الثغرات الشائعة في PHP
يشكك البعض في نمط الحماية الذي يحيط بمترجم PHP, والحقيقة فإن نمط الحماية الذي يحيط بمترجم PHP لا يقل كفاءة عن عن مترجم Microsoft ممثلا في حزمة IIS , فكما نعلم إن PHP لغة مفتوحة المصدر يساهم في تطويرها مجموعة عمل كبيرة من كل النواحي ومع هذا يظل هنالك مجموعة من الثغرات التي لا يمكن أن نصفها بأنها تكونت نتيجة خطأ داخلي بالمترجم بل هي نتيجة قصور برمجي يتسبب فيه المبرمج.
تحتل المتغيرات variables مساحة شاسعة من أرضية الأخطاء البرمجية الشائعة , وخصوصا عندما تكون ميزة الـ Register Global متاحة , وهي ميزة لا غنى عنها , ويكثر استخدامها في مختلف التطبيقات العالمية وفكرتها هي ارسال متغيرات من صفحة لأخرى عبر URL مثلا: www.example.com/index.php?id=1.
ويتضح الخطر عندما نقوم بارسال بيانات سرية مثل كلمة المرور أو معلومات الاتصال بقواعد البيانات أو ما شابه التي كانت بالأحرى أن ترسل عن طريق الـ Post مثلا واحيانا اخرى يقوم المستخدم المتطفل بتغيير قيمة متغير معين من خلال الـ URL.
ثغرة أخرى شائعة بالPHP وهي File Include , وتظهر عندما يلجأ المبرمج إلى استخدام متغير معين ليقوم باختزان اسم الملف المطلوب للقيام بعملية Include أو تضمين للملف وتزيد خطورة عندما يقوم المستخدم بتضمين اسم الملف على متغير عام يظهر في URL وبالتالي يتمكن المستخدم العادي من تغيير مسار الملف إلى مسار ملف داخلي مثلا يحتوي على معلومات حساسة مثل كلمات المرور وغيرها ..
software level separation if good or not (road to unified language)
should we really separate software levels!!
As we all now and find in our studies and work environment that any software is made up of three main parts or layers:
- · Presentation
- · Logic
- · Data
And usually to work on simplifying the problems and getting solutions faster and easier it is always advised to separate these layers in the design and implementation time.
Also it is very obvious that by separating the application into these layers we can get the best results by being able to combine the best abilities we have , since most of the good graphical designers are not that much of oop programmers , and vise versa let the designer deal with the presentation, let the oop guy deal with the logic and the structure and then let database guys to do the data, and the end result will be so close to perfection.
Still sometimes I think there should be a limit for this separation (well I am not an expert in my field to say so but its just my ideas as a recently graduated student from college in this field).
So what am I trying to say ( I was not sure until writing these lines but I think I have an idea). The best place I can see the separation applied is in web application development environment at least the environments that I have experienced. Usually there are HTML/CSS guys who do the website layout, there are photoshop guys who create images, flash guys to create animation if any, database guys, and most importantly the programmers who do work on also two layers client side scripting such as javascript and server side scripting such as jsp, php … whatever.
Wow as you can see lots of fields and lots of specialties needed to do a good web application. So my idea (more specifically my imagination) is what if we can combine some layers of web application building process. Well not all but at least similar ones such as : client side scripts and server side scripts, what if there was a scripting language that could be executed in both sides in server side and in client side and the programmer specifies which code to execute where. I think it would really help and simplify the way of creating websites, recently I had lots of problems in a project while synchronizing my javascript codes with asp.NET codes and let them exchange data, well some ajax libraries do simplify the data exchange between client and server sides, but still having a common language I think will make things go much easier and faster. Then I got into what if we can combine my imagenary language with the functionality of HTML too, well if we can use the same language to create the interface it will be much easier to control , animate , access data in the interface components (textboxs,…,etc). umm ok now I think if we had one language to do these three layers from the first place we would be in web 2.0 since 1997 or something like that.
So here is what I am trying to say from the beginning of the blog ( regulary saperation of software layers is good , but still the layers must be more integrated than they are in web application so they can interact more easily with each other).
Any how this are just thoughts and I am really interested to know what you guys think about them? Am I on the right track, or I just lost it.
Ali 
When should one learn a new programming language?
There are differences in humans as they are difference in applications. Various applications are more skilful than other and some incredibly enlarge there knowledge becoming a better competitor. In this vast developing area, one would ask when I should learn a new evolved programming language.
For some it is a hobby, other does it for fame. There are many reasons which allow or drive one to learn a new programming language. Nothing is better than having knowledge but the wise who has what is required one who learns what he has to.
Languages are not different from speaking languages at the end, the one which is mostly used or you mostly need, is the best one. The main goal is communication and understanding.
It is best to master what you know.
SQLTip2: how to display rows as columns
SQL Tip1, SQL Tip3
most of the time when we are using normalized form of a database we need away to show data in rows of a table as column holding other data.
for example :
we have a table of studentGrade table which looks like this
| student | courseCode | grade |
| ali | Database | 80 |
| Mark | java | 78 |
| Mark | Database | 80 |
| ali | java | 95.25 |
and in the out put we want the table be like:
name | Java | Database
ali | 95.25 | 80
mark | 78 | 80
lets say there is a student table called students such as
name | age | address
ali | ~~~~ |~~~~~~
mark | ~~~ |~~~~~~
to magic sql here will be
[corrected SQL Statment after the first comment (tested on MYSQL)]
select name, java.grade as Java, db.grade as db from students
Join studentGrade java ON
(name = java.student and java.courseCode=”java”)
join studentGrade db ON
(name = db.student and db.courseCode=”Database”)
this way we have joined the studentGrade to itself two times, by creating an instance of table for each course , java instance of the table shows only the Java results, the db instance show database grades.
still this SQL statment only works when all students have been taken all the courses if one student have not taken any one of the courses his row will not appear
any how it could be easily solved be usning left outer join instead of join
hope this simple SQL tip will be helpfull for you
Read More
