Admittedly, I stole this question from somewhere else (can't remember where I read it any more) but thought it was funny:
Q: What is T_PAAMAYIM_NEKUDOTAYIM?
A: Its the scope resolution operator (double colon)
An experienced PHP'er immediately knows what it means. Less experienced (and not Hebrew) developers may want to read this.
But more serious questions now:
Q: What is the cause of this warning: 'Warning: Cannot modify header information - headers already sent', and what is a good practice to prevent it?
A: *Cause:* body data was sent, causing headers to be sent too.
Prevention: Be sure to execute header specific code first before you output any body data. Be sure you haven't accidentally sent out whitespace or any other characters.
Q: What is wrong with this query: "SELECT * FROM table WHERE id = $_POST[ 'id' ]"?
A: 1. It is vulnarable to SQL injection. Never use user input directly in queries. Sanitize it first. Preferebly use prepared statements (PDO)
2. Don't select all columns (*), but specify every single column. This is predominantly ment to prevent queries hogging up memory when for instance a BLOB column is added at some point in the future.
Q: What is wrong with this if statement: if( !strpos( $haystack, $needle ) ...?
A: strpos returns the index position of where it first found the $needle, which could be 0. Since 0 also resolves to false the solution is to use strict comparison: if( false !== strpos( $haystack, $needle )...
Q: What is the preferred way to write this if statement, and why?
if( 5 == $someVar ) or if( $someVar == 5 )
A: The former, as it prevents accidental assignment of 5 to $someVar when you forget to use 2 equalsigns ($someVar = 5), and will cause an error, the latter won't.
Q: Given this code:
function doSomething( &$arg )
{
$return = $arg;
$arg += 1;
return $return;
}
$a = 3;
$b = doSomething( $a );
...what is the value of $a and $b after the function call and why?
A: $a is 4 and $b is 3. The former because $arg is passed by reference, the latter because the return value of the function is a copy of (not a reference to) the initial value of the argument.
OOP specific
Q: What is the difference between public, protected and private in a class definition?
A: public makes a class member available to "everyone", protected makes the class member available to only itself and derived classes, private makes the class member only available to the class itself.
Q: What is wrong with this code:
class SomeClass
{
protected $_someMember;
public function __construct()
{
$this->_someMember = 1;
}
public static function getSomethingStatic()
{
return $this->_someMember * 5; // here's the catch
}
}
A: Static methods don't have access to $this, because static methods can be executed without instantiating a class.
Q: What is the difference between an interface and an abstract class?
A: An interface defines a contract between an implementing class is and an object that calls the interface. An abstract class pre-defines certain behaviour for classes that will extend it. To a certain degree this can also be considered a contract, since it garantuees certain methods to exist.
Q: What is wrong with classes that predominantly define getters and setters, that map straight to it's internal members, without actually having methods that execute behaviour?
A: This might be a code smell since the object acts as an ennobled array, without much other use.
Q: Why is PHP's implementation of the use of interfaces sub-optimal?
A: PHP doesn't allow you to define the expected return type of the method's, which essentially renders interfaces pretty useless.
Definitively security questions !
(simple answers in this post, of course securing php web applications is far more complex)
how to deal with SQL injection ?
mysql_real_escape_string() for a start with MySQL. Then try to learn PDO to take advantage of prepared statements and portability across database vendors.
how to deal with CSRF (Cross-Site Request Forgery) ?
Add a token on every important request to secure important operations (user must have seen the form before sending the crucial request).?
how to deal XSS (Cross-Site Scripting) reflected and stored ?
htmlentities() is good for a start.
variant of XXX injections: LDAP injection, XPath injection, etc... ?
You need to know what is the "vocabulary" used by the XXX and then deduct what you need to sanitize and/or "check-and-reject".
what is the list of sensible functions ?
Functions which interpret PHP code (possibly included in a remote file) or which execute command on your system. A short and incomplete list could be: exec(), passthru(), system(), popen(), eval(), preg_replace()...
how to deal with file inclusion dangers ?
what is a path transversal ?
what are the risks associated with file upload ?
Need careful check of the parameters used when opening file or remote resources.
how to enforce the configuration of your PHP configuration (i.e. do you know what is the use of php.ini) ?
It is going to be long so I skip the answer, please read the PHP manual.
about filtering user data: what is the difference between sanitizing and check-and-refuse ?
The first one transforms the entry in something less hostile. The second one check if the entry is correct and, if not refuse it.
