svn: /phpdoc/fa/trunk/ language/oop5/overloading.xml language/variables.xml security/apache.xml security/database.xml security/filesystem.xml security/globals.xml security/hiding.xml security/magicquotes.xml security/variables.xml

Modified: phpdoc/fa/trunk/language/oop5/overloading.xml
===================================================================
--- phpdoc/fa/trunk/language/oop5/overloading.xml	2010-04-09 16:14:57 UTC (rev 297757)
+++ phpdoc/fa/trunk/language/oop5/overloading.xml	2010-04-09 16:19:45 UTC (rev 297758)
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<!-- EN-Revision: 297028 Maintainer: pedram Status: ready -->
+<!-- EN-Revision: 297638 Maintainer: pedram Status: ready -->
 <!-- Reviewed: yes -->
 <!-- $Revision$ -->
  <sect1 xml:id="language.oop5.overloading" xmlns="http://docbook.org/ns/docbook">

Modified: phpdoc/fa/trunk/language/variables.xml
===================================================================
--- phpdoc/fa/trunk/language/variables.xml	2010-04-09 16:14:57 UTC (rev 297757)
+++ phpdoc/fa/trunk/language/variables.xml	2010-04-09 16:19:45 UTC (rev 297758)
@@ -1,8 +1,10 @@
 <?xml version="1.0" encoding="utf-8"?>
-<!-- EN-Revision: 296457 Maintainer: pedram Status: ready -->
+<!-- EN-Revision: 297557 Maintainer: pedram Status: ready -->
 <!-- Reviewed: yes -->
 <!-- $Revision$ -->
-<chapter xml:id="language.variables" xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink">
+<?xml version="1.0" encoding="UTF-8"?>
+<!-- $Revision$ -->
+ <chapter xml:id="language.variables" xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink">
   <title>Variables</title>

   <sect1 xml:id="language.variables.basics">
@@ -810,7 +812,8 @@
      Depending on your particular setup and personal preferences, there
      are many ways to access data from your HTML forms.  Some examples are:
     </para>
-
+
+    <!-- FIXME PHP_6 register_long_arrays removal alert -->
     <para>
      <example>
       <title>Accessing data from a simple POST HTML form</title>
@@ -826,8 +829,7 @@
    echo $p_username;

 // As of PHP 5.0.0, these long predefined variables can be
-// disabled with the register_long_arrays directive.  As of
-// PHP 6, they are completely unavailable.
+// disabled with the register_long_arrays directive.

    echo $HTTP_POST_VARS['username'];

@@ -1092,3 +1094,4 @@
 vim: et tw=78 syn=sgml
 vi: ts=1 sw=1
 -->
+

Modified: phpdoc/fa/trunk/security/apache.xml
===================================================================
--- phpdoc/fa/trunk/security/apache.xml	2010-04-09 16:14:57 UTC (rev 297757)
+++ phpdoc/fa/trunk/security/apache.xml	2010-04-09 16:19:45 UTC (rev 297758)
@@ -1,15 +1,15 @@
 <?xml version="1.0" encoding="utf-8"?>
-<!-- EN-Revision: 297028 Maintainer: pedram Status: ready -->
+<!-- EN-Revision: 297645 Maintainer: pedram Status: ready -->
 <!-- Reviewed: yes -->
 <!-- $Revision$ -->
 <!-- splitted from ./index.xml, last change in rev 1.66 -->
   <chapter xml:id="security.apache" xmlns="http://docbook.org/ns/docbook">
    <title>Installed as an Apache module</title>
    <simpara>
-    When PHP is used as an Apache module it inherits Apache's user
+    When <acronym>PHP</acronym> is used as an Apache module it inherits Apache's user
     permissions (typically those of the "nobody" user). This has several
     impacts on security and authorization. For example, if you are using
-    PHP to access a database, unless that database has built-in access
+    <acronym>PHP</acronym> to access a database, unless that database has built-in access
     control, you will have to make the database accessible to the
     "nobody" user. This means a malicious script could access and modify
     the database, even without a username and password. It's entirely
@@ -17,12 +17,12 @@
     administrator's web page, and drop all of your databases. You can
     protect against this with Apache authorization, or you can design
     your own access model using LDAP, &htaccess; files, etc. and include
-    that code as part of your PHP scripts.
+    that code as part of your <acronym>PHP</acronym> scripts.
    </simpara>
    <simpara>
-    Often, once security is established to the point where the PHP user
+    Often, once security is established to the point where the <acronym>PHP</acronym> user
     (in this case, the apache user) has very little risk attached to it,
-    it is discovered that PHP is now prevented from writing any files
+    it is discovered that <acronym>PHP</acronym> is now prevented from writing any files
     to user directories. Or perhaps it has been prevented from accessing
     or changing databases. It has equally been secured from writing
     good and bad files, or entering good and bad database transactions.
@@ -41,7 +41,7 @@
    <simpara>
     There are some simpler solutions. By using
     <link linkend="ini.open-basedir">open_basedir</link> you can control and restrict what
-    directories are allowed to be used for PHP. You can also set up
+    directories are allowed to be used for <acronym>PHP</acronym>. You can also set up
     apache-only areas, to restrict all web based activity to non-user,
     or non-system, files.
    </simpara>
@@ -67,3 +67,4 @@
 vim: et tw=78 syn=sgml
 vi: ts=1 sw=1
 -->
+

