Tag: PHP

Laravel 5.X directory permissions / ownership setup

According to the Laravel docs, “After installing Laravel, you may need to configure some permissions. Directories within the storage and the bootstrap/cache directories should be writable by your web server or Laravel will not run”.

After running this command to install Laravel via Composer:

composer create-project –prefer-dist laravel/laravel blog

1

composer create–project —prefer–dist laravel/laravel blog

Change directory ownership by running these commands:

sudo chown -R www-data:www-data /path/to/your/project/storage sudo chown -R www-data:www-data /path/to/your/project/bootstrap/cache

1
2

sudo chown –R www–data:www–data /path/to/your/project/storage
sudo chown –R www–data:www–data /path/to/your/project/bootstrap/cache

Then you should see “Laravel 5” on your public folder when you visit it on a web browser.

Make sure you setup your app key by running php artisan key:generate, or else your Laravel still won’t run!

Reference: “The permissions for the storage and vendor folders should stay at 775, for obvious security reasons” on File permissions for Laravel 5 (and others)

August 14, 2018

PHP: Parse Dates in CSV with inconsistent date formats

A friend was having trouble with a CSV file that she needs to process via PHP before saving to database. The CSV files uploaded to the server have inconsistent date formats such as:

November 1, 2016
Dec.6,2016
nov-10-2016
12122016
12/10/2016

November 1, 2016

Dec.6,2016

nov-10-2016

12122016

12/10/2016

So I prepared a PHP script that lists possible date formats in an array $possible_date_formats and then iterates through the dates read from the CSV file, matching each against the date formats in the array.

Assuming you have a .csv file with tab-delimited data such as this:

id	date	name	email
111	“November 1, 2016”	“Hanna”	hanna43429988abc@yahoo.com
112	“Dec.6,2016”	“Lorem”	lorem88349cde@yahoo.com
113	“nov-10-2016”	“Isum”	isum734740587hij@yahoo.com
114	“12122016”	“Dolor”	dolor44732984jkl@yahoo.com
115	“12/10/2016”	“Sit”	sit85780amet@yahoo.com

id date name email

111 “November 1, 2016” “Hanna” [email protected]

112 “Dec.6,2016” “Lorem” [email protected]

113 “nov-10-2016” “Isum” [email protected]

114 “12122016” “Dolor” [email protected]

115 “12/10/2016” “Sit” [email protected]

My PHP file will output this when it’s run:

November 1, 2016 -> 2016-11-01
Dec.6,2016 -> 2016-12-06
nov-10-2016 -> 2016-11-10
12122016 -> 2016-12-12
12/10/2016 -> 2016-12-10

November 1, 2016 -> 2016-11-01

Dec.6,2016 -> 2016-12-06

nov-10-2016 -> 2016-11-10

12122016 -> 2016-12-12

12/10/2016 -> 2016-12-10

And below is the PHP file I’m talking about.

<?php

date_default_timezone_set(“Asia/Manila”);

$delimiter = “\t”;
$date_index = 1; // expected index of date in imported CSV data
$csv_file_path = ‘csv/sample.csv’;
$possible_date_formats = array( “F j, Y”, // November 1, 2016
								“M.j,Y”, // Dec.6,2016
								“M-d-Y”, // nov-10-2016
								“mdY”, // 12122016
								“m/d/Y” // 12/10/2016
);
$arr_data = array();

$fp = fopen($csv_file_path, ‘r’);

$data_row_ctr = 1; // for checking row number later

while ( !feof($fp) )
{
    $line = fgets($fp, 2048);

    $data = str_getcsv($line, $delimiter);
    if($data_row_ctr > 1) { // process only line above 1 because 1 is headers
    	doSomethingWithData($data);
    }

    $data_row_ctr++;
}                              

fclose($fp);

function doSomethingWithData($data){
	global $date_index;
	$arr_data[‘csv_date’] = $data[$date_index];
	$fix_date_result = fix_date($arr_data[‘csv_date’]);
	if($fix_date_result === false){
		echo “\n”.$arr_data[‘csv_date’].” -> FALSE\n”;
	} else {
		echo “\n”.$arr_data[‘csv_date’].” -> “.$fix_date_result->format(“Y-m-d”).”\n”;
	}

}

function fix_date($date_string){
	global $possible_date_formats;
	foreach ($possible_date_formats as $key => $value) {
		$result = DateTime::createFromFormat($value, $date_string);
		if (is_a($result, ‘DateTime’)) {
		  return $result;
		} 
	}

	return false;

}

<?php

date_default_timezone_set(“Asia/Manila”);

$delimiter = “\t”;

$date_index = 1; // expected index of date in imported CSV data

$csv_file_path = ‘csv/sample.csv’;

$possible_date_formats = array( “F j, Y”, // November 1, 2016

“M.j,Y”, // Dec.6,2016

“M-d-Y”, // nov-10-2016

“mdY”, // 12122016

“m/d/Y” // 12/10/2016

);

$arr_data = array();

$fp = fopen($csv_file_path, ‘r’);

$data_row_ctr = 1; // for checking row number later

while ( !feof($fp) )

{

$line = fgets($fp, 2048);

$data = str_getcsv($line, $delimiter);

if($data_row_ctr > 1) { // process only line above 1 because 1 is headers

doSomethingWithData($data);

}

$data_row_ctr++;

}

fclose($fp);

function doSomethingWithData($data){

global $date_index;

$arr_data[‘csv_date’] = $data[$date_index];

$fix_date_result = fix_date($arr_data[‘csv_date’]);

if($fix_date_result === false){

echo “\n”.$arr_data[‘csv_date’].” -> FALSE\n”;

} else {

echo “\n”.$arr_data[‘csv_date’].” -> “.$fix_date_result->format(“Y-m-d”).“\n”;

}

function fix_date($date_string){

global $possible_date_formats;

foreach ($possible_date_formats as $key => $value) {

$result = DateTime::createFromFormat($value, $date_string);

if (is_a($result, ‘DateTime’)) {

return $result;

}

return false;

}

September 16, 2016

Install & config Apache, MySQL and PHP on your Mac (MAMP)

There’s a Mac computer that I want to use as local development server for web apps. I don’t want to use bundled installers like XAMPP or MAMP because I feel that I will learn more about Apache if I install each component of the LAMP stack separately. By the way, one of my goals is to be an expert in the LAMP stack. And prior to writing this blog entry, I had only been concerned about the actual coding of web apps, and have never had the chance or need to play with the installation and configuration of Linux, Apache, MySQL and PHP as individual components since there’s always been XAMPP and MAMP for easy setup in my local environment. And at work, someone else is always in charge of setting up our Linux server and the rest of the things we need for our production environment.

I also plan to setup a LAMP environment on my Mac by using VirtualBox to create a virtual machine with Linux, but I’m saving that for another post if it happens. 😆

Here in this blog entry, I shall take note of the steps that I take as I setup Apache, MySQL and PHP on Mac.

My environment

Computer: MacBook Pro
Operating System: OS X El Capitan version 10.11.5
I’ll be using the Terminal and Vim editor

Apache, MySQL, and PHP versions that I will setup:

Apache: version 2.4.18 (bundled with El Capitan, default)
MySQL: version 5.7.15 (installed via Homebrew)
PHP: version 5.5.34 (bundled with El Capitan, default)

I have no MAMP, XAMPP or any bundled *AMP stack installed on my Mac, so I will have fresh install of MySQL.

Start Apache on your Mac

Apache is already in OS X El Capitan so I just need to set it up. If you want to check your Apache version, run the command httpd -v in Terminal. Mine is Apache version 2.4.18.

Mac:apache2 toncatzu$ httpd -v
Server version: Apache/2.4.18 (Unix)
Server built:   Feb 20 2016 20:03:19

Mac:apache2 toncatzu$ httpd -v

Server version: Apache/2.4.18 (Unix)

Server built: Feb 20 2016 20:03:19

Type this command in Terminal to start Apache on your Mac:

sudo apachectl start

1	sudo apachectl start

Now that we started Apache, you should now be able to access the URL http://localhost/.

Start PHP on your Mac

Maybe you expected this section to be for MySQL setup, but I’m going to work with PHP first since it should be already in OS X El Capitan, like Apache.