Source: stackoverflow.com
Q: What is T_PAAMAYIM_NEKUDOTAYIM?
A: Its the scope resolution operator (double colon)
An experienced PHP'er immediately knows what it means. Less experienced (and not Hebrew) developers may want to read this.
But more serious questions now:
Q: What is the cause of this warning: 'Warning: Cannot modify header information - headers already sent', and what is a good practice to prevent it?
A: *Cause:* body data was sent, causing headers to be sent too.
Prevention: Be sure to execute header specific code first before you output any body data. Be sure you haven't accidentally sent out whitespace or any other characters.
Q: What is wrong with this query: "SELECT * FROM table WHERE id = $_POST[ 'id' ]"?
A: 1. It is vulnarable to SQL injection. Never use user input directly in queries. Sanitize it first. Preferebly use prepared statements (PDO)
2. Don't select all columns (*), but specify every single column. This is predominantly ment to prevent queries hogging up memory when for instance a BLOB column is added at some point in the future.
Q: What is wrong with this if statement: if( !strpos( $haystack, $needle ) ...?
A: strpos returns the index position of where it first found the $needle, which could be 0. Since 0 also resolves to false the solution is to use strict comparison: if( false !== strpos( $haystack, $needle )...
Q: What is the preferred way to write this if statement, and why?
if( 5 == $someVar ) or if( $someVar == 5 )
A: The former, as it prevents accidental assignment of 5 to $someVar when you forget to use 2 equalsigns ($someVar = 5), and will cause an error, the latter won't.
Q: Given this code:
function doSomething( &$arg )
{
$return = $arg;
$arg += 1;
return $return;
}
$a = 3;
$b = doSomething( $a );
...what is the value of $a and $b after the function call and why?
A: $a is 4 and $b is 3. The former because $arg is passed by reference, the latter because the return value of the function is a copy of (not a reference to) the initial value of the argument.
OOP specific
Q: What is the difference between public, protected and private in a class definition?
A: public makes a class member available to "everyone", protected makes the class member available to only itself and derived classes, private makes the class member only available to the class itself.
Q: What is wrong with this code:
class SomeClass
{
protected $_someMember;
public function __construct()
{
$this->_someMember = 1;
}
public static function getSomethingStatic()
{
return $this->_someMember * 5; // here's the catch
}
}
A: Static methods don't have access to $this, because static methods can be executed without instantiating a class.
Q: What is the difference between an interface and an abstract class?
A: An interface defines a contract between an implementing class is and an object that calls the interface. An abstract class pre-defines certain behaviour for classes that will extend it. To a certain degree this can also be considered a contract, since it garantuees certain methods to exist.
Q: What is wrong with classes that predominantly define getters and setters, that map straight to it's internal members, without actually having methods that execute behaviour?
A: This might be a code smell since the object acts as an ennobled array, without much other use.
Q: Why is PHP's implementation of the use of interfaces sub-optimal?
A: PHP doesn't allow you to define the expected return type of the method's, which essentially renders interfaces pretty useless.
Definitively security questions !
(simple answers in this post, of course securing php web applications is far more complex)
how to deal with SQL injection ?
mysql_real_escape_string() for a start with MySQL. Then try to learn PDO to take advantage of prepared statements and portability across database vendors.
how to deal with CSRF (Cross-Site Request Forgery) ?
Add a token on every important request to secure important operations (user must have seen the form before sending the crucial request).?
how to deal XSS (Cross-Site Scripting) reflected and stored ?
htmlentities() is good for a start.
variant of XXX injections: LDAP injection, XPath injection, etc... ?
You need to know what is the "vocabulary" used by the XXX and then deduct what you need to sanitize and/or "check-and-reject".
what is the list of sensible functions ?
Functions which interpret PHP code (possibly included in a remote file) or which execute command on your system. A short and incomplete list could be: exec(), passthru(), system(), popen(), eval(), preg_replace()...
how to deal with file inclusion dangers ?
what is a path transversal ?
what are the risks associated with file upload ?
Need careful check of the parameters used when opening file or remote resources.
how to enforce the configuration of your PHP configuration (i.e. do you know what is the use of php.ini) ?
It is going to be long so I skip the answer, please read the PHP manual.
about filtering user data: what is the difference between sanitizing and check-and-refuse ?
The first one transforms the entry in something less hostile. The second one check if the entry is correct and, if not refuse it.
Source: stackoverflow.com
No comments:
Post a Comment