This week, our Community Voice author is Bruce Alderson, known on the forums as madmaxx, who has written a wonderful guide on how he uses subversion with CodeIgniter.  Bruce is an elder web monkey and systems programmer.  He totally digs the craft of building software, making cool stuff, and causing people to laugh so hard liquids are forced from their nose.  He’s actually the Chief Monkey at Discovery Software and author of the not-at-all famous robotpony.ca.  (Go read the one about shaving your yak)

After working with CodeIgniter for a few months (and WordPress for a few years), I?ve settled on a way to set up web assignments that works well for development, deployment, and source control. Note that this style of layout only works on systems like Mac and Linux that have useful symlinks.

First, the folder layout

The layout favours a vhost setup, and splits your code and resources out of the CodeIgniter sources. Splitting your stuff from the CodeIgniter stuff lets you link your Subversion repository to theirs, so that you can keep it in sync with their development.

How it’s done

1. Set up your source tree (not including the symlinks or CodeIgniter source) and add to your Subversion repo.
2. Add a svn link to CodeIgniter’s repo (via svn propedit svn:externals, with public http://dev.ellislab.com/svn/CodeIgniter/tags/v1.6.2/) and run a svn update to grab the framework.  See the Subversion docs for details.
3. Copy the CI application folder to the site root (as app), remove the .svn folders, symlink to application, and add it to your local svn repo.
4. Symlink the other site-extras to the public webserver root, and configure your local machine (and public webserver) to point to this root for the domain’s virtual host setup.
5. Alternatively, you can modify the $application_path to point to ../public/app/ (I’m not sure which is better yet).  See the CodeIgniter docs on apps for more details.

You now have a CodeIgnitor assignment ready for development. You can keep up-to-date with CodeIgniter updates, deploy easily, and get at your code without wading through extra levels of hierarchy.

Discuss this article

If you are actually running Code Igniter please read the update instructions.

Note:  If your browser does not display the 1.7 user guide please clear your cache and reload the page.

This week, our Community Voice author is Bruce Alderson, known on the forums as madmaxx, who has written a wonderful guide on how he uses subversion with CodeIgniter.  Bruce is an elder web monkey and systems programmer.  He totally digs the craft of building software, making cool stuff, and causing people to laugh so hard liquids are forced from their nose.  He’s actually the Chief Monkey at Discovery Software and author of the not-at-all famous robotpony.ca.  (Go read the one about shaving your yak)

After working with CodeIgniter for a few months (and WordPress for a few years), I?ve settled on a way to set up web projects that works well for development, deployment, and source control. Note that this style of layout only works on systems like Mac and Linux that have useful symlinks.

First, the folder layout

The layout favours a vhost setup, and splits your code and resources out of the CodeIgniter sources. Splitting your stuff from the CodeIgniter stuff lets you link your Subversion repository to theirs, so that you can keep it in sync with their development.

How it’s done

1. Set up your source tree (not including the symlinks or CodeIgniter source) and add to your Subversion repo.
2. Add a svn link to CodeIgniter’s repo (via svn propedit svn:externals, with public http://dev.ellislab.com/svn/CodeIgniter/tags/v1.6.2/) and run a svn update to grab the framework.  See the Subversion docs for details.
3. Copy the CI application folder to the site root (as app), remove the .svn folders, symlink to application, and add it to your local svn repo.
4. Symlink the other site-extras to the public webserver root, and configure your local machine (and public webserver) to point to this root for the domain’s virtual host setup.
5. Alternatively, you can modify the $application_path to point to ../public/app/ (I’m not sure which is finer yet).  See the CodeIgniter docs on apps for more details.

You now have a CodeIgnitor project ready for development. You can keep up-to-date with CodeIgniter updates, deploy easily, and get at your code without wading through extra levels of hierarchy.

