Tavern on the Meta

Wooohooo! SMark gets the hacker badge!

hehehe

Where's my hacker badge? I wanted one!

I mean I did get some nice swag, so I can't complain at all, but still :-D

Given that it's a secret badge, how do you know you don't have it?

/me still thinks there should be a Ninja badge... No description, no reference anywhere except in your profile should you get it...

@Shog9 I know I got the Troublemaker secret badge, but I'd like to see it at least :-P

8:09 PM

Well, if you went and re-tagged all the PHP questions you've answered, adding in [troublemaker]...

lol

Q: Harmful temptations in programming

75

Just curious, what kinds of temptations in programming turned out to be really harmful in your projects? Like when you really feel the urge to do something and you believe it's going to benefit the project or else you just trick yourself into believing it is, and after a week you realize you h...

^^^^^ makes me perversely happy. This is why P.SE exists...

Q: Create a secret "Ninja" badge

lol

woo hoo! I created my first mso-tag

0

I am suggesting a new badge entitled Ninja. This would be a gold badge. In keeping with the secrecy of true Ninjas, the badge should not be mentioned anywhere except a user's profile page (and after implementation, delete this request to protect that). What are the requirements for awarding th...

feature-request badges ninja

@TheOutOfStarsException, I give a big blah at your MSO post. >_<

@RebeccaChernoff which?

The sarcastic edit rev comment one?

8:17 PM

You've made 1 post on MSO in the last 48 hours...which do you think? q:

@RebeccaChernoff Sorry. Please delete it for me.

I was trying to make a point that it needed to be addressed but maybe I did it the wrong way

@ircmaxell Added tag wiki.

nice!

@Shog9 ROTFL. Well played good sir

@RebeccaChernoff - It seems that you're still busy. Is there a chance that you'll be able to look at my update any time soon?

@TheOutOfStarsException - ping (see iChat)

now, the real question, am I prepared to die for the existance of said badge...

8:32 PM

No, the real question is, are you prepared to kill me, Bill, Grace, and Brant... and then yourself... just to get a badge?

HOW MANY MORE HAVE TO DIE FOR YOUR BADGE-LUST, IRC?

@ircmaxell -serious question

Enough :-D

I have to make sure that the data has been entered.

I am making an associative array and then checking each one

Sure, that's fine

Is this right:

8:35 PM

@Moshe It is on my list. I promise.

@RebeccaChernoff Okay, thank you.

@ircmaxell - I have a "tickets" section in my form

They are 1,3,7, 15 and 0

If they choose 0, they must enter a donation amount

And I'm using placeholders for missing 'solicitor' for now

Is this code good?

@Moshe: you can do that...

What I would do instead, is have an array of expect values, and loop over them

Okay, Thank you.

Next, which injection cleaning function(s) do I use?

then check if the value is set in the input array

so:

mysql_real_escape_string?

8:38 PM

@Moshe idly wonders if there's an injection-cleaning library for Ruby named "iodine"

$expected = array('name', 'cc-number', 'etc');
foreach ($expected as $name) {
    if (!isset($inputs[$name]) || empty($inputs[$name])) {
        //Missing Data!
    }
    // more filtering here
}

Unless you mean what I've done

@ircmaxell How is that different from the code I posted?

It's looping over the known, hard-coded array rather then the unknown input array

(unless I'm mistaken)

Oh, I made hard coded array

Ahhh

ok

8:45 PM

So if there is a missing value, I'm done, can't go on.

If not, I need to cleanse the data from sql injection

just found a pair of security vulnerabilities in Symfony2... In 2 minutes of looking at the code!

One is just plain funny too. Since the method does the exact opposite of what it claims:

@ircmaxell Sshh, don't tell them. Sell it to them for several thousand {currency units} and then use the money to buy stars.