Modified: phpdoc/fa/trunk/security/database.xml
===================================================================
--- phpdoc/fa/trunk/security/database.xml	2010-04-09 16:14:57 UTC (rev 297757)
+++ phpdoc/fa/trunk/security/database.xml	2010-04-09 16:19:45 UTC (rev 297758)
@@ -3,7 +3,8 @@
 <!-- Reviewed: yes -->
 <!-- $Revision$ -->
 <!-- splitted from ./index.xml, last change in rev 1.66 -->
- <chapter xml:id="security.database" xmlns="http://docbook.org/ns/docbook">
+
+  <chapter xml:id="security.database" xmlns="http://docbook.org/ns/docbook">
    <title>Database Security</title>

    <simpara>
@@ -20,9 +21,9 @@
     linkend="security.database.sql-injection">tamper with an SQL query</link>.
    </simpara>
    <simpara>
-    As you can surmise, PHP cannot protect your database by itself. The
+    As you can surmise, <acronym>PHP</acronym> cannot protect your database by itself. The
     following sections aim to be an introduction into the very basics of how to
-    access and manipulate databases within PHP scripts.
+    access and manipulate databases within <acronym>PHP</acronym> scripts.
    </simpara>
    <simpara>
     Keep in mind this simple rule: defense in depth. The more places you
@@ -80,7 +81,7 @@
     <!--simpara>
      If your database server has native SSL support, consider using <link
      linkend="ref.openssl">OpenSSL functions</link> in communication between
-     PHP and database via SSL.
+     <acronym>PHP</acronym> and database via SSL.
     </simpara-->
    </sect1>

@@ -100,7 +101,7 @@
     </simpara>
     <simpara>
      The easiest way to work around this problem is to first create your own
-     encryption package, and then use it from within your PHP scripts. PHP
+     encryption package, and then use it from within your <acronym>PHP</acronym> scripts. <acronym>PHP</acronym>
      can assist you in this with several extensions, such as <link
      linkend="ref.mcrypt">Mcrypt</link> and <link
      linkend="ref.mhash">Mhash</link>, covering a wide variety of encryption
@@ -182,10 +183,10 @@
       </programlisting>
      </example>
       Normal users click on the 'next', 'prev' links where the <varname>$offset</varname>
-      is encoded into the URL. The script expects that the incoming
+      is encoded into the <acronym>URL</acronym>. The script expects that the incoming
       <varname>$offset</varname> is a decimal number. However, what if someone tries to
       break in by appending a <function>urlencode</function>'d form of the
-      following to the URL
+      following to the <acronym>URL</acronym>
       <informalexample>
        <programlisting role="sql">
 <![CDATA[
@@ -368,7 +369,7 @@
       </listitem>
       <listitem>
        <simpara>
-        Check if the given input has the expected data type. PHP has
+        Check if the given input has the expected data type. <acronym>PHP</acronym> has
         a wide range of input validating functions, from the simplest ones
         found in <link linkend="ref.var">Variable Functions</link> and
         in <link linkend="ref.ctype">Character Type Functions</link>
@@ -465,3 +466,4 @@
 vim: et tw=78 syn=sgml
 vi: ts=1 sw=1
 -->
+