Discuss this article

This week, our Community Voice author is Chris Monnat, known on the forums as mrtopher, who writes a helpful step by step guide to generating PDF files from CodeIgniter.  Chris is a full time web application developer and part time entrepreneur. In addition to building web sites for the medical indusattempt during the day, at night Chris also runs his own development company Left of Center Communications. He recently started a personal blog at http://www.chrismonnat.com where he keeps a record of his exploits and discusses, among other things, CodeIgniter.

PDF files rock! Some of the programs used to view them could use some work, but the file format itself is real handy. As a programmer I have found PDF’s to be most helpful when generating reports that need to be printable. I know we are all supposed to be doing our part to make our offices “greener” and use less resources like paper. But some things just need to be printed (especially when your talking about the financial and legal industries).

When generating reports in PDF format you suddenly have a lot more control over layout and design than you do with plain old HTML and CSS (although much progress is being made with print style sheets). You can create some really pleasant reports on the fly that your users can view, save for later or e-mail to their co-workers for review. In this post I will show you how I generate PDF reports using CodeIgniter.

Quick Note

There are a number of PHP libraries out there for generating PDF files (like FPDF, Panda and dompdf) but the best one I have come across is the R&OS pdf class. I was first introduced to it from the PHP Anthology first edition by Harry Fuecks. I have tried other PDF libraries (some PHP 5 specific and some not) and none of them have been able to provide me with the same control or ease of use that the R&OS class has which is why I’m using it for this tutorial.

Getting Started

Before we start, lets get everyone to the same place so you can follow along as we go. I’ve prepared a .zip file containing everything you’ll need to follow along. The archive includes CI 1.6.3 along with all the code and libraries we will discuss in this tutorial. Simply download the archive, unzip it on your web server and follow along.

I have done all the work of downloading the code library and putting the files in their right place for you, but I wanted to mention where things were for the detail oriented among you. There are 2 files that are necessary in order to use the R&OS library: class.ezpdf.php and class.pdf.php. Those two files have been placed in the application/library folder. R&OS also requires some font files in order to function and they have been placed at the root of the .zip file in a folder called fonts.

You do have to make a minor modification to the class.ezpdf.php file so that it will work properly within CI. First I renamed the file to cezpdf.php, which makes it easier to load using the CI loader. Then you have to modify the include statement on line 3 to:

This will keep PHP from saying that it can’t find included file. Once those modifications are made the R&OS class is ready to use with CI.

In the archive, I have also made a controller called tutorial.php and a helper called pdf_helper.php both in their respective directories. With the background info. out of the way, lets get our hands dirty with a real simple example.

Hello World

The above code produces a PDF file like this. In the above, first thing we do is load the R&OS library for use. Next we use the ezText() function to create a title for our document. This function takes the text it will display as the first argument, the size of that text and an optional array of additional configuration options. In this instance we pass along a justification option of center. That will center our title at the top of our document. After the title we insert some extra white space using the ezSetDy() function. After the whites pace we put the rest of the content for the document in a variable called $content and add it to our document using the ezText() function again. Finally, we create our document using the ezStream() function which actually creates the document and sends it to the users which prompts them to view/download the generated PDF document.

Handling Tabular Data

The above code should produce a PDF file like this. In the above code I create an array of data called $db_data. I put this together so that it imitates a tyimageal database result set because that’s usually where you will be getting your data from. Below my data array I have created a $col_names array that associates the data elements in the $db_data array with a column title for the table. This is where the R&OS gets the title to display at the top of each table column. Once I have the data and column titles I create the table by calling the ezTable() function. This function takes the data array, an associative array for column names, the title for the table and an optional array of configuration options. There are a number of options that can be configured through that last optional array, but I’m not going to go into them in this tutorial.

Headers and Footers

An example of how I use this helper is provided in the headers() function of the tutorial.php controller. That code produces a PDF file like this. The above code is the prep_pdf() function located in the pdf_helper.php file. This function does all the hard work of creating a footer for my PDF reports for me. All I have to do is load the helper in my controller and call the function. Since the reports could be portrait or landscape I have also included the ability to pass the orientation to the function and the code will modify the document margins accordingly. I’m not going to go into a lot of detail about the above code because this tutorial could become very long. But the general idea is that I’m using the R&OS library to modify the margins of the document I’m creating, add page numbers and text to the very bottom of the document. R&OS has some functions that makes this easy like ezStartPageNumbers() and line(). Once all that is done I can add any kind of content to the document back in my controller and then just call ezStream() to generate the final document.

