To get a random number with ExpressionEngine, we can go the PHP route, or the non-PHP route. Going the PHP route is obviously easier to output and write the markup for (not to mention, is truely “random”), but enabling PHP in your templates may not be your answer; especially if you don’t want users [who have the ability to create/edit blog posts] have the power to do anything that PHP would allow them to do (such as outputting normally unobtainable data from the database).

Unfortunately, in ExpressionEngine, a “random number” expression has yet to exist; however, one of the nice things about ExpressionEngine is the ability to process PHP at the flip of a switch. 

The PHP Solution:
First, turn on PHP processing in: Templates (tab) > Template Preferences Manager (link) > Allow PHP (dropdown)

Then we simply assign the rand() to a variable, and check against that variable to output accordingly.

<?php 

$random_number = rand(0,6); 

if ($random_number == 1) { echo '<img src="/assets/images/image1.png" />'; }
elseif ($random_number == 2) { echo '<img src="/assets/images/image2.png" />'; }
elseif ($random_number == 3) { echo '<img src="/assets/images/image3.png" />'; }
elseif ($random_number == 4) { echo '<img src="/assets/images/image4.png" />'; }
elseif ($random_number == 5) { echo '<img src="/assets/images/image5.png" />'; }
elseif ($random_number == 6) { echo '<img src="/assets/images/image6.png" />'; }

// ensures an image is displayed even when no other conditions are met (in this case, it really only displays when random_number = 0)
else { echo '<img src="\/assets\/images\/image0.png" \/>'; } 

?>

For those that prefer to avoid PHP, here’s a quick way to (in a way) fake a random number. I figured a good way to do this was using the {current_time}, but only the seconds portion. Granted, its not the most elegant solution, but it gets the job done.

The Non-PHP Solution:

{!-- Sets current time (seconds) to the variable 'current_time_seconds' --}
{assign_variable:current_time_seconds="{current_time format="%s"}"}

{!-- %s = Seconds range: 00-59 --}
{!-- Check current time in seconds and displays a different image based on current time in seconds --}

{!-- displays if 1-9 --}
{if {current_time_seconds} > 0 && {current_time_seconds} < 10}
<img src="/assets/images/image1.png" />

{!-- displays if 11-19 --}
{if:elseif {current_time_seconds} > 10 && {current_time_seconds} < 20}
<img src="/assets/images/image2.png" />

{!-- displays if 21-29 --}
{if:elseif {current_time_seconds} > 20 && {current_time_seconds} < 30}
<img src="/assets/images/image3" />

{!-- displays if 31-39 --}
{if:elseif {current_time_seconds} > 30 && {current_time_seconds} < 40}
<img src="/assets/images/image4.png" />

{!-- displays if 41-49 --}
{if:elseif {current_time_seconds} > 40 && {current_time_seconds} < 50}
<img src="/assets/images/image5.png" />

{!-- displays if 51-59 --}
{if:elseif {current_time_seconds} > 50 && {current_time_seconds} < 60}
<img src="/assets/images/image6.png" />

{!-- displays if seconds don't match any of the conditions above (basically the following times in seconds: 00,10,20,30,40,50) --}
{if:else}
<img src="/assets/images/image0.png" />

{/if}

The non-PHP solution can be a great solution for someone who doesn’t want a random image “every single time” (for the visitors who are clicking through pages within seconds of eachother).

Since I’ve been using the Zend Framework so much lately, I figured why not add this functionality into it? Here’s a view helper to do just that. Enjoy!

class Zend_View_Helper_Widont {
 
    public $view;
 
    public function widont($str = '', $escape = false) {
 
        if ($escape) $str = $this->view->escape($str);
        return preg_replace( '|([^\s])\s+([^\s]+)\s*$|', '$1 $2', $str);
 
    }
 
    public function setView($view) {
 
        $this->view = $view;
 
    }
 
}

Refer to the Zend Framework’s view helper documentation if you don’t know how to install view helpers.

