Make Sure Everyone is on the Same Domain

Even if you don’t have multiple domains pointing to your site, it’s possible that www.example.com and just example.com will work.  If that’s the case, Google and other search engines could be crawling your site twice and the website could take a ranking hit for duplicate content.  The following example shows how we can redirect visitors from two domains down to one.

RewriteCond %{HTTP_HOST} ^www.example.net$ [NC,OR]
RewriteCond %{HTTP_HOST} ^example.net$ [NC,OR]
RewriteCond %{HTTP_HOST} ^www.example.com$ [NC]
RewriteRule ^(.*)$ http://example.com/$1 [R=301,L]

Force SSL on Specific Site Directories

I use SSL on a couple of my sites, but it doesn’t need to be enabled (or forced) on the entire site, so we use .htaccess mod_rewrite rules to enforce SSL where we need it.  The following peice of code will force SSL on all requests in the directory named ‘secure’.

RewriteCond %{HTTPS} off
RewriteRule ^secure/.*$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

Both of these lines need to be copied if we need to enforce more than one directory, so if we need the directory ‘secure’ and the the directory ‘users’ secured, we would use this code.

RewriteCond %{HTTPS} off
RewriteRule ^secure/.*$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

RewriteCond %{HTTPS} off
RewriteRule ^users/.*$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

For the rest of the site, we don’t need SSL, so use something like this if we have the ‘secure’ and ‘users’ directory with SSL enabled.

RewriteCond %{HTTPS} on
RewriteCond %{REQUEST_URI} !secure/.*$
RewriteCond %{REQUEST_URI} !users/.*$
RewriteRule ^(.*)$ http://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

Force SSL on a Domain or Sub-Domain

Similar to the need above, we can force SSL on an entire domain if we need to.

RewriteCond %{HTTPS} off
RewriteCond %{HTTP_HOST} ^wells-it.com$ [NC]
RewriteRule ^.*$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

Take a Website Offline

If a website needs to go down for maintenance or whatever, that can be done with a simple few lines of code.  Just remember to change the page’s path in both lines where you see not-up.htm, or you could create a redirect loop.

RewriteCond %{REMOTE_HOST} !^123\.214\.71\.126
RewriteCond %{REQUEST_URI} !/static/not-up\.htm$
RewriteRule .* /static/not-up.htm [R=302,L]

Remove ‘index.php’ From the URL

This is one that will come in handy if you use CodeIgniter or any other framework that sends all requests through index.php.  Basically, this code checks to see if the URL request exists as a static file or directory.  If does, it would be a picture, style sheet, javascript include, etc.  If it is not found, then it assumes that it must be for the framework to handle, and it sends it to the index.php file.

RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ /index.php/$1 [L]

Keep Visitors Off the Stage

On my large sites, I have both a production copy and a stage copy.  The stage copy is where I do all my developing and testing.  When I am satisfied with the changes, I push the changes to my live site.  The problem is that I don’t want site visitors seeing my stage copy, so I use some mod_rewrite code to keep them off.  You need to know your IP address for this one, and if you have a dynamic IP, you will have to change the file every time you get a new one.

RewriteCond %{REMOTE_HOST} !^56\.51\.98\.126
RewriteCond %{HTTP_HOST} ^stage.wells-it.com$ [NC]
RewriteRule ^(.*)$ http://wells-it.com/$1 [R=301,L]

If you have multiple IP address that you want access to the stage, you can just add another condition.

RewriteCond %{REMOTE_HOST} !^56\.51\.98\.126
RewriteCond %{REMOTE_HOST} !^74\.65\.95\.128
RewriteCond %{HTTP_HOST} ^stage.wells-it.com$ [NC]
RewriteRule ^(.*)$ http://wells-it.com/$1 [R=301,L]

Turn .htaccess Into a Web Application Firewall

I didn’t write this one, so I can’t take credit for it, but you can find the code here.  It contains some very slick code to keep malicious page requests from getting through to your web applications.

Final Notes

Since some of these URL rewrites actually redirect the browser, it’s possible to get into a redirect loop where you will never satisfy the rules you have in place, and the browser will redirect forever…until it detects a loop and stops with an error.  If this happenes, try to see where the loop is or post a comment if you’re stuck.

