felipeNascimento.org(true);

Well … when you’re programming to the web, you MUST not trust anybody.
That’s because your application has many different kind of access, and it is, usually, something that you want.
Sometimes you want it to b accessed by a simple browser, others, from a Mobile, many times, from the computer on the intranet, or even from other server/webserver.
We can interact with desktop applications or applications that are in the other side of the world. So that, you really have to be afraid about “where has this information been?”
Then, two little rules to your life…

• DO NOT trust in the origins your information have
• Only show trustful information

How’s that? Firstly, you’ve gotta verify everything in your INPUT. To do so, I could indicate you some interesting tools PHP offers you:
strip_tags, and addslashes.
This is not everything you will use to be safe, don’t pretend you’re safe just using it. But, adding slashes to your inputs, you’ll avoid many injections, because your strings will be escaped.
Please, understand that your input is always a string, but PHP offers you the “casting”.
If your variable from post, get, or even from your $_SERVER input, is supposed to be an integer, use this.
$_POST['number']= (integer)$_POST['number'];

if something bad was there, you’ve just avoided it.
The strip_tags method allows you to remove tags you don’t want, which is the best way, once you shouldn’t imagine what you don’t want, but what you want.
Everyday someone will be looking for something to destroy something, so, you have to be aware.
If, for example, people may add comments in my application, before inserting it to my database, it’s better to use addslashes, to keep the comment 100% as the user did. BUT, when showing it, you will take care of your OUTPUT.
Before writing it to the output, you will use the strip_tags method, to avoid any < script > or < iframe > anyone may have saved in there.
Strip_tags also allows you to list the tags you WANT to leave, for example, I want < b > and < i > to be written into the comments.

An interesting thing I like to do is, in the very beginning of each php file, I include a header file. In this header, I can verify the sessions, and if that logged person has permission to be around there…I can set the charset ecoding of all pages, and also, clean my variables.
In this header, I go through all the input variables applying some methods I trust. After including this file, I know the variables are clean for use.
Of course, if I have to import data with includes, or use the file_get_contents, for example, it’s quite interesting to call again, the function to clear them all again.

Tips about your user select queries.
I try, more than simply escaping and stripping the input, build my query like this, to verify the user login.

select [fieldNames] from [tableName]
where [status]= [valueIfOk] and [userCode]= [inputCode]
and ([password]= ‘[inputPassword]‘)

Let’s analyze each line:
select [fieldNames] from [tableName] -> here, avoid to use “user” or “login” as table name…the same to the field names, try to adopt your own pattern, preferentially customizing it as much as possible to the current system. Remember, the less your enemy knows about you, safer you are.

Second line:
where [status]= [valueIfOk] and [userCode]= [inputCode] -> here, the first thing we will see is if the user login is correct, and if this is a valid user, with an OK status. If your attacker is trying some injection, he needs to know at least an authorized user’s login.

Third point:
and ([password]= ‘[inputPassword]‘) -> here, we verify between (), or even more than one parentheses, the password, as the last key to verify… if the attacker reach this point with some injection, well, he must put the correct ) to force it to work, once
and(passowrd = ‘1′ or true
will return an error, in case of his password be “1′ or true”, and it reached this point without a \’.

Yup, it’s a bit strange, I know…but I’ll show you what is this about.
When programming in PHP, you must take care about it, because PHP interprets TRUE as equivalent to 1, and false equivalent to 0.
In other words, you may do this test:
if(1)
or
if(0) // what is equivalent to !1

but, sometimes we want to verify something that may be the number 1, or the number 0, and not a boolean.
For example:
$a= 0;
if($a)
echo ‘a’;
else
echo ‘b’;

In this case, $a does exist, but PHP will see its value as false, and you ELSE statement will be executed.
To avoid it, in THIS example, we could use if(isset($a)). This will also avoid a NOTICE message.

BUT, if you still need to verify something like this, you must learn other comparator, the ===, and learn its difference from ==
Basically, == verifies the equivalence of two different items, while === verifies the equality between them.
For example:
if(1 == ‘1′) // returns TRUE
if(1 === ‘1′) // returns FALSE

That’s because 1 is equivalent to the string 1, when casted (understand that internally, PHP will apply casts to execute this instructions), but it is not EQUAL to it.
Sometimes you have a function that returns a number, or, in case of error, false… then, it’s interesting to use === to verify it’s return, like this:
if(myFunc() !== false)

PHP Developer ToolBar, addon for FireFox, has just reached its first thousand downloads!
During its third week of life, the PHPDevBar, as it is also known, has already had 253 Weekly Downloads woth 232 Active Daily Users.
Come along and download/try it too. Help us with your feed back.
Your comments on Mozilla’s website is also welcome.

Unfortunately, it’s still marked as experimental…we are waiting any mozilla’s member to validate it…what’s gonna happen soon, I believe.

PHP Developer ToolBar is an addon for firefox Jaydson and I have developed.
With this addon you can search in many different site engines for PHP method, classes or doubts.
You can find Brazilian PHP Groups and see PHPBC project, and PHP Empregos.
You can also see information about PHP Counter Project.

This toolBar offers you some tools from theWebMind service, to generate classes in an extreme easy way. More than that, using mind-language, you can generate DDL commands and the Classes as if you were using theWebMind.

The current version is 1.2.2

Link: https://addons.mozilla.org/en-US/firefox/addon/12686

Ps.: this is still an experimental addon, because it has no votes enough, so, if you want, you can contribute with posting comments, giving ideas, and voting in mozilla’s website.

I want to, in this webpage, post news about projects, keep in touch with people, say some of my thoughts, express some impressions, and annouce projects or ideas I’m working on.
I hope I’ll have feedback, suggestions, critics and ideas from “the readers”.