To use this helper, call $this->widont($str) from inside of a view. If you pass a true value as the second argument, the string will be escaped before being output.

The reason we decided to leave Zend and go to CakePHP was because it lacked two main components that made it very difficult to wire frame applications quickly and easily. Those components are a layout system, and a form manager. I am happy to announce that Zend has tackled both of these problems in this release, and has actually done a decent job on them. Neither of them are 100% yet (at least not in my opinion), but both are very usable and helpful at the very least. Go grab a copy of the new release and give it a go. I think you’ll be quite happy with it!

For a full list of the new features, check out the official release page on zend developer zone.0

UPDATE! – Zend Developer Zone has published a webinar on Zend_View and Zend_Layout by Ralph Schindler. Go check it out!

I have just wrapped up version 0.2 of our csv library. It includes several new features. The most exciting of which is the new Csv_Sniffer class.

Csv_Sniffer

sniff(string $sample)
Csv_Sniffer’s sniff method accepts a sample of csv data and attempts to deduce its format. In this library, there is a class called Csv_Dialect, which tells Csv_Reader and Csv_Writer the format they should read and write in. If Csv_Sniffer::sniff is successful, it will return a Csv_Dialect object representing the format of the csv file (or at least it’s best guess). You can then pass this dialect to Csv_Reader and it will know how to read the file. You can also pass it to Csv_Writer if you need to append the file or write one in the same format.

try {
    $sample = implode("", array_slice(file('./data/products.csv'), 0, 20)); // grab 20 lines
    $sniffer = new Csv_Sniffer();
    $dialect = $sniffer->sniff($sample);
    $reader = new Csv_Reader('./data/products.csv', $dialect);
} catch (Csv_Exception_CannotDetermineDialect $e) {
    printf("<p>%s</p>", $e->getMessage());
}

hasHeader(string $sample)
Csv_Sniffer’s hasHeader method accepts a sample of csv data and attempts to detect if the file has a header row or not. If so it will return true.

$sample = implode("", array_slice(file('./data/products.csv'), 0, 20)); // grab 20 lines
$sniffer = new Csv_Sniffer();
if ($sniffer->hasHeader($sample)) {
    print("The file probably has a header");
} else {
    print "The file probably doesn't have a header";
}

Csv_Reader_String

This new class is exactly the same as Csv_Reader, except instead of accepting a filename and reading from a file, it reads directly from a string. This could be useful if for some reason somebody had stored csv data in a database and you were retrieving it from there, or if you needed to collect submitted csv data directly from a web form.

if (isset($_POST['csv_data'])) {
    $data = $_POST['csv_data']
    $reader = new Csv_Reader_String($data);
    foreach ($reader as $row) {
        // now you could insert it into a database or whatever else you need to do with it
    }
}

Csv_Dialect::__construct([array $options])

You may now pass an associative array to Csv_Dialect’s constructor to override any of it’s properties. While this doesn’t actually provide any new features, it definitely is a convenience.

$dialect = new Csv_Dialect(array('quotechar' => "'", 'escapechar' => "'", 'quoting' => Csv_Dialect::QUOTE_NONNUMERIC));
$reader = new Csv_Reader('./data/orders.csv', $dialect);