Now to review, the fact that they say they are not supporting it on their website does not mean that you won’t be able to use it. It just means that you shouldn’t expect any more updates. According to PHP’s website, they won’t be releasing any major updates to PHP 4.4 after this year, and they will be releasing critical updates on a case-by-case basis only until August 08, 2008.

I upgraded my commercial web server to run PHP 5 this last summer (’06) after running it on my development server several months before that. If you are behind me and still have yet to check your code for PHP 5, you might as well check for possible changes that are going to be made in PHP 6.

First, head on over to PHP’s guide to Migrating from PHP 4 to PHP 5. Once you clear your code to PHP 5 standards, put in the extra effort now to make sure you are ready for PHP 6 by not using any of the functions below as they will be removed.

• register_globals will be no more. This feature was disabled by default in PHP 5 to encourage developers to merge away from it, but in PHP 6, it’s gone for good.
• magic_quotes will be no more. This feature escaped all incoming data with in my opinion was annoying, so I disabled it on my websites and only escaped the data that needed to be.
• safe_mode will be no more.
• HTTP_*_VARS are gone. Use _POST, _GET, _COOKIE, _SESSION instead.
• Returning reference will be removed.

See phpmysqldev.blogspot.com for more information on PHP 6.

The following templates are ready to go after including it in the TBS class. If you require more help or even implementation code, scroll down beyond the template code.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35

<?xml version="1.0" encoding="[var.info.charset]"?>
<rss version="2.0">
 
   <channel>
      <title>[var.info.title]</title>
      <link>[var.info.link]</link>
      <description>[var.info.description]</description>
      <language>[var.info.language]</language>
      <managingEditor>[var.info.email]</managingEditor>
                <copyright>Copyright [var.info.year]</copyright>
      <generator>[var.info.generator]</generator>
      <pubDate>[var.info.pub_date]</pubDate>
      <ttl>60</ttl>
      <image>
         <link>[var.info.link]</link>
         <title>[var.info.img_title]</title>
         <url>[var.info.img_url]</url>
      </image>
 
      [blkItems;block=begin]
 
      <item>
         <title>[blkItems.title]</title>
         <link>[blkItems.link]</link>
         <comments>[blkItems.comments]</comments>
                        <description><![CDATA[ [blkItems.description] ]]></description>
         <guid isPermaLink="false">[blkItems.guid]</guid>
         <category>[blkItems.category]</category>
         <pubDate>[blkItems.pub_date]</pubDate>
      </item>
 
      [blkItems;block=end]
 
   </channel>
</rss>

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35

<?xml version="1.0" encoding="[var.info.charset]"?>
<feed xmlns="http://www.w3.org/2005/Atom" xml:lang="[var.info.lang]">
   <title>[var.info.title]</title>
   <subtitle>[var.info.description]</subtitle>
        <link rel="alternate" type="text/html" href="[var.info.link]"/>
        <link rel="self" type="application/atom+xml" href="[var.info.atom_link]"/>
   <updated>[var.info.updated]</updated>
   <author>
   <name>[var.info.author_name]</name>
   <uri>[var.info.link]</uri>
   <email>[var.info.email]</email>
   </author>
   <id>[var.info.link]</id>
   <rights>Copyright (c) [var.info.year], [var.info.author_name]</rights>
 
   [blkItems;block=begin]
 
   <entry>
      <title>[blkItems.title]</title>
      <link rel="alternate" type="text/html" href="[blkItems.link]" />
      <updated>[blkItems.updated]</updated>
      <published>[blkItems.pub_date]</published>
      <id>[blkItems.link]</id>
      <summary type="text">[blkItems.summery]</summary>
        <content type="html" xml:lang="[blkItems.lang]" xml:base="[blkItems.link]"><![CDATA[
                [blkItems.content]
      ]]></content>
      <author>
         <name>[blkItems.author]</name>
      </author>
   </entry>
 
   [blkItems;block=end]
 
