A custom error handler in PHP looks trivial until you break half the ecosystem. Just ignore a few rules about suppressed errors and return values, and you've got a trap in your code that nobody expects. Here's how to do it right.
The CSRF attack has been haunting us for twenty years, and frameworks address it in a way that essentially invites users to bypass the protection. SameSite cookies finally offer a systemic way out. I break down Lax, Strict, None, cookie stuffing, and why when it comes to the attack, the right answer is: run.
Whitelisting domains in CSP is a Sisyphean task that ends up so full of holes it loses all meaning – even Google has proven that. A solution called nonce and strict-dynamic exists, but you need to combine it correctly for older browsers. A specific guide for PHP and Nette, including dry-run testing.
Fifteen years, several versioning systems, several encodings, several of my life relationships – and Texy is still here. Version 3.0 brings PHP 7.1 goodies, but otherwise it's exactly the same. And one day it will insert a non-breaking space between your “in” and “peace.”
The final keyword is a great tool for object-oriented design –
until you need to mock the class. Fortunately, there's some incredibly dark
magic: Nette Tester and the BypassFinals library remove final
on-the-fly. One line of code and the problem is gone.
An interface is technically just a trimmed-down class, so the collective term for classes and interfaces is… classes. Elegant, right? Except then you don't know what to call classes that aren't interfaces. Sometimes it's better to forget that you're right.
Output buffering in PHP looks trivial – until you hit a security hole during script termination, broken flags, or the paradox where a bare ob_start() slows down your server instead of speeding it up. A complete guide to what the documentation coyly left out.
A dead-simple CLI tool that converts between array() and
[] syntax using PHP's native tokenizer — no regexes, no
prayers. Battle-tested against thousands of files and works both ways with
--reverse. Grab it from GitHub.
Monolithic frameworks are falling apart into components, and anyone who hasn't figured that out yet has been sleeping through the times. Instead of one big bundle, you put together exactly what you need, update piece by piece, and don't have to wait for the next big release. Nette has nailed this, the others are still trying to catch up.
Nette finished third in the worldwide SitePoint poll for the best PHP framework of 2015. The Czech framework broke through the language barrier and the world took notice – thanks to satisfied users who simply went and voted. I really didn't expect this result.
That's all. More articles are on the way.