Plans for version 0.3

• Csv_Writer will write immediately, rather than when you call close() – This won’t change the interface at all, but in the next version, instead of writing to disk when the user calls close(), it will write immediately when writeRow() or writeRows() is called.
• Interface changes for Csv_Sniffer – I don’t like how you have to pass the same sample data to both sniff() and hasHeader(). I will probably change it to accept $sample in its constructor instead. Another issue I have with it is that if there is a tie between delimiter characters in the sniff method, it just chooses by ascii order. I would like to allow the user to specify an array of characters in order of priority in case of a tie.
• A more advanced unit testing interface – The unit tests I have written are all run at once and since they are reading / writing actual csv files it is beginning to take a while to run them all. I’m putting together an interface that will allow me to run tests seperately or all together as well as a way to time some operations so that I can speed them up as much as possible.
• Csv_Dialect classes for any and all formats I can dig up (Open Office, Miva Merchant, Google Docs and Spreadsheets, standard csv?, etc.)
• Csv_Mapper – A class that maps keys to columns so that you can access them like $row['first_name'].
• Even more documentation I have written some documentation on the google code wiki, but I am planning on writing more consistent docs. The ones I have now are all sort of willy-nilly.
• Csv_Reader_Zip – A csv reader that can read zipped files
• Character encoding – This will be the first time I have really had to deal with multiple character encodings, so this may take me a while. I will need to do some research on the subject.
• More to come – I will finish writing about the new features and complete the docs within the next week or so, for I am tired and I’m going to bed.

Download PHP CSV Utililties v0.2
Read Documentation for PHP CSV Utilities

One common example is when you need to instantiate an object and call a method on it. Normally, you’d have to do something like the following.

$person = new MC2_Person(23);
$person->getFullName();

While this isn’t all that painful when you only need to do it once, in even a moderate sized project, you’ll need to do something like this hundreds of times. Now let’s look at the fluidics way to do this.

with(new MC2_person(23))->getFullName();

Another extremely useful function in fluidics is the dindex function. After using python for the last few months I have really grown fond of the built-in dictionary method get(). What it does is allow you to request an index on an array (called a dictionary in python) and if it doesn’t exist, you can provide a default. In python the syntax is like dict.get(‘key’, ‘defaultval’). In fluidics it’s like this:

$lunch = array('snack' => 'cheetos', 'drink' => 'mountain dew');
$drink = dindex($lunch, "drink", "pepsi"); // returns "mountain dew"
$sandwich = dindex($lunch, "sandwich", "ham"); // returns "ham"

I could sit here and list all the functions that make this little library so useful, but Ollie does a better job of it anyway, so check out his googlecode project. I hope you like it as much as I did. 

Read more about fluidics here.
Ollie Saunders’ Blog

PHP Csv Utilities Documentation (PhpDocumentor)

Since I began doing web development five years ago, I have been exclusively a PHP developer. Recently though, I have taken quite a liking to python. In fact many times while I’m writing PHP I find myself thinking, “It sure would be nice if I could do this the python way”. It’s not that I don’t love PHP, it’s just that python is such an absolute joy to work with. Many features of PHP feel sort of tacked-on as an afterthought. For instance, many standard features available for object-oriented languages are rudimentary or missing completely. Although to PHP’s credit, PHP5 and the new Zend engine 2 have improved the situation considerably.

Several of the recent projects I’ve been working on have required an “import from / export to CSV” feature. PHP comes with a few functions for reading and writing csv files right out of the box: fgetcsv and fputcsv. While these are good functions and they get the job done I find they just aren’t enough in many cases. It would be nice if PHP had an interface like python’s csv module. Enter PHP CSV Utilities. The library is still in its infancy and nothing about the interface is concrete yet, but here are some of the things that are already possible with the library:

Open a csv file and parse it line-by-line:

The simplest possible method of reading a csv file is to create a new Csv_Reader object and loop over it with foreach.

$reader = new Csv_Reader('/path/to/myfile.csv');
foreach ($reader as $row) {
    // do something.. $row now contains an array of the current row
}

What if the file doesn’t exist?

Csv_Reader will throw a Csv_Exception_FileNotFound exception if it can’t open the file you provide

try {
    $reader = new Csv_Reader('/path/to/file');
} catch (Csv_Exception_FileNotFound $e) {
    echo $e->getMessage();
}

Read the header line and then loop through the rest of the lines

If you know the file you are reading has a header row, simply grab it and then loop through the reader with a while loop (foreach will not work here because it starts at the beginning and loops through everything in the reader).

