Türker Yıldırım

php

  • preg_quote takes a delimiter argument

    Note1 min read

    Interpolating user input into a pattern is how a search box becomes a regular expression injection. preg_quote() escapes the metacharacters, but its default output is still not safe…

  • dump-autoload -o is not optional in production

    Note1 min read

    PSR-4 resolves a class by converting the namespace to a path and checking the filesystem. That is one or more stat calls per class, on every request, for…

  • Generators keep a million-row export inside memory

    Note2 min read

    A method that builds an array and returns it holds every row in memory at once. For an export of a few hundred rows that is invisible; for…

  • pre_get_posts is the hook query_posts pretends to be

    Note2 min read

    query_posts() replaces the main query after WordPress has already run it, which throws away the first result set, breaks pagination and leaves conditional tags lying about what page…

  • use function and use const, not just use for classes

    Note1 min read

    Namespaced code can import classes with use, but until 5.6 functions and constants had no equivalent. Calling a namespaced function meant either fully qualifying it every time or…

  • Write an array to CSV in PHP

    Snippet1 min read

  • Nonces are not permissions — check both

    Note1 min read

    A nonce proves the request came from a form your site rendered, recently. It says nothing about whether the person submitting it is allowed to perform the action…

  • wpdb->prepare placeholders are typed, and unquoted

    Note1 min read

    $wpdb->prepare() looks like sprintf() and behaves differently in the one way that matters: %s adds the surrounding quotes itself. Writing them by hand produces a doubly-quoted value and…

  • str_getcsv parses a single CSV line without a file handle

    Note1 min read

    CSV is not a format you should parse with explode() — quoted fields containing the delimiter, and escaped quotes inside those, break it immediately. fgetcsv() handles all of…

  • A service layer is where the fat controller was going anyway

    Note2 min read

    Business logic in a controller is reachable from exactly one place: an HTTP request. The first time the same operation is needed from a console command, a queue…