Scott Keck-Warren (@[email protected])

Father of Two, Partner, Technology Manager at WeCare Connect, Blogger at @thisprogramming, YouTuber @phparch

[Scott Keck-Warren (@[email protected]) @scottkeckwarren]

#PHP tip: make `declare(strict_types=1);` the first statement in every file.

A function that takes `int $x` accepts `"5"` and coerces it, and PHP will even turn `"5 apples"` into `5` with a warning. Turn it on, and passing `"5"` throws a TypeError right at the call.

#PHPDev

[Scott Keck-Warren (@[email protected]) @scottkeckwarren]

What's the worst security bug you've found buried in legacy code you inherited? I'll go first: an MD5 password check using `==` let "magic hash" strings starting with `0e` log in without the real password. PHP saw `0 == 0`. In prod for years. Your turn. #PHP #Security #AppSec

[Scott Keck-Warren (@[email protected]) @scottkeckwarren]

Nobody labels the scary parts of legacy code. That MD5 `==` login check I found let "magic hash" strings in without a password for years, and it looked fine at a glance. Fix a codebase like that one unsafe line at a time. Leave each file safer than you found it. #CareerDev #PHP

[Scott Keck-Warren (@[email protected]) @scottkeckwarren]

in_array() uses loose comparison by default, so type juggling sneaks in.

in_array(0, ['admin', 'user']); // true (!)

0 == 'admin'` is true, so 0 "matches" a list of strings. Pass `true` as the third arg to fix it:

in_array(0, ['admin', 'user'], true); // false

#PHP #PHPDev

[Scott Keck-Warren (@[email protected]) @scottkeckwarren]

The php[tek] 2026 call for papers is open. If you've got a talk in you, submit it. First-time speakers are welcome, and reviewers care about the idea, not your follower count. Don't reject yourself before the committee gets the chance.

See the #phptek website
#PHP #PHPDev

[Scott Keck-Warren (@[email protected]) @scottkeckwarren]

A PHP myth is that `==` is just a looser `===` and they do the same thing. `==` converts types first, so `"0e123" == "0e456"` is TRUE (PHP reads both as 0). Drop that into an MD5 login check (please don't), and an attacker walks in without the password.

#PHP #Security #WebDev

[Scott Keck-Warren (@[email protected]) @scottkeckwarren]

I once found a login system comparing MD5 hashes with `==`. A hash starting with `0e` and then all digits reads as scientific notation, so PHP decides `0 == 0` and you're in without the password.

[Scott Keck-Warren (@[email protected]) @scottkeckwarren]

Confession: before I found parse_url() I hand-rolled URL parsing with strstr and explode like some kind of medieval craftsman. What code did you write from scratch that a single built-in function already handled?

#PHP #PHPDev

[Scott Keck-Warren (@[email protected]) @scottkeckwarren]

Early in my career, I proved myself by writing code. Now I prove myself by deleting it. Half my "clever" helpers already existed in the stdlib; I just hadn't read the manual. Less code I own means less I have to maintain.

#CareerDev #PHPDev

[Scott Keck-Warren (@[email protected]) @scottkeckwarren]

"A little copy-paste never hurt anyone." Sure, until you fix a bug in one copy and forget the other four. Now they've drifted and behave differently. Duplication isn't a style nit; it's a latent bug waiting for the clones to disagree.

#PHP #CleanCode

[Scott Keck-Warren (@[email protected]) @scottkeckwarren]

I spent years writing 12 lines of strstr() and explode() and regex to pull the host out of a URL. PHP has had parse_url() since PHP 4. Returns scheme, host, path, and query as an array. I feel a little dumb.

#PHP #PHPDev

[Scott Keck-Warren (@[email protected]) @scottkeckwarren]

I still see people reach for a `foreach` loop to pull one column out of an array of arrays. `array_column($rows, 'email')` does it in one line. Pass a third argument and it keys the result by another column too, so you get a lookup map with no loop at all.

#PHP #PHPDev #Laravel

[Scott Keck-Warren (@[email protected]) @scottkeckwarren]

What's the slowest part of your dev loop right now? For me, it's static analysis on a big codebase. I've been testing a Rust-based tool that's 4x faster than PHPStan but covers fewer rules, and it's got me wondering how much coverage I'd give up for speed.

#PHP #PHPDev #DevTools

[Scott Keck-Warren (@[email protected]) @scottkeckwarren]

James Cole's advice for new Firefly III users: skip the five-year import. Start a month back and keep entering data from there. #PHP #OpenSource #PersonalFinance

@phparch for more

[Scott Keck-Warren (@[email protected]) @scottkeckwarren]

I used to think shipping smaller PRs was just a process thing. Now I think it's a career skill. The engineers who grow fastest aren't the ones who make fewer bad assumptions; they just set things up so they find out they're wrong sooner.

#CareerDev #PHP #PHPDev

[Scott Keck-Warren (@[email protected]) @scottkeckwarren]

James Cole named his app plain Firefly, rewrote it in Groovy and called that choice pretty terrible for a web app, then rebuilt it in PHP as Firefly III because "three eyes" sounded cool. #PHP #OpenSource

@phparch for more

[Scott Keck-Warren (@[email protected]) @scottkeckwarren]

James Cole kept Firefly III manual entry only on purpose. Typing in every transaction forces you to feel where your money goes. #PHP #OpenSource

@phparch for more

[Scott Keck-Warren (@[email protected]) @scottkeckwarren]

James Cole: "Doing this for free was always a part of why I started it." He's not anti paid apps, he's just committed to giving Firefly III away. #PHP #OpenSource

@phparch for more

[Scott Keck-Warren (@[email protected]) @scottkeckwarren]

"What incentive does a paid program have to help me solve my financial problems? If I solve it, I stop paying." James Cole on why he built Firefly III for free. #PHP #OpenSource

@phparch for more

[Scott Keck-Warren (@[email protected]) @scottkeckwarren]

I submitted a PR once with a couple hundred lines of changes and got back 42 comments because the whole thing was built on a flawed assumption. A smaller feedback loop would've caught that.

#PHP #SoftwareDev #PHPDev