Also, as of writing, the latest PHP version is 7 but I want to take one little step at a time as I write this so I’ll stick with the PHP 5 bundled with my Mac. I will try to post another blog entry on how to upgrade from PHP 5 to PHP 7. 🙂

We are going to edit the Apache configuration file to enable PHP on Mac, but for now let’s make a back up of the file. Let’s do that by running these commands:

cd /etc/apache2 #navigate to the apache2 folder
sudo cp httpd.conf http.conf.20160910.bak #copy httpd.conf file into httpd.conf.20160910.bak

1 2	cd /etc/apache2 #navigate to the apache2 folder sudo cp httpd.conf http.conf.20160910.bak #copy httpd.conf file into httpd.conf.20160910.bak

Notice the 20160910 in the command sudo cp httpd.conf http.conf.20160910.bak. It’s the date when I made a backup. You may change the date or even delete it.

Open Vim to edit httpd.conf by running this command:

sudo vim httpd.conf

1	sudo vim httpd.conf

Find the following line in httpd.conf and uncomment it:

LoadModule php5_module libexec/apache2/libphp5.so

1	LoadModule php5_module libexec/apache2/libphp5.so

Remove the hash symbol (#) at the beginning of that line to uncomment it.

Vim editor tip: when you open the httpd.conf file, search for the line containing “php5_module” by pressing the esc key to make sure you’re not in INSERT mode, then type /php5_module and then hit the return/enter key. Vim should point you to the line that you should uncomment. Press the “i” key to enter INSERT mode in Vim, and uncomment that line. To save the file, press esc key again and type :wq!

Now, restart Apache to reflect the change:

sudo apachectl restart

1	sudo apachectl restart

Check if PHP works

Run these commands:

cd /Library/WebServer/Documents
sudo vim temp_phpinfo.php

1 2	cd /Library/WebServer/Documents sudo vim temp_phpinfo.php

Press the “i” key to enter INSERT mode again, then place this PHP code into temp_phpinfo.php:

<?php

phpinfo();

<?php

phpinfo();

Then using your web browser, go to http://localhost/temp_phpinfo.php

If the page shows a table of details about PHP, then PHP now works on your Mac. Good job! 🙂

I recommend that you delete this temp_phpinfo.php file though, and avoid using phpinfo() especially in production servers because it can lead to security issues. It will be easier for attackers to hack into your system when they see all the details that phpinfo() exposes.

Install MySQL

Install Homebrew if you haven’t yet. I choose to install MySQL with Homebrew because I find the process simple.

Run this command to install MySQL via Homebrew:

brew install mysql

1	brew install mysql

The installation process on my Mac looked like this:

Mac:local toncatzu$ brew install mysql
==> Installing dependencies for mysql: openssl
==> Installing mysql dependency: openssl
==> Downloading https://homebrew.bintray.com/bottles/openssl-1.0.2h_1.el_capitan
######################################################################## 100.0%
==> Pouring openssl-1.0.2h_1.el_capitan.bottle.tar.gz
==> Using the sandbox
==> Caveats
A CA file has been bootstrapped using certificates from the system
keychain. To add additional certificates, place .pem files in
  /usr/local/etc/openssl/certs

and run
  /usr/local/opt/openssl/bin/c_rehash

This formula is keg-only, which means it was not symlinked into /usr/local.

Apple has deprecated use of OpenSSL in favor of its own TLS and crypto libraries

Generally there are no consequences of this for you. If you build your
own software and it requires this formula, you’ll need to add to your
build variables:

    LDFLAGS:  -L/usr/local/opt/openssl/lib
    CPPFLAGS: -I/usr/local/opt/openssl/include

==> Summary
?  /usr/local/Cellar/openssl/1.0.2h_1: 1,691 files, 12M
==> Installing mysql
==> Downloading https://homebrew.bintray.com/bottles/mysql-5.7.15.el_capitan.bot
######################################################################## 100.0%
==> Pouring mysql-5.7.15.el_capitan.bottle.tar.gz
==> /usr/local/Cellar/mysql/5.7.15/bin/mysqld –initialize-insecure –user=[…]
==> Caveats
We’ve installed your MySQL database without a root password. To secure it run:
    mysql_secure_installation

To connect run:
    mysql -uroot

To have launchd start mysql now and restart at login:
  brew services start mysql
Or, if you don’t want/need a background service you can just run:
  mysql.server start
==> Summary
?  /usr/local/Cellar/mysql/5.7.15: 13,510 files, 445.9M

Mac:local toncatzu$ brew install mysql

==> Installing dependencies for mysql: openssl

==> Installing mysql dependency: openssl

==> Downloading https://homebrew.bintray.com/bottles/openssl-1.0.2h_1.el_capitan

######################################################################## 100.0%

==> Pouring openssl-1.0.2h_1.el_capitan.bottle.tar.gz

==> Using the sandbox

==> Caveats

A CA file has been bootstrapped using certificates from the system

keychain. To add additional certificates, place .pem files in

/usr/local/etc/openssl/certs

and run

/usr/local/opt/openssl/bin/c_rehash

This formula is keg-only, which means it was not symlinked into /usr/local.

Apple has deprecated use of OpenSSL in favor of its own TLS and crypto libraries

Generally there are no consequences of this for you. If you build your

own software and it requires this formula, you’ll need to add to your

build variables:

LDFLAGS: -L/usr/local/opt/openssl/lib

CPPFLAGS: -I/usr/local/opt/openssl/include

==> Summary

? /usr/local/Cellar/openssl/1.0.2h_1: 1,691 files, 12M

==> Installing mysql

==> Downloading https://homebrew.bintray.com/bottles/mysql-5.7.15.el_capitan.bot

######################################################################## 100.0%

==> Pouring mysql-5.7.15.el_capitan.bottle.tar.gz

==> /usr/local/Cellar/mysql/5.7.15/bin/mysqld –initialize-insecure –user=[…]

==> Caveats

We’ve installed your MySQL database without a root password. To secure it run:

mysql_secure_installation

To connect run:

mysql -uroot

To have launchd start mysql now and restart at login:

brew services start mysql

Or, if you don’t want/need a background service you can just run:

mysql.server start

==> Summary

? /usr/local/Cellar/mysql/5.7.15: 13,510 files, 445.9M

By default, Homebrew installs MySQL without root password, and with this setup, you can now log into MySQL by typing:

mysql -uroot

1	mysql –uroot

But wait! Securing MySQL with a password is highly recommended, and if you agree, run this command:

mysql_secure_installation

1	mysql_secure_installation

With a password for root set, you should access MySQL with this command instead, adding a -p to the command for a password prompt:

mysql -uroot -p

1	mysql –uroot –p

MySQL command line on a Mac Mini with MAMP bundle installed

The Mac Mini I’m using at work already has MAMP installed, but I followed the steps for setting up Apache, MySQL and PHP in this page just to test. Since MAMP is already installed, I already have MySQL.

So, before using MySQL via command line, simply start your MySQL server from MAMP and then use command line MySQL by logging in like this:

mysql -uroot -p

1	mysql –uroot –p

Create sample database table for testing with PHP later

Run the following commands:

create database test;
use test;
create table sample (id int not null, name varchar(20) not null, primary key (id));
insert into sample (id,name) values (1,”catzie”);
insert into sample (id,name) values (2,”petar”);

create database test;

use test;

create table sample (id int not null, name varchar(20) not null, primary key (id));

insert into sample (id,name) values (1,“catzie”);

insert into sample (id,name) values (2,“petar”);

This is what my MySQL command line interface looked like:

mysql> create database test;
Query OK, 1 row affected (0.01 sec)

mysql> use test;
Database changed
mysql> create table sample (id int not null, name varchar(20) not null, primary key (id));
Query OK, 0 rows affected (0.02 sec)

mysql> insert into sample (id,name) values (1,”catzie”);
Query OK, 1 row affected (0.00 sec)

mysql> insert into sample (id,name) values (2,”petar”);
Query OK, 1 row affected (0.00 sec)

mysql> create database test;

Query OK, 1 row affected (0.01 sec)

mysql> use test;

Database changed

mysql> create table sample (id int not null, name varchar(20) not null, primary key (id));

Query OK, 0 rows affected (0.02 sec)

mysql> insert into sample (id,name) values (1,”catzie”);

Query OK, 1 row affected (0.00 sec)

mysql> insert into sample (id,name) values (2,”petar”);

Query OK, 1 row affected (0.00 sec)

Make sure PHP can communicate with MySQL

The following command creates a symbolic link to help point to the right socket for MySQL to use on Mac.

cd /var 
sudo mkdir mysql
sudo chmod 755 mysql
cd mysql
sudo ln -s /tmp/mysql.sock mysql.sock

cd /var

sudo mkdir mysql

sudo chmod 755 mysql

cd mysql

sudo ln –s /tmp/mysql.sock mysql.sock

Reason: “You may have a socket (appearing as a zero length file) as /tmp/mysql.sock or /var/mysql/mysql.sock but 1 or more apps is looking in the other location for it.” – source

Another option: A fellow developer told me that instead of creating a symbolic link to the socket, he connects directly to localhost:3306, connecting through networking sockets instead of Unix sockets.