</feed>

Please note that in my examples, I don’t include classes before I define them because I make use if PHP’s __autoload() function. Since you probably don’t, insert the necessary include statement(s) before any object declaration statements. Most of the variables are self-explanatory in this file. Lines 12-23 define fields that are for the general feed, and data that does not pertain the the individual elements. Lines 30-48 take care of the feed items. In my example, I run a MySQL query, and feed that data into a complex array. You can populate that array any way you want as long as you keep those element names the same and keep that MergeBlock function alone online 48.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52

<?php
   /* make sure that we are sending the correct header */
   header('Content-type: application/rss+xml');
 
   /* create template object */
   $tbs = new clsTinyButStrong();
 
   /* set main template */
   $tbs->LoadTemplate('rss_2_0.xml', false);
 
   /* define information fields */
   $info['charset'] = 'utf-8';
   $info['title'] = '';
   $info['link'] = '';
   $info['description'] = '';
   $info['language'] = 'en';
   $info['email'] = '';
   $info['year'] = '';
   $info['generator'] = '';
   $info['pub_date'] = date('r');
   $info['img_link'] = '';
   $info['img_title'] = '';
   $info['img_url'] = '';
 
 
   /* for this section, you can include your entries through a query (if your column names 
      match up with the fields), or a data array */
 
   /* I'm going to use a data array from a MySQL table.  The following is an example on how to do the data block  */
   $query = "SELECT * FROM Fields ORDER BY date DESC";
   $result = /* code to process your MySQL query */;
 
   for ($i = 0; $i < mysql_num_rows($result); $i++)
   {
      $row = mysql_fetch_assoc($result);
 
      $blkItems[] = array(
                           'title' => '',
                           'link' => '',
                           'comments' => '',
                           'description' => '',
                           'guid' => '' . '@' . 'http://your.site.here',
                           'category' => '',
                           'pub_date' => date('r', )
                        );
   }
 
   $tbs->MergeBlock('blkItems', $blkItems, true);
 
   /* show output, but don't stop the script */
   $tbs->Show(TBS_OUTPUT);
?>

Please note that in my examples, I don’t include classes before I define them because I make use if PHP’s __autoload() function. Since you probably don’t, insert the necessary include statement(s) before any object declaration statements. Most of the variables are self-explanatory in this file.
Lines 12-23 define fields that are for the general feed. Lines 30-50 take care of the feed items. In my example, I run a MySQL query, and feed that data into a complex array. You can populate that array any way you want as long as you keep those element names the same and keep that MergeBlock function alone online 52.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56

<?php
   /* make sure that we are sending the correct header */
   header('Content-type: application/atom+xml');
 
   /* create template object */
   $tbs = new clsTinyButStrong();
 
   /* set main template */
   $tbs->LoadTemplate('atom.xml', false);
 
   /* define information fields */
   $info['lang'] = 'en-US';
   $info['charset'] = 'utf-8';
   $info['title'] = '';
   $info['description'] = '';
   $info['author_name'] = '';
   $info['link'] = '';
   $info['email'] = '';
   $info['tag'] = '';
   $info['pub_date'] = date('Y');
   $info['updated'] = date('c');
   $info['year'] = date('Y');
   $info['atom_link'] = 'http://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];
 
 
   /* for this section, you can include your entries through a query (if your column names 
      match up with the fields), or a data array */
 
   /* I'm going to use a data array from a MySQL table.  The following is an example on how to do the data block  */
   $query = "SELECT * FROM Fields ORDER BY date DESC";
   $result = /* code to process your MySQL query */;
 
   for ($i = 0; $i < mysql_num_rows($result); $i++)
   {
      $row = mysql_fetch_assoc($result);
 
      $blkItems[] = array(
                           'lang' => 'en-US',
                           'author' => 'Andrew Wells',
                           'title' => htmlspecialchars($row['title']),
                           'link' => PATH_WEB_HOME . 'fields/' . $row['slug'] . '/',
                           'comments' => PATH_WEB_HOME . 'fields/' . $row['slug'] . '/',
                           'summery' => $row['intro'],
                           'content' => $row['intro'],
                           'guid' => $row['field_id'] . '@' . PATH_WEB_HOME,
                           'category' => 'Fields',
                           'updated' => date('c', strtotime($row['updated'])),
                           'pub_date' => date('c', strtotime($row['added']))
                        );
   }
 
   $tbs->MergeBlock('blkItems', $blkItems, true);
 
   /* show output, but don't stop the script */
   $tbs->Show(TBS_OUTPUT);;
?>

It is my best guess that the image verifications are the hardest to crack, so in theory, if you tweak that, the bots will not be able to adapt to it.

