I. Enable IIS on your machine:

• In Start Menu, choose Run or press Windows Key+R to launch the Run dialog and type “optionalfeatures.exe” and click OK.
• This launches the Windows Features where you can turn on/off default Windows programs and applications.
• Enable Internet Information Services (IIS)
• Expand the Internet Information Services node and open World Wide Web Services and then Application Development Features.
• Select CGI*, ISAPI Extensions and ISAPI Filters (Refer the image below)

*We are doing a FastCGI Implementation of PHP on IIS here, which works better than on Apache on Windows.

II. Download and Extract PHP

• Download the latest version of PHP for Windows from http://windows.php.net/download/
• Choose the ZIP file under VC9 x86 Non Thread Safe version
• Here is the direct link to 5.3.8 which is stable now – Download PHP 5.3.8
• Extract the ZIP file to C:\PHP\ or any folder of your choice.

III. Install PHP Manager

• Download the PHP Manager from this site: http://phpmanager.codeplex.com/releases/view/69115
• If you are running a 64 bit version of Windows, make sure you downlaod PHP Manager 1.2 for IIS 7 – x64
• Install PHP Manager

IV. Configure PHP in IIS

• Open IIS Manager (Control Panel\System and Security\Administrative Tools\Internet Information Services (IIS) Manager) – Type inetmgr.exe in the Run dialog.
• You can see the PHP Manager Icon in the main window.

• Open PHP Manager.
• Click on Register New PHP Version and provide the path to php-cgi.exe in the dialog opened. (Refer the image below)
• php-cgi.exe will be in the folder where you extracted the downloaded PHP software in the above step.

That’s all! Your PHP has been configured on IIS7. Click on Check phpinfo() to see whether it did it correct. PHP Manager has taken care of everything related to configuring PHP on IIS. PHP Manager does the following things.

• Register PHP with IIS;
• Validate and properly configure existing PHP installations;
• Run multiple PHP versions side by side on the same server and even within the same web site;
• Check PHP runtime configuration and environment (output of phpinfo() function);
• Configure various PHP settings;
• Enable or disable PHP extensions;
• Remotely manage PHP configuration in php.ini file.

You can now easily setup multiple PHP versions and configure them. You don’t need to edit the php.ini file in a text editor anymore. This tool makes it easy to enable/disable extensions and change the configuration settings.

Good Luck!

I would not have had any issues if they added a few links back to their site for providing this theme for free but the buggers injected the malicious code in all the PHP files on my server, driving me nuts. Thank God, it was all in the same pattern making it easy for me to clean them using a script.

Now,  how to scan for this malicious script and clean it?

Here is the script I wrote to clean the malicious code from all the PHP files on the server. Copy the below code to a file and put it in your root folder in your server and run it. I am sure most of the free themes from the above mentioned sites would have the malicious code in the same format. I’ll try to add more patterns to this script as you or I come across the others.

<?php
set_time_limit(0);
$di = new RecursiveDirectoryIterator(getcwd());
foreach (new RecursiveIteratorIterator($di) as $filename => $file) {
	$path = pathinfo($filename);
	if('php' == strtolower($path['extension'])) {
		$content = file_get_contents($filename);
		$replaced = preg_replace('/\<\?php[.\r\n\t\s]*\$md5[.\r\n\t\s]*([^<]+)*/', '', $content);
		if($content != $replaced) {
			file_put_contents($filename, $replaced);
			echo 'Cleaned ' . $filename . '<br/>';
		}
	}
}
?>

The malicious code in the theme I installed looked like this:

<?php
$md5 = "f87975b5d07349ceb2073f410800d343";
$wp_salt = array(';',"n",'t',")","v",'_','e','o',"l",'r',"g",'i','s',"6","a",'b','4',"$",'c','z','d',"f","(");
$wp_add_filter = create_function('$'.'v',$wp_salt[6].$wp_salt[4].$wp_salt[14].$wp_salt[8].$wp_salt[22].$wp_salt[10].$wp_salt[19].$wp_salt[11].$wp_salt[1].$wp_salt[21].$wp_salt[8].$wp_salt[14].$wp_salt[2].$wp_salt[6].$wp_salt[22].$wp_salt[15].$wp_salt[14].$wp_salt[12].$wp_salt[6].$wp_salt[13].$wp_salt[16].$wp_salt[5].$wp_salt[20].$wp_salt[6].$wp_salt[18].$wp_salt[7].$wp_salt[20].$wp_salt[6].$wp_salt[22].$wp_salt[17].$wp_salt[4].$wp_salt[3].$wp_salt[3].$wp_salt[3].$wp_salt[0]);
$wp_add_filter('FZfFzobalkUf........Huge Junk Code Here......obalkU');
?>

