Opinions, Expertise, Passion.

MySQL Conference 2007 Day 4 started early again at 8:20 am with PHP on Hormones by the father of PHP Ramus Lerdorf.

A very funny man, one of the best insightful talks of the conference (rather scary actually). Here are some opening comments.

• In his own words as Keynote speaker. “I’m here because I’m old”.
• Php 1 from 1994 started after seeing Mozilla in 1993. Because it was just me using it, I could change the language any time.
• In 2005 the code looks like this (in comparison on 1995) — I’m not sure if this is worth 10 years of development
• I wrote PHP to avoid programming
• It’s changed to be more OO because people expect that. Universities teach this.
• Hey, I was fixing bugs in my sleep. Iwould wake up, and in my mail box there would be bug fixes to bugs I didn’t even know I had.

Why do people contribute?

• Self-interest
• self expression
• hormones
• Improve the world

The slide included a great Chemical equation of “The Neuropeptide oxytocin” — Nature’s trust hormone

People need to attract other people, it makes you feel good, it comes out when you interact with people.

It’s not what people think about you, but rather what they think about themselves.

• PHP was my baby, giving up control, just because I started it, doesn’t mean I have a bigger say in it.
• Systems that harness network effects and get better the more people use them in a way that caters to their own self-interest. — Web 2.0
• Once you build a framework your done, the users build the site, they drive the content.
• The same people that work on open source projects, are the same people that use websites.
  • Self-interest
  • self expression
  • hormones
  • Improve the world

1. Performance
It your sites falls apart your done.

• Benchmark
  • http_load
  • Callgrind inside valgrind
  • XDebug

valgrind –tool=callgrind

• Excellent tool to see where time is spent in the code. You have to run a profiler.
• Example of using Drupal. It turns out 50% of time was spent in the them, it had 47 SQL queries, 46 Selects.
• Went from 4 per second to 80 per second, without any code changes. Some performance options, and some caching.
• Guaranteed you can double the speed of your website by using a profiler.

2. Security
Critical problem areas.

• 404 pages
• Search page
• PHP_SELF
• $_GET, $_POST, $_COOKIE
• $_SERVER
• Lots of stupidity in IE (e.g. Always send a charset)

The web is broken you can all go home now.

People are venerable because people run older versions of browsers, and their data is not secure, and you can’t secure their data.

What can happen??
9 out of 10 of you have cross-site scripting hole on your site

Remote Greasemonkey
Profile Hacks
JS Trojans

Added a PHP logo to the MySQL User Website, it’s really the PHP website
IBM webpage, on article about security.

Tool to find holes, banks, insurance companies, CIA, even Yahoo where I work.

You know if they have been to bankofamerica.com, you can tell if they are a customer, you can tell if they are logged, you can then see their cookie credentials.

You don’t know if any sites have these problems.

JS trojan, iframe that captures
reconfigures your wireless router, moves it outside your DMZ, then uses traditional techniques to attack your machine (that you thought was secure inside a firewall)

You should never ever click on a link. It sort of defeats the purpose of the web.

Never use the same browser instance to do personal stuff and browsing.

So what are we doing about this?
There isn’t much we (PHP) can do to secure sites developed.
Built a filter extension in 5.2, back in 5.1.

http://php.net/filter *** YOU MUST IMPLEMENT THIS
filter.default=special_chars

3. APIs are Cool!

Two lines to grap the Atom feed from flickr of photos just uploaded.
That’s all I have to add to my code.

The really make you want to use the servers. It’s so easy.

API drives passion, drive people to use your site.
You can add a lot of cool things to your sites.

What to do

• Avoid Participation Gimmicks
• Get their Oxytocin flowing
• Solve One Problem
• Clean and Intuitive UI
• API’s
• Make it work

A full copy of the slides can be found at http://talks.php.net/show/mysql07key