How to Post Codebase on GitHub without Revealing Database Login and Password Parameters in PHP

It’s quite simple.

Inside configuration file congif.php:

<?php 
  include("secret.php");
  $password = PASSWORD;  //defined in secret.php
  $username = USERNAME;
?>

Inside secret.php

<?php
  define('PASSWORD', 'example_password');    
  define('USERNAME', 'example_username') ;   
?>

Inside .gitignore, just add:

path/secret.php

path: the path to secret.php

Therefore, secret.php will not be uploaded to GitHub and keep these secret parameters safe!

Do Not Use Cookies as The Way We Use Variables

Considering the code as follows:

<?php
  setcookie("test", "1", time() + 3600);  // set cookie
  echo $_COOKIE["test"];
?>

The result shows ‘undefined index’ after execution:

Notice: Undefined index: test in /xxx/index.php on line 2

Why is this happened? Has cookie not been set?
No, it is because the browser hasn’t sent a HTTP request to the server, so the browser hasn’t got the request cookie yet.

According to the document rfc6252 from Internet Engineering Task Force (IETF), it explains how cookies work at the introduction:

Using the Set-Cookie header field, an HTTP server can pass name/value pairs and associated metadata (called cookies) to a user agent. When the user agent makes subsequent requests to the server, the user agent uses the metadata and other information to determine whether to return the name/value pairs in the Cookie header.

Hmm~~, what does that mean exactly?

Let’s open the Chrome Developer Tools and show you how cookies works.

I wrote three php programs as follows:

1. set_cookie.php: to set cookie ‘test’ and value as 1.

<?php
  setcookie("test", "1", time() + 3600);
  echo $_COOKIE["test"];
?>

2. show_cookie.php: show the value of cookie ‘test’.

<?php
  echo $_COOKIE["test"];
?>

3. delete_cookie.php: delete the cookie 'test.

<?php
  setcookie("test", "", time() - 3600);
?>

Check the cookies in Chrome Devtools

1. Now, let’s start to run set_cookie.php and see what will happen through Chrome devtools. In Chrome devtools windows, there is a Response Cookie ‘test’ as 1 shown in the ‘Cookies windows’. The cookie ‘test’ is not shown at the side of ‘Request Cookies’ meaning that the browser hasn’t received cookie data from server yet. So, it shows ‘undefined index’ message in the browser as expected.

run set_cookie.php

2. Next, let’s run show_cookie.php to send a HTTP request to the server and show the cookie ‘test’. It shows cookie ‘test’ and value as 1 at the side of ‘Request Cookies’. As expected, the browser shows ‘1’, the value of cookie ‘test’.

run show_cookie.php

3. let’s run delete_cookie.php to delete the cookie ‘test’. It shows a ‘delete’ value at the side of ‘Response Cookies’. The cookie ‘test’ and value 1 is still at the side of ‘Request Cookies’.

delete_cookie.php

4. Let’s run show_message.php again to send a HTTP request to the server. It also send the response cookies to the server and delete the cookie ‘test’. The cookie ‘test’ has disappeared at both sides of the ‘Cookies windows’. Therefore, it shows ‘undefined index’ in the browser again.

show_cookie again

Use cookies for storing data while variables for calculation.

As shown above, the behavior of cookies are different from variables. We can not use cookies just as the way we use variables.

Do not make the calculation according to cookies values if a HTTP request hasn’t been sent to the server. Using variables to do so to make sure the correct calculation.

Four Ways to Show Message Bar After Redirecting to Another Page in PHP

There are four ways to show a message bar up front of the web page when needed in PHP. As shown below, the main function of the message bar is to notify users a warning message.

Four ways to build up a message bar are as follows:

1. Passing message by assigning a smarty variable.

index.php

<?php    
         :
$msg = 'Please login!';
         :
$smarty->assign('msg', $msg);    
// redirect to index.html
$smarty->display('index.html'); 
  
?> 

index.html

{if (isset($msg)}
  {$msg}
{/if}

It works very good except one situation: program redirects to another page and exits the original one before Smarty variable has been assigned.

Considering a situation below:

<?php
         :
if !login() {
  $msg = 'Please login!';
  header("location:login.php");
  exit;
}
         :
$smarty->assign('msg', $msg);    
// redirect to index.html
$smarty->display('index.html'); 
?>

Normally, we put $smarty->assign('msg', $msg); at the end of index.php file. It will not work in the above example since a header() command redirects to the login page and exits index.php. $msg will not be assigned to a Smarty variable.

2. Query string parameters

ex.
shopping_cart.html

<a href="index.php?msg=Cart is empty!">Empty Cart</a>  

index.php

$msg = isset($_REQUEST['msg']) ? 
  filter_var($_REQUEST['msg'], 
  FILTER_SANITIZE_MAGIC_QUOTES) : '';
echo $msg;

It shows a long line of words in the url windows of the browser. I really don’t like it. It is not a good way to do it.

3. Using Cookie

ex.
index.php

      :
setcookie('msg', 'Hello! New user!', time() + 365*86400);
      :
function show_message() {
  $msg = $_COOKIE['msg'];
  setcookie('msg', '', time() - 3600);
  return $msg;
} 

index.html

{if isset($smarty.cookies.msg)}
  {show_message()}
{/if}  

It seems to be a good solution, However, it resulted in some unexpected error while using cookie method. It was not stable when I tested it. The browser could not render the correct page. I recommend not to use it.

4. Using Session

ex.
index.php

<?php
session_start();
       :
       :
write_message('Hello! New user!');
header("location:{$_SERVER['HTTP_REFERER']}");
  
function write_message($msg = '') {
  $_SESSION['msg'] = $msg;
}

function show_message() {
  $msg = $_SESSION['msg'];
  unset($_SESSION['msg']);
  return $msg;
}
?> 

index.html

{if isset($smarty.session.msg)}
  <div class="alert alert-danger alert-dismissible show" role="alert">
    {show_message()}
    <button type="button" class="close" data-dismiss="alert" aria-label="Close">
      <span aria-hidden="true">&times;</span>
    </button>
  </div>
{/if} 

The session method is the most recommended method to show a message bar at the redirected page. It’s quite easy, simple and no restriction at all. You can insert write_message('xxxxx') anywhere in code and it will show up in the redirected page. The only one drawback to criticize is that it consumes server’s resources since session runs on the server.