Apache httpd.conf

First of all, I add this to the end of my httpd.conf.

Make sure to check if there is already a line with AccessFileName though, and if it is, just edit that instead of adding another one

Environment variables

With that done, you can have one regular .htaccess which would be used in production and a local one for your machine.

These two files can now live side by side, checked in to source control, and not cause any trouble. Alternatively you could set the local one to be ignored so that other developers could create their own setup.

Kohana bootstrap

Now comes the Kohana specific part. In my application/bootstrap.php I have the following (among other stuff of course).

And that’s pretty much all there is to it. This way I don’t have to worry about not overwriting the .htaccess on my production server or stuff like that. The .htaccess is untouched and just for the production environment

This pretty much always returns zero, even though the uploading actually took many seconds, because the request start time is after the server has received the post data. That we actually just get how long the script took to run, which of course is pretty close to zero seconds. So, what can we do?

1. Right before data is posted, nudge the server with an AJAX call which stores the current timestamp in a session variable
2. Post the data
3. Compare current timestamp with the one stored in step 1

Wasn’t sure how it would work, but seems to work pretty well. There will of course be a very tiny difference since the AJAX request will be a bit part of the time, but compared to the upload time it shouldn’t matter much. Anyways, here’s how you could do it

In your HTML you need your form, obviously.

And then we need the Javascript which does the AJAX request (using jQuery). Notice that this makes sure we have gotten a response from the timer script before we actually submit the form.

The start timer simply stores a timestamp in a session variable.

Then in the upload script we simply need to compare that time with the current timestamp to figure out how long this took.

And that’s pretty much all there is to it! Working sample at samples.geekality.net/upload-timer.

All you need is regular output buffering with the ob_gzhandler as output callback.

The cool thing is that it actually looks at what the browser accepts before doing anything.

Before ob_gzhandler() actually sends compressed data, it determines what type of content encoding the browser will accept (“gzip”, “deflate” or none at all) and will return its output accordingly. All browsers are supported since it’s up to the browser to send the correct header saying that it accepts compressed web pages.

Tried adding it for a text field with timezone auto-completing for example, and without this handler:

With this handler:

Do like!

Install LAMP

Install PHP modules used by Kohana

Enable rewrite module

Allow for .htaccess overrides

Find the part about the /var/www directory and set AllowOverride from None to All. Then save the file.

Remove annoying Apache warning

If you restart Apache now, you’ll get a warning like this:

apache2: Could not reliably determine the server’s fully qualified domain name, using 127.0.1.1 for ServerName

To prevent that, add a line with “ServerName localhost” to the httpd.conf file.

Restart Apache

What is valid?

To figure that out, we need a look in the ECMAScript Language Specification. In chapter 13 on functions, we find that a function name is a so-called identifier, which is described in chapter 7.6. There we can find the following facts:

Identifier	<IdentifierName> but not <ReservedWord>
IdentifierName	<IdentifierStart> <IdentifierName> <IdentifierPart>
IdentifierStart	<UnicodeLetter> $ _ \ <UnicodeEscapeSequence>
IdentifierPart	<IdentifierStart> <UnicodeCombiningMark> <UnicodeDigit> <UnicodeConnectorPunctuation> <ZWNJ> <ZWJ>
UnicodeLetter	Uppercase letter (Lu) Lowercase letter (Ll) Titlecase letter (Lt) Modifier letter (Lm) Other letter (Lo) Letter number (Nl)
UnicodeCombiningMark	Non-spacing mark (Mn) Combining spacing mark (Mc)
UnicodeDigit	Decimal number (Nd)
UnicodeConnectorPunctuation	Connector punctuation (Pc)
UnicodeEscapeSequence	The definitions of the nonterminal UnicodeEscapeSequence is given in 7.8.4
ZWNJ	U+200C (Zero-width non-joiner
ZWJ	U+200D (Zero-width joiner
ReservedWord	<Keyword> <FutureReservedWord> <NullLiteral> <BooleanLiteral>
Keyword	break, do, instanceof, typeof, case, else, new, var, catch, finally, return, void, continue, for, switch, while, debugger, function, this, with, default, if, throw, delete, in, try
FutureReservedWord	class, enum, extends, super, const, export, import implements, let, private, public, yield, interface, package, protected, static
NullLiteral	null
BooleanLiteral	true, false

Looks long, but not too complicated.

Checking if a string is valid

To check if a string is a valid identifier is now pretty easy. We just need to make sure the string matches the allowed syntax, and that it’s not a reserved word. The first we can solve with a regular expression and the second with a simple white list array. For example, something along the following lines.

Not too complex, although the regular expression might look a bit nuts at first because of all the Unicode character groups. You might find regular expressions other places to do this that uses a-z for the letters, but as you saw from the specification that won’t cover much of what’s actually valid.

I built the expression using the very helpful RegexBuddy and exported an HTML explanation of it. Also threw together a tiny identifier validator thing where you can test it out with. You find it all at samples.geekality.net/js-identifiers.

And that’s that. Hope that might be helpful for someone and please let me know if you find any issues with it!

