How can I protect my PHP code? - php

I have developed an application and now I would like to hire some programmers to work on several pieces of it to upgrade and tweak it.
I have read other questions/answers here but they are mainly about obfuscating the code which is something I do not want to do (as I need them to read it and tweak it).
What I'm basically asking is, what is the best way to structure my code so I will have to expose only what I have to?
A good example for me is a webapp called RightNow which I'm developing for at work, what they do is they let you play around with all the widgets (you can create/edit/remove any widget) but the core of the application is in folders I do not have permissions to.
After you do your coding on the widgets, you then 'deploy' the application and it goes live. I have no idea what the deployment actually does behind the scenes, but this is one practice (not sure if it's the best) which allows the application owner to have control over the core of the code but still allow development for it.
Is there a better way? what do you think?

First you can use a version control software like SVN for example.
and then you can have copies of the code, one for testing and one for the your programmer. When the programmer is done changes and tweaks, the testing code gets updated first and when the test are done the live application gets updated.

you can obfuscate your core classes(ones that you don't want to expose). and other developers can include and use them at the same project as long as you provide a nice api to your classes.

Related

PhpBB's automod like software for php

I have looked and looked all over to find a way to make something similar to PhpBB's automod system they use for their software.
I cannot seem to find anything similar to this with the whole xml find and replace code updater and mod installer.
I may just be typing in the wrong keywords in Google, but does anyone know of any system like this available before I start trying to make my own?
EDIT: I mean more like a code updater. For example find and replaces in a php file.
FIND:
?>
ADD BEFORE:
echo "this is text added before the ?>";
I realize this could be done with str_replace but there is surely a system out there that already does this reliably.
The reason that a system doesn't exist outside of phpBB is because it's an incredibly poor way to manage modifications. Your question does not make it clear what you want to gain from this, but since it is your own code, you should definitely not look to copy something so awful.
For “patching” code
If you want the ability to apply updates to your code, then you should look at handling it through version control. For instance, you could develop and test in a local git repository, and once you are happy, push the changes to the server. You have many options here from a basic update script to a fully-fledged Continuous Integration solution.
phpBB have implemented a solution for patching code on your live site via a Web interface, which has many issues with security, verifiability and maintainability among others.
For exposing “plugin” functionality
If you want the ability to register plugins in parts of your code, then you should architect your code as such to allow it to be handled easily. Wordpress, MediaWiki and other projects can help you write such a structure.

Is there an argument against using a CMS?

I'm thinking about rebuilding my website from scratch, but this time, using a CMS. Everywhere I turn people tell me to use a cms, but it's only now I'm really considering it. My site isn't too complicated. Is this a good idea in terms of workflow? I'm the only person who will edit the site, so if it's just a matter of workflow and efficiency, should I just convert now before it gets really big?
Sure, a few come to mind.
Deployment complexity. Many CMSes require a database, which means running a database process somewhere, and backing that up, as well as the rest of the code and assets for the site.
More space will be required to hold the CMS code for the manager, framework, libraries, etc.
Bloat could come into play, the CMS may, and likely would, implement features you have no use for.
Additionally any CMS will have some kind of limitations, some things will be more tricky to do than others when compared to a mostly static site.
Just read the code. That's often all the arguments you need. (If your needs are really simple and you don't need plugins and you don't need to write any code yourself I'd still use a CMS, though)
If your site is mainly a design showcase, and doesn't have real content in it, then a CMS will only get in your way and make things harder.
Otherwise, it will mostly be of help.
Along with everyone else's statements. If it's just a small site you don't necessarily need a CMS, but if you are wanting to use a CMS for client projects in the future, why not start now.
Deployment. If you're doing some big changes to your site or testing something, you'll probably want to try it out locally with a development copy of the database. Once you're done, how do you get everything to the live site without overwriting, say, comments that were made on the live site since you created a development copy?
Specialization. CMS's are great for some things, but they're bad at others. What if you want to add more complex functionality to your site? It might be a plugin or module at first, but soon you're writing all this code and you realize you should have just used a framework and built the CMS part yourself.
If it's a simple static site with a single editor and without any aspirations of using complicated functionality and you feel confident enough in your web language of choice, then go for it. Even if you don't feel confident enough, it should be a good challenge.
Write some minor templating so that you can separate your code from your design, have some simple way of adding articles or blog posts or whatever - it could be as simple as including text files from a directory.
Using a CMS, even in their modern and quite usable state will require more resources, hardware-wise. and will probably have a steep learning curve. It will also require maintenance and dilligent security patch application as new vulnerabilities appear. On the other hand a CMS can get you up and running with a basic site quickly, and grow with your needs if you feel like enriching it, as you get to use its large variety of ready made plugins and extensions. You want blog comments with users logging in via OAuth? No problem. RSS? There's an extension for that.
Bottom line is, if this is a simple static site with a single editor as you describe it, it should be trivial to set up some code to run it. You'll spend as much time on its template design as you would on customizing a CMS's template, avoid the initial learning curve a CMS requires, and not worry too much about the resources and maintenance a modern CMS requires. You will, however, be limited in functionality and future ideas by what you can write or integrate yourself.
It depends somewhat on the purpose of the site.
If it is a means to an end of getting information posted on the web, then adopting something like WordPress will quickly get you going, and provide lots of extra functionality that would take a fair amount of time to build in - e.g. stats, feeds, remote publishing etc. There are a few basic steps you'll need to go through setting up self-hosting on a shared web-hosting package e.g. creating the DB and unzipping the files etc but fairly straightforward really. And the time you save administering your website can be focussed on other things where you're making a difference or doing something different to everyone else.
However if your purpose is in part the learning experience of developing the functionality or you have unusual requirements that aren't in a standard CMS, then there is an argument for developing your own.

