141–150 of 532 posts
I'm in the group described halfway down: was on the Internet during PHP 5, lost interest in it, and moved on [to Go]. I haven't written anything in PHP newer than version 5. Even transitioning from 4 to 5 was quite a big deal, I definitely noticed improvements. But it wasn't enough. I couldn't fit the data set in memory with PHP. But I could do it with Go. I couldn't do parallel computations in PHP in order to respon…
It's a Laravel package and it's the best CMS I've ever used (from a dev perspective). v4 just dropped the other day
Hilarious because other languages are capable of that per minute not per month
If I read this as a documentation page, this makes me scared:
`Order::create($validated + ['status' => 'pending']);`
What does it mean to add an array to something?
> Read the following code as if it were a documentation page: If I read this as a documentation page, this makes me scared: `Order::create($validated + ['status' => 'pending']);` What does it mean to add an array to something?
> Read the following code as if it were a documentation page: If I read this as a documentation page, this makes me scared: `Order::create($validated + ['status' => 'pending']);` What does it mean to add an array to something?
Earlier quoted context omitted.
Just made the same comment and deleted it seeing that you already stated it. Protecting against all of these is hard and no tech is going to automatically protect for all of this on its own. Such a weird statement to make that takes away from the message of the site entirely.
I worked for a company and we used the PHP ORM Propel. So in theory no SQL injections you would think, WRONG. We used a function like findOne() (I don't recall exactly). It looked like this: $resetTokens->findOne($GET['password-reset-token']); The issue was that findOne would accept wildcards, so one could use ?password-reset-token=% in the URL and reset the password of any random users.
The snippet also validates request inputs, so clearly it doesn't assume that inputs are safe.
Earlier quoted context omitted.
What "computer science terms" did you encounter, that you did not understand? I also do not have a CS degree, but every term that I've encountered in the Laravel docs I found easy to search for. Just don't rely on Wikipedia for explanations, for CS (and mathematics) subjects Wikipedia seems to be useful only to those already versed in the field.
I struggled with sorting out Contracts vs Facades vs Traits. I graduated from university 20 years ago with a software engineering degree, where it was drummed into me that simpler often is better, and much more robust. Reading the Laravel docs however, leaves more questions than I started off with. eg. https://laravel.com/docs/5.8/contracts – talks a lot about how Contracts are powerful additions (like all the other…
Earlier quoted context omitted.
I want to second this. The top StackOverflow comment for protecting against XSS in PHP still recommends htmlspecialchars() https://stackoverflow.com/questions/1996122/how-to-prevent-x... which is a terrible and ancient approach (context-aware templates are the modern approach). I also Googled to check CSRF protection and all the sites I can find just discuss rolling it yourself; the example uses some CSPRNG that can…
You don't get XSS protection out the box from any language's standard library, nor CSRF.
> Read the following code as if it were a documentation page: If I read this as a documentation page, this makes me scared: `Order::create($validated + ['status' => 'pending']);` What does it mean to add an array to something?
`$validated = ['key' => 'value']; $validated['status'] = 'pending'; Order::create($validated);`