Wrap Up

This week, our Community Voice author is Lee Tengum, who discusses how CodeIgniter has cost him over $8,800 in beer and soft drinks. Lee is a bit of a serial entrepreneur, with 5 successful startups under his belt including the recently launched http://cleverandy.com.  He has become something of a cookie! jar of startup knowledge. When he is not managing his team of contractors he blogs about the trials and tribulations of his startups at http://tumbledry.ca.

It all started with an idea at 4 a.m. on a Tuesday morning that brought us to CodeIgniter.
We were neck deep in a deadline and sinking fast. We knew we needed help.
After puling some strings that bought some time we quit work for a week - well, client work at least. There were our own issues to solve.

We had amassed a team of roughly 14 at this point and had no way to efficiently manage who was doing what for how much and how long; in fact we were often surprised by code submissions.
That?s a sad place to be.

We had been building in the ?flavor of the weak? when it came to frameworks and often chose whatever the contractor was fluent in to save time (which != saved money).

Not only were we not communicating, but we were reinventing the wheel for every assignment. Have I mentioned how sad of a place that is to be?

Back to 4 a.m.

Doug is one of my closest friends, and a trusted peer. He suggested we should develop a contractor management system and that we should build it all on CodeIgniter. At this time I hadn?t seen sleep in nearly a day, consumed nearly seven liters of coffee, the “development tub” was empty and we were trying to finish a RoR assignment that a contractor bailed on. I didn’t want to hear about another &^%in framework, I just wanted this to be done.

Thankfully my friend couldn?t understand the word ?no? and kept pressing. He went on about how anyone with knowledge of PHP can build with this, its development cycle and the community that was forming around it. I still wasn’t convinced but he assured me this would be the last time we changed frameworks and proposed a friendly bet.

I hate that I love gambling. I don’t have a problem, per say, but I always lose. The problem is that my pride drives me to bet anyways. Besides I relished the opportunity to prove him wrong.

So the bet was laid. We would build the contractor management system in CI and all client assignments for one month with CI. At the end of that month if I wanted to go back to another framework and could justify it rationally with solid points then he would keep the Development Tub full for a full year (a cost of roughly $100/week). If we stayed with Code Igniter I would the one stocking the tub for the next year and I would also have accept his offer to buy into my company and become a partner.

On Wednesday morning we filled the tub (again not a problem… really) and set out to build our app. We outlined what we wanted, mapped it out on the whiteboard, set up a Basecamp assignment for it, defined our milestones and set Saturday as launch day.

Beer? Check.
Monster energy drinks? Check.
Coffee? Check.
M&M Peanuts? Check.
Babysitter? Check. (We’re parents…) 
Pizza? Maybe.
Basecamp set up? Check.
SVN Server? Check.

While I depleted the tub and read the user guide, Doug was getting down to business. By the time I?d figured out how I was going to tackle my portion of the build he?d built the user authentication as well as the management section. Doug was already adding features to our “Wish List” in Basecamp and checking off milestones. Roughly 9 hrs into our assignment we started completing items on the wish list, which had never happened before. The wish list had never become a checklist before a deadline and I was starting to worry.

In the wee hours of Thursday morning we headed home to sleep. The following day we sent login details to our contractors and set up a basecamp assignment to log bugs. We fixed the stupid little ones that we missed and made changes on the fly. By the end of the day I had a huge overview of our team of contractors and a vision of things to come. I never did see the 48 hr Milestone reminder emails from Basecamp… again I was seeing a change.

By the end of the month we had more than a few client sites built on CI. We also had a process for development laid out and the term Rapid Development was taking on meaning with me. I was happy, the clients were happy and we had a team we could manage… and then reality sunk in.