Uploading some specific features but not all developed features from development to live server

This is more or less related to project management and also with every developer. How you guys handle this situation when you have developed many features on development site and all are tested by client and ready to go live.
These features have some code in common files ie. One PHP file have the code for one feature as well as one other feature.
But client will ask you to upload only 2 feature out of 10 or 15. Files are common if you upload that file directly will leads to error problems because they have code for other features. If you upload all updated files then all feature will be live.
A possible way is go back and comment out that feature which is not needed live for now from common files. But there is possiblities to forgot to comment anywhere else.
This is also not a good way and at last client will say what happen everything was tested on development server and why these bugs and errors are introduced on live server.
This will reduce the faith on developers.
I faced this problem many times and could not found any good way to avoid these issues. So I am thinking that you guys also facing or faced this problem.
I am thinking versioning system can help here.
How you guys are handling this?
Could you share ideas?
The situation you are describing is impossible to manage sanely. I don't believe it would be possible to make this situation work, but the real question is why would you want to?
There are a number of issues with the scenario you describe, but the core issue is really this. You are testing one thing, and deploying another. You acknowledge in your question the interconnected nature of changes. In reality it is even more difficult than you describe. You simply cannot know how a system will behave when you try and deploy parts of a tested solution. Why test it at all?
The only sensible solution I can see is to have a sandbox environment where new features are demonstrated. However keep your test enviornment only for testing stuff that will go live. So in your example the one or two features are in test, ready to be signed off for prod, and the other featues are locked in the sandbox.
This leads to the next problem, which is managing your source code. I don't see any sane strategy for managing the arbirtrary inclusion of features from a code base. Even under the mostflexible system I know, Perforce, any branching straegy would require awful resolves on merges as you try to move stuff in and out.
I have seen this happen, and believe me it gets very ugly.
I suggest you come up with a better solution. Talk to your client and change the way things are done. It will be better for you, and in the long run better for them.
A solution could be to use cheap version branching as provided by VCS such as Git or Mercurial. The project would consist in many feature branches used to develop said features and build branches where feature branches would be merged and adhoc fixing would take place. When a build branch is ready for test, it is tested, fixed if needed and then the build branch is shipped to production platform.
When features have been validated, the build branch can be merged into remaining feature branches so the branches under development can integrate the "official" changes.
To sum up, the application is custom built from existing feature branches as needed.
One reasonably sane way to manage this on the code level is to isolate each feature into a plugin. Then you can add/remove features on-demand by simply enabling or disabling corresponding plugins.
But this solution has certain costs:
Time to develop and test plugin engine for your app
You need to test every plugin configuration (set of enabled plugins and their versions) that is going to be deployed. Otherwise there's a risk that this specific set is not compatible and end users would be first to see resulting crash, or data loss, or some other horror
Additional time to wirte plugins the way that they're minimally dependent on each other.
It's usually worth it only if you have many clients with different needs. In your case, I'd recommend explaining cost of separately enabling features to your client to see if they really need it this hard. Most likely, they don't

Upgrading a PHP/MYSQL application?