Modified: phpdoc/fa/trunk/security/filesystem.xml
===================================================================
--- phpdoc/fa/trunk/security/filesystem.xml	2010-04-09 16:14:57 UTC (rev 297757)
+++ phpdoc/fa/trunk/security/filesystem.xml	2010-04-09 16:19:45 UTC (rev 297758)
@@ -3,10 +3,11 @@
 <!-- Reviewed: yes -->
 <!-- $Revision$ -->
 <!-- splitted from ./index.xml, last change in rev 1.66 -->
- <chapter xml:id="security.filesystem" xmlns="http://docbook.org/ns/docbook">
+
+  <chapter xml:id="security.filesystem" xmlns="http://docbook.org/ns/docbook">
    <title>Filesystem Security</title>
    <simpara>
-    PHP is subject to the security built into most server systems with
+    <acronym>PHP</acronym> is subject to the security built into most server systems with
     respect to permissions on a file and directory basis. This allows
     you to control which files in the filesystem may be read. Care
     should be taken with any files which are world readable to ensure
@@ -14,8 +15,8 @@
     filesystem.
    </simpara>
    <simpara>
-    Since PHP was designed to allow user level access to the filesystem,
-    it's entirely possible to write a PHP script that will allow you
+    Since <acronym>PHP</acronym> was designed to allow user level access to the filesystem,
+    it's entirely possible to write a <acronym>PHP</acronym> script that will allow you
     to read system files such as /etc/passwd, modify your ethernet
     connections, send massive printer jobs out, etc. This has some
     obvious implications, in that you need to ensure that the files
@@ -24,7 +25,7 @@
    <simpara>
     Consider the following script, where a user indicates that they'd
     like to delete a file in their home directory. This assumes a
-    situation where a PHP web interface is regularly used for file
+    situation where a <acronym>PHP</acronym> web interface is regularly used for file
     management, so the Apache user is allowed to delete files in
     the user home directories.
    </simpara>
@@ -75,7 +76,7 @@
     <itemizedlist>
      <listitem>
       <simpara>
-       Only allow limited permissions to the PHP web user binary.
+       Only allow limited permissions to the <acronym>PHP</acronym> web user binary.
       </simpara>
      </listitem>
      <listitem>
@@ -149,7 +150,7 @@
    <sect1 xml:id="security.filesystem.nullbytes">
     <title>Null bytes related issues</title>
     <simpara>
-     As PHP uses the underlying C functions for filesystem related
+     As <acronym>PHP</acronym> uses the underlying C functions for filesystem related
      operations, it may handle null bytes in a quite unexpected way.
      As null bytes denote the end of a string in C, strings containing them
      won't be considered entirely but rather only until a null byte occurs.
@@ -220,3 +221,4 @@
 vim: et tw=78 syn=sgml
 vi: ts=1 sw=1
 -->
+