	    /**
	     * Compares two passwords.
	     *
	     * This method implements a constant-time algorithm to compare passwords to
	     * avoid (remote) timing attacks.
	     *
	     * @param string $password1 The first password
	     * @param string $password2 The second password
	     *
	     * @return Boolean true if the two passwords are the same, false otherwise
	     */
	    protected function comparePasswords($password1, $password2)
	    {
	        if (strlen($password1) !== strlen($password2)) {

Some guy just rang by doorbell and asked to buy my car... LOL

That's not constant-time. Not by a long shot. In fact, it's significantly worse than $str == $str1 (which isn't constant-time, but it's practically constant time by comparison)

8:49 PM

@ircmaxell - how do I cleanse the data?

cleanse what data?

cleanse each bit of info from injection. Do I use something like mysql_real_escape_string?

Are you using PDO?

@ircmaxell I haven't gotten to that. I'm using Doctrine AFAIK, if it's not to difficult to learn.

Oh, then bind it to doctrine, and let it handle that for you

8:51 PM

So at this point I can dive into Doctrine?

yup

Great, going to have a look.

er, @ircmaxell what's this 'use path/to/library' business? Is that standard PHP?

Jin

@Jin heh

@Moshe It's a namspace

8:53 PM

Ok

Which files from the download are not part of the library? I don't want to upload extra stuff

@ircmaxell - Er, is the 'bin' folder required for Doctrine to run?

isn't sure

Going to follow the tutorial under the assumption that the Doctrine folder and the bin library are required

@ircmaxell - How do I use your encryption class?

Should I bother encrypting all of the data or just the CC numbers?

I'm getting this error with Doctrine: Fatal error: Class 'DriverManager' not found in

@Moshe: just use it like the example in theere

$e = new Encryption(MCRYPT_BLOWFISH, MCRYPT_TYPE_CBC);
$encrypted = $e->encrypt($data, $key);

I have to include it no?

include("encryption.php");

And what do I do about Doctrine not working?

Fatal error: Class 'DriverManager' not found in "redacted_filename.php" at line 124

use require instead of include

and you need to properly load doctrine

follow their docs

9:06 PM

I thought I did, will try again

submitted his 4th bug report as a direct result of SO questions: trac.symfony-project.org/ticket/9572

@ircmaxell - Apparently, I'm supposed to use the Doctrine\DBAL namespace and the `Doctrine\Common` namespace.

@ircmaxell How do I use multiple namespaces?

I would try the "c" way: "namespace::namespace::object"

9:22 PM

cough C++...

I loaded the files, getting another error.

Send me teh codez!!!

use multiple use statements

Gah!

Gah!!!

has a deadline in a half hour

Well ~30 min

hehehe

I have to load the DriverManager Class

Which I have not clue how to do

Is PDO any easier?

...

needs spoonfeeding ahhh

opens mouth and chokes on spoonful of binary

3

9:31 PM

@Shog9 you say that like I care :p ;)

what happens when a mod transcends to the next privilege level?

e.g. I'm at 1499 on dba, so I'm about to hit 1500

DROP TABLE 'users'

@Shog9 >_<

@Shog9 oooh, I get to do that? NICE

can't be a proper DBA site unless mods get direct DB access, right?

@ircmaxell - Link to your encryption class again?

got it

9:41 PM

hehehe

A: PHP 2-way encryption: I need to store passwords that can be retrieved

15

Personally, I would use mcrypt like others posted. But there is much more to note... How do I encrypt and decrypt a password in PHP? See below for a strong class that takes care of everything for you: What is the safest algorithm to encrypt the passwords with? safest? any of them. The safe...

What do I want to put in cipher and key?

$e = new Encryption(MCRYPT_BlOWFISH, MCRYPT_MODE_CBC);

and for key, your passkey for decrypting the data

Ah, ok

that's it?

yup

Cool!

testing...

@ircmaxell Cool, it works, but there's a typo on line 164

9:48 PM

there is?

yea

What's the typo?

hmac, not hamc

$hash = hash_hmac('sha1', $hash, $key);

last section

Fixed, thanks!

@ircmaxell Thank you.

Where do I store my key?