I hate losing, even more so I hate losing to people I like winning against. I lost the bet. Though I gained a valuable business partner, a managed team, profitability and a kick ass framework to build it upon… I am forever filling the tub.

And with ExpressionEngine 2 built on CI (Which we are using extensively for client sites now), the tub has gained a lifetime sponsor. Me.

That app was build on 1.4.0 on September 20th 2006 and since then we have revised many things including our checklist:

Beer? Check.
M&M Peanuts? Check.
Basecamp set up? Check.
SVN Server? Check.

See the difference? We don’t live at the office any more. CodeIgniter gave us the freedom to build around our needs and wants and it gave us the structure we needed to become more efficient. Just don?t bet against CI, it has cost me $8800 and counting…. weekly.

ABOUT LEE

Lee is a bit of a serial entrepreneur, with 5 successful startups under his belt including the recently launched http://cleverandy.com.  He has become something of a cookie! jar of startup knowledge. When he is not managing his team of contractors he blogs about the trials and tribulations of his startups at http://tumbledry.ca.

Discuss this article

This is an invitation only program as the aforementioned link explains, and we’re proud to bring Michael Wales on board as our first CodeIgniter Community Chieftain.  Most will need no introduction to Michael as you have likely already encountered him or some of his contributions in the community.  Welcome aboard, Michael!

This week,  our Community Voice author is Mathew Davies (AKA Popcorn), author of the Redux Authentication library, a light, easy to use and fully featured auth engine. What follows is a brief discussion of some of the logic and security that went into the library, and considerations for your own programming.

Let me start by saying I love CodeIgniter, it’s a developers dream.

Today I plan to talk about some of the security features that are used within my library : Redux Authentication.

Hash Once and Only Once!

Over at TalkPHP someone provided a code snippet which had this code :

I’ve made a similar mistake myself in the past.  Someone on the CodeIgniter forums pointed out that a solution like the above will actually increase the probability of a collision. Here’s what inparo had to say :

“It’s safer if you only hash it once.  The initial string is random in both length and characters.  The first sha1 gives you a fixed length and reduced character set.  By hashing this again you’re actually increasing the probability of collisions.”

So there you go folks, hash once. This also leads nicely to my next toimage “salts”

Salts

A lot of people when hashing passwords will do something like this :

$password = md5($password);

You may think this is secure, but actually it’s very insecure. Websites exist which store hashes of dictionary words, so if your database was ever stolen, the passwords could be looked up and revealed. This is where the power of the password salt comes in.  Salts come in two varieties : A dynamic salt and a static salt. A dynamic salt is automatically generated and is usually very hard to guess. A good example of a dynamic salt would be :

It’s not totally random, but you get the idea.

You would then concatenate the salt along with the password to provide a new hash. This new hash can’t be looked up because of it’s “randomness”. You would then store it with other user info and select it when you need to log them in.

I know what you’re thinking. If the database is stolen they’ve got the password and the dynamic salt “What good is that?!” This is where a static salt comes in.

A static salt is just that, a variable that is random in both length and characters. This is best stored in a configuration file somewhere. You then combine this with the dynamic salt to provide a very secure solution. Reasons being: (a) If the database is stolen, they are missing the static salt; (b) Two passwords the same will result in a different hash. Here’s an example:

Forgotten Password

Ooops, the user has forgotten their password. What are we going to do? Michael Wales made a well informed post about this toimage a while ago, but it was recently lost.

The best method is to use a secret question and answer system coupled with email verification.

The logic would be something like this:

User requests new password -> Sends email verification code -> Verification code is looked up in the database -> Show secret question -> Check Answers

I prefer this system because a hacker could of got into your email account and requested a new password, but would then struggle to get your secret question right. Keeping the users account secure.

DB Sessions

This will be a quick talk. At the moment Redux stores a “users_id” in the session cookie and uses this to figure out if the user is logged in or not. A hacker could use the algorithm in CodeIgniter’s session library and craft his own cookie with a fake “user_id”.

