8/8/2019 30 Php Best Practice

http://slidepdf.com/reader/full/30-php-best-practice 1/14

Advertise Here

30+ PHP Best Practices forBeginnersGlen Stansberry on Aug 13th 2009 with 133 comments

PHP is the most widely-used language for programming on the web. Here are thirtybest practices for beginners wanting to gain a firmer grasp of the fundamentals.

Editor’s Note: The “Best Practices” series has been my baby for three articlesnow. However, due to my focus on the CI video series , I’ve decided to hand off thisnext entry to Glen. Having said that, I’m not very good at keeping my mouth shut!I thought it might be fun to sporadically add a few rebuttals to his tips. I hope hedoesn’t mind!

1. Befriend the PHP ManualIf you’re new to PHP, then it’s time to get acquainted with the awesomeness thatis the PHP manual . The PHP manual is incredibly thorough and has truly helpfulcomments following each article. Before asking questions or trying to gure out anissue on your own, save some time and just head straight to the manual. Odds arethe answer to your question is already nestled in a helpful article at the PHP.netsite.

0+ PHP Best Practices for Beginners | Nettuts+ http://net.tutsplus.com/tutorials/php/30-php-best-pra...

of 14 10-08-09 01:08 PM

8/8/2019 30 Php Best Practice

http://slidepdf.com/reader/full/30-php-best-practice 2/14

2. Turn on Error ReportingError reporting in PHP is very helpful. You’ll nd bugs in your code that you mightnot have spotted earlier, as not all bugs keep the application from working. There

are different levels of strictness in the reporting that you can use, but E_ALL willshow you the most errors, critical and warnings alike.

Once you’ve gotten your application ready for production, you’ll want to turn off error reporting, or your visitors will see strange errors that they don’t understand.

3. Try an IDEIDE’s (Integrated Development Environments) are helpful tools for any developer.While they’re not for everyone, an IDE denitely has its place. IDE’s provide toolslike

syntax highlightingcode completionerror warningsrefactoring (reworking)

And many other features. There are plenty of great IDEs out there that supportPHP.

4. Try a PHP Framework

0+ PHP Best Practices for Beginners | Nettuts+ http://net.tutsplus.com/tutorials/php/30-php-best-pra...

of 14 10-08-09 01:08 PM

8/8/2019 30 Php Best Practice

http://slidepdf.com/reader/full/30-php-best-practice 3/14

You can learn a lot about PHP just by experimenting with PHP frameworks.Frameworks like CakePHP or CodeIgniter allow you to quickly create PHPapplications, without having to be an expert with PHP. In a sense, they’re almostlike PHP training wheels that show you what a PHP application should look like, andshow you valuable programming concepts (like separating the logic from thedesign, etc.).

Rebuttal: I personally wouldn’t recommend that beginners use aframework. Learn the fundamentals rst.

5. Learn the DRY ApproachDRY stands for Don’t Repeat Yourself , and it’s a valuable programming concept, nomatter what the language. DRY programming, as the name implies, is ensuringthat you don’t write redundant code. Here’s an example from Reinhold Weber :

This code…

view plaincopy to clipboardprint?

$mysql = mysql_connect('localhost', 'reinhold', 'secret_hash');1.mysql_select_db('wordpress') or die("cannot select DB");2.

now with the DRY approach:

view plaincopy to clipboardprint?

$db_host = 'localhost';1.$db_user = 'reinhold';2.$db_password = 'secret_hash';3.$db_database = 'wordpress';4. 5.$mysql = mysql_connect($db_host, $db_user, $db_password);6.mysql_select_db($db_database);7.

0+ PHP Best Practices for Beginners | Nettuts+ http://net.tutsplus.com/tutorials/php/30-php-best-pra...

of 14 10-08-09 01:08 PM

8/8/2019 30 Php Best Practice

http://slidepdf.com/reader/full/30-php-best-practice 4/14

You can read more about the DRY programming principle here and here .

6. Indent Code and Use White Space forReadabilityIf you don’t use indentations and white space in your code, the result looks like a

Jackson Pollack painting. Ensure that your code is readable and easy to searchbecause you’ll most denitely be making changes in the future. IDEs andadvanced text editors can add indentation automatically.

