What is an event system?

An event system is a way to call prefined functions at a specified time in your application code. It’s main use is to allow developers to add functionality to your code without modifying the original source. Directly editing the source code of an application is proven not to work because every time the software gets updated, the changes made to the source get overwritten. By offering an event system in your application developers will be able to write plugin style code which will get executed at a specified time in the main application code. This makes your platform easier to develop for and offers a low entry level for coders wanting to add functionality themselves.

Overview of the system

event::$events is a static variable (array) which holds all of the registered events and associated Closure objects.

event::register(‘eventName’, function($args){}) accepts two arguments. The first being the name of the event and the second being a Closure object which will be called when the event is fired. You can see we use type hinting for the second argument to only accept a Closure object, this way we don’t need to write extra code in the function to check whether the method is callable.

    public static function register($event, Closure $func)
    {
        self::$events[$event][] = $func;
    }

event::fire(‘eventName’, $args) also accepts two arguments. The first is the event name and the second is an array of arguments that will be passed to the Closure function when it is called. Because we can register multiple methods to one event, we need to iterate over the array of events and then call the function with passed arguments.

    public static function fire($event, $args = array())
    {
        if(isset(self::$events[$event]))
        {
            foreach(self::$events[$event] as $func)
            {
                call_user_func($func, $args);
            }
        }

    }

Usage

Suppose we were writing a blogging platform and we wanted to make it easy for developers to call functions when a new blog post was created or deleted. In the appropriate location we would call the fire event::method(). In this case we are passing $postInfo , an array of post data, as an argument

event::fire('blog.post.create', $postInfo);

If we wanted to send an email to someone every time a post is published we only need to register an event and include the code.

event::register('blog.post.create', function($args = array()){

    mail('myself@me.com', 'Blog Post Published', $args['name'] . ' has been published');

});

Alternatively, if the event system were put to use in a framework, there could be events for various times during the framework’s loading process (eg. before routing, before calling the controller function, before accessing the database). We would call the fire function at these times.

event::fire('pre.controller');

event::register('pre.controller', function($args = array()){

	log::write('pre controller');

	//include some relevant files
});

Full source

class event
{

    public static $events = array();

    public static function fire($event, $args = array())
    {
        if(isset(self::$events[$event]))
        {
            foreach(self::$events[$event] as $func)
            {
                call_user_func($func, $args);
            }
        }

    }

    public static function register($event, Closure $func)
    {
        self::$events[$event][] = $func;
    }

}

If you have any questions or comments about the event class please ask below in the comments.

Hypothetical Situation: You had just done some online banking and had ticked the ‘Remember me’ option when you logged in. The banking website easily allows you to transfer money to other people. While browsing the malicious site you see a link that seems to take you somewhere harmless but it actually sends you to www.my.bank/transfer?to=3740384342?amount=99999 . Because you ticked ‘remember me’ you are automatically logged in and the bank goes ahead and transfers the funds.

There are some obvious fundamental issues the bank could address such as checking with the user whether they want to send the funds and masking their URLs but the problem of the form still remains. Theres nothing from stopping anyone sending seemingly valid data to the URL the form submits to. This problem is known as Cross Site Request Forgery (CSRF) and it is a potential problem in every single dynamic website. While stealing money is an extreme example, CSRF could also be used to steal cookies from a website or post spammy comments on a blog without the user being aware that they are doing so.

Actions on websites are always associated with forms – logging in, transferring funds or posting a comment on the blog. Our solution to the CSRF problem is to generate a unique key when the user visits the page with the form on it. We set this key as a $_SESSION as well as a hidden input field in the form. When the form is submitted we will check the key stored in the session and the key posted by the form. If they are the same then we know the user willingly submitted the form. If they don’t match (or the $_SESSION key is empty) then we know something malicious is going on and we can safely redirect the user (and take no action).

session_start();

//if the form was submitted..
if(isset($_POST['submit']))
{

    //check the tokens
    if($_SESSION['csrfToken'] == $_POST['csrfToken'])
    {
        echo 'form is good';
    }
    else
    {
        header("Location: www.query7.com");
    }

}
else
{

//generate the token
$token = md5(uniqid(rand(), TRUE));

//set the token as a session
$_SESSION['csrfToken'] = $token;


//our form with the hidden field
$form = '
<form method="POST" action="">
Account: <input type="text" name="account" /><br />
Amount: <input type="text" name="amount" /><br />
<input type="hidden" name="csrfToken" value="' . $token . '" />
<input type="submit" value="Send Money" name="submit" />

</form>';

echo $form;


}

We can add an additional level of security by making sure the user was fowarded from the page that contains the form.

//after checking of the tokens match

if(!$_SERVER['HTTP_REFERER'] == 'http://yoursite.com/location/of/form.php')
{

    header('Location: http://www.yoursite.com/tricked.php');
}

If you have any questions about CSRF or how to protect against it please ask them in the comments.

