PHP Hypertext Preprocessor Language is a server side interpreted language written in C that runs primarily on Linux environments. PHP scripts can be run directly or served as webpages.

This article needs immediate attention, and is in desperate need of content.

Development Environment

PHP CLI

Xochipilli says
Many Linux distributions package the PHP CLI separately

To check the syntax of a PHP file (lint):

 php -l /path/to/script.php
 php --syntax-check /path/to/script.php

To see the current version of PHP (CLI):

 php -v
 php --version

To execute PHP code via CLI (without PHP tags):

 php -r 'PHP CODE HERE'
 php --run 'PHP CODE HERE'

Notice: You do not need to enclose the code in PHP begin and end tags, but you must single quote the code, so strings must be double quoted inside of it.

To define variables while running a PHP script:

 php -d foo=bar /path/to/script.php
 php --define foo=bar /path/to/script.php

To run a script silently:

 php -q /path/to/silent_script.php
 php --no-header /path/to/silent_script.php

This will suppress HTTP header output, so this is CGI only.

To load a Zend extension for use with a script in CLI:

 php -z /path/to/zend/extension.so /path/to/script.php
 php --zend-extension /path/to/zend/extension.so /path/to/script.php

To see a list of modules that PHP CLI has loaded:

 php -m
 php --modules

To benchmark execution times of a script N times:

 php -T TIMES /path/to/script.php
 php --timing TIMES /path/to/script.php

To generate extended information for debugging or profiling:

 php -e /path/to/script.php

To hide sensitive arguments from external tools:

 php -H -d mypassword=blah -d myuser=user /path/to/script.php
 php --hide-args -d mypassword=blah -d myuser=user /path/to/script.php

PEAR/PECL

PEAR and PECL are repositories for re-usable PHP libraries and code for common tasks. Below are links to lists of packages that are available for use:

Development PHP.INI

For use in development environments, you will want to rid your code of any and all errors which might disclose information about your setup. To assist you in doing this, there are a few variables in PHP.INI that might be helpful:

 error_reporting=8192
 display_errors=On
 display_startup_errors=On
 log_errors=On
 error_log=error_log
 report_memleaks=On
 expose_php=On
 asp_tags=Off

Notice: We turn asp_tags Off because valid PHP code headers should be used anyway, in case asp_tags is Off in production, which it should be.

PHP Basics

Variables

A variable is how you store a value such as a string or integer. An example where a variable would be used is if you wanted to handle a string multiple times throughout your application. Here is an example of a variable and how it can be used:

<?php $variable = "Blackhat Academy "; $variable1 = "Rules!"; echo "$variable $variable1"; ?>

This snippet of code will display the following:

 Blackhat Academy Rules!

Operators

Operators are used to compare variables, mathematics, and more. For example, you can set a variable equal to another variable using the '=' operator.

List of operators:

 + - Addition
 - - Subtraction
 * - Multiplication
 / - Division
 % - Modulus

 
<?php
$add = 1 + 1;
$subtract = 5 - 2;
$multiply = 6 * 5;
$divide = 14/7;
$modulus = 5 % 2;
 
echo "1 + 1 = $add";
echo "5 - 2 = $subtract";
echo "6 * 5 = $multiply";
echo "14 / 7 = $divide";
echo "5 % 2 = $modulus";
?>

Comparison operators are used to evaluate true or false when comparing variables and/or values

List of comparison operators:

 == - Equal To
 != - Not Equal To
 < - Less than
 > - Greater than
 <= - Less Than or Equal To
 >= - Greater Than or Equal To

Data Types

PHP is a dynamically-typed language, consisting of integers, arrays, associative arrays, strings, and classes.

Integers

In PHP, variables can be casted as an integer simply by assigning the variable a numeric value, such as:

 $var = 1;

Strings

String type will automatically be set if the variable has '' or "" surrounding the value.

 $str = "string here";

Arrays

Arrays are of the 'mixed' type, that is to say, you can adjoin elements of any type inside of an array, and even associative arrays if you wanted. Some examples are:

 $arrA = array(1, 2, 3);
 $arrB = array('1', '2', '3');
 $arrC = array(1, '2', 3, '4');

Associative Arrays

Similar to other languages, PHP can hold key => value pairs inside of an array object, like so:

 $asArrA = array(
   'a' => 1,
   'b' => '1',
   'c' => array(1,2,3),
   'd' => $arrC
 );

Above is the more readable way to create an associate array. There is also direct assignment upon initialization like so:

 $asArrB['a'] = $arrA;   // [a] => array(1,2,3);
 $asArrB['b'] = $arrB    // [b] => array('1','2','3');
 $asArrB['c'] = $arrC;   // [c] => array(1,'2',3,'4');
 $asArrB['d'] = $asArrA; // [d] => ([a] => 1, [b] => '1', ...)