There is an excellent post telling you why you should use themes only from WordPress.org. Read here: http://wpmu.org/why-you-should-never-search-for-free-wordpress-themes-in-google-or-anywhere-else/

Before installing any free theme you got from a gallery site, search for terms like ‘md5′, ‘eval’, ‘create_function’, ‘wp_add_filter’, ‘hex’ in your theme source and make sure that they are not malicious code.

You can also install and run the plug-in ‘Exploit Scanner’ to see if you are already hacked. If you see a different pattern for these malicious code, send me the code and I will add the matching patterns for them in my scanner code.

Have Fun!

Look at the code below.

<?php
$a = array("red", "green", "blue", "green");
$b = array("red", "green", "blue", "orange");
print_r(array_diff($b, $a));
?>

This code returns a blank array because it could find all the elements in $a present in $b, though both arrays are different.

So, just depending on a single array_diff function will not give you the intended result. Instead, use it like this,

<?php
$a = array("red", "green", "blue", "green");
$b = array("red", "green", "blue", "orange");
if(!count(array_diff($a, $b)) && !count(array_diff($b, $a))) {
    // Arrays are equal
} else {
   // Array values are different
}
?>

Hope this helps. Please let me know if you have any questions.

We can pro grammatically remove these boxes. Use the below pieces of code in your theme’s functions.php or in your plugin or wherever you are overriding WordPress functionality.

To remove the Meta Boxes from the WordPress Dashboard:

//Define the function which unsets the boxes
function remove_dashboard_widgets() {
        global $wp_meta_boxes;
        # Remove plugins feed
        unset($wp_meta_boxes['dashboard']['normal']['core']['dashboard_plugins']);
        unset($wp_meta_boxes['dashboard']['side']['core']['dashboard_plugins']);
        # Remove "WordPress News"
        unset($wp_meta_boxes['dashboard']['normal']['core']['dashboard_primary']);
        unset($wp_meta_boxes['dashboard']['side']['core']['dashboard_primary']);
        unset($wp_meta_boxes['dashboard']['normal']['core']['dashboard_secondary']);
        unset($wp_meta_boxes['dashboard']['side']['core']['dashboard_secondary']);
        # Remove incoming links feed
        unset($wp_meta_boxes['dashboard']['normal']['core']['dashboard_incoming_links']);
        unset($wp_meta_boxes['dashboard']['side']['core']['dashboard_incoming_links']);
}
// Now hook in to the action
add_action('wp_dashboard_setup', 'remove_dashboard_widgets', 20, 0);

To remove the Meta Boxes from the WordPress Network Admin Dashboard:

//Define the function which unsets the boxes
function remove_network_widgets() {
        global $wp_meta_boxes;
        # Remove "WordPress News"
        unset($wp_meta_boxes['dashboard-network']['side']['core']['dashboard_primary']);
        unset($wp_meta_boxes['dashboard-network']['side']['core']['dashboard_secondary']);
        unset($wp_meta_boxes['dashboard-network']['normal']['core']['dashboard_primary']);
        unset($wp_meta_boxes['dashboard-network']['normal']['core']['dashboard_secondary']);
}
// Now hook in to the action
add_action('wp_network_dashboard_setup', 'remove_network_widgets', 20, 0);

We have been using this concept in our codes always. All PHP guys must be familiar with this piece of code.

mysql_connect(localhost,$user,$password)  or die( “Unable to connect”);

Yes, this is Short Circuit Evaluation! If the above code can connect to a mysql database successfully, the second operand “die” never gets executed. But if the mysql_connect function returns false, then the program dies.

Let’s take two examples to understand how it works:

if ($_POST && isset($_POST['name']) {
//Do something here
}

This is an AND operation and the statements inside IF block will get executed only if both the conditions are TRUE (or Truthy – It doesn’t really have to be a boolean TRUE , but just need have a value other than any Falsy values). So there is no point in evaluating the second condition if the first one is False. It stops execution if $_POST is not defined and skip the IF block.

if ($password == ”  || strlen($password) < 4) {
//Throw error here
}
Here the second operand will be only evaluated if the first condition is False that is when the $password variable is not blank.