7. “Tier” your Code Tiering your applications is nothing more than separating the different componentsof the code into different parts. This allows you to easily change your code in thefuture. NETTUTS writer Jason Lengstorf has written an excellent article on how totier your PHP applications for easier maintenance.

8. Always Use <?php ?>Often times programmers try to take shortcuts when declaring PHP. Here are a fewcommon ones:

view plaincopy to clipboardprint?

<?1.echo "Hello world";2.

?>3. 4.<?="Hello world"; ?>5. 6.<% echo "Hello world"; %>7.

While these do save a few characters, all of these methods are depreciated andunofficial. Stick with the standard <?php ?> as it will be guaranteed to besupported in all future versions.

9. Use Meaningful, Consistent Naming

0+ PHP Best Practices for Beginners | Nettuts+ http://net.tutsplus.com/tutorials/php/30-php-best-pra...

of 14 10-08-09 01:08 PM

8/8/2019 30 Php Best Practice

http://slidepdf.com/reader/full/30-php-best-practice 5/14

ConventionsNaming this isn’t just for your own good. There’s nothing worse than trying to ndyour way through some other programmer’s nonsensical naming conventions.Help yourself and others by using names that make sense for your classes and

functions.

10. Comment, Comment, CommentAside from using white space and indentations to separate the code, you’ll alsowant to use inline comments to annotate your code. You’ll thank yourself laterwhen you’re needing to go back and nd something in the code, or if you justcan’t remember what a certain function did. It’s also useful for anyone else whoneeds to look over your code.

11. Install MAMP/WAMPMySQL is the most popular type of database to use with PHP (though it’s not theonly one). If you’re wanting to set up a local environment to develop and test yourPHP applications on your computer, look into installing MAMP (Mac) or WAMP(Windows). Installing MySQL on your own computer can be a tedious process, andboth of these software packages are drop-in installs of MySQL. Clean and simple.

12. Give your Scripts LimitsPutting a time limit on your PHP scripts is a very critical thing. There are timeswhen your scripts will fail, and when they do, you’ll want to use the set_time_limitfunction to avoid infinite loops and database connection timeouts. Theset_time_limit puts a time limit on the maximum number of seconds a script will

0+ PHP Best Practices for Beginners | Nettuts+ http://net.tutsplus.com/tutorials/php/30-php-best-pra...

of 14 10-08-09 01:08 PM

8/8/2019 30 Php Best Practice

http://slidepdf.com/reader/full/30-php-best-practice 6/14

8/8/2019 30 Php Best Practice

http://slidepdf.com/reader/full/30-php-best-practice 7/14

16. Never, Ever Trust Your UsersIf your application has places for user input, you should always assume thatthey’re going to try to input naughty code. (We’re not implying that your users arebad people. It’s just a good mindset.) A great way to keep your site hacker-free isto always initialize your variables to safeguard your site from XSS attacks . PHP.nethas an example of a properly secured form with initialized variables:

view plaincopy to clipboardprint?

<?php1.if (correct_user($_POST['user'], $_POST['password']) {2.

$login = true;3.}4. 5.if ($login) {6.

forward_to_secure_environment();7.}8.?>9.

17. Store Passwords with EncryptionMany PHP beginners often plunk sensitive data like passwords into the databasewithout applying any encryption. Consider using MD5 to encrypt passwords beforeyou put them into the database.

view plaincopy to clipboardprint?

echo md5('myPassword'); // renders - deb1536f480475f7d593219aa1afd74c1.

Rebuttal: Keep in mind, however, that MD5 hashes have long since beencompromised. They’re absolutely more secure than not, but, with the

0+ PHP Best Practices for Beginners | Nettuts+ http://net.tutsplus.com/tutorials/php/30-php-best-pra...

of 14 10-08-09 01:08 PM

8/8/2019 30 Php Best Practice

http://slidepdf.com/reader/full/30-php-best-practice 8/14

use of an enormous “rainbow table,” hackers can cross reference yourhash. To add even more security, consider adding a salt as well. A salt isbasically an additional set of characters that you append to the user’sstring.

18. Use Database Visualization Design ToolsIf you’re finding it difficult to plan and modify databases for your PHP applications,you might look into using a database visualization tool. MySQL users can work withDBDesigner and MySQL Workbench to visually design your databases.

