Apache Handlers - Running HTML as PHP

Apache handlers allow you to control what Apache will do with certain file types. When Apache sees a file, it has an action built in for that file type, and will perform that action.

If you wish Apache to do a different action, you will need to make a handler to tell Apache to perform that action. For example, if you use a file type that requires a special service to run it, such as a file with server side includes that is not named with a .shtml extension, you need to tell Apache to treat these files differently.

To get regular html pages to handle php code, you need to add this line to your htaccess file.

It is highly recommended that you never allow html pages to automatically handle php or shtml, because this forces all of your html pages to be processed by the server first. Instead, please rename your files to .php or .shtml whenever possible.

System Mime Type defaults

Handler Code	File Extensions
application/x-hdf	hdf
application/vnd.wap.wbxml	wbxml
image/x-xbitmap	xbm
image/x-icon	ico
image/vnd.djvu	djvu djv
application/x-troff-me	me
application/perl	pl plx ppl perl pm
application/x-tcl	tcl
image/bmp	bmp
text/x-sql	sql
image/png	png
text/x-log	log
audio/x-realaudio	ra
application/x-latex	latex
application/x-director	dcr dir dxr
text/rtf	rtf
application/xhtml+xml	xhtml xht
application/vnd.ms-powerpoint	ppt
application/x-csh	csh
image/svg+xml	svg
application/x-troff-ms	ms
image/x-rgb	rgb
application/x-img	img
image/jpeg	jpeg jpg jpe
image/x-portable-pixmap	ppm
text/plain	asc txt
image/cgm	cgm
application/x-sh	sh
application/andrew-inset	ez
application/vnd.wap.wmlscriptc	wmlsc
text/x-registry	reg
video/vnd.mpegurl	mxu
image/ief	ief
audio/x-pn-realaudio	ram rm
image/x-xpixmap	xpm
video/mpeg	mpeg mpg mpe
text/tab-separated-values	tsv
application/rdf+xml	rdf
application/x-httpd-php	phtml php php3 php4 php5 php6
x-conference/x-cooltalk	ice
image/tiff	tiff tif
text/richtext	rtx
text/css	css
application/ruby	rb
application/x-wais-source	src
application/xml	xml xsl
application/voicexml+xml	vxml
image/x-portable-graymap	pgm
chemical/x-xyz	xyz
model/iges	igs iges
application/vnd.mif	mif
application/mathml+xml	mathml
application/x-ustar	ustar
application/x-troff-man	man
text/vbscript	vbs
text/calendar	ics ifb
chemical/x-pdb	pdb
application/smil	smi smil
application/srgs+xml	grxml
image/x-portable-anymap	pnm
application/x-shockwave-flash	swf
audio/mpeg	mpga mp2 mp3
video/x-sgi-movie	movie
application/cgi	cgi
application/x-cpio	cpio
application/x-javascript	js
text/x-setext	etx
audio/basic	au snd
text/sgml	sgml sgm
application/x-tar	tgz tar
application/vnd.mozilla.xul+xml	xul
application/x-futuresplash	spl
application/xslt+xml	xslt
model/mesh	msh mesh silo
application/mac-binhex40	hqx
text/vnd.wap.wml	wml
image/x-cmu-raster	ras
application/x-sv4cpio	sv4cpio
audio/x-aiff	aif aiff aifc
application/x-gtar	gtar
audio/x-ms-wax	wax
audio/x-ms-wma	wma
image/x-xwindowdump	xwd
application/x-cdlink	vcd
application/msword	doc
video/quicktime	qt mov
application/x-bcpio	bcpio
application/x-tex	tex
text/x-config	cnf conf
application/x-sv4crc	sv4crc
application/x-dvi	dvi
application/x-troff	t tr roff
audio/x-mpegurl	m3u
application/x-shar	shar
audio/mp4	a-latm m4p m4a mp4
application/pdf	pdf
application/mac-compactpro	cpt
application/vnd.wap.wmlc	wmlc
video/x-msvideo	avi
application/ogg	ogg
text/html	html htm shtml
image/gif	gif
audio/midi	mid midi kar
application/x-pkcs7-crl	crl
application/x-chess-pgn	pgn
audio/x-pn-realaudio-plugin	rpm
application/srgs	gram
application/x-koan	skp skd skt skm
image/vnd.wap.wbmp	wbmp
application/x-netcdf	nc cdf
model/vrml	wrl vrml
application/x-httpd-php-source	phps
application/vnd.ms-excel	xls
application/postscript	ai eps ps
application/x-texinfo	texinfo texi
application/zip	zip
image/x-portable-bitmap	pbm
audio/x-wav	wav
application/x-x509-ca-cert	crt
application/oda	oda
application/xml-dtd	dtd
application/octet-stream	bin dms lha lzh exe class so dll iso dmg
text/vnd.wap.wmlscript	wmls
application/x-stuffit	sit

 

Mysql - sql injection prevention

If you have ever taken raw user input and inserted it into a MySQL database there's a chance that you have left yourself wide open for a security issue known as SQL Injection.

SQL injection refers to the act of someone inserting a MySQL statement to be run on your database without your knowledge. Injection usually occurs when you ask a user for input, like their name, and instead of a name they give you a MySQL statement that you will unknowingly run on your database.

Below is a sample string that has been gathered from a normal user and a bad user trying to use SQL Injection. We asked the users for their login, which will be used to run a SELECT statement to get their information.