Just there?

@ircmaxell - Warning: mcrypt_decrypt() [function.mcrypt-decrypt]: The IV parameter must be as long as the blocksize in /Users/Moshe/Sites/MYHT Raffle/encryption.php on line 53

9:51 PM

I would put it in a constant

Huh?

really? how did you store the value?

    $de = mcrypt_decrypt($this->cipher, $key, $data, $this->mode, $iv);

In an array

Oh, hang on

It uses invalid UTF8 characters. So you might want to base64 encode it...

how so?

is obviously inexperienced at this and doesn't need to continue blasting the fact all over the internet

$data = base64_encode($data);

Wait, what goes in $encryptedData?

9:54 PM

The output from $e->encrypt()

$e2 = new Encryption(MCRYPT_BlOWFISH, MCRYPT_MODE_CBC);
$data = $e2->decrypt($encryptedData, 'key');

oh ok

@ircmaxell - It worked, I was trying to decrypt nonexistent data

@ircmaxell Can I decode the same way?

$data = base64_decode($data);

yup

us3.php.net/manual/en/function.base64-decode.php

cool!

Do you know what BASE64 means?

Base64

Base64 is a group of similar encoding schemes that represent binary data in an ASCII string format by translating it into a radix-64 representation. The Base64 term originates from a specific MIME content transfer encoding. Base64 encoding schemes are commonly used when there is a need to encode binary data that needs be stored and transferred over media that are designed to deal with textual data. This is to ensure that the data remains intact without modification during transport. Base64 is used commonly in a number of applications including email via MIME, and storing complex data in XM...

I wish PHP's base_convert supported up to 64...

@Moshe: PHP's docs are very good. Just type the function you think you want in the search box, and it'll find it for you

And if you need, find the section related to what you want to do, and then look over the functions available

10:08 PM

@ircmaxell and if that doesn't work type the name of the function you think you need with a space and php in to google's search box and the magic fairies will do wonderful things for you

Yup

10:38 PM

@RebeccaChernoff in case you didn't get the @ in the THC room:

in Town Hall Discussion, 23 mins ago, by The OutOfStars Exception

@Rebecca if I could ask you a favor, please make sure to tag all Town Hall stuff with election so it will show up in here automatically. Thanks!

A: Is using mysqli_real_escape_string enough to secure my query string?

1

You could use prepared statements.

A: Are dynamic mysql queries with sql escaping just as secure as prepared statements?

0

I think @ircmaxell got it right on. As a follow up, be on the lookout for this kind of thing. I used to do it all the time: <?php //sanitize the dangerous posted variable... $clean = mysql_real_escape_string($_POST['some_dangerous_variable']); //...and then forget to use it! $query = "SEL...

Uhhhhhh

/facepalm

/Double facepalm

Grace Note

Hola all~

Is decaffeinated coffee just as tasty as the real thing?

Tim Stone

10:49 PM

'Ello

Hey @Grace, how goes?

@TimPost It is if you're stupid enough.

Grace Note

@TheOutOfStarsException Not bad. Managed to get drained on seeing another "What is CW" post on Meta, though, so I thought I'd just step aside for a bit.

That was a great bit by Richard Jeni...

he goes on a tirade about I can't believe it's not butter and how that could apply to anything if you were stupid enough.

You walk into a home improvement store, and go I can't believe it's not butter. Uhh, it's lawn furniture Bob...? I know, I was expecting butter...

I can't decide where to ask this question: "Should I have three events or one event with parameter that has three values?". I fear it may fall between the two stools that are Stack Overflow and Programmers'.

10:54 PM

@ChrisF: does it have an application?

meaning, is there a specific use-case, or is it in general?

@ircmaxell There's a use case. I have a class that at the moment fires three distinct events for three distinct but related situations

@ChrisF I think that's fine for programmers

Well, if there's a defined use-case, post it on SO. If there's not, post it on Programmers. That's my opinion anyway

it works on either one, IMHO - but if you have a specific platform, use, etc. I would go with SO.

rather than event_1() event_2() event_3(), use event(1, 2, 3)

10:56 PM

@Shog9 .NET

@TimPost I'm leaning that way - I just wanted to get an idea of what people thought "best practice" was - hence my reluctance to post straight away.

