Sanitize CSS in PHP - Ruby Alternatives an option? - php

We have a requirement to allow users to customise the CSS for a PHP app. In general, only that user will be able to view the custom CSS, but there are cases when other users in their group could also view the CSS, hence the need to ensure that its sanitized.
I am aware that HTMLPurifier and CSSTidy can be used for PHP, but CSSTidy is extremely outdated, and apparently can't handle everything that we need to throw at it.
I havent found any other PHP libs that can do this.
One alternative that I am exploring is taking a ruby library (http://apidock.com/rails/HTML/WhiteListSanitizer/sanitize_css or https://github.com/courtenay/css_file_sanitize/blob/master/lib/css_sanitize.rb) and converting it into php.
Before I go down that route, are there any alternatives to the above? And are there any pitfalls that I should be aware of before using one of the Ruby libs?

Update:
After almost eight years later, I wanted to leave a second note
because my answer start getting downvotes.
I am not dealing with JS/CSS anymore as much as my early career years. I
did mostly focus on building backend services and tools recent years. So, my knowledge on this subject may be outdated, even if I tried to keep it sharp, which requires discipline and hard work.
Neverthless, nicer tools may exist today other than HtmlPrufier and/or TidyCSS. I am not saying those tools are bad. But community support and active maintenance is important. As a thumb of rule, I am staying away from dead or unmaintained dependencies in my applications.
If PHP is a MUST here to sanitize, I would look into Wikimedia's CSS sanitizer first if it works for me. More or less, it's doing the job. Persisting a minified version of given CSS in filesystem, updating as modified on application side also would be a secondary goal for me. A pre-generated version could make my life easier when sending to browser. Any tooling would work there, PHP may just fire a dedicated event for it. Creating sanitized version of CSS may also be a background process candidate rather than generating on demand. Maybe via available tools from other platforms beyond PHP. So there are a lot more options and possibilities out there nowadays.
Hope my explanations shed some light for people trying to achieve something similar.
Original answer was:
HTMLPurifier and CSSTidy are right tools. CSSTidy still maintaining by Cedric Morin and few other developers on Github. Also default CSS level of CSSTidy is CSS3.0 since April 2012.
You may use that.

Related

Difficult choices for creating an ERP from scratch (with php ?)