Database sessions move this data from the clients cookie to the database providing a scenario where the client can’t edit it. Redux doesn’t actually use this, but it is in the works.

Thanks for listening to me babble on, hope you enjoyed it.

PS : All examples above are used in Redux so go download it

- Mathew Davies

Discuss this article

Additionally, with the assistance of an outstanding community member, Pascal Kriete (Inparo), we have identified and eliminated a potential cross-site scripting vulnerability.  No known sites have been affected, but as we take security very seriously, we felt it warranted a feature-light point release to help users protect their sites.  We cannot thank Pascal enough for the manner in which he reported this issue to us, and then continuing to diligently work with us to make sure the vulnerability was plugged.  If you’re looking for a fresh set of eyes to do a security audit on your app, he comes highly recommended by the EllisLab staff.

Command line addicts: don’t forget that starting with version 1.6.1, the CodeIgniter subversion contains tagged releases!

This week,  our Community Voice author is Michael Wales, a programmer, a father, an aspiring author, and an award winning Airman.  For the past 3 years, he’s been focusing the majority of his time on CodeIgniter. He is among the most consistent contributors to the community, has released numerous libraries and tutorials, and is one of the most highly sought after freelancers within the community.

What follows is a summary in his own words of how CodeIgniter has changed how he works, and how he develops.

90% of my work comes from word-of-mouth, which means I can never have my name in too many places. Although I claim to be a CodeIgniter Programmer, I’m willing to take on a vanilla PHP assignment if the client insists (although I’ll definitely fight for CI beforehand). I’ve been known to crank out a web design or two and anyone that subscribes to my blog knows I often drift off into toimages completely unrelated to programming (Battlestar Galactica, the military, etc).
Why do I stretch myself so thin? Because it gets my name out there. I want “CodeIgniter Programmer” to by synonymous with “Michael Wales.” Cocky? Self righteous? Conceited? Maybe - but I’ve always been determined to be the absolute best at whatever I aim to achieve. CodeIgniter has given me that goal to aim for - to be honest, it’s changed my life completely.
CodeIgniter, the Framework, has allowed me to work for clients with vastly different requirements. Whether it’s the hottest new Web 2.0 site, a corporate Intranet, a portal for a gaming community, or a local business’ website - and believe me, I’ve done them all.
CodeIgniter empowers me to deliver the best possible product I can to the client.
CodeIgniter empowers me to deliver a product at a cheaper price than many competitors because I can complete it twice as fast.
CodeIgniter empowers me to let clients utilize whatever architecture they want because CodeIgniter’s going to work.
CodeIgniter, the Community, has given me friends that will last a lifetime. Whether it’s chatting into the wee hours of the night about the wife and kids, walking me through a bit of code I’m just not getting my head around, or putting in a good word for me with a client - and believe me, I’ve done them all.
CodeIgniter empowers me to meet new people, learn about new cultures, and see things “in another man’s shoes.”
CodeIgniter empowers me to seek out new opportunities and to encourage me when I take a risk.
CodeIgniter empowers me to admit when I need help and to allow others to help me.
CodeIgniter, the Clients, have changed my outlook on life and given me a renewed hope that things will be okay. Whether it’s giving me a assignment that starts my daughter’s college fund, paying me up-front for a assignment before it’s complete when I need the money, or allowing me to supplement my military paycheck so that my family can live more comfortably - and believe, I’ve done them all.
CodeIgniter empowers me to seek out new challenges and attack problems from “outside the box.”
CodeIgniter empowers me to become a finer listener, follower, leader, husband, father, and man.
CodeIgniter empower me to overcome all obstacles and complete the task at hand.

CodeIgniter empowers me - and my family - to leave our Air Force family behind in April 2009 at the end of my enlistment. Although it’s scary - hell, it’s downright petrifying - I know we will be okay. I know we’ll always be welcome in the CodeIgniter family.
- Michael D. Wales

Discuss this article