MySQL & PHP Code:

// a good user's name

$name = "timmy";

$query = "SELECT * FROM customers WHERE username = '$name'";

echo "Normal: " . $query . "<br />";

// user input that uses SQL Injection

$name_bad = "' OR 1'";

// our MySQL query builder, however, not a very safe one

$query_bad = "SELECT * FROM customers WHERE username = '$name_bad'";

// display what the new query will look like, with injection

echo "Injection: " . $query_bad;

Display:

Normal: SELECT * FROM customers WHERE username = 'timmy'
Injection: SELECT * FROM customers WHERE username = '' OR 1''

The normal query is no problem, as our MySQL statement will just select everything from customers that has a username equal to timmy.

However, the injection attack has actually made our query behave differently than we intended. By using a single quote (') they have ended the string part of our MySQL query

• username = ' '

and then added on to our WHERE statement with an OR clause of 1 (always true).

• username = ' ' OR 1

This OR clause of 1 will always be true and so every single entry in the "customers" table would be selected by this statement!

Sending an email containing HTML from within a PHP page

The mail function in PHP allows you to send a plain text email in a single function call from within your script but please read the cautions at the end of this post before you do so!. How do you send out something in HTML format, though?

The mail function takes an additional (fourth) parameter of extra headers ... and one of the headers that you can use is a content-type: which lets you define the data type that's in the email - for example: text/html. There's an example showing how a message may be sent as both plain text and as HTML [here].

Email protocols are intrinsically line based, and 7 bit ... which means that what you send out needs to have a new line character at least once every 80 characters, and it cannot reliably contain high end (special) characters. In theory, that should not be a problem with HTML, but it could be a nuisance to have to split things down, and it could be more than a nuisance if you were sending out things like .jpg images. The solution here is to use a content-transfer-encoding header, with a base64 encoding - and of course to encode the data stream to suit. Full example [here].

Some Common Email Headers

The lines given here are examples of each of the most common types:

Supplied as parameters to the mail function:

To: Graham Ellis <graham@wellho.net>
Subject: A Demonstration of Email Headers

Supplied (if required) as part of the fourth (extra) parameter

From: Well House Consultants <info@wellho.net>
Reply-To: Lisa Ellis <lisa@wellho.net>
Cc: Gypsy <thedog@wellho.net>, Charlie <thecat@wellho.net>
Bcc: copybox@wellho.net, Audit <audittrail@wellho.net>
Date: Thu, 4 Nov 2010 14:30:27 +0000
Precedence: Bulk
Message-ID: 12345
In-Reply-To: wellho-5454
References: 12332, 11001, wellho-5420
MIME-Version: 1.0

A line like this sets up the document to be multipart if you wish:

Content-Type: multipart-alternative;boundary=00112233445566778899aabbccddeeff

The following can be supplied as part of the header or at the head of each section in a multipart email

Content-Type: text/html
Content-transfer-encoding: base64
Content-disposition: inline; filename="mypage.html"

The cautions at the end of this post

Before you start emailing from your server, consider the following:

a) Does the person your sending to REALLY want the email? (If it's confirming an order, the answer will be a resounding "YES", but if you're writing to tell him of your latest gizmo for sale, he might not be so keen!)

b) You're sending out an automated email from your server ... so it may look rather like other automated emails that people send out in bulk from servers (a.k.a. "spam") to many automated filters. How are you going to make your message special enough to be delivered?

c) Check that you are not providing an open emailing platform - that a user of your site is NOT able to enter a recipient's email address and message and use your server to send out unsolicited advertising material without your knowledge / approval. You really don't want to get yourself blacklisted! 

Filtering PHP form inputs

There's a vital need to validate user inputs in PHP - to make sure that users have put something sensible into the boxes on your forms. And there are multiple ways of doing this:

a) You can check the incoming strings against regular expressions. In the old days you may have used the ereg functions, but these days you would use preg functions - slighly more complex, but more powerful and quicker. And the ereg functions have been deprecated. Using regular expressions, you need to define yourself what a particular string should look like - so you have a great flexibility

b) From PHP 5.2, you can use the filter_var function to filter what's in a variable. It will return FALSE if there's no match, or the value that the variable contains if it does match. For example, "does $sample contain an integer?":

  $result = filter_var($sample, FILTER_VALIDATE_INT);
And (sample program [here]) you get results like:
  Looking at 404
  Integer result - 404
  int(404)
and
  Looking at Graham Ellis
  NOT an Integer
  bool(false)

c) If you're using the Zend Framework, there's a validation element available within each form component / widget and you can use that to check is the form have been validly filled in.

So - which of these should you use? If you're using the MVC (Model View Controller) approach, using the Zend Framework, then it's logical to use the functions that are provided by the framework. For major systems, some sort of framework is an excellent idea - whether you use Zend, one of the others, or routines that you write yourself (your own framework) is up to you. If you use your own, then you'll be coding one of the other two options, once only, within your own framework setup as part of your standard.

filter_var is an excellent tool to use for checking specific types - email addreses, integers, IP addresses and the like; they're coded into PHP's functions so you san save yourself a great deal of work in formulating regular expressions, and you know they'll be updated and maitained with future releases as standards may change, rather than you having to update regular expressions yourself.

Tasting OOP Concepts

If you have not yet entered the realm of Object Oriented Programming, then you are at a disadvantage, and you are falling behind fast.

OOP is essentially a method of programming with the use of classes, or Objects, which tie like things together, remove the need for repetition of code and perform the basic tasks of production very simply. Objects are essentially classes that collect a bunch of functions together and wrap them in a wrapper that can be reused over and over again without the need to rewrite functionality or procedures every time you need to do something.

Procedural Programming works by following a routine from the top to the bottom of each page as the server reads every file on your server. With OOP, there could be one or two objects being instantiated, which, in turn could instantiate a few, a hundred or a thousand other objects which could all perform certain tasks depending on variables passed into the objects. OOP is faster, simpler, easier to debug, uses less server resources, less code, is faster loading and more logical to work with once you figure out the basic principles. Go OOP - It changed my development style forever.