Enable mod_rewrite

My guide suggests we enable this now to avoid forgetting later that it’s not yet enabled. This will prevent hiccups when we’re already busy with coding web apps.

Edit the config file with Vim.

sudo vim /etc/apache2/httpd.conf

1	sudo vim /etc/apache2/httpd.conf

Uncomment the following lines:

LoadModule deflate_module libexec/apache2/mod_deflate.so
LoadModule expires_module libexec/apache2/mod_expires.so
LoadModule rewrite_module libexec/apache2/mod_rewrite.so

LoadModule deflate_module libexec/apache2/mod_deflate.so

LoadModule expires_module libexec/apache2/mod_expires.so

LoadModule rewrite_module libexec/apache2/mod_rewrite.so

Restart Apache:

sudo apachectl restart

1	sudo apachectl restart

Sample PHP-MySQL code to test your “MAMP” stack

Remember the table I created earlier? This is when we’re going to use that.

Run this command, we’re going to paste code into it:

sudo vim /Library/WebServer/Documents/testsql.php

1	sudo vim /Library/WebServer/Documents/testsql.php

Paste the following PHP code which SELECTs data from a sample MySQL table. Remember to edit the variable values to match your own settings, especially the password.

<?php

$servername = “localhost”;
$username = “root”;
$password = “your-password”;
$dbname = “test”;

try {
    $conn = new PDO(“mysql:host=$servername;dbname=$dbname”, $username, $password);
    // set the PDO error mode to exception
    $conn->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);

    // test query
    foreach($conn->query(‘SELECT * FROM sample’) as $row) {
        echo $row[‘id’] . ‘ ‘ . $row[‘name’] . ‘<br>’; //etc…
    }

    echo “(done)”;

    }
catch(PDOException $e) {
    echo “Error: ” . $e->getMessage();
}

$conn = null;
?>

<?php

$servername = “localhost”;

$username = “root”;

$password = “your-password”;

$dbname = “test”;

try {

$conn = new PDO(“mysql:host=$servername;dbname=$dbname”, $username, $password);

// set the PDO error mode to exception

$conn->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);

// test query

foreach($conn->query(‘SELECT * FROM sample’) as $row) {

echo $row[‘id’] . ‘ ‘ . $row[‘name’] . ‘ ’; //etc…

}

echo “(done)”;

}

catch(PDOException $e) {

echo “Error: “ . $e->getMessage();

}

$conn = null;

Visit this link on your browser: http://localhost/testsql.php

It should display this:

1 catzie
2 petar
done

Move Document Root folder

Right now, the document root is at "/Library/WebServer/Documents", and you may have noticed that each time we edit a file to create a new file within this folder, we need to sudo. That is inefficient, so let’s move our document somewhere that we won’t have to sudo for each change that we want to make.

We will move document root from "/Library/WebServer/Documents" to /webcontent.

Create “webcontent” folder under the root directory /. You can choose any other name you like.

sudo mkdir /webcontent

1	sudo mkdir /webcontent

Let’s create a sample page inside the newly created folder.

sudo vim /webcontent/index.html

1	sudo vim /webcontent/index.html

And place anything there such as “Hello!”

Now, let;s edit the Apache configuration file to point to the /webcontent folder:

sudo vim /etc/apache2/httpd.conf

1	sudo vim /etc/apache2/httpd.conf

Change the line DocumentRoot "/Library/WebServer/Documents" into /webcontent

Change the line <Directory "/Library/WebServer/Documents"> into <Directory "/webcontent">

Restart Apache:

sudo apachectl restart

1	sudo apachectl restart

Visit http://localhost again, and you should see whatever text you placed inside /webcontent/index.html

Just in case you still need to ‘sudo’ to access /webcontent folder

Try to copy the /webcontent/index.html file to check if you no longer need sudo in the /webcontent folder:

cp /webcontent/index.html /webcontent/index2.html

1	cp /webcontent/index.html /webcontent/index2.html

If it gives you the error cp: /webcontent/index2.html: Permission denied then here are your options:

Option #1: Change ownership of /webcontent folder

In the Mac Mini I use, the directory permissions for /webcontent is drwxr-xr-x which means only the owner (root) has permissions write to it, unless I sudo as another user, which is not convenient if I need to edit many files.

What we can do is change ownership of /webcontent from “root” user to our own user, like so:

Shell

sudo chown -R yourUsername /webcontent

1

sudo chown -R yourUsername /webcontent

Now try to create or edit files under the /webcontent folder. Your system should no longer deny you permission, since it is owned by you. So far I have not encountered a problem yet with this setup.
Option #2: Move document root under your user folder

You can try to move your document root under your user folder, i.e. ~/ or /Users/<yourUsername>, and see if you can edit files there without the need for sudo. Your user is the owner of this folder so you shouldn’t need additional permissions to edit files under it.

On my MacBook Pro, I no longer had to sudo when I edit files in new document root /webcontent, but on another Mac computer that I use (Mac Mini), I still needed sudo to edit files in document root. I will edit this blog entry when I find a way to avoid this.

Tested on:

Computer: Mac Mini
Operating System: OS X El Capitan version 10.11
Apache: 2.4.16 (bundled with El Capitan)
PHP: 5.5.27 (bundled with El Capitan)
MySQL: 5.5.34 (bundled with installed MAMP)

Extras…

How to stop Apache on your Mac

Type this command in Terminal to stop Apache on your Mac:

sudo apachectl -k stop

1	sudo apachectl –k stop

sudo apachectl stop

1	sudo apachectl stop

Based on my observation, when I start and stop Apache multiple times, the stop command with -k only works on the first time. Succeeding commands for stopping Apache becomes just sudo apachectl stop.

How to check version of Apache, MySQL and PHP

Apache version:

apachectl -v

1	apachectl –v

httpd -v

httpd –v

MySQL version:

If using MAMP bundle, MySQL service should be running when you use this command:

mysql –version

1	mysql —version

The welcome screen should show MySQL version when you login to MySQL via command line:

 mysql -uroot -p

1	mysql –uroot –p

PHP version:

php -v

php –v

ERROR 2002 (HY000): Can’t connect to local MySQL server through socket ‘/tmp/mysql.sock’ (2)

When I got this error regarding a socket (my MySQL is installed via Homebrew), it was fixed when I started MySQL by running the following command:

mysql.server restart

1	mysql.server restart

I think the same command is used for both starting and restarting of the MySQL server. Note that this is the command I use for my MySQL that’s installed via Homebrew. If you have MAMP GUI and not the MySQL from Homebrew, simply use that interface to start your MySQL service.

Reference(s):
Install MySQL on Mac OSX with Homebrew
Running Simple Select Statements
symbolic link setup for correct socket file locations in Mac OS X for MySQL
Version of Apache in Mac
Main Guide: Installing Apache, PHP, and MySQL on Mac OS X El Capitan

September 14, 2016

Web Security: How SQL Injection is done

SQL injection is one of the most common website exploits. For us developers to prevent SQL injection attacks, we must first understand how it’s done. Together, let’s review the basics of SQL injection.

Remember, let’s use our knowledge on good things only, okay?

The scope of this post is only a MySQL injection sample from PHP code. I am on a Windows 7 computer, using Git Bash and running SQL commands via command line, and coding my PHP file via VIM editor. My localhost is run by XAMPP.

I will be using MySQL, not MySQLi or PDO which have prepared statements, because the SQL injection is easier to demonstrate in MySQL.

Create database

I’m running these commands via command line.

