Next up for me was Derick Rethans’ Xdebug talk. Xdebug is an extremely useful tool for PHP developers. I’ve used its stack trace feature as well as its code coverage analysis via PHPUnit. I’ve also dabbled with its profiling capabilities. The session introduced me to several other Xdebug features with which I’d like to experiment.

After that I had the pleasure of seeing Matthew Turland’s talk on New SPL Features in PHP 5.3. New SPL data structures in PHP 5.3 include stacks, queues, heaps, priority queues, and sets. Matthew provided test code that compared the performance and memory usage of each these new data structures to that of using PHP’s array functionality.

I skipped the first afternoon session to take part in the Hack Track which happened to coincide with Zend Framework’s May Bug Hunt Days. I was granted commit access and directly committed my first bug fix, a small change to make HTTP headers case-insensitive.

Others stuck around to fix more bugs while I went to check out Bill Karwin’s Models for Hierarchical Data with SQL and PHP. Examples of hierarchical data include categories/subcategories, bill of materials, and threaded discussions. Bill talked about four main approaches to storing hierarchical data in SQL databases: adjacency list, path enumeration, nested sets, and usage of a closure table.

The adjacency list is a naive approach that almost everyone tries first. Basically, each entry knows its immediate parent. The problem with this approach is that querying deep trees can be very inefficient involving many joins. Path enumeration involves storing an enumerated chain of ancestors in each entry. This can be very efficient and take advantage of indexing. However, there is no referential integrity with this approach. The nested set approach seemed a bit complicated. I don’t feel I can explain it properly here, so you’ll have to check out Bill’s slides if you’re interested in how this works. The closure table approach made the most sense to me and didn’t seem overly complicated. Not only do you store each entry, but you also store every path including those from the parent node to each descendant, those from each ancestor to its child node, as well as a reflexive reference from the node to itself.

My final session of the day was Travis Swicegood’s Building Real-Time Applications with XMPP, the Extensible Messaging and Presence Protocol. If you’ve use Google Talk then you’ve used XMPP. As a web developer, the request and response pattern in HTTP is ingrained into my thinking. However, XMPP is a very different creature in that it keeps a socket open during what can be a lengthy exchange of messages. While I don’t think HTTP is going away anytime soon, real-time applications involving potentially large numbers of publishers and subscribers (e.g. Twitter) are becoming more prevalent and XMPP is well suited for this environment.

Today was tutorial day, or day zero. This morning I attended Arne Blankerts’ Bad Guy For a Day – A Websecurity hands-on tutorial. I liked that he took a step back and looked at the different types of security such as the transport layer, infrastructure layer, data warehouse, user interface design, user level security, and application level security. He talked about the usual suspects such as cross-site scripting (XSS), session fixation, cross-site request forgery (XSRF), and SQL injection. Filtering input and escaping output was also addressed, of course. He demonstrated attacks on several security holes in an (intentionally) badly written application. Take a look at the slides for more details.

This afternoon I attended Ed Finkler’s JavaScript for PHP Developers talk. Like most PHP developers, I find myself often working with other web technologies such as JavaScript. The object model in JavaScript is very different than in PHP and I found Ed’s explanations of these differences very helpful. The JavaScript core language is often confused with the Document Object Model (DOM) API and a clear explanation of the line between the two was also useful. His slides don’t appear to be posted yet, but I’ll link to them once they are.

One last note: if you happen to be here at TEK·X then be sure to rate the sessions on joind.in. The speakers really appreciate the feedback!