I'm currently trying to find the best solution/technology to build our ERP.
Our line of work is very specific, no ERP on the market would fit our needs (or 50% of them), so we decided to go for an in-house solution.
We were advised to choose a client/server solution (.net + WPF), but the result of the first delivery is below our expectations.
We are currently thinking about starting over in php (with the same SQL Server Database), and wondering :
Would a php framework (Symfony, Laravel) be a good pick ? We need to have freedom, to ensure maintainability over time
Would a front-end framework (Bootstrap, Foundation, Materialze) be a good idea
Or should we do everything from scratch
Our main concerns are :
Those framework (and the web itself) will evolve, meaning we have a high maintenability risk (although we can prevent our employees to not use our recommanded browser)
Those frameworks are already well organised, meaning it might be difficult to do whatever we want with them
If we use addons (like UI Kits, JQuery scripts), we will multiply compatiblity risks over time
Considering the investment, our solution should have a 10-year lifetime (with maintenance and improvement over time, of course)
While this question is based on advise and not really suitable for this website. I will do my best to answer your questions.
Would a php framework (Symfony, Laravel) be a good pick ? We need to
have freedom, to ensure maintainability over time
It would, Laravel is based on Symfony and has more out-of-the-box solutions. With Symfony you have more freedom.
Would a front-end framework (Bootstrap, Foundation, Materialze) be a good idea Or should we do everything from scratch
You could use any of those font-end frameworks, however they update reguarly, keeping up with trends. Updating a font-end framework means updating every view you have. You could choose not to update however.
If we use addons (like UI Kits, JQuery scripts), we will multiply compatiblity risks over time
jQUERY has been around since 2006 and is not likely to go anywhere anytime soon. It would advise it is safe to use.
I'm currently working in a company that made a from scratch ERP 8 years ago. They had a similar line of work and no ERP fits the needs.
So 8 years later (today), the erp is still used every day, but it's like impossible to maintain. Php (and tech in general) evolves so fast that you can't waste time (and money) evolving it.
Server version
Security failures
...
I recommend to use a "safe" framework with :
long term support
Easy migration system between versions (which means you can evolve your erp easily)
So yes, using a framework is the solution imo. And symfony seems to be the safest. You'll first need to learn how to use it properly but after that you'll be free to do whatever you want with it. Moreover, you can find help everywhere on this framework. It has a strong community which is an important strength.
In the front office, Bootstrap and JQuery are safe too. Bootstrap has a strong community too, and jQuery is not moving on versions.
I'm working on ERP solution and all I can is tell you about how we do it:
PHP framework should be used for your project because it gives you a
good base on what to work on and speeds you up. I'm working in
Laravel and it has all I need.
We are using Bootstrap 3. I'd recommend using some sort of front-end
framework because if your html will be written in easy-to-read manner
then upgrading to newer versions of framework shouldn't be hard.
We use JS + jQuery + vue.js. All I can say is: you shouldn't rely on
JS, php is what your project is based on. JS should be used for
simple stuff that make page feel more dynamic. As JS libraries are
written in JS they will barely lose any functionality over time.
I really should vote to close this - it's both too broad and primarily opinion based.
If you want to develop a web based application using Java, C or C# then a framework is pretty much essential. But with PHP it's a very different story - you are starting with a language specifically designed for the purpose which comes with a rich library of tools from a single vendor. Further if you develop on a Linux platform then the development tools and the platform all come under one provider for patch management. As soon as you start adding in third party components, the problem becomes much more complicated.
For seem reason, Open Source projects seem to thrive and do well when they are making frequent releases. For commercial software regular releases are important for generating revenue streams. When a product is finished in development it seems it is finished in the market. Consider pound vs haproxy.
IME the quality of code you can download from the internet varies greatly. Sadly popularity does not always equate to quality (but price has little relationship either). Frequently programmers are too focussed on delivering functionality to consider security, performance and scalability. Indeed there seems to be a belief that adding more functionality into a framework gives it some advantage over other products (more functionality = more complexity = more bugs = less security + harder to fix).
A problem specific to PHP frameworks is most seek to be all things to all people (more complexity) - providing session abstraction, templating, database abstraction, templating, routing... There are some exceptions of highly focussed tools (e.g. smarty for templating, metabase or AdoDB for database abstraction, jQuery for interacting with the DOM) which focus on doing one thing and doing it well.
Once you start adding third party code into your system, you need to ensure methods for ensuring that code is up to date - but the cost is up front - adding the second, third, fourth... package has a lot less impact than adding the first one (assuming that you do put proper process in place around the management of sourcing and deployment). Using composer helps (but falls a long way short of fixing) the base problem.
Yes, you will be encountering problems that other people have written solutions for. Using a (good) framework or library will probably save costs early on in the project (once you have dealt with the bump of getting your development team up to speed).
Those frameworks are already well organised, meaning it might be difficult to do whatever we want with them
I suggest that if they are well organised it should make it easier for you to do whatever you want with them!
But have a look around SO - frequently people are posting questions asking how do I do xyz with CakePHP / Falcon / CodeIgniter / Laravel. In most cases, what they are asking would be easier to do without the framework rather than via the framework.
I could go on, but this reply is already too long.
There is no answer to your question. If there was it would depend on a lot of other factors like available skills, risk appetite, budget....
If you decide to use a framework (or frameworks) then do consider building the system around micro-services and (if practical) avoid using the frameworks front controller. This will reduce your dependence on the framework if you ever need to re-engineer it out.

What are the relative advantages of various Python/PHP web frameworks (particularly for my project)?