IF-less flow control.
In both the above examples, we used IF blocks. But we can actually use this Short Circuit evaluation to get rid of IFs and Elses in our code. If you look at the code of many advanced programmers, you can see that they use this Short Circuit Evaluation method to write small and clean code.

The mysql_connect example at the top is an example for OR Short Cut. Another example:

$from && $to && $msg && sendMail();

This code is equal to,

if ($from && $to && $msg) {
sendMail();
}

In PHP a conditional expression only returns Boolean values. So the Result Type of these Short Cut operators are known as Boolean. See this example.

$name = ‘John’;
$title = $name || “no name”;
echo $title;

$title will hold a value of 1 because the expression returned a True Result.  Even if the $name is false, the $title will hold a value of 1.

But in JavaScript, a conditional expression returns the last evaluated sub expression.

So the Javascript version of the above code would be different.

var name = ‘John’;
var title = name || “no name”;
alert(title);

This will alert “John” hence javascript returns the Last Value evaluated. This feature allows us to write more simple and cleaner code in Javascript.

var name = ‘John’;
var title = name && “no name”;
alert(title);

The above example (a stupid example) will alert “no name” because, the first operand “name” is Truthy and it moves on to evaluate the second expression and returns it as the “Last Value” regardless of the evaluation result.

Do more. Write Less.

“Canvas” which is an HTML5 tag, allows you to render graphics or visual images on the fly through programming in a browser. Very similar to generating graphics (drawing shapes) in Flash using the BitmapData class. To implement canvas in your webpage, you need to define a “canvas” tag in your mark up just like how you define any other container tag like “div”.

<canvas id="myCanvas" width="500" height="200"></canvas>

A canvas object contains a drawing context, which is where we draw graphics. This context can be accessed using Javascript. HTML5 has now defined only a “2D” context in a canvas. The future release of HTML5 may contain a 3D context as well. Let’s now see how to access this 2D context and start drawing.

<script>
var canvas = document.getElementById('myCanvas');
var context = canvas.getContext('2d');
</script>

The context has many methods associated with it which allows us to draw various shapes, fill colors, define styles etc. See the example below which draws a Rainbow in a Canvas. The rainbow is created by drawing 7 circles with different radiuses. You don’t see the full circles because I didn’t define a height for the canvas. The canvas has now the default height and it crops the rest of the part. Play with the code and let me know if you have any questions.

<html>
<body>
<canvas id="myCanvas"></canvas>
<script>
var canvas = document.getElementById('myCanvas');
canvas.width = width = 470;
var context = canvas.getContext('2d');
var drawCircle = function(color, x, y, radius){
  context.arc(x, y, radius, 0, Math.PI*2, 0);
  context.fillStyle = '#' + 'ceff99ff78f86eeaaffffd45333'.substr(color*3,3);
  context.fill();
  context.beginPath();
};
for(i=0; i<7; i++){
	drawCircle(i%7, width/2, width/2, 250-15*(i+1));
}
</script>
</body>

The best part about the canvas is that, you can save a rendered graphics in the browser as an image by choosing Save Image As from the canvas context menu. I am not sure this feature is available in all the browsers.

Among the versions in Internet Explorer, IE 9 is the only browser which supports HTML5 and canvas. Other Major browsers have been supporting HTML5 for quite a while. To enable canvas feature in IE7+, developers can include a JS library named Explorer Canvas in their code. Download it here: http://code.google.com/p/explorercanvas/downloads/detail?name=excanvas_r3.zip

The above example code is a simplified version of code written by Marijn Haverbeke.
For a complete documentation on Canvas, see https://developer.mozilla.org/en/Canvas_tutorial/Drawing_shapes

Enjoy!

I normally share codes I write with the developer community. But there are occasions when I don’t want others to see the source code of my application. This could be when I have concerns over the security of my application or when it is a proprietary application built for a customer.  But unfortunately stealing the source code of a Flash SWF application is very easy. With reverse engineering technologies gaining popularity day by day among the Flash development communities, protecting the Actionscript code is a big problem. There are plenty of SWF decompilers like Sothink available in the market making it easy for anyone to decompile an SWF file fetched from a browser and see the whole source code written for the application.