19. Use Output BufferingOutput buffering is a simple way to greatly improve the performance and speed of your PHP script. Without output buffering, your script will show the HTML on thepage as it’s processed – in pieces. Adding output buffering allows the PHP to storethe HTML as a variable and send it to the browser in one chunk.

0+ PHP Best Practices for Beginners | Nettuts+ http://net.tutsplus.com/tutorials/php/30-php-best-pra...

of 14 10-08-09 01:08 PM

8/8/2019 30 Php Best Practice

http://slidepdf.com/reader/full/30-php-best-practice 9/14

To enable output buffering, simply add ob_start() like so at the top of the file.

Rebuttal: Though not required, it’s generally considered to be a goodpractice to go ahead and append the “ob_end_ush();” function as wellto the bottom of the document. P.S. Want to compress the HTML as well?

Simply replace “ob_start();” with “ob_start(‘ob_gzhandler’)”;Refer to this Dev-tips article for more information.

view plaincopy to clipboardprint?

<!DOCTYPE html>1.<?php ob_start('ob_gzhandler'); ?>2.<html lang="en">3.<head>4.

<meta http-equiv="Content-Type" content="text/html; charset=utf-8">5.<title>untitled</title>6.

</head>7.<body>8. 9.</body>10.</html>11.<?php ob_end_flush(); ?>12.

20. Protect your Script From SQL InjectionIf you don’t escape your characters used in SQL strings, your code is vulnerable toSQL injections. You can avoid this by either using the mysql_real_escape_string , orby using prepared statements.

Here’s an example of mysql_real_escape_string in action:

view plaincopy to clipboardprint?

$username = mysql_real_escape_string( $GET['username'] ) ;1.

and a prepared statement:

view plaincopy to clipboardprint?

$id = $_GET['id'];1.$statement = $connection->prepare( "SELECT * FROM tbl_members WHERE id2.$statement->bind_param( "i", $id );3.$statement->execute();4.

0+ PHP Best Practices for Beginners | Nettuts+ http://net.tutsplus.com/tutorials/php/30-php-best-pra...

of 14 10-08-09 01:08 PM

8/8/2019 30 Php Best Practice

http://slidepdf.com/reader/full/30-php-best-practice 10/14

By using prepared statements, we never embed the user’s inputted datadirectly into our query. Instead, we use the “bind_param” method tobind the values (and escaping) to the query. Much safer, and, notably,faster when executing multiple CRUD statements at once.

Read more on creating secure PHP applications at Nettuts.

21. Try ORMIf you’re writing object-oriented PHP, then you can use the nifty object relationalmapping (ORM). ORM allows you to convert data between relational databases andobject-oriented programming languages. In short: ORM allows you to work withdatabases the same way that you work with classes and objects in PHP.

There are plenty of ORM libraries for PHP like Propel , and ORM is built into PHPframeworks like CakePHP .

22. Cache Database-Driven PagesCaching database-driven PHP pages is an excellent idea to improve the load andperformance of your script. It’s really not all that difficult to create and retrievestatic files of content with the help of our good friend ob_start(). Here’s an exampletaken from Snipe.net :

view plaincopy to clipboardprint?

// TOP of your script1.$cachefile = 'cache/'.basename($_SERVER['SCRIPT_URI']);2.$cachetime = 120 * 60; // 2 hours3.// Serve from the cache if it is younger than $cachetime4.if (file_exists($cachefile) && (time() - $cachetime < filemtime($cachefile))) {5.include($cachefile);6.echo "<!-- Cached ".date('jS F Y H:i', filemtime($cachefile))." -->";7.exit;8.}9.

ob_start(); // start the output buffer10. // Your normal PHP script and HTML content here11.// BOTTOM of your script12.$fp = fopen($cachefile, 'w'); // open the cache file for writing13.fwrite($fp, ob_get_contents()); // save the contents of output buffer to the file14.fclose($fp); // close the file15.ob_end_flush(); // Send the output to the browser16.

0+ PHP Best Practices for Beginners | Nettuts+ http://net.tutsplus.com/tutorials/php/30-php-best-pra...

0 of 14 10-08-09 01:08 PM

8/8/2019 30 Php Best Practice

http://slidepdf.com/reader/full/30-php-best-practice 11/14

This bit of code will use a cached version of a page that is less than 2 hours old.

