--- title: "Exakat 1.5.5 review" url: https://www.exakat.io/exakat-1-5-5-review/ date: 2018-11-27 modified: 2020-10-06 author: "dams" description: "[caption id=\"attachment_4446\" align=\"alignleft\" width=\"300\"] Exakat 1.5.5 review[/caption] Exakat 1.5.5 Review Exakat 1.5.5 is the sinkterklas version : it brings a lot of speed, reports and analysis on its boat, from..." categories: - "Code auditing" - "Technology" tags: - "files" - "fputcsv" - "http headers" - "php" - "php city" - "report" - "security" image: https://www.exakat.io/wp-content/uploads/2018/11/sinkterklas.320.jpg word_count: 1325 --- # Exakat 1.5.5 review [![](https://178.62.231.40/wp-content/uploads/2018/11/sinkterklas.320-300x300.jpg)](https://178.62.231.40/wp-content/uploads/2018/11/sinkterklas.320.jpg)Exakat 1.5.5 review # Exakat 1.5.5 Review Exakat 1.5.5 is the sinkterklas version : it brings a lot of speed, reports and analysis on its boat, from Spain. Seriously, Exakat 1.5.5 now reports your HTTP headers for unsafe configuration; it also suggests speed up tricks for fputcsv(), and it recommends using the *file() functions, instead of file*get_contents(). Then, Exakat turns your code into a city, with the help of PHP City. [Hij komt, hij komt](https://www.youtube.com/watch?v=BAvbhUMTF9E), the Exakat 1.5.5 review. ## Speed up fputcsv() [fputcsv](http://www.php.net/fputcsv) is a native function that writes files in the [CSV](https://en.wikipedia.org/wiki/Comma-separated_values) format. It takes a single dimensional array, and add the separator, and the optional enclosing characters. Since it only accepts one row at a time, it is often used this way : ``` ``` ``` ``` This is pretty convenient, but it tends to be a slow process. The fputcsv() actually write the line at call time, leading to a lot of flushes. Those are slow. It would be a lot faster to batch all the rows into one large text, and then, fwrite() it into the file. While writing the CSV format manually is not too difficult, it is not convenient. fputcsv() does the work fast and clean, while rewriting the proper escaping of all elements in the array is gruesome. It would be nice to have fputcsv() as a formater, decoupled from the file pointer it requires as first argument. Actually, this thought is the origin of this nice speed trick : let's give fputcsv() a file to write on, then let's use fwrite() to the disk in one shot. Of course, such a temporary file shouldn't be on the disk, but in memory. So, we can rely on `php://memory` or `php://temp`. Those are special file that fopen() recognizes : the first one creates the file in memory, while the second creates the file in memory until a certain size. By default it is 2 Mb, but it may easily be configured. When using `temp`, PHP will automatically write the `temp` file on the disk when it reaches 2 Mb, so this will defeat our own target. So, we stick with `memory`. Here is how it works : ``` ``` ``` ``` First, we open the memory file, and write everything with fputcsv(). Then, we rewind the file, and pour it in one shot into the destination file. When writing 300 000 rows on the disk, fputcsv() in a foreach requires 1,192 ms, while the php://memory trick requires 308 ms. This is almost a 4-times speed up, for about 1 Mb of data on the disk. The php://memory trick is interesting, as it shifts a flushing problem to a memory problem. Beware of this if you're manipulating very large CSV, as the script may eat up all the memory. Otherwise, this acceleration is available starting with the smallest arrays, so there is no reason to avoid it! ## Security HTTP header From the [MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/access-control-allow-origin) web docs : The HTTP `X-XSS-Protection` response header is a feature of Internet Explorer, Chrome and Safari that stops pages from loading when they detect reflected cross-site scripting (XSS) attacks. The `Access-Control-Allow-Origin` response header indicates whether the response can be shared with requesting code from the given origin. Both those headers may be emitted from the PHP application, to change the security level. `X-XSS-Protection` may be set to 0, and `Access-Control-Allow-Origin` may be set to `*`, which are unsafe. Anytime headers are identified in the code as doing so, they are now reported. ``` ``` ``` ``` ## Use the _file() function Quite a number of PHP function have a `_file` version, that