1. Make sure you have the latest version of phpBB installed (given)
2. Enable image verification, and user activation
3. Open up phpbb/includes/usercp_confirm.php
4. Find tweakable values. Some examples are $total_width, $total_height, $img_width, $img_height, $width, (you get the idea)
5. Preview as you tweak to make sure the images are still readable, yet make sure you are making noticeable changes.

I tweaked the $width variable on line 87 to the point where some of the letters were getting squished together and getting cut off by a few pixels, and that was enough for me.

I tried this method on a board that was getting 10-15 spam registrations a day. It’s been spam free for almost a month now.

If you find a method that woks, post it, but generalize it. If you get too many people start copying you exactly, it will make it work the spammer’s time to adapt to it. Remember, the key is to make your board different from all the others.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57

<?php
 
	/*
	*	snippet_geshi.php: inserts formatted code into the Pivot blog entries
	*	Copyright (C) 2007  Andrew Wells <contact@pr0gr4mm3r.com>
	*	
	*	This program is free software; you can redistribute it and/or
	*	modify it under the terms of the GNU General Public License
	*	as published by the Free Software Foundation; either version 2
	*	of the License, or (at your option) any later version.
	*	
	*	This program is distributed in the hope that it will be useful,
	*	but WITHOUT ANY WARRANTY; without even the implied warranty of
	*	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
	*	GNU General Public License for more details.
	*	
	*	You should have received a copy of the GNU General Public License
	*	along with this program; if not, write to the Free Software
	*	Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
	*	
	*	Assuming a php code file called 'code.txt' in the DOC_ROOT/pivot/code directory, call like this:
	*	[[geshi:code.txt:php]]
	*/
 
	function snippet_geshi($code_loc, $code_lang) {
	   global $Paths;
 
	   $code = file_get_contents($_SERVER['DOCUMENT_ROOT'] . "/pivot/code/" . $code_loc);
	   $code = stripslashes($code);
	   $code_lines = count(file($_SERVER['DOCUMENT_ROOT'] . "/pivot/code/" . $code_loc));
 
	   if ($code_lines < 11)
	   {
	   	$height = ($code_lines * 15) + 40;
	   }
	   else
	   {
	   	$height = 300;
	   }
 
	   // Create a GeSHi object
	   $geshi =& new GeSHi($code, $code_lang);
	   $geshi->enable_line_numbers(GESHI_FANCY_LINE_NUMBERS);
	   $parsed = $geshi->parse_code();
 
		$download_info = '<div style="color: #7F7F7F; font-size: 8pt; margin: 0 auto; margin-bottom: 15px; overflow: auto; width: 90%; ">
			The above code is not formatted for copying.  <a href="' . PATH_WEB_HOME . 'code_download.php?loc=' . $code_loc . '">
			Click here</a> for the code in plain text.</div>';
	   $start = '<div style="background-color: #F8F6F6; border-color: #000000; border-style: solid; border-width: 1px; height: ' . $height . 'px; margin: 0 auto; margin-bottom: 2px; margin-top: 20px; overflow: auto; width: 90%;">';
	   $end = '</div>';
 
	   $finished_code = $start . "n" . $parsed . "n" . $end . $download_info;
 
	   #echo $finished_code;
	   return $finished_code;
	}
?>

This snippet reads a code file and displays in an entry using the GeSHi script. The above code is what you need to show code in your blog entries. There are, however, a few changes that will probably need to be made.

