Zend PHP 5 Certification Exam - review

This time it's about the Zend PHP5 exam itself, not about PHP. I have taken the exam today and singing loudly in my car on the way back home I thought: the guys who are about to take it might want to know how it goes. And this is the story about what happens when you decide to go into the lion's cave armed with your brain and that only.

Well, it's not that bad. People I met in the exam centre were very friendly. I was taking my exam in Feltham, in the test center run by TSM Consultants UK Ltd. Poor folks were working even though it was bank holiday. They said it was all right, though.

They are serving as a test spot for some insane number of vendors, one of them being Zend. It is all very professional. When I booked the exam, I was asked to turn up about 15 minutes before the exam starts. I was also told to have two forms of identification on me, at least one with a picture of my lovely face. I complied, of course, and I am glad I did. It is not just talks - they take it really seriously. No id? Then they wave you goodbye and invite you some other time when you can be bothered to read the instruction before coming.

I was being checked in by a nice lady who asked me to read the terms and conditions. I learned I was not allowed to take anything with me to the examination room - mobile, jacket, rack sack even my beloved coffee had to be left behind. They gave me a locker for my valuables, though, so I put there my coffee. I am joking, my jailbroken iPhone of course. And I had to use the toilet beforehand because if you leave the room once the exam has started there is no coming back.

When I was ready we entered the exam room. It was poket-size with about 5 computers standing around the walls. There was also proper Big Brother equipment. That's right. You are being watched, listened in and recorded during the exam. Who cares after all? If you know you are not going to make it you can always smash a few monitors and hope for becoming famous on YouTube after they release you from custody.

Speaking of the monitors - they were nice biggies, so I had no trouble reading the questions. If the chairs were a bit more comfy I would not complain, though. That's because the room was equipped with budget low-end office chairs. On the other hand the exam lasts for 90 minutes only, so being brave fellow I gritted my teeth and took my seat. The countdown timer started after I accepted the terms and condition and when the first question appeared on the screen.

After a few questions I realised the exam was not very different from the Zend PHP 5 Certification Mock Exam. It is similar type of questions and if you succeeded with a few of these mock exams you should be fine. The whole exam consists of 70 questions served in random order. For each question you may add a comment or mark it for later review. That last feature turned out quite handy when I gave all answers and wanted to come back to those which I was not entirely sure about. Review screen showed me links to all the questions and indicated the marked ones. Finally I decided I was ready and after answering zillion times 'yes' to a question going like: 'are you sure you want to finished the exam?' I saw big, beautiful and smiling at me from the screen:

CONGRATULATIONS!
You have passed Zend PHP 5 Certification Exam.

PHP5: Bitwise Left Shift Goes in Cycle

Going through ZEND PHP Certification Study Guide I came across a bit confusing example. It says that bitwise left shift by 32 positions on integer value of 1 performed on 32-bit machine would give 0 as a result.

Reading through the guide I usually write small snippets of code to check things myself and remember them better. So I did this time. To my big surprise, the result was different from what I had read. Here is the code:

<?php
$x = 1;
echo $x << 32;
// outputs 1

I wanted to find out what was going on, so I tried:

<?php
$x = 1;
print ('PHP_INT_SIZE: ' . PHP_INT_SIZE . "\n");
$maxBits = PHP_INT_SIZE * 8;

$format = '%0' . $maxBits . "b\n";

for ($i = $maxBits - 1; $i <= $maxBits + 1; $i++ ) {
 printf('x << ' . $i . ': ' . $format, $x << $i);
}

for ($i = $maxBits * 2 - 1; $i <= $maxBits * 2 + 1; $i++ ) {
 printf('x << ' . $i . ': ' . $format, $x << $i);
}

And here is the result I got:

PHP_INT_SIZE: 4
x << 31: 10000000000000000000000000000000
x << 32: 00000000000000000000000000000001
x << 33: 00000000000000000000000000000010
x << 63: 10000000000000000000000000000000
x << 64: 00000000000000000000000000000001
x << 65: 00000000000000000000000000000010

That means that bitwise shifting left goes in cycle modulo architecture-defined-number-of-bits. On 32-bit machine shift left by 32 bits gives same result as no shift at all (32 % 32 = 0). Shift by 33 is same as shift by 1 (33 % 32 = 1).
But is it really true? How about shifting different value than 1? I tried to shift 2 and here is the result:

PHP_INT_SIZE: 4
x << 31: 00000000000000000000000000000000
x << 32: 00000000000000000000000000000010
x << 33: 00000000000000000000000000000100
x << 63: 00000000000000000000000000000000
x << 64: 00000000000000000000000000000010
x << 65: 00000000000000000000000000000100

I checked the results on Mac (PHP 5.2.6), Windows (PHP 5.3) and Linux (PHP 5.2.12) and they were identical. It looks like new language feature which wasn't present while the ZEND PHP Certification Study Guide has been created. Although the Bitwise Operators manual page warns: "Don't left shift in case it results to number longer than 32 bits."
It's for another discussion whether to use it or not. Anyway, I guess it's good to know.

PHP5: Sending headers

Http headers can be sent only before any other output. This is a simple requirement and funny how big impact it may have on application architecture and how many tricky questions may be asked about it. Here is one from the Zend PHP 5 Certification Mock Exam.

You will find correct answer in bold.

One can ensure that headers can always be sent from a PHP script by doing what?