I'm deciding on a web framework for an upcoming project, and I'd appreciate any advice. We've decided to use jQuery for the JavaScript, and are heavily leaning toward Python or PHP (more Python) for our server-side logic. I'm especially interested in web2py because of its jQuery integration.
About our project
Our project is to develop a security console for a complex
cybersecurity system operating within an organization's internal
network.
This console will be largely server-driven, as messages come in from the network and must be pushed by the server to the user.
The user will also be able to initiate security actions, the implementation for which will likely be in C++.
The interface we've planned will be relatively rich, and I want to leverage jQuery's power as much as possible.
We have some control over the browser environment we'll be running in (e.g., we don't have to worry about clients with JavaScript disabled).
Our site is likely to have only a few, long-lived client connections.
We are looking for software components with permissive licenses, though we're using some copyleft components (I see that web2py is LGPL while Django is BSD, so +1 to Django)
We have about a month to create a functional demo of our system, of which this interface is a small (but visible) part.
About us
We are two developers with about 5 years of programming experience, but little web development experience. I have several years of Python experience and a summers' worth of experience messing around with PHP. My coworker has some Python experience and has never touched PHP.
I used Django once back in 2008, and was frustrated by the file and code structure, which I found highly unintuitive. Perhaps this structure is inherent to the MVC model (I've had similar experiences with Django and CakePHP since), and I just need to bite the bullet and memorize it.
My Question
Given the information above, what are the relative advantages of the various Python/PHP web frameworks for our project? As mentioned above, I'm especially interested in web2py because of its jQuery integration, though Django's dominance is (once again) hard to ignore.
Thank you very much for your time!
Before deciding on a framework, you should first decide if you want to commit to a language you are unfamiliar with.
You said you've both got minimal PHP experience, so you have to weigh up the advantages here; Will the pros for going PHP (if any) out weigh the amount of time the developers will need to spend to retrain?
(Although depending on your background experience, PHP should be very easy to pick up.)
If you frame it like that, PHP would have to have a pretty convincing offering to give you. From what I'm seeing, specifically Django vs web2py, they both seem very close in functionality - which is good, but doesn't provide the "you must use x!" scenario you may be after.
However, If you will be bringing more people in later and feel finding people to work with web2py will be difficult, it may tip it to PHP. You said your self, Django's popularity (and BSD license) is hard to ignore, and it should make it easier to find people for later expansion.
If it were me, in your shoes, I would go with web2py. Assuming the development team will continue to be Python focused for the foreseeable future.
Python vs PHP: Python
With python, you can always write wrappers for C code so you won't have to mess with starting other processes and passing args to them. That might be useful for your security functions.
Web2py will allow you to easily write a webservice for this too, to more easily integrate the C portions with the web-site infrastructure.
If you already prefer python, I would go with that. If you need to bring on web-developers later that are trained in PHP, teach them Python. It won't take long, and I'm sure they'll appreciate it in the long run. Plus, moving from a PHP MVC framework to web2py or even django would make things easier. I've used CodeIgniter for PHP and find that web2py was so much simpler and easy to understand.
Also as for the directory structure, django is not actually true MVC -- it's MTV (model, template, view).
I find web2py's organization a little more straight-forward. But yes, either way it can seem strange at first. I would say YES, you should bite the bullet and use MVC.
In web2py, the "view" is html markup with the ability to write raw python code. The controller extracts data from the model (database), attaches any needed files (css/js etc) and the model of course simply defines the structure of the data and allows you to access it in an OO way.
Lastly, I wouldn't tip my hat in favor of web2py just because of jQuery integration. It does use it, and a some of the built-in framework stuff (like response.flash/session.flash, the LOAD function that loads a page or data from another controller) rely on jQuery, but using it in another framework only means you have to write an include statement (e.g. ).
But, the way it allows/forces you to focus on development is what takes the cake for me.
I've been using Django as part of my work for a couple years now and truly enjoy it when I can make it work. Unfortunately, and maybe it's just me, but I end up spending hours working on configuration every time I start a new server, or try to make it work in a development IDE.
It's relatively simple to start a new project and start coding. But there are all sorts of little catches that keep things from working if you deviate from the norm. Things like if you want your django project to serve from a subdirectory like example.com/django. The information is out there to make it work. But it's hard to find.
I can't tell you if web2py has those same problems or not. I only just learned about it from your question. It does look slick and simple though. I can tell you that after the hassles of getting the applications to serve properly from whatever server configuration I'm using, django is way more fun to program with than plain php. PHP frameworks may differ.
From my understanding the project not usual web application, you must need event driven program, web server in python.
Django won't help you here.You should look into Flask, Flask has inbuilt console too.http://werkzeug.pocoo.org/, you might need to use twisted, gevent,Flask jquery.
I would recommend asking about web2py on its mailing list -- you'll get lots of help and advice there. Regarding the LGPL license, note that it only applies to the framework, not your application -- you can license your application however you like, including closed source/commercial.
It sounds like you'll need some server push functionality, but if you'll really only need a few long-lived connections at a time, you might not need to bother with solutions like Twisted or gevent. If necessary, though, web2py does include this (requires Tornado, and works using WebSockets, though can be adapted to use other methods).