PHP in Action is a book aimed at people who are comfortable coding procedural or object orientated PHP scripts. It doesn’t teach you what a variable is or what function to use if you want to connect to a database but it does teach you design patterns, best practice techniques and useful information about PHP5′s object system. If you are looking into writing a PHP framework or want to further understand design patterns and objects in PHP then I highly recommend this book. It’s written by prominent members of the PHP community – Dagfinn Reiersol, Marcus Baker and Chris Shiflett and is 525 pages long.

Overview of the book

Chapters 2,3,4 cover the PHP5 class system. The book offers detailed and useful examples of each of the topics as well as plenty of metaphors to help the reader understand exactly what each feature should do and is capable of doing. I found this contrasted greatly with the almost minimal explanations and examples offered by the official documentation on php.net. The following features are covered:

• Magic Methods – __get(), __set(), __construct(), __autoload()
• Exception handling
• Error handling
• Property visibility – public, protected, private
• Abstract classes
• Static methods
• Interfaces

Chapters 5,6,7 talk about object orientated principles and design patterns. Object orientated patterns and solutions are discussed including the Open Closed Principle, Single Responsibility Principle and Dependency Inversion. The knowledge learnt in these chapters can be transferred to other programming languages which support object orientation. The book also goes into detail about several design patterns, all of which are vital if you are looking to write a large web application or framework in PHP. The book covers the following design patterns:

• Strategy
• Adapter
• Decorator
• Iterator
• Composite

A large portion of Part 2 is dedicated purely to testing code. Marcus Baker (one of the authors) is a developer for SimpleTest (PHP testing library) so all testing examples in the book are focused around it. We are given a gentle introduction to test driven development with some basic examples and explanations on why we should test. We are then given two very detailed examples of how to test a class that interacts with a MySQL database and an email class (which uses mock objects). The third part of the book is focused around user interaction with your PHP web application. It starts off by looking at how and why you should keep your presentation (HTML) code seperate from your logic (PHP) code and then moves on to the Front Controller design pattern. The section is concluded with a form class which validates on both client and server side. The book concludes with a section on representing SQL rows and tables with PHP objects. It takes an indepth look at the Data Mapper pattern and creating a Data Gateway.

Opinion

It is clear the authors of the book are experienced PHP programmers who participate actively in the community. When explaining the Adapter pattern and seperation of presentation/logic  code they use the example of PHPTAL and Smarty - two popular and modern templating solutions in PHP. The book is set out very well with clear code examples, well set out headers and helpful class diagrams. The only drawback of the book is that it was published June 30th 2007 so it doesn’t include features added in PHP 5.2 and 5.3 . While nothing covered in the book is wrong, it’s unfortunate that topics such as namespaces, anonymous functions and late static binding aren’t covered. It would have been nice to see a section at the end of the book which brings together all topics that were covered in the book. A basic PHP framework that includes form handling, templating a database layer could have been made. That being said, a tremendous amount of content is covered in great detail and I urge anyone looking to further their PHP knowledge to buy this book.

PHP In Action from Amazon

Note: throughout the tutorial we will use the hypothetical files.

/Framework/Database/Mysql/Query.php
/lib/myClass.php
/index.php

The Basics

To declare a namespace you simply use the namespace keyword followed by the name of your namespace. You can specify sub namespaces by using the backslash ( \ ). Best practices state that your namespace path should match the directory path. For example the file /Framework/Database/Mysql/Query.php should have the namespace Framework\Database\Mysql and the name of the class should be Query. You should have one namespace and class per file.

Using Namespaces

In /lib/myClass.php we declare a namespace, lib, and then define a simple class, myClass. In our index.php file we include the class and instantiate it. Because myClass is in the namespace lib, we must refer to the class as lib\myClass, not just myClass. An alternate way to get namespaced classes is to use the use keyword. By specifying what classes you are use-ing at the top of the script it’s easy to look back at your code to see the dependencies for each page. You can also use foo as bar. This essentially renames class foo as bar. You’ll need to do this if you are use-ing two or more classes with the same name (namespaces will be different). Otherwise you will get name errors. Examples below.