Classes

Classes are a way of defining custom datatypes and function libraries for PHP code. Most of PEAR and PECL is designed this way so as to import functions using OOP or Object-Oriented Programming.

Here's an example of a class:

<?php class MyClass { public $version = 1.0; public $mystr = 'hello world'; public function PrintHello() { print $this->mystr . "\n"; } } ?>

So, to actually use this class, it has to exist prior to instanciation of an object with that classes name. Usually, a programmer might save the file with the class definition as: ./classes/class.MyClass.php but there are several heirarchies in which to guide your filename decisions. This is beyond the scope of this article, so the structure will be left as an excercise to the reader.

Some example inclusion and usage:

<?php require_once 'classes/class.MyClass.php'; $foo = new MyClass; $foo->PrintHello(); ?>

Arrow Operator

When accessing the methods (functions) and properties (class variables) of a class, you will be using the Arrow Operator ->

This is put between the instanciated variable and the method or property, like so:

 print $foo->mystr;
 $foo->PrintHello();

Scope Resolution Operator

This operator will let you access methods and constants defined inside of a class, or from inside of a class.

 
<?php
class MyClass2 {
  const MY_STRING = 'hello world';
}
?>

From here, as long as the class is loaded, the properties of MyClass2 are available outside of the class via the Scope Resolution Operator, as shown below:

 
<?php
require_once './classes/class.MyClass2.php';
echo MyClass2::MY_STRING;
?>

Inheritance

Abstracts

Interfaces

Extending Classes

In many cases, there may be a need to extend the functionality of a generic or Base class, with functions from a new class. To facilitate this, you can use the extends class keyword. Here a Base class is defined:

 
<?php
class Base {
  public $strA = 'hello world';
  public $strB = 'peekaboo';
}
?>

There we have our Base class, which holds two public strings, so let's create an extension of that class to print them using the extends keyword:

 
<?php
class Printer extends Base {
  public function PrintBase() {
    print parent::strA;
    print parent::strB;
  }
  public function PrinterPrintBase() {
    print $this->strA;
    print $this->strB;
  }
}
?>

Now, instead of just instanciating the Base class, you can instanciate the Printer class instead, which will inherit the values and functions of the Base class, with the added variables and functions of the Printer class.

 
<?php
require_once './classes/class.Base.php';
require_once './classes/class.Printer.php';
$foo = new Printer;
$foo->PrintBase();
// This will output 'hello world' and 'peekaboo' from the Base class.
$foo->PrinterPrintBase();
// Because $strA and $strB were inherited from the Base class, you can now reference them using the Arrow Operator.
?>

The special name parent:: refers to the class from which your instanciated class was derived. Parent should be used in the case that your inheritance tree changes, so you will not have to go replace all references to a singular class name.

Functions

Defining functions in PHP is accomplished using the function keyword, followed by the function name and comma delimited arguments, surrounded by parenthesis:

 
<?php
function myFunction($arg1, $arg2) {
  // your function code here
}
?>

You may also wish to have default values for variables if none are passed for the particular argument:

 
<?php
function myFunction($arg1, $arg2 = '') {
  // your function code here
  // if myFunction() is called with only one argument passed, $arg2 will automatically be set to ''
  // if myFunction() is called with two arguments, $arg2 will inherit the value of the 2nd argument passed
}
?>

If the function is encapsulated in an object, you may specify the visibility of the function, public, protected or private.

 
<?php
class MyClass
{
    public function myFunction($arg1, $arg2) {
      // myFunction code here
    }
}
?>

The above class will enable the use of such code as:

 
<?php
$foo = new MyClass;
$foo->myFunction('bar');
$foo->myFunction('bar', 'baz');
?>

Unlike some programming languages, like Perl or Python, PHP member functions implicitly extract their parent into the $this variable.