• See lines 28 & 30. If your code folder is in a different location, please change these paths. (You will have to create the code folder)
• See lines 46-48 & 52. If you do not decide to include a link to download the code (see second hunk of code in this entry), you will need to remove lines 46-48 and edit line 52 accordingly.
• Change “PATH_WEB_HOME” on line 47 to your site’s home path (for example “http://www.yoursite.com/”)
• Please note that the GeSHi object is declared on line 42, but the GeSHi class file is never included. That’s because I use PHP’s autoload() function. You are responsible for installing the GeSHi script and including it where necessary.

That should be it! See the code below to allow users to download the code for easier copying.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40

<?php
	/*
	*	code_download.php: code_download.php is designed to work with the GeSHI snippet for Pivot
	*	Copyright (C) 2007  Andrew Wells <contact@pr0gr4mm3r.com>
	*	
	*	This program is free software; you can redistribute it and/or
	*	modify it under the terms of the GNU General Public License
	*	as published by the Free Software Foundation; either version 2
	*	of the License, or (at your option) any later version.
	*	
	*	This program is distributed in the hope that it will be useful,
	*	but WITHOUT ANY WARRANTY; without even the implied warranty of
	*	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
	*	GNU General Public License for more details.
	*	
	*	You should have received a copy of the GNU General Public License
	*	along with this program; if not, write to the Free Software
	*	Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
	*/
 
	$filename = urldecode($_GET['loc']);
 
	/* this should only be a filename, take out any directory references */
	$filename = str_replace('..', '', $filename);
	$filename = str_replace('/', '', $filename);
 
	header('Content-type: application/txt');
	header('Content-Disposition: attachment; filename="' . $filename . '"');
 
	if (file_exists($_SERVER['DOCUMENT_ROOT'] . "/pivot/code/" . $filename))
	{
		$dump = file_get_contents($_SERVER['DOCUMENT_ROOT'] . "/pivot/code/" . $filename);
 
		echo stripslashes($dump);
	}
	else
	{
		echo "File not found.";
	}
?>

The only thing you may have to edit here is the path to the code files if you changed them from the default. Find all instances of ‘$_SERVER['DOCUMENT_ROOT'] . “/pivot/code/”‘ and edit accordingly.

[sourcecode language="php" collapse="true"]
<?php
/* This code created by Andrew Wells (www.pr0gr4mm3r.com) */
/* Your comments or questions are welcome: contact@pr0gr4mm3r.com */

include("includes/Snoopy.php");

/* first, reform the variables to post them back */
$post_vars['cmd'] = ‘_notify-validate’;
$post_vars['ipn_test'] = 1;

foreach ($_POST as $key => $value)
{
$post_vars[$key] = $value;
}

/* now send the data back */
$snoopy = new Snoopy;
$submit_url = ‘http://www.sandbox.paypal.com/cgi-bin/webscr’;

/* uncomment these lines if you use GoDaddy.com as your host */
/* $snoopy->proxy_host = "proxy.shr.secureserver.net";
$snoopy->proxy_port = "3128"; */

$result = $snoopy->submit($submit_url, $post_vars);

if ($result)
{
$headers = implode("\n", $snoopy->headers);
$content = $snoopy->results;

if (strpos(‘VERIFIED’, $content) !== FALSE)
{
/* information checks out, but be sure to verify payment information and amount */

}
else if (strpos(‘INVALID’, $content) !== FALSE)
{
/* information is invalid; possible spoofing */

}
}
else
{
/* connection failed */

}
?>[/sourcecode]
The above code is what I now use to test and post-back my PayPal Instant Payment Notifications. It does make use of the Snoopy script, so be sure to download yourself a copy here if you don’t have it. This is much better than PayPal’s sample because 1) it works, and 2) it is neater code because it uses the Snoopy class.

Points to address:

• This script is meant to post to the PayPal Sandbox. When implementing this script for real, comment out line 9, and take out ‘sandbox.’ on line 18.
• Uncomment lines 21-22 if your host if GoDaddy.
• Line 34 is where you put the code for a successful verification*.
• Line 39 is where you put the code for an unsuccessful verification (possible spoofing).
• Line 44 is where you put the code to handle a connection failure.

*A successful validation does not mean all the information is correct, especially if you aren’t using encrypted PayPal buttons. You still want to verify all payment information.