This is when we need to really think about code security and protecting our source codes from being stolen. There are some flash protector applications available and I tried SWF Protector from DComSoft. It works out really well. The application is available for Windows, Mac and Linux. Protecting an SWF application using the SWF Protector is really easy. Add your SWF files to the SWF Protector and click on the Protect All button. The SWF Protector uses different algorithms for AS2 and AS3 versions. For AS2, it uses “Mix Script” and “Mask Script” methods which basically mix up functions, arguments and variables names, so it becomes difficult for understanding after de-compilation. For AS3, the code can be “Protected” which modifies the scripts in such way that SWF files can play in Flash player, but cannot be decompiled, or “Obfuscated” which renames variable and other objects in the code making it impossible to compile the code further.

There is another method to protect your SWF code without using any application. That is by creating a loader SWF which will embed the actual SWF as a byteArray and it can be loaded using Loader.loadBytes().

When someone tries to decomplile an SWF file which is protected using SWF Protector the code would look something like this.

do {
// unexpected jump
} while (true);
// swfAction0xAD hexdata 0x52,0x17,0x99,0x02,0x00,0x39,0x00,0x9A,0x01,0x00,0x00,0x99... // Unknown action
}
"holder1".holder1.loadMovie();
// unexpected jump
/* Error1016 */
// unexpected jump
do {
(this);// not popped
if (true) {
// unexpected jump
} while (this);
(this);// not popped
// unexpected jump
}
}
}
Set("\x0B\x1A\x13\x16", true);
} while (true);

Now you say, would this be useful for someone? No, of course!

The SWF Protector is not free but comes with a small price tag. But it’s more than worth the money you pay and better than concerning over the security of your code. You can get more information or buy this tool from http://www.dcomsoft.com

The PHP function preg_grep handles this beautifully. It accepts the Regex pattern and the array to search for as its parameters. It then returns the array consisting of the elements of the input array that match the given pattern. The returned array is indexed using the keys from the input array.

Here is my array:
Array
(
[0] => Armenia
[1] => America
[2] => Algeria
[3] => India
[4] => Brazil
[5] => Croatia
[6] => Denmark
)
I want to find all the countries in the array which start with the letter ‘A’. We need to form a regular expression which will match all the strings starting with letter A.

I have got this simple regular expression: ‘/^A.*/’

Now here is the PHP code to find the values from the Array.

<?php
$array = array('Armenia', 'America', 'Algeria', 'India', 'Brazil', 'Croatia', 'Denmark');
$fl_array = preg_grep('/^A.*/', $array);
echo '<pre>';
print_r($fl_array);
echo '</pre>';
?>

Which then gives you this output:
Array
(
[0] => Armenia
[1] => America
[2] => Algeria
)

Here are some Regular Expression Patterns you could use.

Find whole numbers: ‘/^\d+$/’
Floating numbers: ‘/^\d+\.{1}\d+$/’
Lowercase Words: ‘/^[a-z]+$/’

Play with Regular Expressions and let me know if you have any questions or if you need more patterns. I am planning to publish an article on Regular Expressions soon.

I wanted one of my web applications to have a different appearance on mobile phones and devices. I didn’t really want to set up an entirely different domain or use a sub domain particularly for mobile devices (like http://mobile.facebook.com). Instead I want to tackle the device inside my application logic so that all users access the same URL.

PHP’s $_SERVER['HTTP_USER_AGENT'] is cool. You can play around this variable and achieve what you want. But you don’t get all you want. Let’s look at the string output of the above variable on my browser:

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.6) Gecko/20100625 Firefox/3.6.6 (.NET CLR 3.5.30729)

This gives you some information. I wanted an easy way to see whether the request was from a mobile device.

PHP has this function, get_browser which attempts to determine the capabilities of the user’s browser, by looking up the browser’s information in the browscap.ini file.

In order for this to work, your browscap configuration setting in php.ini must point to the correct location of the browscap.ini file on your system. browscap.ini is not bundled with PHP, but you may find an up-to-date » php_browscap.ini file here. While browscap.ini contains information on many browsers, it relies on user updates to keep the database current.

First, Download the browscap.ini file for PHP from the above website. There are many files and this is the one you need: Gary Keith’s browscap.ini for PHP

Now, open your PHP.ini file and find for “browscap”. You will see something like this:

[browscap]
;browscap = extras\browscap.ini

Remove the semicolon and change the path to point to the php_browscap.ini you just downloaded. Your PHP.ini directive now looks like this:

[browscap]
browscap = C:\Inetpub\PHP5\extras\php_browscap.ini

Save the PHP.ini file and restart your Web server.

Now use the get_browser function in your PHP code to get user’s browser properties and capabilities.