Modified: phpdoc/fa/trunk/security/globals.xml
===================================================================
--- phpdoc/fa/trunk/security/globals.xml	2010-04-09 16:14:57 UTC (rev 297757)
+++ phpdoc/fa/trunk/security/globals.xml	2010-04-09 16:19:45 UTC (rev 297758)
@@ -3,25 +3,26 @@
 <!-- Reviewed: yes -->
 <!-- $Revision$ -->
 <!-- splitted from ./index.xml, last change in rev 1.66 -->
+
   <chapter xml:id="security.globals" xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink">
    <title>Using Register Globals</title>
    &warn.deprecated.feature-5-3-0.removed-6-0-0;
    <para>
-    Perhaps the most controversial change in PHP is when the default value
-    for the PHP directive <link linkend="ini.register-globals">
-    register_globals</link> went from ON to OFF in PHP
+    Perhaps the most controversial change in <acronym>PHP</acronym> is when the default value
+    for the <acronym>PHP</acronym> directive <link linkend="ini.register-globals">
+    register_globals</link> went from ON to OFF in <acronym>PHP</acronym>
     <link xlink:href="&url.php.release4.2.0;">4.2.0</link>.  Reliance on this
     directive was quite common and many people didn't even know it existed
-    and assumed it's just how PHP works.  This page will explain how one can
+    and assumed it's just how <acronym>PHP</acronym> works.  This page will explain how one can
     write insecure code with this directive but keep in mind that the
     directive itself isn't insecure but rather it's the misuse of it.
    </para>
    <para>
     When on, register_globals will inject your scripts with all
-    sorts of variables, like request variables from HTML forms.  This
-    coupled with the fact that PHP doesn't require variable initialization
+    sorts of variables, like request variables from <acronym>HTML</acronym> forms.  This
+    coupled with the fact that <acronym>PHP</acronym> doesn't require variable initialization
     means writing insecure code is that much easier.  It was a difficult
-    decision, but the PHP community decided to disable this directive by
+    decision, but the <acronym>PHP</acronym> community decided to disable this directive by
     default.  When on, people use variables yet really don't know for sure
     where they come from and can only assume.  Internal variables that are
     defined in the script itself get mixed up with request data sent by
@@ -64,7 +65,7 @@
     When register_globals = on, we could also use
     <varname>$username</varname> in our example below but again you must
     realize that <varname>$username</varname> could also come from other
-    means, such as GET (through the URL).
+    means, such as GET (through the <acronym>URL</acronym>).
    </para>
    <para>
     <example>
@@ -164,3 +165,4 @@
 vim: et tw=78 syn=sgml
 vi: ts=1 sw=1
 -->
+

Modified: phpdoc/fa/trunk/security/hiding.xml
===================================================================
--- phpdoc/fa/trunk/security/hiding.xml	2010-04-09 16:14:57 UTC (rev 297757)
+++ phpdoc/fa/trunk/security/hiding.xml	2010-04-09 16:19:45 UTC (rev 297758)
@@ -3,6 +3,7 @@
 <!-- Reviewed: yes -->
 <!-- $Revision$ -->
 <!-- splitted from ./index.xml, last change in rev 1.66 -->
+
   <chapter xml:id="security.hiding" xmlns="http://docbook.org/ns/docbook">
    <title>Hiding PHP</title>
    <para>
@@ -10,14 +11,14 @@
     But in some cases, every little bit of extra security is desirable.
    </para>
    <para>
-    A few simple techniques can help to hide PHP, possibly slowing
+    A few simple techniques can help to hide <acronym>PHP</acronym>, possibly slowing
     down an attacker who is attempting to discover weaknesses in your
     system. By setting expose_php to <literal>off</literal> in your
     &php.ini; file, you reduce the amount of information available to them.
    </para>
    <para>
     Another tactic is to configure web servers such as apache to
-    parse different filetypes through PHP, either with an &htaccess;
+    parse different filetypes through <acronym>PHP</acronym>, either with an &htaccess;
     directive, or in the apache configuration file itself. You can
     then use misleading file extensions:
     <example>
@@ -39,10 +40,10 @@
 ]]>
      </programlisting>
     </example>
-    Or hide it as HTML code, which has a slight performance hit because
-    all HTML will be parsed through the PHP engine:
+    Or hide it as <acronym>HTML</acronym> code, which has a slight performance hit because
+    all <acronym>HTML</acronym> will be parsed through the <acronym>PHP</acronym> engine:
     <example>
-     <title>Using HTML types for PHP extensions</title>
+     <title>Using <acronym>HTML</acronym> types for PHP extensions</title>
      <programlisting role="apache-conf">
 <![CDATA[
 # Make all PHP code look like HTML
@@ -50,7 +51,7 @@
 ]]>
      </programlisting>
     </example>
-    For this to work effectively, you must rename your PHP files with
+    For this to work effectively, you must rename your <acronym>PHP</acronym> files with
     the above extensions. While it is a form of security through
     obscurity, it's a minor preventative measure with few drawbacks.
    </para>
@@ -77,3 +78,4 @@
 vim: et tw=78 syn=sgml
 vi: ts=1 sw=1
 -->
+