Boolean Logic

Ternary Conditionals

In PHP, if else statements typically look like this:

 
if( $a == $b ) {
    print "Equal!";
}
else {
    print "Not Equal!";
}

However, there is shorthand for this called a Ternary conditional. We can write the same if else statement like this:

 
($a == $b) ? print "Equal!" : print "Not Equal!";

Where the general form is:

 
(condition) ? if condition is true : if condition is false;

Loops

PHP has four main types of loops.

for

This loop is good for performing a set of instructions a set number of times. For example:

 
for($i=0; $i<5; $i++) {
    print "i = " . $i . "\n";
}

The above will print the value of i 5 times and the values will be:

   i = 0
   i = 1
   i = 2
   i = 3
   i = 4

foreach

This is probably the most common loop in all of PHP. It makes going through the elements of an array really easy. For example:

 
$names = array("Jack", "Jill", "Mike", "Sally", "Steve");
 
foreach($names as $name) {
    print $name . "\n";
}

The output of this code will be

 Jack 
 Jill
 Mike
 Sally
 Steve

Another really neat thing you could have done with this is the following:

 
$names = array("Jack", "Jill", "Mike", "Sally", "Steve");
 
foreach($names as $key => $name) {
    print "Entry #: " . $key . " Name = " . $name . "\n";
}

The output will be:

 Entry #: 0 Name = Jack 
 Entry #: 1 Name = Jill
 Entry #: 2 Name = Mike
 Entry #: 3 Name = Sally
 Entry #: 4 Name = Steve

Notice that in this example we define a $key. This key tells us what index of the array we are on. This is especially powerful when you use associative arrays like this:

 
$names = array("Manager" => "Jack", "Sales" => "Jill", "Accounting" => "Mike", "HR" => "Sally", "CEO" => "Steve");
 
foreach($names as $key => $name) {
    print "Position: " . $key . " Name = " . $name . "\n";
}

 Position: Manager Name = Jack
 Position: Sales Name = Jill 
 Position: Accounting Name = Mike
 Position: HR Name = Sally
 Position: CEO Name = Steve

while

The while loop is probably the most simple of them all. In it's most basic form:

 
<?php
while( true statement ) {
   // do something
}
?>

In this case, while "true statement" remains true, we will keep looping. For example:

 
<?php
$i = 5;
while( $i < 10 ) {
   $i = $i + 1; // This could be shortened to $i++; But I'm being intentionally verbose.
}
?>

The above code will continue to add 1 to $i until $i = 10, at which point the loop will stop. $i will retain it's value of 10.

Alternatively, there is another syntax for while:

 
<?php
while(expr):
  // do something
endwhile;
?>

Within the loop, there are of course ways of skipping and breaking out of the loop completely, they are:

 break;

Which will break out of the while() loop completely.

 continue;

Which will skip to the end of the current iteration and run through to the next iteration.

do-while

This loop is very similar to the while loop. Example:

 
$a = 0;
do {
    print "Hello: " . $a . "\n";
    $a = $a + 1;
} while( $a < 5);

The output of this will be:

 Hello: 0
 Hello: 1
 Hello: 2
 Hello: 3
 Hello: 4

There is one major difference between the while and the do-while: The condition is evaluated AFTER the code is run. In a normal while loop, the condition is evaluated BEFORE the code in the { } is run. So for example

With a normal while loop:

 
while( 1 == 0) {
    print "Hello!";
}

In this case "Hello" never gets printed because "1 == 0" gets evaluated BEFORE the code within the braces gets executed.

However, this changes in the following do-while example:

 
do {
    print "Hello!";
} while( 1 == 0);

The word "Hello" will get executed exactly once because the condition "1 == 0" gets executed AFTER the code between the braces is executed.

User Input

Security

code

Dangerous functions

include()
eval()
mysql_query()
pgsql_query()
phpinfo()
system()

Dangerous practices

include()
echo(), print(), sprintf()
string sanitizing using non-recursive string replacement
improper type handling

Best practices

The Golden Rule: Treat all user input as if it's malicious. Anything that gets transferred from the browser to the server (session variable especially) is a new vector for attacking your web app.

File inclusion

Type Handling

$clean_int = (int)$dangerous_int;

XSS

SQL Injection

Preventing SQL injection in PHP applications is relatively simple, so long as you are thorough. String input, surrounded by single quotes can be sanitized with mysql_real_escape_string(), which will escape dangerous characters such as single quotes (as well as \, so that you cannot escape the escapes!). Sanitizing integer input can be done simply by casting the input to integer.

PHP

Contents