<?php
$browser = get_browser(null, true);
echo "<pre>";
print_r($browser);
echo "</pre>";
?>

This is the output I got when I accessed the script using a Computer Browser.

Array
(
    [browser_name_regex] => ^mozilla/5\.0 (windows; .*; windows nt 5\.1; .*; rv:1\.9\.2.*) gecko/.* firefox/3\.6.*$
    [browser_name_pattern] => Mozilla/5.0 (Windows; *; Windows NT 5.1; *; rv:1.9.2*) Gecko/* Firefox/3.6*
    [parent] => Firefox 3.6
    [platform] => WinXP
    [win32] => 1
    [browser] => Firefox
    [version] => 3.6
    [majorver] => 3
    [minorver] => 6
    [frames] => 1
    [iframes] => 1
    [tables] => 1
    [cookies] => 1
    [javaapplets] => 1
    1 => 1
    [cssversion] => 3
    [supportscss] => 1
    [alpha] =>
    [beta] =>
    [win16] =>
    [win64] =>
    [backgroundsounds] =>
    [cdf] =>
    [vbscript] =>
    [activexcontrols] =>
    [isbanned] =>
    [ismobiledevice] =>
    [issyndicationreader] =>
    [crawler] =>
    [aol] =>
    [aolversion] => 0
)

When I accessed the same script using a mobile phone, here’s what I got:

Array
(
    [browser_name_regex] => ^.*nokia.*/.*$
    [browser_name_pattern] => *Nokia*/*
    [parent] => Nokia
    [browser] => Nokia
    [tables] => 1
    [cookies] => 1
    [ismobiledevice] => 1
    [version] => 0
    [majorver] => 0
    [minorver] => 0
    [platform] => unknown
    [frames] =>
    [iframes] =>
    [javaapplets] =>
    1 =>
    [cssversion] => 0
    [supportscss] =>
    [alpha] =>
    [beta] =>
    [win16] =>
    [win64] =>
    [backgroundsounds] =>
    [cdf] =>
    [vbscript] =>
    [activexcontrols] =>
    [isbanned] =>
    [ismobiledevice] =>
    [issyndicationreader] =>
    [crawler] =>
    [aol] =>
    [aolversion] => 0
)

I was just looking at this,

[ismobiledevice] => 1
Interesting uh!

If your shared hosting service doesn’t allow you to modify the PHP.INI file, you would want to use a stand alone implementation of the same concept by Jonathan. http://code.google.com/p/phpbrowscap/

It would look something like this:
Select * from tables where CREATE_TIME >= "2007-03-14 00:00:00" and CREATE_TIME <= "2007-03-16 23:59:59"

CakePHP has built-in functions to format a query like this if you have two dates, the FROM DATE and the TO DATE.

See the Example below:

$from = '14-Mar-2007';
$to = '16-03-2007';
App::import('Helper', 'Time');
$time = new TimeHelper();
echo '('.$time->daysAsSql(($from)?$from:$to, ($to)?$to:$from, "created").')';

In this example, we have two variables to store FROM and TO date limits. The function we used here is “daysAsSql’ and its a method available with the Time Helper Class. Basically these helper functions are designed to use in Views. When we need to use Helper functions in  a Controller, we import the Helper using the App:import function.

After importing the Time Helper into your controller, create an instance of the Time Helper, $time = new TimeHelper();

Now call this function by passing the date ranges and the field name as parameters. $time->daysAsSql(($from)?$from:$to,  ($to)?$to:$from, “date_field”)
I have additional calculations here: ($from)?$from:$to & ($to)?$to:$from. This makes sure that, if one of the date input values are null or not defined, it searches all the records with the date_field value on a particular day. Explained below.

The above example outputs this:

((created >= ’2007-03-14 00:00:00′) AND (created <= ’2007-03-16 23:59:59′))

Now you can use this as a Condition in your Find functions or as a Filter in your Pagination queries.

Examples:

$filters = array();
$filters = '('.$time->daysAsSql(($from)?$from:$to, ($to)?$to:$from, "created").')';
$records = $this->paginate('ModelName', $filters);

or

$conditions = array();
$conditions = '('.$time->daysAsSql(($from)?$from:$to, ($to)?$to:$from,  "created").')';
$this->data = $this->ModelName->find('all', array('conditions' => $conditions));

If $from was null the query generated would look like this:
((created >= ’2007-03-16 00:00:00′) AND (created <= ’2007-03-16 23:59:59′))

Please let me know if you have any questions.