Note: I have ignored the issue with the Unicode escape sequences for now as I’m not quite sure how to best handle those. From the specification:

A UnicodeEscapeSequence cannot be used to put a character into an IdentifierName that would otherwise be illegal. In other words, if a \UnicodeEscapeSequence sequence were replaced by its UnicodeEscapeSequence’s CV, the result must still be a valid IdentifierName that has the exact same sequence of characters as the original IdentifierName. All interpretations of identifiers within this specification are based upon their actual characters regardless of whether or not an escape sequence was used to contribute any particular characters.

So, I’m not sure if there is a way to just convert those sequences into actual characters or if this is done automatically by PHP as they come in as GET parameters or what. Either way, my code above there is ignoring them. This means, identifiers with escape sequences will not be considered valid. If you have some good ideas on how to handle it, please leave a comment

rgbstock.com

Found an article which explained pretty well why I was a bit confused. It also had a code example in Perl(?).

So, thought I could stick a PHP version here in case that page dies or I forget. Actually there are two. The first calculates the age kind of manually, and can be used in PHP 4 and PHP 5. The second is a lot shorter and simpler, but requires PHP 5.3.

Enjoy

This next function uses the DateTime::diff method available in PHP 5.3.

You can test them out at samples.geekality.net/age

Instant Payment Notification (IPN) is a message service that notifies you of events related to PayPal transactions. You can use it to automate back-office and administrative functions, such as fulfilling orders, tracking customers, and providing status and other information related to a transaction. — PayPal

Once again the documentation, tutorials and code samples I found on this was a bit all over the place. Sort of messy and outdated. So, once again I decided to do my own thing and just follow the steps required and implement them myself. And since the tutorial on PDT turned out to be a bit of a success, I decided to share this too. Hopefully it can make the lives of fellow developers easier

How it works

The concept is pretty simple. You first give PayPal an address to a listener, for example http://business.example.com/ipn/listener.php. Then, whenever something happens, PayPal will post information about the event to that address. So for example if someone completes a payment, your listener will be notified shortly after with the transaction details and all you need to know.

This tutorial will focus on the listener part, as the setting up part on PayPal is very simple (Leave a comment if you disagree). Just go to the PayPal account settings, find the IPN settings and give the URL to your IPN listener. For testing we don’t even need to do that. All we need to do is to set up a PayPal Developer Account. We can then use their very handy Instant Payment Notification (IPN) simulator that you find among their Test Tools. So let’s get started!

Step 0: Sign up for a Developer Account

If you haven’t, go sign up for a PayPal Developer account. We don’t need to set up any accounts this time, as we will simply use the mentioned simulator.

Using the simulator is ultra simple. You just enter the address of your listener and choose a transaction type. You can then fill out all the data that should be in this fake transaction and then just hit “Send IPN” at the bottom. Luckily PayPal actually fills out all the fields with random test data, so unless you are trying to test something specific, you can just ignore the data and hit the button right away

Now, to the actual listener file…

Step 1: Catch the IPN

First thing we need to do in our listener is of course to catch the data we get from PayPal. The data is sent as a POST request, so PHP has actually done that for us. We just need to grab it

Step 2: Verification

Since what we got could just be plain bogus from some stranger, we need to verify it with PayPal. This is done by taking all the POST data in its unaltered state, add one field to the beginning, and then send it back. In return we should then get one word, VERIFIED or INVALID. To do that, we can use our old buddy cURL.

Note that in the very beginning actually check for a field called test_ipn. If that exists with a value of 1, it means it’s a request from the sandbox. In other words, we can choose the correct PayPal interface by just looking for that.

You can also see I set two cURL options called SSL_VERIFYPEER and CAINFO. The reason for that you will find in my post on cURL SSL verification.

Step 3: Fix character set

Now that we know the data is valid, we can start to deal with it. What you get could be in a different character set than what you want though, so we should fix that first. The data should contain a key called charset which specifies what character set the data is using. We just need to check for that and if needed convert from that to what we want, for example UTF-8.

Step 4: Use the data!

Yup, believe it or not, that was everything that was needed to catch an IPN message from PayPal. Where you go from here completely depends on what exactly you need to do.

What you at least should do is the following:

1. Confirm that the payment status is Completed.
   PayPal sends IPN messages for pending and denied payments as well, so don’t ship stuff or anything until the payment has cleared.
2. Use the transaction ID to verify that the transaction has not already been processed.
   This prevents you from processing the same transaction twice. You can for example store the transaction id in a database and check against those before you do anything with incoming IPNs. If you’re smart you could also store the time the IPN came in and the raw IPN data. This way you have a log of all incoming messages you can use if you need to reprocess something or for debugging if something weird is going on.
3. Make sure the receiver’s email address is the one you expected.
4. Make sure the price, item description, et cetera, match what it should be.

And then finally you should of course make sure your customer gets what they should

You can read more about PayPal Instant Payment Notifications in their IPN Guide.

Working sample

I have put together a working sample you can check out over at samples.geekality.net/ipn. Hopefully this tutorial and that sample can help you get started with all of this

I also put together an IPN handler class you can use pretty much out of the box. The sample uses it, and it’s very simple. Just extend the class, override the process method and do what you need. Below is a simple example.

That’s all! I’m sorry it took so long to get this tutorial written, but hopefully someone can find it useful. I have learned a lot writing it at least! Please leave a comment if it was helpful, if it wasn’t helpful, if there are mistakes, typos, or if you just want to say thank you