What I do is run the mysql command like this: path_to/xampp/mysql/bin/mysql -h localhost -uMyUsername -pMyPassword

Then run use MyDatabaseName; to select a database.

create table users (id int(11) not null auto_increment, name varchar(255), secret varchar(255), primary key (id));

1	create table users (id int(11) not null auto_increment, name varchar(255), secret varchar(255), primary key (id));

This is a very simple database table with only 3 columns: the primary key “id”, “name”, and “secret”. The value of “secret” column, as its name implies, is user’s secret so nobody else should know about this, especially unauthorized users.

Then insert data using the following commands:

insert into users (name, secret) values (“Epi”, “I eat poop. Don’t tell mommy.”);
insert into users (name, secret) values (“Pinky”, “I’m a spoiled brat who’s always fighting with other dogs”);
insert into users (name, secret) values (“Asia”, “I eat too much my belly is touching the floor”);

insert into users (name, secret) values (“Epi”, “I eat poop. Don’t tell mommy.”);

insert into users (name, secret) values (“Pinky”, “I’m a spoiled brat who’s always fighting with other dogs”);

insert into users (name, secret) values (“Asia”, “I eat too much my belly is touching the floor”);

As you can see, those are dirty little secrets of our users, which in my case, are dogs in my house. :3

epi-pinky-asia-dogs-chihuahua

They are cute little chihuahuas who have embarrassing secrets just like humans. But because I’m using their secrets are samples in my database, these secrets won’t be secrets any longer. I also need to not secure my script for demo purpose. Sorry little babies 🙁 The readers don’t know you personally anyway. Hehehe

show tables; in mysql command line should show that 3 rows have been inserted.

Unsecured PHP script that runs MySQL query

Let’s save this as path_to/xampp/htdocs/test_sql_injection.php

<?php
$servername = “localhost”;
$username = “root”;
$password = “root”;
$db_name = “test”;
 
$conn = mysql_connect($servername, $username, $password);
 
if(!$conn){
        die(“couldn’t connect: ” . mysql_error());
}
 
echo “Connected to db<br>”;
 
if(empty($_GET[‘name’])){
        die(“missing name param”);
}
 
$q_name = $_GET[‘name’];
 
echo “your input param is $q_name<br>”;
 
$query = “SELECT * FROM users WHERE name = ‘$q_name'”;
 
echo “Your MySQL query is: $query<br>”;
 
mysql_select_db($db_name);
 
$retval = mysql_query($query, $conn);
 
if(!$retval){
        die(“failed to get data:” .  mysql_error());
}
 
while($row = mysql_fetch_array($retval, MYSQL_ASSOC)){
	echo “<p style=’color:red’>”;
    echo “id: ” . $row[‘id’] . “, name: ” . $row[‘name’] . “, secret: ” . $row[‘secret’];
	echo “</p>”;
}
echo “<br>That is all!”;
 
 
mysql_close($conn);

<?php

$servername = “localhost”;

$username = “root”;

$password = “root”;

$db_name = “test”;

$conn = mysql_connect($servername, $username, $password);

if(!$conn){

die(“couldn’t connect: “ . mysql_error());

}

echo “Connected to db ”;

if(empty($_GET[‘name’])){

die(“missing name param”);

}

$q_name = $_GET[‘name’];

echo “your input param is $q_name ”;

$query = “SELECT * FROM users WHERE name = ‘$q_name'”;

echo “Your MySQL query is: $query ”;

mysql_select_db($db_name);

$retval = mysql_query($query, $conn);

if(!$retval){

die(“failed to get data:” . mysql_error());

}

while($row = mysql_fetch_array($retval, MYSQL_ASSOC)){

echo “”;

echo “id: “ . $row[‘id’] . “, name: “ . $row[‘name’] . “, secret: “ . $row[‘secret’];

echo “”;

}

echo “ That is all!”;

mysql_close($conn);

Expectation vs. Reality

Expectation: The PHP script should be accessible through this URL: http://localhost/test_sql_injection.php since we saved it in the htdocs folder. We will be able to query the ‘users’ table by supplying a GET param called “name” in the URL, like so: http://localhost/test_sql_injection.php?name=epi and the script will show us the id, name, and secret of the matched row.

It should be safe as long the attacker only searches for a name that he/she already knows, right? Hmm, nope!

Reality: If the attacker passes malicious string as GET parameter, he/she can view ALL rows in our users table.

How? I’ll walk you through it.

Exploiting the vulnerability of PHP script via SQL Injection

Note: Originally, my PHP script had $_POST data instead of $_GET and I was POSTing the ‘name’ for the query via curl --data "name=A' OR 'x'='x" http://localhost/catzie_injection.php. After changing it into GET, I couldn’t hack the script with the same string value passed to ‘name’. I don’t know why. So to make life easier, let’s just hack it by accessing the URL via web browser.

Imagine yourself as a curious person with potential in hacking, and pretend you don’t know what we inserted to the database earlier! 😆

Access the following URL with your browser:

http://localhost/test_sql_injection.php?name=epi

1	http://localhost/test_sql_injection.php?name=epi

It should should give you information about the user named Epi. Here’s what it shows:

Connected to db your input param is epi Your MySQL query is: SELECT * FROM users WHERE name = 'epi' id: 1, name: Epi, secret: I eat poop. Don't tell mommy. That is all!

yuck meme

Oops, we saw Epi’s secret! That’s literally a dirty little secret, isn’t it? But that’s ok, because Epi told us we can look up her secret in this database.

Now, aren’t you curious about the secret of other users in the database? Aren’t you tempted to hack into the database?

How can we hack this script so that we could view all database rows, and not just Epi’s details?

Let’s try this URL, with empty query:

http://localhost/test_sql_injection.php?name=

1	http://localhost/test_sql_injection.php?name=

Uhhh, nope. I only got this:

Connected to db missing name param

meme-face-thinking

Ooh, I know! Maybe I can manipulate the query string of the PHP string!!!

Let’s try this now:

http://localhost/test_sql_injection.php?name=x’ or ‘x’=’x

1	http://localhost/test_sql_injection.php?name=x’ or ‘x’=’x

I got this result in my browser:

Connected to db your input param is x' or 'x'='x Your MySQL query is: SELECT * FROM users WHERE name = 'x' or 'x'='x' id: 1, name: Epi, secret: I eat poop. Don't tell mommy. id: 2, name: Pinky, secret: I'm a spoiled brat who's always fighting with other dogs id: 3, name: Asia, secret: I eat too much my belly is touching the floor That is all!
success-meme-face

Now we know the secrets of other users. 😆

The danger

You should understand by now that this vulnerability can lead to exposure of even more sensitive information to the attacker, such as passwords, contact numbers, addresses, etc.

Explanation of how we hacked to see all database rows

How did that happen? It’s all in the manipulated query!

The intention of the PHP script is to construct a query like this:

SELECT * FROM users WHERE name = ‘Epi’

1	SELECT * FROM users WHERE name = ‘Epi’

But instead of passing a real name, we passed this value:

x’ or ‘x’=’x

1	x‘ or ‘x‘=’x

Notice that we did not add a quote at the beginning and end of the value. It’s because that value is inserted between the single quotes in my PHP script’s query string, so that it produces this query:

SELECT * FROM users WHERE name = ‘x’ or ‘x’=’x’

1	SELECT * FROM users WHERE name = ‘x’ or ‘x’=‘x’

The 'x'='x' in the WHERE clause will always return true, and since “or” only requires one true value, then every row in the database becomes a match for the SELECT query.

How to prevent SQL injection attacks like this?

Sorry but I won’t cover tutorials on how to do that in this post.

meme are you kidding me

Now, now, don’t get mad! Basically, what you need to do is use “prepared statements” with MySQLi or PDO.

Please refer to the following articles that will give you precise instructions on how to secure your PHP scripts and web apps so that you could prevent SQL injection attacks.

August 28, 2016

Laravel 5: create route group that is only available during testing (Middleware)

Today I needed to protect a group of routes from everything except my testing environment. I need to run PHPUnit tests that depend on certain routes, but I don’t want those routes to be available anywhere else. I’ll share in this blog post what I did to get what I need.