I'm looking for inputs into how I can manage the upgrade process itself of a homegrown php/mysql application. Meaning, if we have a 'stable' version of our php/mysql application working on our production server, and we now want to upgrade it to the next version that we've worked on - how do we go about doing that elegantly? What practices should I be implementing?
What I was planning to do was just to
Ask the developers to stop
checking in code after all stability
/ functionality tests are done
Take the application offline*** (Q: how should I prevent ppl for logging in / accessing public pages? Best practices for that?) but allow access to developers through a secret login page / url
Log onto the production server and check out the latest version
locally***
Have the developers/testers test their code through the secret access page / url***
After that is done, we restore access to all by removing this secret access page / url, removing the site-under-maintenance page and restoring access to all.
***NOTE: A simple way of doing this would be to rename /myapp/ to /myapp.old/ and put the new application version into /myapp.new/ Developers would access /myapp.new/, test to their satisfaction and then after we're done, we would rename this back to /myapp/ (this is just the basic idea)
This is a huge question, and in many ways it will depend on your specific project. But here are some practices to think about:
Put lots of comments in your code. Things that seem perfectly logical now will be confusing when you go back to make changes in a year or two.
Maintain a development version of the site with its own database. You can test changes to the site before publishing to your production site.
Use a PHP framework (such as CakePHP, CodeIgniter, etc). If you are far along on your project, this may be difficult to do. But it will help you write code in a way that is easy to update, and will include a lot of stable, mature functions that you won't have to write from scratch. Using one of these frameworks (and following its best practices) is probably the best way for a beginner to learn to think about writing modular code that's easy to update. This will also encourage you to develop your database in a way that is consistent with the structure of your site.
Write tests (the framework should help you with this) to programatically check your code for errors.
Use a version control system such as Subversion or Git. This allows you to track changes to the site, and easily roll back changes if/when you realize they are buggy.
Comprehensive unit test coverage would be very helpful, as would small, highly cohesive, low-coupled classes. In addition to the unit tests, good coverage from an integration level would be valuable.

From a development standpoint, what are the advantages/disadvantages of the major Content Management Systems?