Modified: phpdoc/fa/trunk/security/magicquotes.xml
===================================================================
--- phpdoc/fa/trunk/security/magicquotes.xml	2010-04-09 16:14:57 UTC (rev 297757)
+++ phpdoc/fa/trunk/security/magicquotes.xml	2010-04-09 16:19:45 UTC (rev 297758)
@@ -2,12 +2,13 @@
 <!-- EN-Revision: 297028 Maintainer: pedram Status: ready -->
 <!-- Reviewed: yes -->
 <!-- $Revision$ -->
+
   <chapter xml:id="security.magicquotes" xmlns="http://docbook.org/ns/docbook">
    <title>Magic Quotes</title>
    &warn.deprecated.feature-5-3-0.removed-6-0-0;
    <para>
     Magic Quotes is a process that automagically escapes incoming data to the
-    PHP script. It's preferred to code with magic quotes off and to instead
+    <acronym>PHP</acronym> script. It's preferred to code with magic quotes off and to instead
     escape the data at runtime, as needed.
    </para>

@@ -28,8 +29,8 @@
        <link linkend="ini.magic-quotes-gpc">magic_quotes_gpc</link>
       </simpara>
       <simpara>
-       Affects HTTP Request data (GET, POST, and COOKIE). Cannot be set at
-       runtime, and defaults to <emphasis>on</emphasis> in PHP.
+       Affects <acronym>HTTP</acronym> Request data (GET, POST, and COOKIE). Cannot be set at
+       runtime, and defaults to <emphasis>on</emphasis> in <acronym>PHP</acronym>.
       </simpara>
       <simpara>
        See also <function>get_magic_quotes_gpc</function>.
@@ -43,7 +44,7 @@
        If enabled, most functions that return data from an external source,
        including databases and text files, will have quotes escaped with a
        backslash. Can be set at runtime, and defaults to <emphasis>off</emphasis>
-       in PHP.
+       in <acronym>PHP</acronym>.
       </simpara>
       <simpara>
        See also <function>set_magic_quotes_runtime</function> and
@@ -76,7 +77,7 @@
      <listitem>
       <simpara>
        There is no reason to use magic quotes because they are no longer
-       a supported part of PHP. However, they did exist and did help a
+       a supported part of <acronym>PHP</acronym>. However, they did exist and did help a
        few beginners blissfully and unknowingly write better (more secure)
        code. But, when dealing with code that relies upon this behavior
        it's better to update the code instead of turning magic quotes on.
@@ -237,3 +238,4 @@
 vim: et tw=78 syn=sgml
 vi: ts=1 sw=1
 -->
+

Modified: phpdoc/fa/trunk/security/variables.xml
===================================================================
--- phpdoc/fa/trunk/security/variables.xml	2010-04-09 16:14:57 UTC (rev 297757)
+++ phpdoc/fa/trunk/security/variables.xml	2010-04-09 16:19:45 UTC (rev 297758)
@@ -3,10 +3,11 @@
 <!-- Reviewed: yes -->
 <!-- $Revision$ -->
 <!-- splitted from ./index.xml, last change in rev 1.66 -->
+
 <chapter xml:id="security.variables" xmlns="http://docbook.org/ns/docbook">
  <title>User Submitted Data</title>
  <para>
-  The greatest weakness in many PHP programs is not inherent in the
+  The greatest weakness in many <acronym>PHP</acronym> programs is not inherent in the
   language itself, but merely an issue of code not being written with
   security in mind. For this reason, you should always take the time
   to consider the implications of a given piece of code, to ascertain
@@ -76,7 +77,7 @@
   You may also want to consider turning off register_globals,
   magic_quotes, or other convenience settings which may confuse
   you as to the validity, source, or value of a given variable.
-  Working with PHP in error_reporting(E_ALL) mode can also help warn
+  Working with <acronym>PHP</acronym> in error_reporting(E_ALL) mode can also help warn
   you about variables being used before they are checked or
   initialized (so you can prevent unusual data from being
   operated upon).
@@ -103,3 +104,4 @@
 vim: et tw=78 syn=sgml
 vi: ts=1 sw=1
 -->
+