Assumptions in this tutorial:

You already have Laravel 5 installed on your computer and you are running the app in “testing” mode (e.g. PHPUnit testing)

Introduction

In Laravel, Middleware filters requests that are coming into our application. One of the pre-made Middleware in Laravel 5.2 is Authenticate, which looks like this:

<?php

namespace App\Http\Middleware;

use Closure;
use Illuminate\Support\Facades\Auth;

class Authenticate
{
    /**
     * Handle an incoming request.
     *
     * @param  \Illuminate\Http\Request  $request
     * @param  \Closure  $next
     * @param  string|null  $guard
     * @return mixed
     */
    public function handle($request, Closure $next, $guard = null)
    {
        if (Auth::guard($guard)->guest()) {
            if ($request->ajax() || $request->wantsJson()) {
                return response(‘Unauthorized.’, 401);
            } else {
                return redirect()->guest(‘login’);

            }
        }

        return $next($request);
    }
}

<?php

namespace App\Http\Middleware;

use Closure;

use Illuminate\Support\Facades\Auth;

class Authenticate

{

/**

* Handle an incoming request.

* @param \Illuminate\Http\Request $request

* @param \Closure $next

* @param string|null $guard

* @return mixed

public function handle($request, Closure $next, $guard = null)

{

if (Auth::guard($guard)->guest()) {

if ($request->ajax() || $request->wantsJson()) {

return response(‘Unauthorized.’, 401);

} else {

return redirect()->guest(‘login’);

}

return $next($request);

}

Inside the handle() method, it checks if the request is using AJAX -or- is asking for JSON, and if either condition returns TRUE, it blocks access and returns ‘Unauthorized’ as response. Otherwise, client is redirected to the ‘login’ route, which should happen when client is requesting via web browser.

What I did to make my grouped routes available only in testing environment (in my case, when running PHPUnit) was create a new Middlewave. I’ll show you how. 🙂

Create a new file under Http/Middleware and name it TestingEnvOnly.php

<?php
namespace App\Http\Middleware;
use \App\Http\Controllers\API\ApiLogsController;
use Closure;
use \Log;
/**
 * Check if phpunit is the one running the app
 */
class TestingEnvOnly 
{
    /**
     * Handle an incoming request.
     *
     * @param  \Illuminate\Http\Request  $request
     * @param  \Closure  $next
     * @return mixed
     */
    public function handle($request, Closure $next)
    {
        if(env(‘APP_ENV’) == “testing”){
            return $next($request);
        } else {
            return response(‘Unavailable.’, 401);
        }
    }
}

<?php

namespace App\Http\Middleware;

use \App\Http\Controllers\API\ApiLogsController;

use Closure;

use \Log;

/**

* Check if phpunit is the one running the app

class TestingEnvOnly

{

/**

* Handle an incoming request.

* @param \Illuminate\Http\Request $request

* @param \Closure $next

* @return mixed

public function handle($request, Closure $next)

{

if(env(‘APP_ENV’) == “testing”){

return $next($request);

} else {

return response(‘Unavailable.’, 401);

}

In the handle method, we check if app environment is set to testing, and if so, we allow the request to access the requested route. Otherwise, the request should fail and repond with ‘Unavailable’.

Now, let’s register this Middleware to Http/Middleware. Add the following to the $routeMiddleware array:

‘testing’ => \App\Http\Middleware\TestingEnvOnly::class

1	‘testing’ => \App\Http\Middleware\TestingEnvOnly::class

It’s time to add a testing-only route:

<?php

Route::group([‘middleware’ => [‘testing’]], function(){
    Route::get(“testing_env_only”, function(){
        echo “This should be visible only for testing environment”;
    });
});

<?php

Route::group([‘middleware’ => [‘testing’]], function(){

Route::get(“testing_env_only”, function(){

echo “This should be visible only for testing environment”;

});

If you use PHPUnit like I do, you can test our new Middleware by creating this test method:

<?php
    public function testNewMiddleware(){
        $content = $this->call(“GET”, “/api/v1/testing_env_only”)->getContent();
        var_dump($content);
    }

<?php

public function testNewMiddleware(){

$content = $this->call(“GET”, “/api/v1/testing_env_only”)->getContent();

var_dump($content);

}

I’m only using var_dump so that we can easily see the printed string response which should say “This should be visible only for testing environment” when you run PHPUnit.

Now, in your web browser, visit the route your set for /api/v1/testing_env_only. It should say ‘Unauthorized’.

Here’s how the files I edited in Laravel look like now:

I’m using Laravel 5.2 and these are codes I uploaded at Gist

July 22, 2016

Laravel 5: activate API token guard and print “Unauthorized” instead of login redirect

In Laravel 5, I wrap my API routes in a route group like this:

Route::group([‘middleware’ => [‘auth:api’,’throttle’]], function() {
    // API routes here
});

Route::group([‘middleware’ => [‘auth:api’,‘throttle’]], function() {

// API routes here

});

Notice that I use auth:api and throttle on my middleware array.

auth:api turns on the auth middleware with API token as guard, while throttle activates rate limiter for APIs.

To get started with API token authentication, you may read https://gistlog.co/JacobBennett/090369fbab0b31130b51.

I followed the same tutorial to set mine up, but had this issue: Upon using invalid api_token or no token at all, I am redirected to the /login route, which in my case is a currently nonexistent route.

As instructed by the guide, I already edited my app/Http/Middleware/Authenticate.php file to add the || $request->wantsJson() condition, but my API routes still redirected to /login route upon detection of invalid api_token.

The solution

What I did was add another condition: || $guard == "api"

And now, my app/Http/Middleware/Authenticate.php file looks like this:

<?php

namespace App\Http\Middleware;

use Closure;
use Illuminate\Support\Facades\Auth;

class Authenticate
{
    /**
     * Handle an incoming request.
     *
     * @param  \Illuminate\Http\Request  $request
     * @param  \Closure  $next
     * @param  string|null  $guard
     * @return mixed
     */
    public function handle($request, Closure $next, $guard = null)
    {
        if (Auth::guard($guard)->guest()) {
            if ($request->ajax() || $request->wantsJson() || $guard == “api”) {
                return response(‘Unauthorized.’, 401);
            } else {
                return redirect()->guest(‘login’);

            }
        }

        return $next($request);
    }
}

<?php

namespace App\Http\Middleware;

use Closure;

use Illuminate\Support\Facades\Auth;

class Authenticate

{

/**

* Handle an incoming request.

* @param \Illuminate\Http\Request $request

* @param \Closure $next

* @param string|null $guard

* @return mixed

public function handle($request, Closure $next, $guard = null)

{

if (Auth::guard($guard)->guest()) {

if ($request->ajax() || $request->wantsJson() || $guard == “api”) {

return response(‘Unauthorized.’, 401);

} else {

return redirect()->guest(‘login’);

}

return $next($request);

}

July 21, 2016

Laravel 5 RESTful API with Basic Auth: PHPUnit Testing

I’ve been using PHPUnit to test my RESTful API. PHPUnit is ready to use in Laravel.

In my Laravel-based RESTful API, I have an endpoint /api/users which returns JSON data when you send a GET request. The API will only return such data if the client sends the corrent username and password (Basic Authentication). The JSON data looks like this:

{“success”:true,”users”:[{“id”:1,”name”:”default”,”email”:”def@def.def”,”created_at”:”2016-07-08 20:23:47″,”updated_at”:”2016-07-08 20:23:47″},{“id”:2,”name”:”Eddard Stark”,”email”:”winter@westeros.org”,”created_at”:”2016-07-08 20:23:47″,”updated_at”:”2016-07-08 20:23:47″},{“id”:3,”name”:”Jon Snow”,”email”:”lorcommander@nightswatch.org”,”created_at”:”2016-07-08 20:23:47″,”updated_at”:”2016-07-08 20:23:47″},{“id”:4,”name”:”Sansa Stark”,”email”:”wholetthedogsout@winterfell.com”,”created_at”:”2016-07-08 20:23:48″,”updated_at”:”2016-07-08 20:23:48″},{“id”:5,”name”:”Tyrion Lanniter”,”email”:”ilikedragons@westeros.org”,”created_at”:”2016-07-08 20:23:48″,”updated_at”:”2016-07-08 20:23:48″},{“id”:6,”name”:”Lyanna Mormont”,”email”:”lyanna@bearisland.org”,”created_at”:”2016-07-08 20:23:48″,”updated_at”:”2016-07-08 20:23:48″},{“id”:7,”name”:”Davos Seaworth”,”email”:”seaworth@westeros.org”,”created_at”:”2016-07-08 20:23:48″,”updated_at”:”2016-07-08 20:23:48″},{“id”:8,”name”:”Daenerys Targaryen”,”email”:”queen@westeros.org”,”created_at”:”2016-07-08 20:23:48″,”updated_at”:”2016-07-08 20:23:48″},{“id”:9,”name”:”Cersei Lannister”,”email”:”longmayshereign@westeros.org”,”created_at”:”2016-07-08 20:23:48″,”updated_at”:”2016-07-08 20:23:48″},{“id”:10,”name”:”Gregor Clegane”,”email”:”hound@westeros.org”,”created_at”:”2016-07-08 20:23:48″,”updated_at”:”2016-07-08 20:23:48″}],”status_code”:200}