23. Use a Caching SystemIf you’re wanting a more robust caching system, there are a few caching scriptsfor PHP that might be more complete than the above example.

MemcachedAPCXCacheZend CacheeAccelerator

24. Validate Cookie DataCookie data, like any data passed on the Web, can be harmful. You can validate

cookie data with either the htmlspecialchars() or mysql_real_escape_string() .

25. Use Static File Caching SystemsAside from using database caching systems like Memcached, you might also wantto try a templating system to increase performance in your PHP applications.Smarty is a robust templating system has caching built into it.

26. Profile your CodeProfiling your code with a tool like xdebug can help you to quickly spot bottlenecksand other potential problems in your PHP code. Some IDEs like Netbeans have PHPprofiling capabilities as well.

0+ PHP Best Practices for Beginners | Nettuts+ http://net.tutsplus.com/tutorials/php/30-php-best-pra...

1 of 14 10-08-09 01:08 PM

8/8/2019 30 Php Best Practice

http://slidepdf.com/reader/full/30-php-best-practice 12/14

27. Code to a StandardOnce you’ve gotten the ropes of PHP down, you can start learning about coding toa standard. There are differences between standards out there (say Zend and

Pear ), and finding one and sticking with it will help with the consistency of yourcoding in the long run.

28. Keep Functions Outside of Loops You take a hit of performance when you include functions inside of loops. Thelarger the loop that you have, the longer the execution time will take. Take theextra time and line of code and place the function outside of the loop.

Editor’s Note: Think of it this way. Try to remove as many operations fromthe loop as possible. Do you really need to create that variable for every iteration of the loop? Do you really need to create the function eachtime? Of course not.

29. Don’t Copy Extra VariablesSome people like to try and make their code more appealing by copying

predefined variables to smaller-named variables. This is redundant and couldpotentially double the memory of your script. Google Code has bad and goodexamples of variable usage:

Bad

view plaincopy to clipboardprint?

$description = strip_tags($_POST['description']);1.echo $description;2.

Good

view plaincopy to clipboardprint?

echo strip_tags($_POST['description']);1.

Rebuttal: In reference to the comment about “doubling the memory,”

0+ PHP Best Practices for Beginners | Nettuts+ http://net.tutsplus.com/tutorials/php/30-php-best-pra...

2 of 14 10-08-09 01:08 PM

8/8/2019 30 Php Best Practice

http://slidepdf.com/reader/full/30-php-best-practice 13/14

this actually is a common misconception. PHP implements “copy-on-write” memory management. This basically means that you canassign a value to as many variables as you like without having to worry about the data actually being copied. While it’s arguable that the “Good” example exemplied above might make for cleaner code, I highly doubt that it’s any quicker.

30. Upgrade to the Latest Version of PHPWhile it seems like a common sense thing, many people don’t upgrade PHP asoften as they should. There are lots of performance increases between PHP 4 andPHP 5. Check your server to make sure you’re up to date.

31. Reduce the Number of Database QueriesAny way that you can cut back on the number of database queries, the betteryour PHP script will perform. There are tools like Stace (Unix) and Process Explorer(Windows) that allow you to find redundant processes and how you might combinethem.

32. Don’t be Afraid to Ask for HelpIt’s only human nature to want to hide the fact that we don’t know much about acertain topic. Nobody likes being a n00b! But how are we going to learn withoutasking? Feel free to use forums, IRC, StackOverflow to ask more seasoned PHPdevelopers questions. The PHP website has a page on getting PHP help .

Have any rebuttals of your own? I’m sure you do! Let’s start the debate.

0+ PHP Best Practices for Beginners | Nettuts+ http://net.tutsplus.com/tutorials/php/30-php-best-pra...

3 of 14 10-08-09 01:08 PM

8/8/2019 30 Php Best Practice

http://slidepdf.com/reader/full/30-php-best-practice 14/14

web development tuts and articles.36

diggs

By Glen StansberryGlen Stansberry is a web developer and blogger. You can read more tips on webdevelopment at his blog Web Jackalope or follow him on Twitter .

0+ PHP Best Practices for Beginners | Nettuts+ http://net.tutsplus.com/tutorials/php/30-php-best-pra...

4 of 14 10-08-09 01:08 PM