I'm interested in using a CMS instead of building a website from scratch. However, as a software engineer, if I'm going to be using open-source tools, I'm going to use them to their full extent, including the possibility of developing plugins/extensions/modules and maybe even contributing core code.
I'm currently looking at WordPress, Drupal, and Joomla!. They all appear to have the features I need, either as core features or plugins. However, I'm curious how hard it is to learn the system and then develop for it.
Does anyone have experience with this? When using and developing WordPress, Drupal, and/or Joomla!, what were your experiences like?
I avoid Joomla like the plague. It is highly difficult to extend, especially if your use case isn't one of the ones their devs specifically designed the CMS for. Great if you want to do a small business brochure site, but if you're looking to heavily customise... ditch it. The pay-to-play nature of much of the dev community is a turnoff, too.
WordPress is very heavily specialised in the blogging direction. If that fits your needs, go for it - it's a slick, well supported, system. If you're looking for something that's a bit more complex in a CMS, though, go with...
Drupal. My favourite PHP CMS, hands down, with the exception of blogging. Functions like hook_nodeapi, hook_user, hook_form_alter, etc. make it essentially effortless to heavily tweak the function of nearly everything in the system. If I want to replace the password field in the user login form with an upload field and MD5() the uploaded file to verify the user, I can do that - without hacking core code, and in a few lines of form alteration and validation code. Pretty astounding the first couple times you do something slightly nutty like that.
I haven't used Joomla much and have never really needed to tweak Wordpress outside the design but have used Drupal quite extensively. Drupal seems to be becoming the standard for PHP CMS' which I think is quite a shame given how much is wrong with it. I won't try to tell you why you should use it, or shouldn't, but here's a few things that I find really annoying with it.
Complete lack of OOP. Ok, in Drupal 7 they're finally doing some OOP with the Abstraction Layer but the community as a whole still shuns the entire concept of OOP as it applies to the CMS as a whole. And given their dependence on modules and third party code doing a decent OOP setup would help keep the code more organized. Currently to avoid naming conflicts you need to prefix all functions and constants with your module name which can lead to some very long function names which can lead to some very long lines of code which can make things a little less readable than doing something like $node->parent()->parent()->title;
Drupal content is completely unorganized. When doing an information heavy site it's imperative that you have well organized content and Drupal simply doesn't allow this. Drupal's content management is just one large list of nodes with a few filters you can apply. There are ways you can use Drupal's taxonomy system and other modules to setup relationships but I've never found any that actually make the interface easier to navigate and make it easy to manage the content on the templates. At work I've created a module that allows this but it's required dumping weeks worth of development time into it a simple feature that any good CMS should come with out of the box.
The admin interface is absolutely rancid. This one pretty much speaks for its self but install a copy of Drupal and click around. Then take a look at say, the Radiant interface (Radiant is Rails I know, but we're talking UI here). Another example of a good UI for the admin would be FrogCMS, a PHP port of Radiant.
No ORM, and absolutely no attempt to have one, means you better like writing lots of SQL to get the data you need. While I generally have no problems with writing my own SQL it's starting to get a bit old when most good frameworks and CMS' built on them have at least some kind of ORM for you to use. Even if it's a botched one.
Drupal loves to use non-standard file extensions (.module, .info, .install, .inc, etc) so you better make sure your htaccess and/or virtual host is setup to not allow direct access to these files or all your source code will be wide open for the world to see.
Personally I think FrogCMS looks like it's off to a good start to be an up-and-comer if the maintainers allow the community to contribute to it and allow it to grow. You'll need to do more coding as it doesn't have a big feature set out of the box and doesn't have a plugin repository like Drupal or Joomla but from a coding standpoint it's setup with a pretty well done, albeit basic, MVC implementation that will help your code be more organized and easier to maintain.
I've only developed for Joomla! and have been a user of wordpress, but Joomla! development is too clumsy if you want to completely change the layout. Writing a plugin or 'component' is fairly easy if you know the way around the code, but getting it to do exactly what you want isn't so easy because it likes to force you to use it's MVC design pattern which I find too clumsy.
I've seen both the Joomla! and Drupal code base, and I'd say that Joomla!'s code is much cleaner and better documented. It also heavily uses the MVC design pattern which can be good or bad depending on your preference and what you want to use it for. It has the most extensive use of OO programming in any php project I've seen.
I haven't developed for wordpress, but as a user, automatic updates are a godsend! plugins and themes can be found and installed through an interface in wordpress itself, so as a developer you save a bit of time in trying to promote your plugin because it gets made available to everyone right away. Heavy modifications might break some of of this though, so I wouldn't recommend it if you want to modify it a lot.
Joomla!'s plugin community is heavily monotized, but there is a huge community of plugin developers. I don't know about Drupal, and most wordpress plugins are free. So that's something to consider as well if you plan on using third party plugins.
over the years, i began hating PHP, since i had to work a lot with it until i found good alternatives, so the first question i ask you is: does it have to be PHP?
but staying with PHP i'd add the following:
most people like Drupal a lot because of it's extensibility ... that's fine, but it still has some design problems ... it's is very potent and flexible and has a huge user base -> lot of plugins, big community to ask for advice etc.
when it comes to Joomla, one has to say, that in the past, this has been a really a complete mess ... but in version 1.5 the whole thing was redesigned and is now very clean ... i always laughed down at joomla, but recently i had a talk with some other developer i had worked with on several occasion, who quite conviced me, that it has become a developer friendly software ... plus, it is soooooooo damn easy to administrate ... i know no other CMS that is so easy to use (and is a "real" CMS, not a forum or blogging engine)
you might wanna have a look at Vanilla CMS ... very sexy, still slick and powerful ...
use a CMS based on a good PHP framework ... typo3 (Flow3 (IMHO really the most funky PHP framework)), something based on symfony (can't find anything, but this should be a good start), mambo (CakePHP) or maybe something based on code igniter ... you will always need to get familiar with the framework, but a) this is always good, b) if the framework is good, the app is likely to be good and extensible, c) you yourself will have a high productivity when building extensions since the framework will do a lot for you ...
finally, you might wanna have a look at opensourcecms ... always helpful ...
good luck with your choice then ... ;)
greetz
back2dos

Categories