{“success”:true,“users”:[{“id”:1,“name”:“default”,“email”:“[email protected]”,“created_at”:“2016-07-08 20:23:47”,“updated_at”:“2016-07-08 20:23:47”},{“id”:2,“name”:“Eddard Stark”,“email”:“[email protected]”,“created_at”:“2016-07-08 20:23:47”,“updated_at”:“2016-07-08 20:23:47”},{“id”:3,“name”:“Jon Snow”,“email”:“[email protected]”,“created_at”:“2016-07-08 20:23:47”,“updated_at”:“2016-07-08 20:23:47”},{“id”:4,“name”:“Sansa Stark”,“email”:“[email protected]”,“created_at”:“2016-07-08 20:23:48”,“updated_at”:“2016-07-08 20:23:48”},{“id”:5,“name”:“Tyrion Lanniter”,“email”:“[email protected]”,“created_at”:“2016-07-08 20:23:48”,“updated_at”:“2016-07-08 20:23:48”},{“id”:6,“name”:“Lyanna Mormont”,“email”:“[email protected]”,“created_at”:“2016-07-08 20:23:48”,“updated_at”:“2016-07-08 20:23:48”},{“id”:7,“name”:“Davos Seaworth”,“email”:“[email protected]”,“created_at”:“2016-07-08 20:23:48”,“updated_at”:“2016-07-08 20:23:48”},{“id”:8,“name”:“Daenerys Targaryen”,“email”:“[email protected]”,“created_at”:“2016-07-08 20:23:48”,“updated_at”:“2016-07-08 20:23:48”},{“id”:9,“name”:“Cersei Lannister”,“email”:“[email protected]”,“created_at”:“2016-07-08 20:23:48”,“updated_at”:“2016-07-08 20:23:48”},{“id”:10,“name”:“Gregor Clegane”,“email”:“[email protected]”,“created_at”:“2016-07-08 20:23:48”,“updated_at”:“2016-07-08 20:23:48”}],“status_code”:200}

I’m gonna show you how to create a PHPUnit test for this kind of JSON API data in Laravel 5.

To create a test case, use this command:

 php artisan make:test ApiUsersTest

1	php artisan make:test ApiUsersTest

This will create a new test case named ApiUsersTest.php in your directory /tests

Paste the following code in it.

<?php

use Illuminate\Foundation\Testing\WithoutMiddleware;
use Illuminate\Foundation\Testing\DatabaseMigrations;
use Illuminate\Foundation\Testing\DatabaseTransactions;

class ApiUsersTest extends TestCase
{
    use DatabaseTransactions; 

    public function testGetAllUsersNoAuth()
    {
		$content = $this->call(‘GET’, ‘/api/users’)->getContent();
		$this->assertEquals($content, “Invalid credentials.”);
    }

    public function testGetAllUsersWithBasicAuth()
    {
	    $content = $this->call(‘GET’, ‘/api/users’,[],[], [], [
            “HTTP_Authorization” => “Basic ” . base64_encode(“username” . “:” . “password”),
            “PHP_AUTH_USER” => “username”, // must add this header since PHP won’t set it correctly
            “PHP_AUTH_PW” => “password” // must add this header since PHP won’t set it correctly as well
        ])->getContent();

		$json_content = json_decode($content);

        if(!empty($json_content->success)){
        	$this->assertTrue($json_content->success); // this test expects the JSON key “success” to have value of Boolean true
        }
        
	}

}

<?php

use Illuminate\Foundation\Testing\WithoutMiddleware;

use Illuminate\Foundation\Testing\DatabaseMigrations;

use Illuminate\Foundation\Testing\DatabaseTransactions;

class ApiUsersTest extends TestCase

{

use DatabaseTransactions;

public function testGetAllUsersNoAuth()

{

$content = $this->call(‘GET’, ‘/api/users’)->getContent();

$this->assertEquals($content, “Invalid credentials.”);

}

public function testGetAllUsersWithBasicAuth()

{

$content = $this->call(‘GET’, ‘/api/users’,[],[], [], [

“HTTP_Authorization” => “Basic “ . base64_encode(“username” . “:” . “password”),

“PHP_AUTH_USER” => “username”, // must add this header since PHP won’t set it correctly

“PHP_AUTH_PW” => “password” // must add this header since PHP won’t set it correctly as well

])->getContent();

$json_content = json_decode($content);

if(!empty($json_content->success)){

$this->assertTrue($json_content->success); // this test expects the JSON key “success” to have value of Boolean true

}

Edit the test case as needed.

July 9, 2016

Laravel update from v.5.0.35 to v.5.2.32 hiccups and solutions

I tried to update Laravel 5 today and here were the steps I had to take.

First checked my Laravel version before the update:

$ php artisan –version
Laravel Framework version 5.0.35

1 2	$ php artisan —version Laravel Framework version 5.0.35

Edited composer.json in my laravel’s root folder like such:

	“require”: {
		“laravel/framework”: “5.2.*”
	}

“require”: {

“laravel/framework”: “5.2.*”

}

Run this on command line:

composer update

1	composer update

You might need to delete root folder’s composer.lock file before the update can actually begin.

I got an error which I later fixed. Scroll to the bottom of the following message.

$ composer update
Loading composer repositories with package information
Updating dependencies (including require-dev)
  – Removing symfony/filesystem (v2.8.6)
  – Removing symfony/security-core (v2.6.13)
  – Removing danielstjules/stringy (1.10.0)
  – Removing ircmaxell/password-compat (v1.0.4)
  – Removing vlucas/phpdotenv (v1.1.1)
  – Installing vlucas/phpdotenv (v2.2.1)
    Downloading: 100%

  – Installing symfony/polyfill-mbstring (v1.2.0)
    Downloading: 100%

  – Removing symfony/var-dumper (v2.6.13)
  – Installing symfony/var-dumper (v3.0.6)
    Downloading: 100%

  – Removing symfony/translation (v2.6.13)
  – Installing symfony/translation (v3.0.6)
    Downloading: 100%

  – Removing symfony/routing (v2.6.13)
  – Installing symfony/routing (v3.0.6)
    Downloading: 100%

  – Removing symfony/process (v2.6.13)
  – Installing symfony/process (v3.0.6)
    Downloading: 100%

  – Removing symfony/debug (v2.6.13)
  – Installing symfony/debug (v3.0.6)
    Downloading: 100%

  – Removing symfony/http-foundation (v2.6.13)
  – Installing symfony/http-foundation (v3.0.6)
    Downloading: 100%

  – Removing symfony/event-dispatcher (v2.8.6)
  – Installing symfony/event-dispatcher (v3.0.6)
    Downloading: 100%

  – Removing symfony/http-kernel (v2.6.13)
  – Installing symfony/http-kernel (v3.0.6)
    Downloading: 100%

  – Removing symfony/finder (v2.6.13)
  – Installing symfony/finder (v3.0.6)
    Downloading: 100%

  – Removing symfony/console (v2.6.13)
  – Installing symfony/console (v3.0.6)
    Downloading: 100%

  – Removing nikic/php-parser (v1.4.1)
  – Installing nikic/php-parser (v2.1.0)
    Downloading: 100%

  – Removing psy/psysh (v0.4.4)
  – Installing psy/psysh (v0.7.2)
    Downloading: 100%

  – Removing classpreloader/classpreloader (1.4.0)
  – Installing classpreloader/classpreloader (3.0.0)
    Downloading: 100%

  – Removing laravel/framework (v5.0.35)
  – Installing laravel/framework (v5.2.32)
    Downloading: 100%