$reader = new Csv_Reader('/path/to/myfile.csv');
$header = $reader->getRow(); // grabs first row
while ($row = $reader->getRow()) { // starts from second row
    // do something
}

Read a csv file that was created by Excel

Excel has the ability to save as a csv file instead of its proprietary xls format. The library supports what are called Csv dialects (terminology borrowed from python). Csv dialects simply tell reader and writer objects how to do their job. For instance, Excel only quotes columns if there are special characters in them. Using the standard reader would inproperly parse the output of an Excel csv file. To read an Excel csv file properly, simply provide a Csv_Dialect_Excel object in the constructor.

$dialect = new Csv_Dialect_Excel;
$reader = new Csv_Reader('/path/to/file', $dialect); // now reader will read excel csv file properly (this does not mean xls)
foreach ($reader as $row) {
    // do something
}

But what if I have an excel file with a different delimiter, like a tab character?

If you need to change any of the options in a dialect, you may either extend it via inheritance, or you may simply change said option at run-time.

$dialect = new Csv_Dialect_Excel();
$dialect->delimiter = "\t";
$reader->setDialect($dialect);
foreach ($reader as $row) {
    // do something with $row
}

Csv_Dialects represent the format of a csv file – This means you can read or write just about any type of csv file. As of right now, Csv_Dialect has the following properties (most of which were borrowed from python’s csv module):

• delimiter – The delimiter is the character that seperates column values from eachother in a row
• quotechar – The character used to quote columns
• escapechar – The character used to escape special characters such as the delimiter or the quotechar
• lineterminator – The character used to denote the end of a line
• quoting – This tells the reader which rows in the csv file are quoted, and the writer which columns to quote. Can be any of the following Csv_Dialect constants:
  • Csv_Dialect::QUOTE_MINIMAL – Quotes only items that contain special characters such as the delimiter or quotechar
  • Csv_Dialect::QUOTE_ALL – Quotes all items regardless of their content
  • Csv_Dialect::QUOTE_NONNUMERIC – Quotes only items with nonnumeric values
  • Csv_Dialect::QUOTE_NONE – Quotes no items regardless of their content
• doublequote – Not yet implemented
• skipinitialspace – Not yet implemented
• skipblanklines – Set to true if you would like for the reader to ignore blank lines

Rewrite a csv file with Excel formatting (or any other format)

The Csv_Writer object accepts a Csv_Reader object in its writeRows() method, so rewriting a csv file with a new dialect (new delimiter, line-ending, etc) is really simple.

$reader = Csv_Reader('/path/to/file.csv');
$writer = new Csv_Writer('/path/to/file.csv', new Csv_Dialect_Excel());
$writer->writeRows($reader);
$writer->close(); // writes csv file but now it's in Excel csv format

I’d really like to get an idea of features that would be useful to people other than myself. I’m also interested in feedback on the interface, and ways I could improve the library. If you’re interested, download the library and play around with it a bit. When you find something you like or dislike or if you have any kind of input at all, leave a comment below or drop me an email. Enjoy!

PHP Csv Utilities Documentation (PhpDocumentor)

Download PHP Csv Utilities

Plans for version 0.2

• Csv_Sniffer – a class that accepts a sample of csv and attempts to deduce its format. It will then return a dialect that fits the csv file as well as attempt to detect whether or not the file has a row of headers.
• Csv_Dialect classes for any and all formats I can dig up (Open Office, Miva Merchant, Google Docs and Spreadsheets, standard csv?, etc.)
• An option parameter for Csv_Dialect – I was considering allowing an array of parameters in Csv_Dialect’s constructor. This way you could easily put together a dialect like $dialect = new Csv_Dialect(array(‘quotechar’ => “‘”, ‘escapechar’ => ‘”‘));
• More comprehensive unit tests – Although I made my best effort to stick to test-driven development practices (since learning them properly has been on my priority list for a while), there are still some areas where I could use some more testing.
• More documentation – I’m going to strive to document every feature of this library. Poor documentation is a pet peeve of everybody.