Desktop software development (possibly using web technology) and cryptographic checks

OK, go easy on me as it's my first question here. ;)
I am experienced in Web Application development, but I need to design 2 different desktop applications at work. I need advice on what languages to use (I use PHP for Web Applications, I have little other experience), any frameworks that may help me accomplish this easier and any IDEs to use to make my life easier too.
My first application will essentially be an interface to an embedded or remote DB and essentially it needs to do not much more than CRUD. A fulltext search function will be necessary as will sorting of the CRUD table too. I'd like to include the possibility of hiding columns of data too, but this isn't a priority. I currently use MySQL, but am happy to use any other DB, as long as they support importing from Excel. Of course, if it supports an excel spreadsheet as the database, fantastic, but wishful thinking...
I only need to support Windows XP upwards, this won't change. Let me know if I can add anything to help answer this.
My second application is going to be more complicated, I guess. It needs to output the SHA, MD5, CRC-32, CRC-16 signatures for an entire external drive on-screen and/or into a text document of the users choice (new and append). The external drive could be Compact Flash, EEPROM, CD-ROM, DVD-ROM, SD, etc. Whereas I have an idea where to start on the first application, this one is where I need major help as I have no idea which programming language has built-in support for all the algorithms above, or the best way to go about coding it. So any and all advice will be more than welcome.
Edit: OK, so I have come across Titanium and am wondering if this is the best option out there for my 2 projects. The first one I am certain I can achieve, but the second project is going to be pretty difficult I believe, as unlike most hash calculators out there, I do not only need to check individual files for SHA/MD5/CRC-32/CRC-16, but I also need to check Compact Flash through a USB-connected Sandisk CF reader and EEPROMs through a COM or USB connection as well. I essentially need to produce the signature/hash for the entire drive, not the files on it. Any advice on this in particular would be helpful, please let me know if I am going too far off-topic by stackoverflow standards, as I can create a new question with this in.
I'm going to have to say Perl might be a good (though not necessarily the best) option for you, if you aren't one of the PHP developers who are Perl-allergic:
Perl is probably easier for a PHP developer to pick up than some statically typed compiled language that typical desktop apps are written in
Perl has libraries to interface to pretty much ANY database back-end you want, though I'm not 100% sure about using Excel as DB directly (I'm fairly confident something exists in CPAN but can't recommend anything from personal experience).
Perl has Windows GUI development - from an easier (for you) web GUI using local/embedded web server to Tk to Win32 GUI modules (StackOverflow has a couple of questions with very good references on the topic of Perl Windows GUI options).
Perl has a fairly complete set of support for MD5/SHA etc... Again CPAN is your friend.
If the only development experience you have is PHP for web, your options for quick desktop development are seriously limited.
since i don't know of any (sane) way to use PHP for desktop apps, my first thought was to reach for a framework that would let you use JavaScript and a mostly declarative UI. That would save you from most of the pain.
The best one for that would be Qt, which is supposed to let you do almost everything on QML and JavaScript. the unfortunate part is the 'almost'; since anything that escapes that would mean C++ development. The best C++ environment, for sure; but still widely different from Web work (specially PHP web work).
The other option, which I think would be best for you is Adobe AIR. I haven't really checked it; but it lets you write a 'desktop-like' app using only Flash (with or without the Flex framework) or HTML+JavaScript. When i first saw it seemed pretty much complete. For DB work i think it can use an embedded SQLite library; or access any HTTP service (which could be a local DB+PHP app exposing the CRUD methods)
You could try PHP-GTK.
It may not be the fastest, but it does work.

