20 June 2013

A Bit of PHP History

PHP was originally developed by Rasmus Lerdorf in 1995, some 18 years ago. It's acronym stood for a very bold and fitting Personal Home Page. In 1997, PHP 3 was releaseed, followed by a release in 2000 for PHP 4. On July 2004, PHP 5 was launched which added support for extremely desirable features such as PHP Data Objects (PDO), Object-Oriented Programming (OOP) and many performance enhancements.

The PHP 5 train began the current generation of the language. PHP 5.0 replaced the core parser with Zend Engine II. In 2005, PHP 5.1 included major changes to performance and formally added PDO support. The following year, in 2006, PHP added native JSON support in PHP 5.2. Up until this time, there were no major changes to the languages nature. In 2009, PHP 5.3 was launched. Many of the features which have been staged for a PHP 6 release were merged to form PHP 5.3. Up until 2 years ago, PHP 5.3 was not taken seriously by many hosting companies which prevented developer access to many of the new features.

PHP 5.3 included Namespace support, allowing you to re-use function names and classes within your code base. It also added Lambda functions or annonymous functions, closures and the addition/removal of other features. The PHP Group took this major release a step further when they launched PHP 5.4 in 2012.

PHP 5.4 added a native web-server for testing and development, support for Traits, reduced memory footprint and removed some insecure and possibly compromising functions in liue of security. This version of PHP also allowed for alternative syntax for arrays which allows you to write to an array like $array_var = array(); or $array = [];.

On June 20th, 2013, PHP 5.5.0 was tagged in the official PHP GIT repository. This is an amazing step forward towards progress when it comes to stabililty, support and reorganization when it comes to an open-source community project. I would suggest you take a look at the changelog for PHP5.5.0 which illustrates its readiness after release candidate 3 status.

What's New In 5.5.0

There are a few new functions which include:

  1. array_column()
  2. cli_set_process_title()
  3. cli_get_process_title()
  4. boolval()
  5. password_hash()
  6. password_get_info()
  7. password_needs_rehash()
  8. password_verify()

Using generators and functions within foreach

In the example below, make note of the yield keyword. The yield keyword will return values to the foreach function. Now, we no longer need to create a function or an array and pass it to foreach. We can call the function directly within the call to foreach.

<?php
function xrange($start, $limit, $step = 1) {
    for ($i = $start; $i <= $limit; $i += $step) {
        yield $i;
    }
}


echo 'Single digit odd numbers: ';


/* Note that an array is never created or returned,
 * which saves memory. */ 
foreach (xrange(1, 9, 2) as $number) {
    echo "$number ";
}
?>

Finally, finally added to Exception Catching

If you are familiar with Java and C, you know about Exception Handling. Keywords commonly used are throw, which will throw an exception, catch, which will catch a thrown exception, and try which will execute the enclosed block of code which should be evaludated for exceptions.

Previously, PHP 5.4 and 5.3, both support Exceptions, but neither of them had support for the finally keyword. What this keyword allows you to do is to execute code before leaving your try/catch statements.

Example:

<?php
try{
    if(is_null($var)){
        throw new \Exception("Variable \$var is null");
    }
}
catch( \Exception $e ){
    echo $e->getMessage();
}
finally{
    echo "Time to continue execution";
    $var = "Basic default value";
}

Passwords and bcrypt

The fundementals behind bcrypt were implemented into the PHP 5.5.0 source. This allows for the functions prefixed with password_. You can read more about the passwords in the PHP Manual: Password. This change was greatly needed, but once again only works if you can protect your algorithm and salt.

Here is an example from the PHP Manual:

<?php
echo password_hash("rasmuslerdorf", PASSWORD_DEFAULT)."\n";


$options = [
    'cost' => 7,
    'salt' => 'BCryptRequires22Chrcts',
];
echo password_hash("rasmuslerdorf", PASSWORD_BCRYPT, $options)."\n";
?>

The above returns:

$2y$10$.vGA1O9wmRjrwAVXD98HNOgsNpDczlqm3Jq7KnEd1rVAGv3Fykk1a
$2y$07$BCryptRequires22Chrcte/VlQH0piJtjXl.0t1XkA8pw9dMXTpOq

You can then apply a password_verify() on the above responses:

<?php
// See the password_hash() example to see where this came from.
$hash = '$2y$07$BCryptRequires22Chrcte/VlQH0piJtjXl.0t1XkA8pw9dMXTpOq';


if (password_verify('rasmuslerdorf', $hash)) {
    echo 'Password is valid!';
} else {
    echo 'Invalid password.';
}
?>

This returns:

Password is valid!

Take a look at ircmaxell's git for a userland implementation of the above.

Accessing your class name

Previously, when you wanted to reference your classes name, you had to execute get_class() or call the constant __CLASS__. There is a new way to access your classname resolution using ClassName::class. This can be helpful when using Namespaces, but personally I have not found a use for this yet.

Zend Optimizer

We have not had a chance to play with Zend Optimizer too much, but you can read up on it on Zend's GitHub.

In summary

Tagged under php-2, php5, php5-5, php5-5-0, php6, and others
Mike Mackintosh

This post was written by Mike Mackintosh, a decorated security professional.




Related Posts