Writing lock file
Generating autoload files
> php artisan clear-compiled


  [Symfony\Component\Debug\Exception\FatalErrorException]
  Class ‘Illuminate\Routing\ControllerServiceProvider’ not found


Script php artisan clear-compiled handling the post-update-cmd event returned with error code 255

$ composer update

Loading composer repositories with package information

Updating dependencies (including require–dev)

– Removing symfony/filesystem (v2.8.6)

– Removing symfony/security–core (v2.6.13)

– Removing danielstjules/stringy (1.10.0)

– Removing ircmaxell/password–compat (v1.0.4)

– Removing vlucas/phpdotenv (v1.1.1)

– Installing vlucas/phpdotenv (v2.2.1)

Downloading: 100%

– Installing symfony/polyfill–mbstring (v1.2.0)

Downloading: 100%

– Removing symfony/var–dumper (v2.6.13)

– Installing symfony/var–dumper (v3.0.6)

Downloading: 100%

– Removing symfony/translation (v2.6.13)

– Installing symfony/translation (v3.0.6)

Downloading: 100%

– Removing symfony/routing (v2.6.13)

– Installing symfony/routing (v3.0.6)

Downloading: 100%

– Removing symfony/process (v2.6.13)

– Installing symfony/process (v3.0.6)

Downloading: 100%

– Removing symfony/debug (v2.6.13)

– Installing symfony/debug (v3.0.6)

Downloading: 100%

– Removing symfony/http–foundation (v2.6.13)

– Installing symfony/http–foundation (v3.0.6)

Downloading: 100%

– Removing symfony/event–dispatcher (v2.8.6)

– Installing symfony/event–dispatcher (v3.0.6)

Downloading: 100%

– Removing symfony/http–kernel (v2.6.13)

– Installing symfony/http–kernel (v3.0.6)

Downloading: 100%

– Removing symfony/finder (v2.6.13)

– Installing symfony/finder (v3.0.6)

Downloading: 100%

– Removing symfony/console (v2.6.13)

– Installing symfony/console (v3.0.6)

Downloading: 100%

– Removing nikic/php–parser (v1.4.1)

– Installing nikic/php–parser (v2.1.0)

Downloading: 100%

– Removing psy/psysh (v0.4.4)

– Installing psy/psysh (v0.7.2)

Downloading: 100%

– Removing classpreloader/classpreloader (1.4.0)

– Installing classpreloader/classpreloader (3.0.0)

Downloading: 100%

– Removing laravel/framework (v5.0.35)

– Installing laravel/framework (v5.2.32)

Downloading: 100%

Writing lock file

Generating autoload files

> php artisan clear–compiled

[Symfony\Component\Debug\Exception\FatalErrorException]

Class ‘Illuminate\Routing\ControllerServiceProvider’ not found

Script php artisan clear–compiled handling the post–update–cmd event returned with error code 255

So, Illuminate\Routing\ControllerServiceProvider’ could not be found.

What I did was remove the following line from config/app.php:

‘Illuminate\Routing\ControllerServiceProvider’,

1	‘Illuminate\Routing\ControllerServiceProvider’,

New error upon running php artisan –version:

  [ErrorException]
  file_put_contents(E:\my\path\to\laravel\bootstrap/cache/services.php): failed to open stream: No such file or directory

1 2	[ErrorException] file_put_contents(E:\my\path\to\laravel\bootstrap/cache/services.php): failed to open stream: No such file or directory

I created a folder named “cache” under bootstrap folder to solve that one.

Tried to check my Laravel version again, but this was the new error:

$ php artisan –version


  [Symfony\Component\Debug\Exception\FatalErrorException]
  Call to undefined method Illuminate\Bus\Dispatcher::mapUsing()

$ php artisan —version

[Symfony\Component\Debug\Exception\FatalErrorException]

Call to undefined method Illuminate\Bus\Dispatcher::mapUsing()

Solution was this:

‘App\Providers\BusServiceProvider’

1	‘App\Providers\BusServiceProvider’

Then, finally!

$ php artisan –version
Laravel Framework version 5.2.32

1 2	$ php artisan —version Laravel Framework version 5.2.32

Oops, I can’t view my Laravel site on the web browser. It gives the following error:

FatalErrorException in Controller.php line 9:
Trait ‘Illuminate\Foundation\Bus\DispatchesCommands’ not found

1 2	FatalErrorException in Controller.php line 9: Trait ‘Illuminate\Foundation\Bus\DispatchesCommands’ not found

I opened App/Http/Controllers/Controller.php and replaced all instances of DispatchesCommands with DispatchesJobs.

Next web browser error:

InvalidArgumentException in AuthManager.php line 86:
Auth guard [] is not defined.

1 2	InvalidArgumentException in AuthManager.php line 86: Auth guard [] is not defined.

So I replaced the content of my config/auth.php file with the following:

<?php
return [
    /*
    |————————————————————————–
    | Authentication Defaults
    |————————————————————————–
    |
    | This option controls the default authentication “guard” and password
    | reset options for your application. You may change these defaults
    | as required, but they’re a perfect start for most applications.
    |
    */
    ‘defaults’ => [
        ‘guard’ => ‘web’,
        ‘passwords’ => ‘users’,
    ],
    /*
    |————————————————————————–
    | Authentication Guards
    |————————————————————————–
    |
    | Next, you may define every authentication guard for your application.
    | Of course, a great default configuration has been defined for you
    | here which uses session storage and the Eloquent user provider.
    |
    | All authentication drivers have a user provider. This defines how the
    | users are actually retrieved out of your database or other storage
    | mechanisms used by this application to persist your user’s data.
    |
    | Supported: “session”, “token”
    |
    */
    ‘guards’ => [
        ‘web’ => [
            ‘driver’ => ‘session’,
            ‘provider’ => ‘users’,
        ],
        ‘api’ => [
            ‘driver’ => ‘token’,
            ‘provider’ => ‘users’,
        ],
    ],
    /*
    |————————————————————————–
    | User Providers
    |————————————————————————–
    |
    | All authentication drivers have a user provider. This defines how the
    | users are actually retrieved out of your database or other storage
    | mechanisms used by this application to persist your user’s data.
    |
    | If you have multiple user tables or models you may configure multiple
    | sources which represent each model / table. These sources may then
    | be assigned to any extra authentication guards you have defined.
    |
    | Supported: “database”, “eloquent”
    |
    */
    ‘providers’ => [
        ‘users’ => [
            ‘driver’ => ‘eloquent’,
            ‘model’ => App\User::class,
        ],
        // ‘users’ => [
        //     ‘driver’ => ‘database’,
        //     ‘table’ => ‘users’,
        // ],
    ],
    /*
    |————————————————————————–
    | Resetting Passwords
    |————————————————————————–
    |
    | Here you may set the options for resetting passwords including the view
    | that is your password reset e-mail. You may also set the name of the
    | table that maintains all of the reset tokens for your application.
    |
    | You may specify multiple password reset configurations if you have more
    | than one user table or model in the application and you want to have
    | separate password reset settings based on the specific user types.
    |
    | The expire time is the number of minutes that the reset token should be
    | considered valid. This security feature keeps tokens short-lived so
    | they have less time to be guessed. You may change this as needed.
    |
    */
    ‘passwords’ => [
        ‘users’ => [
            ‘provider’ => ‘users’,
            ’email’ => ‘auth.emails.password’,
            ‘table’ => ‘password_resets’,
            ‘expire’ => 60,
        ],
    ],
];

<?php

return [

|————————————————————————–

| Authentication Defaults

|————————————————————————–

| This option controls the default authentication “guard” and password

| reset options for your application. You may change these defaults

| as required, but they’re a perfect start for most applications.