manipulates a file directly. For example, the `hash` function. ``` ``` ``` ``` Sadly, for those of use who keeps forgetting that file, the alternative is to use the `hash` function, after reading the file with file_*get_*contents(); ``` ``` ``` ``` The performance gain is not significant, but memory is saved in the process, leading to a less greedy script. ## The PHPcity report A new report was added to the current list : PHPcity. It originates from the [`code city`](https://wettel.github.io/codecity.html) source code visualisation, invented by `Richard Wettel`. [![](https://178.62.231.40/wp-content/uploads/2018/11/phpcity.792-300x300.png)](https://178.62.231.40/wp-content/uploads/2018/11/phpcity.792.png)Spot those large tall building as the large and complex class of your code The idea is to represent the code source as the building in a city. Pieces of code are first gathered as districts, based on namespaces or folders. Then, each class is represented, based on their number of properties, methods (for the base) and lines of code (for the height). Colors are also used to represent abstract, final or interfaces. [PHPcity](https://github.com/adrianhuna/PHPCity.git) is a project from Adrian Huna, that applies those principles to PHP. It is based on [JScity](https://github.com/aserg-ufmg/JSCity)and requires some data extraction from the code source. Exakat provides the metrics for PHP city to display them. In command line, use this: ``` > php exakat.phar report -p -format Phpcity ``` Then, upload the script to [PHPcity demo](https://adrianhuna.github.io/PHPCity/) and then interact with your code. # The Weekly Audits : 2018, Week #48 Exakat includes a 'weekly' report : this report is built with a selection of five analyses. This means a short audit report, with few issues to review. This is not a lot to read them, and review them in your code. Everyone in the PHP community can focus on one of the classic coding problems and fix it. Talk about the weekly audit around you : you'll find programmers facing the same challenges. To obtain the 'weekly' audit, run an audit, and request the 'Weekly' report. ``` \# Init the project (skip when it is already done) php exakat.phar init -p -R https://github.com/Seldaek/monolog.git -git \# Run the project (skip when it is already done) php exakat.phar project -p \# Export the weekly project (every monday) php exakat.phar report -p -format Weekly \# Open projects//weekly/index.html in your browser ``` Every week, you can find here 5 new analysis to review in your code. In fact, when your code is clean, you can also take a quick look at the upcoming Weekly recommendations for PHP code review : 2018, week 2018-48 - [Throw Functioncall](https://exakat.readthedocs.io/en/latest/Rules.html#throw-functioncall) : The `throw` keyword expects to use an exception. - [Not Not](https://exakat.readthedocs.io/en/latest/Rules.html#not-not) : Double not makes a boolean, not a true. - [Invalid Pack Format](https://exakat.readthedocs.io/en/latest/Rules.html#invalid-pack-format) : Some characters are invalid in a pack() format string. - [Too Many Injections](https://exakat.readthedocs.io/en/latest/Rules.html#too-many-injections) : When a class is constructed with more than four dependencies, it should be split into smaller classes. - [Parent First](https://exakat.readthedocs.io/en/latest/Rules.html#parent-first) : When calling parent constructors, always put it first in the `__construct`method. Every week, you can find here 5 new analysis to review in your code. In fact, when your code is clean, you can also take a quick look at the upcoming week with the 'Go further' section. # Happy PHP Code Reviews All the 362 analyzers are presented in the docs, including the obedient__**DIR__**[ Then Slash](http://exakat.readthedocs.io/en/latest/Rules.html#__dir__-then-slash) : __**DIR__** must be concatenated with a string starting with '/'.__**DIR__** doesn't include the final slash, so any concatenation that doesn't start with it will see the directory name changed. It is a rare bug : 7% applications mishandle__**DIR__**. You can check all of the Exakat reports at the gallery: [exakat gallery](https://www.exakat.io/exakat-gallery). Download Exakat on exakat.io, install it with [Docker](https://hub.docker.com/r/exakat/exakat/), upgrade it with 'exakat.phar upgrade -u' and like us on [github](https://github.com/exakat/exakat).