/lib/myClass.php

namspace lib;

class myClass
{

public function foo()
{
echo 'hello world';
}

}

index.php

require 'lib/myClass.php';

//Error, Class not found.
$bar = new myClass();

//Displays hello world on the screen.
$bar = new lib\myClass();
$bar->foo();

//Displays hello world on the screen
use lib\myClass;

$bar = new myClass();
$bar->foo();

//Displays hello world
use lib\myClass as newName;

$bar = new newName();
$bar->foo();

Implementing an Autoloader

Rather than including every file you think you will need in your script, you can implement an autoloader. The autoloader is run every time a class that hasn’t been defined is called. In our autoload function we can translate a namespace-d class name into a file to include. Assuming we follow the convention of namespaces mapping to directories this is relatively simple.

function __autoload($class)
{
    $file = str_replace('\\', '/', $class) . '.php';

    if(file_exists($file))
    {
        require $file;
    }
}

So if we called

$db = new \Framework\Database\Mysql\Query();

The autoloader would include the file Framework/Database/Mysql/Query.php where (if you were following convention) there would be a class called Query. Notice that the autoload function replaces two backslashes with a foward slash – even though the namespaces only have singular backslashes. This is because the backslash is the escape character for PHP and by putting two backslashes, it evaluates to one backslash.

Gotchas

Built in class names returning as not found.
In your existing code you may use classes built into PHP such as Exception, StdClass, Mysqli etc.. When working with namespaces you must remember to prefix these with the backslash to indicate that you want to use the class from the root namespace, the PHP library – not your own version of the class that has the same name.

Relative namespaces.
If in /Framework/Database/Mysql/Query.php we needed to use the class in /lib/MyClass.php then you would most likely use the use statement and write something like below.

Query.php

namespace Framework\Database\Mysql;

use lib\Myclass;

class Query{}

However this will error out. Why? Because PHP is trying to find the class located at \Framework\Database\Mysql\lib\myClass. We need to explicitly define that the namespace path is taken from the root of our application so we prepend a backslash and it will work as intended.

namespace Framework\Database\Mysql;

use \lib\myClass;

class Query{}

If you have any questions about namespaces in PHP feel free to ask them in the comments below.

cURL vs file_get_contents()

Many PHP scripts require the user to download and then parse the HTML source of a page. When people ask how to do this, the most common reply is to use the file_get_contents() function as it’s a simple one line solution – you just need to set the first argument to webpage you want to download and it will return the source code of it. While it may seem very easy to use, it has many pitfalls.

1. cURL is significantly faster than file_get_contents() at retrieving the source of a webpage. It took around 2.3 seconds for file_get_contents() to retrieve the source of google.com while cURL only took 0.65 seconds. (source)
2. Familiarity of code. cURL is implemented in Python, Ruby, Java and many other languages. Your cURL code in PHP will be easily translatable and transferable to other languages, allowing you to save time and money.
3. cURL allows you to do more. If the webpage were password protected or required a form to be submitted before viewing, this would be possible in cURL. No possible way with file_get_contents().
4. cURL enables you to remain anonymous while requesting the webpage. You can funnel all cURL requests through one or multiple proxies whereas file_get_contents() will give away the server IP address.

cURL Class

cURL is only available through procedural functions, there is no cURL class in PHP. Hence scripts that utilize cURL can be messy. By writing a simple class wrapper, we can execute a cURL request in one line – yet still have the power and configuration of cURL. The class has two public methods. The first getPage() accepts one argument – the URL of the website. It returns an array of information about the request including the HTML source, content type, time it took to request the page, average download speed and other useful stats. The second downloadFile() accepts two arguments – the url to the file being downloaded and name of the file it should be saved as. The $options attribute holds the cURL options (that we eventually set using curl_set_opt_array()). A full list of options as well as their descriptions are available here.

class curl
{

public $options = array(
CURLOPT_RETURNTRANSFER => true,     // return the web page
CURLOPT_HEADER         => false,    // don't return the headers
CURLOPT_FOLLOWLOCATION => true,     // follow redirects
CURLOPT_USERAGENT      => "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.0.3705; .NET CLR 1.1.4322; Media Center PC 4.0)", // set a normal looking useragent
CURLOPT_AUTOREFERER    => true,     // set referer on redirect
CURLOPT_CONNECTTIMEOUT => 120,      // timeout
CURLOPT_TIMEOUT        => 120,      // timeout
CURLOPT_MAXREDIRS      => 10,       // stop after 10 redirects
);

public function __construct()
{
}

public function getPage($url)
{

$p = curl_init($url);
curl_setopt_array($p, $this->options );

$content = curl_exec($p);

if(!$content)
{
throw new \Exception(curl_error($p) . ' ERROR CODE ' . curl_errno($p));
}

$header  = curl_getinfo($p);
curl_close($p);

$header['content'] = $content;

return $header;
}

public function downloadFile($url, $filePath)
{
$fp = fopen($filePath, 'w');

$this->options[CURLOPT_URL] = $url;
$this->options[CURLOPT_FILE] = $fp;

$p = curl_init();

curl_setopt_array($p, $this->options);

$file = curl_exec($p);

curl_close($p);

fclose($fp);

}

}

$c = new curl();

$c->downloadFile('http://static.reddit.com/reddit.com.header.png', 'logo.png');

//Will download the reddit header image into a file called logo.png

$foo = $c->getPage('http://www.query7.com');

print_r($foo);