‘defaults’ => [

‘guard’ => ‘web’,

‘passwords’ => ‘users’,

|————————————————————————–

| Authentication Guards

|————————————————————————–

| Next, you may define every authentication guard for your application.

| Of course, a great default configuration has been defined for you

| here which uses session storage and the Eloquent user provider.

| All authentication drivers have a user provider. This defines how the

| users are actually retrieved out of your database or other storage

| mechanisms used by this application to persist your user’s data.

| Supported: “session”, “token”

‘guards’ => [

‘web’ => [

‘driver’ => ‘session’,

‘provider’ => ‘users’,

‘api’ => [

‘driver’ => ‘token’,

‘provider’ => ‘users’,

|————————————————————————–

| User Providers

|————————————————————————–

| All authentication drivers have a user provider. This defines how the

| users are actually retrieved out of your database or other storage

| mechanisms used by this application to persist your user’s data.

| If you have multiple user tables or models you may configure multiple

| sources which represent each model / table. These sources may then

| be assigned to any extra authentication guards you have defined.

| Supported: “database”, “eloquent”

‘providers’ => [

‘users’ => [

‘driver’ => ‘eloquent’,

‘model’ => App\User::class,

// ‘users’ => [

// ‘driver’ => ‘database’,

// ‘table’ => ‘users’,

// ],

|————————————————————————–

| Resetting Passwords

|————————————————————————–

| Here you may set the options for resetting passwords including the view

| that is your password reset e-mail. You may also set the name of the

| table that maintains all of the reset tokens for your application.

| You may specify multiple password reset configurations if you have more

| than one user table or model in the application and you want to have

| separate password reset settings based on the specific user types.

| The expire time is the number of minutes that the reset token should be

| considered valid. This security feature keeps tokens short-lived so

| they have less time to be guessed. You may change this as needed.

‘passwords’ => [

‘users’ => [

‘provider’ => ‘users’,

’email’ => ‘auth.emails.password’,

‘table’ => ‘password_resets’,

‘expire’ => 60,

];

Another error… Oh will this end soon?

ErrorException in somefile.php line 9:
Object of class Illuminate\Routing\UrlGenerator could not be converted to string (View: D:\…\laravel\resources\views\app.blade.php) (View: D:\…/laravel\resources\views\app.blade.php)

1 2	ErrorException in somefile.php line 9: Object of class Illuminate\Routing\UrlGenerator could not be converted to string (View: D:\...\laravel\resources\views\app.blade.php) (View: D:\.../laravel\resources\views\app.blade.php)

…which was caused by this code in my blade file:

<?php echo url(); ?>

1	<?php echo url(); ?>

I simply passed a string “/” to the url() method to fix it. Then, ta-da! I could browse my Laravel site again via web browser.

May 23, 2016

Laravel 5: Create controller under new folder and routing

So here I am on a Sunday, trying to make progress with a personal Laravel 5 site I need to work on. As I bear with the noise outside in the street (some crazy neighbors set up a swimming pool IN THE STREET! :oops:), I’m trying to figure out how too create a new Laravel 5 controller and place it inside a sub-folder.

Thanks to a StackOverflow answer as my guide, it’s now working. Here, I’ll share how I did it. Just replace “New” with whatever name you want.

First, create NewController.php on this folder: app\Http\Controllers\New\

Then the first part of the code should be like:

<?php namespace App\Http\Controllers\New; use App\Http\Controllers\Controller; class NewController extends Controller {

1
2
3
4
5

<?php namespace App\Http\Controllers\New;

use App\Http\Controllers\Controller;

class NewController extends Controller {

My call for the blade file in index() looks like this:

public function index() { return view(‘admin.home’); }

1
2
3
4

public function index()
{
return view(‘admin.home’);
}

In app\Http\routes.php, add this:

$router->get(‘/new’, ‘New\PostsController@index’);

Last, run composer dump-autoload or php artisan dump

Guide: Laravel Controller Subfolder routing

May 22, 2016

PHP dynamic variable names tutorial

I think it’s very convenient for us developers, being able to name our variables dynamically. I’ll show you how to do it in PHP. 🙂

For example, we have variable $foo with “bar” as value like this:

<?php
$foo = “bar”;

1 2	<?php $foo = “bar”;

If we want to create a variable named based on the “value” of variable $foo, this is what we write:

<?php
$foo = “bar”;
$$foo = “My variable name is bar.”;
if(isset($bar)) echo $bar;

<?php

$foo = “bar”;

$$foo = “My variable name is bar.”;

if(isset($bar)) echo $bar;

The echo should display: My variable name is bar.

Notice that the second variable that we declared was written as $$foo with 2 dollar symbols before the variable name. This makes it a variable variable — a variable whose name is a variable. What happens is that it first gets the value of $foo, which is “bar” and then uses that value as the variable name. And so, in the example above, defining the variable as $$foo = "My variable name is bar." is equal to defining it as $bar = "My variable name is bar.".

Making the PHP variable name more dynamic

Now, what if you want to make your variable name more dynamic? I’ll give you another example.

Here we are generating a random 1-digit number, we’ll use it later:

<?php
$numbers= array(1,2,3);

1 2	<?php $numbers= array(1,2,3);

The way that we’ll define the dynamic variables will be a bit different from the example earlier.

And here we have an array of strings:

<?php

$words = array(“uno”, “dos”, “tres”);

for($x=0; $x<sizeof($words); $x++){
	echo $words[$x];
}

<?php

$words = array(“uno”, “dos”, “tres”);

for($x=0; $x<sizeof($words); $x++){

echo $words[$x];

}

What if we want to create variables whose names are based on the value of strings in the array, like $uno, $dos, and $tres?

We do it like in the code below. Notice that I defined my dynamically named variable like ${$v} inside the foreach:

<?php

$words = array(“uno”, “dos”, “tres”);

for($x=0; $x<sizeof($words); $x++){
	${$words[$x]} = “variable $” . $words[$x] . ” is defined! “;
}

if(isset($uno)) echo $uno;
if(isset($dos)) echo $dos;
if(isset($tres)) echo $tres;

<?php

$words = array(“uno”, “dos”, “tres”);

for($x=0; $x<sizeof($words); $x++){

${$words[$x]} = “variable $” . $words[$x] . ” is defined! “;

}

if(isset($uno)) echo $uno;

if(isset($dos)) echo $dos;

if(isset($tres)) echo $tres;

Now let’s use the $numbers I showed you earlier. Pay attention to what I put inside the foreach.

<?php

$numbers= array(1,2,3);
$words = array(“uno”, “dos”, “tres”);

for($x=0; $x<sizeof($words); $x++){
	${$words[$x] . $numbers[$x]} = “variable $” . $words[$x] . $numbers[$x] . ” is defined! “;
}

if(isset($uno1)) echo $uno1;
if(isset($dos2)) echo $dos2;
if(isset($tres3)) echo $tres3;

<?php

$numbers= array(1,2,3);

$words = array(“uno”, “dos”, “tres”);

for($x=0; $x<sizeof($words); $x++){

${$words[$x] . $numbers[$x]} = “variable $” . $words[$x] . $numbers[$x] . ” is defined! “;

}

if(isset($uno1)) echo $uno1;

if(isset($dos2)) echo $dos2;

if(isset($tres3)) echo $tres3;

The foreach let us define variables whose names are $uno1, $dos2 and $tres3, which are concatenated values from arrays $numbers and $words.

This is where the magic happens: ${$words[$x] . $numbers[$x]}

We combined elements from $words and $numbers arrays, then turned them into variable names by enclosing them in ${}

And that’s it! Use variable variables at your convenience. 🙂

February 19, 2016

Tag: PHP

My environment

Apache, MySQL, and PHP versions that I will setup:

Start Apache on your Mac

Start PHP on your Mac

Check if PHP works

Install MySQL

MySQL command line on a Mac Mini with MAMP bundle installed

Create sample database table for testing with PHP later

Make sure PHP can communicate with MySQL

Enable mod_rewrite

Sample PHP-MySQL code to test your “MAMP” stack

Move Document Root folder

Just in case you still need to ‘sudo’ to access /webcontent folder

Option #1: Change ownership of /webcontent folder

Option #2: Move document root under your user folder

Tested on:

Extras…

How to stop Apache on your Mac

How to check version of Apache, MySQL and PHP

Apache version:

MySQL version:

PHP version:

ERROR 2002 (HY000): Can’t connect to local MySQL server through socket ‘/tmp/mysql.sock’ (2)

Create database

Unsecured PHP script that runs MySQL query

Expectation vs. Reality

Exploiting the vulnerability of PHP script via SQL Injection

The danger

Explanation of how we hacked to see all database rows

How to prevent SQL injection attacks like this?

Assumptions in this tutorial:

Introduction

Here’s how the files I edited in Laravel look like now:

The solution

Making the PHP variable name more dynamic