php Configure HTML Purifier Cache directory HTML Purifier is a great library for sanitization. It just has a somewhat strange default setting when it comes to caching. It uses an internal cache for the structures it
symfony Get global symfony kernel parameters Recently I needed to inject the current environment into a service, but couldn't remember how the parameter Symfony offers for it was named. Luckily you can output the existing parameters
doctrine You might not want to use entity manager / repository in a Doctrine migration But why? It's so appealing. The simple answer: You're going to loose the opportunity to run the migrations from the beginning. Let me explain: Usually you're able to put your
php Escape percent sign in PHP sprintf Why would anybody need to know that? For me it's using it in a sql query in combination with a like request. The simple solution: Use two of them. $likeQuery
php Psalm Collection annotation for Doctrine Psalm is an awesome tool for code quality. What I didn't get for a while was how to annotate Doctrine collections. First I used the array syntax, but then I
doctrine Query for JSON list in MySQL with Doctrine Working with JSON is not as easy in MySQL as in other databases. But even in MySQL there are ways to add more complex queries through Doctrine. In this example
symfony Improve security when working with JWT and Symfony Using JWT for authentication in a SPA with Symfony is very easy thanks to bundles like FOSUserBundle, LexikJWTAuthenticationBundle and JWTRefreshTokenBundle. Unfortunately they don't provide security against XSS attacks (which you
composer Composer tools Recently I had an issue where I switched packages and realized only in production, that a package I use was only available in dev as a dependency and was now
php Calculate last day of month with PHP and DateTime There are multiple options to calculate a the last (or first) day of a month. The most readable I found is the following for the current month: $lastDayOfCurrentMonth = new \DateTime(
apache Prevent XSS through Content-Security-Policy The Content-Security-Policy is a great little step to improve your XSS protection. In short you can define which content is allowed to be loaded through with channel. This can be
typescript Download file through Typescript / Javascript When working with JWT a few things get a little bit trickier. One of the examples is downloading a file through an API. When working with sessions, you can just
composer Composer package not installed Recently I switched from jms/serializer to symfony/serializer. While developing, everything worked great, but on deployment on the live system the error "phpdocumentor/reflection-docblock" not installed appeared.
php Remove array element by value in PHP With collection types like those provided in Doctrine you have methods like removeElement(). When using plain arrays we unfortunately don't have those useful helper functions. What we can use though
php Remove JWT refresh token on logout in Symfony Using JWT has a few advantages when working with SPAs, but also a few security disadvantages. One of them is that (depending on the implementation) with only a refresh token
php Blackfire Setup with MAMP Pro Blackfire is kind of a profiler for pro users and MAMP Pro is used mostly for starters. But that doesn't mean that you're not a pro when using MAMP or
node Increase node memory limit for build When running bigger applications you might run into the memory limit of node. I had that issue recently with an Angular application. Usually the build process is triggered through npm
security Improve JWT security with single use refresh token One of the security issues with JWT is the refresh token used to generate a new JWT. Once an attacker gets access to the refresh token, he can use the
mysql Select for empty JSON array in MySQL Should be as simple as NOT list = '[]', but of course it's not. There is a separate JSON function for it called JSON_LENGTH with which we can check
php Manually check if password is valid in Symfony Just using the same encoder, encoding a plain password and matching those two against each other seams the logical solution, but doesn't work as the hash won't be exactly the
php Prevent XSS through HTML sanitization with HTML purifier Sanitizing of HTML content from a user is one of the most important parts to secure an application against XSS attacks. In PHP you can use a simple strip_tags(
php Generate file name including german umlauts in PHP I build a download for a file where the filename is not the original one but should be dependent on the project name. But those projects contains special characters, so
console Zip file with password on Mac Recently I wanted to send a zip file with a password for sending confidential data to a colleague. But I didn't want to download a separate app for it. Luckily
testing Keep local storage in Cypress When using cypress for tests, your session and local storage data will be cleared after every test. This is a good default, but might make the tests slower as the
security Slow user creation because of password generation in fixtures Creating user for tests can be really time consuming due to the password hashing. This is no accident. The hashing has to be slow. This is no bug, but a
symfony Cors Listener in Symfony backend When working with a frontend and backend on different domains I run into issues with the cors headers. Here's a way to solve them for a Symfony backend. A setup
