">. What if there is more than one class in there, ala <li class="hot active">? We could use the XPath function contains which looks to see if a string contains another string but that would cause problems (e.g. searching for “a” in conjunction with classes like “active”, “nav”, etc. would result in false positives).

To match any list item with a classes which contains the letter “a” can be sought with:

//li[contains(@class, "a")]

Nearly there, now to work out how to not match false positives. To do this, we can look for “[space]a[space]” with a slightly modified class string (classes at the start/end of the string wouldn’t normally have spaces before/after respectively). Whilst we’re at it, we can normalize the spaces in the class string which converts any number of spaces, tabs, etc. characters into just a single space.

So, to properly get at a class name of “active” for all list items, regardless of its position in the class string, the following XPath query can be used.

//li[contains(concat(" ", normalize-space(@class), " "), " active ")]

Note: there are single spaces in the first and last arguments for concat, and on either side of the word active.

Just as an observation, the comparable CSS selector to do this would be li[class~="active"] (or the more usual li.active) which would be awesome to use if XPath decided to implement a similar syntax.