Possible / Eventual Features

• Csv_Reader_Zip – A csv reader that can read zipped files
• Csv_Reader_String – A csv reader that accepts a string instead of a file
• Character encoding – This will be the first time I have really had to deal with multiple character encodings, so this may take me a while. I will need to do some research on the subject.

This release a number of improvements in CSS handling, including the filter HTMLPurifier_Filter_ExtractStyleBlocks which integrates HTML Purifier with CSSTidy for cleaning style sheets (see the source code file for more information on usage), contains experimental support for proprietary CSS properties with %CSS.Proprietary, case-insensitive CSS properties, and more lenient hexadecimal color codes. Also, all code has been upgraded to full PHP 5 and is E_STRICT clean for all versions of PHP 5 (including the 5.0 series, which previously had parse-time errors).

For more details about the release, check out HTML Purifier’s website. 

<form method="post" action="<?php echo $_SERVER['PHP_SELF']; ?>">
  <!-- form contents -->
</form>

How could this possibly be a security issue? I mean this is an untainted value set by PHP itself, right? 

Wrong!

Unfortunately, this is not the case at all. The PHP_SELF element can in fact be altered by the user to include any kind of malicious XSS code he/she desires. They will be limited only by their imaginations, and the amount of data that is actually allowed though the url (I believe this depends upon the browser). Don’t feel too down on yourself if you weren’t aware. Using this element in an irresponsible manner has been a staple in online PHP tutorials for as long as I can remember.

Where’s the beef?

So where is this supposed user-polluted input? If you take a moment to examine the entire $_SERVER array (hint: phpinfo()), you’ll notice another element called PATH_INFO. See, it is perfectly valid to tack on extra information after the page name in the URL. For example, the following is a valid URL in PHP.

http://www.example.com/index.php/news/category/javascript

In this case, PATH_INFO would be populated with the data appended to the end of the URL. PHP_SELF will also contain this data.. If you were to examine your $_SERVER array given this URL, you’d see something like the following:

[PATH_INFO] => /news/category/javascript
[PHP_SELF] => /php/phpselftest.php/news/category/javascript

Now let’s revisit our form example from earlier. Using $_SERVER['PHP_SELF'] directly within the form action, you can see how this may present an XSS vulnerability. I realize how paranoid I have sounded about XSS in the last several blog posts, but I assure you it’s for good reason. If you are unfamiliar with XSS, I encourage you to read up on it. Wikipedia’s article on the subject is a good starting point.

Let’s say the user enters http://www.example.com/form.php/%22%3E%3Cscript%3Ealert(‘xss attack’)%3C/script%3E%3Cbr%20class=%22irrelevant

Now let’s take a look at what effect this has on our form output:

<form method="post" action="http://www.example.com/form.php/"><script>alert('xss attack')</script><br class="irrelevant">
  <!-- form contents -->
</form>

This is not good. While I can assure you that the simple javascript I injected is harmless, I can’t guarantee the same for your users. It would be a somewhat trivial task for an attacker to write a javascript capable of stealing sensitive data and tricking an unsuspected user into executing it by way of a link such as the one above.

Don’t worry, there are many solutions

Among the many solutions, I prefer the simplest. In many cases, you can get away with just using a pound sign instead of explicitly naming the page.

<form method="post" action="#">
  <!-- form contents -->
</form>

However, should you require the use of the <base> HTML element, this solution will generally fail miserably. The browser will no longer assume it should post back to the current page, and instead post to whatever you have assigned to your base tag’s href attribute.

In this case, you can either sanitize the value of PHP_SELF, or you can get the basename() of either the magic constant, __FILE__ (available for php v4.0.2 or later) or the basename() of $_SERVER['SCRIPT_FILENAME'].