@ChrisF Sounds like, however a matter of preference / opinion unless you are specifically trying to diagnose a bottleneck

@TimPost agreed.

Or something along the lines of "Is doing this () causing this () ?"

@TimPost No bottleneck atm. It is a design preference.

10:58 PM

my answer would be, "depends on how you intend to handle the events" - if the actions are gonna tend to be significantly different, then you'll end up just switching on the param anyway

Not a bad day... 315 rep and cap just hit...

@Shog9 The actions are different but related. I think I might stick with 3 events for now.

@ChrisF One thing is for sure, you're spending an awfully long time thinking about it :)

@TimPost I've had a beer - I'm not coding at the moment

The big danger with a param would be the temptation to keep overloading it... Sure it's three values now, but...

11:01 PM

@Shog9 There's no danger of that - the parameter comes from WMPLib.

That's why you define an implementation and don't just cowboy it up ;)

@Shog9 yeah, so I would say that really determines where it's gonna be most effective, one versus three

But equally three events seems OK now, but if I add more logging/reporting (say) this could expand as well.

@ChrisF then not passing it through has the additional advantage of not leaking WMP details?

If you are going to handle each event nearly the same, aside from one or two specific details, then lumping them all together makes sense. But having wildly different execution paths means passing less data and having tighter implementations on each event handler.

mootinator

I am going home my dear friends.

11:04 PM

@TheOutOfStarsException didn't I? I always use [discussion] [election]?

mootinator

If the room becomes intolerable in my absence, I apologize.

@drachenstern Another disadvantage is polluting the call graph. Where 90% of the time only a single method is actually entered.

It sounds so simple - but there are pros and cons to each approach and as @TimPost says I've spent a long time over this effectively minor detail.

This is why I despair designing APIs without at least one well-understood use-case.

I'm taking an executive decision. Leave as three events for now but if I decide I need to handle a new state I'll refactor into one with a parameter.

11:06 PM

@ChrisF I call that 'gardening' - where you just kind of piddle around in the code, pulling up a couple of weeds here or there, re-arranging a few things while planning something bigger

@mootinator lmao

@ChrisF only if they have drastically similar code paths

Look at the .NET controls for webforms (guess where I live) ... they have at least a half dozen if not more alerts for any that databind. Some as many as a dozen or more possible alerts

@drachenstern At the moment the code paths are very similar which is what prompted the question in the first place.

This discussion has actually been more useful than posting a question. Thanks people.

lol, I would encourage you to post a P.SE question then, and let some of this trickle down to there, so that others can also be enlightened.

@drachenstern The Silverlight controls have lots of events too - which I suppose influenced my original "design" choice.

Yeah. I don't see any problem with that. When I implement events like that on mine, the page-side handler becomes really tiny.

like 3 - 4 lines

11:13 PM

@drachenstern I'll have to bookmark them and post while sober. I don't think I could make a coherent question right now.

lmao

@drachenstern That is a real benefit of separate events.

That's how I feel an event handler should be.

If there were a way to skip the C# .NET stuff of if (e.row.rowtype == datatype.somecontroltype) { if (e.row.option == datatype.someoption) { if e.row.cells ... I would be so happy

Let me do what I need on the data in question damnit, don't give me all this extra crap :p

But that would just mean more complexity in other places of course

@ChrisF - Sometimes it just helps to think out loud :)

@TimPost aye "rubber duck programming"

I love my shower programming time

chat.stackoverflow.com/rooms/7/c

why do some people have such a hard time answering the actual question?

11:23 PM

@RebeccaChernoff Sorry was AFK. You did everywhere but one, I forgot which. I was mostly just saying please keep doing that because I set up feeds in the THC room