You know you're moving up in the world when Microsoft feels that it’s necessary to make cartoon disparaging your products, in favor of their own wares. Pierre, one of the PHP developers, has found this gem on the French segment of the Microsoft site. I guess it means that PHP is making enough in-roads into the Enterprise market, that big fish like MS feel it necessary to spread some FUD as a stop-gap measure. Thanks to Sean Coates we now have an English translation available: http://www.flickr.com/photos/12538148@N00/100864754/

The final (stable) release of FUDforum 2.7.4 is now available for download. This release is a culmination of several month of developed that have resulted in a series of new features as well as a resolution of fair number of bugs. All FUDforum users are encourages to upgrade to this release at their convenience. Code wise the release is virtually identical to 2.7.4RC2. The upgrade and installation packages can be found here: Upgrade Packages Install Packages

My proposal for the php|tek 2006 conference have been approved, which means that I'll be flying to sunny Florida this spring. Given the gloomy weather here in Toronto, it certainly sounds like a lot of fun. On the conference's agenda I have just two items this time; I will be giving an introductory talk on PDO that should be of interest to anyone writing new PHP applications that utilize databases. The other item is a seminar on PHP Security, which will cover web security topics from the ground up, with the focus on web applications designed in PHP. Aside from my own talks, Marco has collected an impressive array of speakers with notables such as Rasmus, Marcus, Derick, John, Sara (who I've never met in real life ;-)) and many others. So if you need to get away from the day to day drudgery and learn something about PHP in the process, this a conference you don't want to miss!

Chris has written a compelling piece about how the use of addslashes() for string escaping in MySQL queries can lead to SQL injection through the abuse of multibyte character sets. In his example he relies on addslashes() to convert an invalid multibyte sequence into a valid one, which also has an embedded ' that is not escaped. And in an ironic twist, the function intended to protect against SQL injection is used to actually trigger it. The problem demonstrated, actually goes a bit further, which even makes the prescribed escaping mechanism, mysql_real_escape_string() prone to the same kind of issues affecting addslashes(). The main advantage of the mysql_real_escape_string() over addslashes() lies in the fact that it takes character set into account and thus is able to determine how to properly escape the data. For example, if GBK character set is being used, it will not convert an invalid multibyte sequence 0xbf27 (¿’) into 0xbf5c27 (¿\’ or in GBK a single valid multibyte character followed by a single...

This morning I've released PHP 5.1.2 , which is a culmination of about 3 months work by PHP developer community. Big thanks to all the developers who have spent the time to make this release possible. This release combines some new features, a fair number of bug fixes and even addresses a few security bugs. If you are using PHP 5, this release is definitely worth upgrading to. The major changes can be found in the release announcement, while if you want to read the entire changelog, you can find it here. Surprisingly enough unlike most PHP release this one was actually right one time and followed the release plan I've made to the letter, hopefully this is something we can keep up. A little bit of trivia, PHP 5.1.2 is my 12th PHP release, which coincidentally was released on January the 12th ;-)