Php/Javascript to make a browser game?

I've been on and off intrested in making a text based browser game.
I have been turned off by the idea because of the daunting amount of things to learn.
PHP (or another sever side scripting language)
Javascript
HTML
MySql
And the fact of severs and apache..
Can I just pay for web hosting and by-pass having to set-up apache?
Also how long will it take me to learn all thoose things well enough to start work on my game?
Should I just stick with Flash and then C# for XNA?
Just install XAMPP, which is basically the lazy man's Apache/PHP/MySQL setup in 1 click. You just install it and it does all the work, nothing for you to setup nor config.
Don't let the complexity of PHP/HTML/Javascript set you off, we all hard to start somewhere. Just start with the parts you know how to make, then look around for each individual problem. Being motivated is key to learning anything, and if you have something you enjoy working on, you won't have a problem learning what you need to pull this off.
Do you have a specific game in mind?
Does it need to be multiplayer?
In the initial stages, does it require server interaction at all?
Conversely,
Are you interested in the possibility of building a working game first, and adding in features like saving high scores, multiplayer, or other server-interactions later?
Is a self-contained game like nethack or Hitchhikers a good starting place for you?
If your initial game does not require server interaction, you can build quite complex games using only HTML and JavaScript. This will reduce the number of concepts and languages you need to learn up front.
Once you have had some practice building non-trivial games in HTML and JavaScript, you can then add in features like server-integration, and learn a server-side language like PHP, Python, Perl, ASP.NET, or Ruby...
You can definitely pay for hosting, and eliminate the effort of setting up and maintaining a server yourself. A quick search will find you a number of web hosting sites to choose from.
I believe sticking with flash would make things easier, as syncing multiplayer with javascript and PHP isnt going to be easy.
It depends how complex the game you want to make is. You can easily learn some basic PHP and javascript inside of a month (like pretty much any other language), but it'll take a lifetime to master (like any other language).
I would recommend you start out small - plan to implement just a subset of your features, and take them on one at a time.
I would plan to use libraries / frameworks. For Javascript I would currently recommend JQuery because I find it easy to use, it has a large community and it's well documented. Using a library like JQuery allows you to easily ignore a lot of the browser specific details, since they deal with all that nonsense for you.
For PHP I personally use Zend Framework - this is a massive beast that isn't always the best documented, but if you start with the "Quick Start" tutorial and then only look at features as you need them, you shouldn't get overwhelmed too easily. One of the great things about Zend is that you can pick and choose what features you want to use without hassle.
With regards to servers, yes you can use a web host and bypass setting up a full server yourself very easily and cheaply. You can find local installations (eg. XAMPP) that will allow you to quickly set up a local install of Apache, PHP and MySQL to get started with.
First of all, if you're developing an MMO or want to offer multiplayer support, you're going to need to learn PHP and mySQL. In theory, you could go ASP.NET instead, but I would strongly advise against it, since Microsoft servers cost more to rent, and since PHP/mySQL is much better documented and easier for beginners to learn. If you're building a single-player game, Javascript and HTML could technically be adequate, but knowing PHP will still make your life easier, in the long run.
Although you should probably set up a LAMP stack (Linux Apache mySQL PHP) on a local network so you understand how it works, hosting your own server almost never makes sense for a production environment. You could, however, save yourself some money by developing the game on your own LAMP stack. Alternately, most shared hosts (around $80 / year) provide support for PHP and mySQL, and this would be perfectly adequate for building your game. Eventually, once you're ready to launch -- and assuming it becomes even marginally popular -- you're going to need at least a VPS, and possibly a dedicated server.
Finally, a note on Flash:
In the last few years, the popularity of mobile devices has skyrocketed, and this presents a risk for Flash games, since Apple refuses to support the plugin. If you need advanced graphics support, a more timely alternative would be HTML5. Unfortunately, this carries its own set of drawbacks: namely, since it's a long way off from official release, it's not yet universally supported, and features that are supported will vary from one browser to another. So basically, HTML5 is the future, and Flash is the past. The best option for right now? Probably Javascript; you might be surprised what JS can achieve, when properly combined with CSS, and you'll need it for AJAX functions anyway. Best of all, it's supported by virtually every device and browser.
So, in conclusion, I'm recommending that you learn HTML, CSS, PHP, mySQL and Javascript, and don't be intimidated by that variety of languages; the more you learn, the more easily you learn the rest.