• Enable header buffering in PHP 5
• Set the header.force INI directive to true
• Enable output buffering in PHP 5
• There is no way to ensure that headers can always be set, they must always be checked
• None of the above

The header documentation page says: "As of PHP 4, you can use output buffering to get around this problem". That obviously makes sense on the contrary to header buffering suggested by the first answer. Header buffering would not help because the troublemaker here is premature output.
According to PHP manual there is no such directive as header.force and does not seem to have much sense as well, which shoots off the second answer.
The third one has some potential but is not correct - output buffering has been avaiable since PHP4.
And as output buffering seems to combat the problem successfully, the fourth answer is there only to trick you.

Zend PHP 5 Certification Mock Exam: how to destroy a session

Here is another question about sessions from the Zend PHP 5 Certification Mock Exam. Good answers are in bold:

To destroy a PHP session completely, one must which of the following?

• Regenerate the session ID using session_regenerate_id()
• If cookies are used, destroy it
• Use session_demolish() to completely destroy the session
• Change the session name using session_name()
• Destroy the session data using session_destroy()

A few words of explanation. To destroy a session we need to remove all the data associated with the session and try to prevent the client from requesting the session using the id. Usually the session id is stored on the client side as a cookie. In this case, we need to destroy the cookie, which means that the second answer is correct. To remove all the data stored associated with the session, we need to use session_destroy function, and this also means the last answer is correct. It is described briefly on the session_destroy manual page.

Regarding three remaining answers, regenerating session id is useful for preventing session fixation. There is not such a function as session_demolish() described in PHP manual. Changing session name does not remove the data, it simply changes the name of the cookie storing the session id.

Zend PHP 5 Certification Mock Exam: magic function

One of the Zend PHP 5 Certification Mock Exam questions shows recursive function called "magic". The question reads as follows (correct answer in bold):

What does the following function do, when passed two integer values for $p and $q?

<?php
function magic($p, $q) {
return ($q == 0)
    ? $p
    : magic($q, $p % $q);
}
?>

• Loops infinitely
• Switches the values of $p and $q
• Determines if they are both even or odd
• Determines the greatest common divisor between them
• Calculates the modulus between the two

It turns out that the function is simply on of the Euclidean algorithm implementations. If you do not remember from your math class how it works, here is the the Euclidean algorithm procedure described.

Stopping PHP Script Execution

Do you know all the ways of stopping PHP script execution? Put your knowledge to a test with this question from the Zend PHP 5 Certification Mock Exam.

The question is as follows. Correct answers in bold.

What would go in place of ?????? below to make this script execute without a fatal error?

<?php

$a = 1;
$b = 0;

??????

$c = $a / $b;
?>

• quit();
• die();
• stop();
• __halt_compiler();
• exit();

die() and exit() are quite obvious, stop() and quit() do not exist and what about __halt_compiler()? The latter was introduces in PHP5. Manual page says it stops the execution of the compiler and nothing after this call is executed.

Generating Custom Session ID in PHP 5

Another one of my favorite questions from Zend PHP 5 Certification Mock Exam. Correct answer in bold.

If you would like to change the session ID generation function, which of the following is the best approach for PHP 5?

• Set the session.hash_function INI configuration directive
• Use the session_set_id_generator() function
• Set the session id by force using the session_id() function
• Use the session_regenerate_id() function
• Implement a custom session handler

Surprisingly, the most obvious answer, made sound like something not really reasonable, is the correct one. A few words of explanation.

• session.hash_function allows to choose between MD5 and SHA-1 hash algorithm for session id generation
  
• session_set_id_generator() function does not exist, at least according to session handling chapter of PHP documentation
• session_regenerate_id() function uses the algorithm selected by session.hash_function
• custom session handler is not meant to allow setting functionality to generate session ids

And session_id() is the only one on the list allowing to set custom session id and definitely it is the correct answer.

Zend Engine Executor Models in PHP 5

Yet another tricky question from the Zend PHP 5 Certification Mock Exam. It took some time to find it, so I thought it might be worth to put it here. Correct answers are in bold.

Which of the following are examples of the new engine executor models available in PHP 5?

• Switch
• Conditional
• Goto
• Call
• Dynamic

It has been nicely described on Zend Devzone.

Zend PHP 5 Certification Mock Exam: SQLite

I came across this tricky question while solving the PHP 5 Certificatin Mock Exam. The answers in bold are the correct ones. I have also added a few words of explanation to each of them.

Which of the following SQL statements will improve SQLite write performance?

• PRAGMA locking_mode = "Row";
  locking_mode can only be "NORMAL" or "EXCLUSIVE"
  
• PRAGMA count_changes = Off;
  it is believed to increase the speed slightly
  
• PRAGMA default_synchronous = Off;
  synchronous set to "Off" makes SQLite continue after write operation without waiting for the storage to finish writing - this might give a real boost
  
• PRAGMA default_synchronous = On;
  synchronous can only be "OFF", "NORMAL" or "FULL"
  
• PRAGMA locking_mode = "Table";
  locking_mode can only be "NORMAL" or "EXCLUSIVE"

Cross-Site Scripting (XSS)

Today I came across a question: "what is most important when trying to prevent a cross-site scripting attack?"

The answer is most intuitive. The most important rule to prevent cross-site scripting is "never trust user input". Not far behind comes "escape output".

These are general server-side programming rules, they do not apply only to specific language, like PHP.