How common is PEAR in the real world?

I have looked at a good deal of other peoples source code and other open source PHP software, but it seems to me that almost nobody actually uses PEAR.
How common is PEAR usage out in real world usage?
I was thinking that maybe the current feeling on frameworks may be affecting its popularity.
PHP programmer culture seems to have a rampant infestation of "Not Invented Here" syndrome, where everyone appears to want to reinvent the wheel themselves.
Not to say this applies to all PHP Programmers, but them doing this apparently far too normal.
Much of the time I believe its due to lack of education, and that combined with difficulty of hosting providers providing decent PHP services.
This makes getting a workable PEAR installation so much more difficult, and its worsened by PHP's design structure not being favorable to a modular design.
( This may improve with the addition of namespaces, but have yet to see ).
The vast majority of PHP code I see in the wild is still classic amateur code interpolated with HTML, and the majority of cheap hosting that PHP users inevitably sign up for doesn't give you shell access.
In my (limited) experience, every PEAR project that was potentially interesting had major points against it:
Code is targetted at the widest audience possible. There are hacks in place all over the place to deal with old/unsupported PHP versions. New useful features are ignored if they can't be emulated on older versions, meaning you end up lagging behind the core language development.
Any given project tends to grow until it solves everyone's problem with a single simple include. When your PHP interpreter has to process all of that source code on every page hit (because the authors may not have designed it to be opcode-cache-friendly), there is a measurable overhead for processing thousands of unused lines of code.
Style was always inconsistent. It never felt like I was learning generalizable APIs like in other languages.
I used to use PEAR::DB at work. We discovered that most of our scripts spent their time inside PEAR code instead of our own code. Replacing that with a very simple wrapper around pgsql_* functions significantly reduced execution time and increased runtime safety, due to the use of real prepared statements. PEAR::DB used its own (incorrect at the time) prepared-statement logic for Postgres because the native pgsql_ functions were too new to be used everywhere.
Overall, I feel like PEAR is good as a "starter library" in many cases. It is likely to be higher quality code than any individual will produce in a short amount of time. But I would certainly not use it in a popular public-facing website (at least, not without a lot of tweaking by hand... maintaining my own fork).
Im my opinion PEAR is a good project but lacks people who want to work and keep working on it, most of the packages have inconsistent coding practices (I do not mean coding style) and there are lots of TODO's in the whole thing.
I find it useful sometimes for coding stuff I didn't know existed yet, like custom country validation functions and so on, otherwise I'm better served with any available framework out there (like CodeIgnite or Zend Framework).
The Pear library is the kinda stuff that just sits there, plugging away, with very little glory. If you are looking for something that it can do, and there's nothing more specifically targeted in the framework that you are using - go use it.
I've been working on a dating site for the last two years - and there's at least 65 pear-sourced files I've used, and are still live there today. Some, like the pager or html_Quickform will be overtaken by new code as it's updated, but for others there's just no need.
PEAR is not common, nor popular.
I tried to use PEAR so many times, but it lacks the umpphh to commit.
I prefer Zend Framework which takes the approach of 'loose' type, use only what you want.
PEAR is not common, nor popular — but it is good, and I'd recommend it to anyone.
(I do agree with Tom in that it doesn't feel like a single, unified, API; but then, this is PHP … one wouldn't like to see it getting above its station as an interpreted hack language now would one?!)

Categories