However, you may find a time to work with data at the binary level in PHP (and many other programming languages). Here’s a quick guide to understanding binary numbers and the common operators for handling them.

“Normal” Numbers – Base Ten, Decimal System

When you deal with numbers, you are probably using the “Base Ten” or “Decimal” number system. These are numbers made up of a set of ten different digits – zero through nine.

A given quantity – like 512 – is created with a series of digits. The position of the digit tells us how much the digit actually represents. The ’2′ here is in the units place, so it simply represents 2. The 1 is in the tens place, so it actually represents 10. The 5 is in the hundreds place, so it represents 500.

The number could be re-written as:

500 + 10 + 2 = 512

You’ll notice a pattern here. Each new place is worth ten times the previous place. The third digit (the hundreds place) is worth 10 * 10. If we added a fourth place, it would be worth 10 * 100 (1000).

This gives us a nifty little mathematical formula – which is why this is called “base ten” numbering. The nth digit (where zero is the right-most digit) is worth 10^n. Here’s the number 1024 re-written to illustrate this.

(1 * 10^3) + (0 * 10^2) + (2 * 10^1) + (4 * 10^0) = 1024

This is a lot of work to read a number that we intuitively know is worth 1,024. However, it helps to understand how binary numbers work.

Binary Numbers – The Base Two System

While base ten numbers are simple enough for humans to work with, computers are designed to use a binary or base two numbering system.

The simplest unit of information is a binary bit – a 0 or a 1.

To create complex numbers, we can string together 0′s and 1′s. For example, a number could be written as 0010 0101.

To understand what this value means, we can apply the same rules as we did above. However, since this is a base two system instead of a base ten system, each place is multiplied by 2^n.

Let’s start with a smaller example – 1111.

(1 * 2^3) + (1 * 2^2) + (1 * 2^1) + (1 * 2^0)
    = 8 + 4 + 2 + 1
    = 15

These rules can be expanded to represent byte-sized numbers (8-bits, or 2^8, or 255) or even larger numbers.

Manipulating Bits and Bytes – Bitwise Operators

Most programming languages come with some built in operators to handle bits. These help make very basic comparisons and manipulations of numbers.

These typically include the ‘and’ or intersection operator, the ‘or’ or union operator, and the ‘xor’ or exclusive-or operator. We’ll just take a look at the ‘and’ and ‘or’ operators right now. [Note: I use the terms intersection and union because I think they make it much easier to understand, if you are at all familiar with math sets and statistics. They aren’t typical ‘coding’ terms).

The ‘and’ or intersection operator – the ‘&’ character in PHP – compares two binary numbers and returns a new binary number with a ’1′ in every unit in which both numbers have a ’1′. If both numbers have a value in the second place, then the return number will have a value in the second place. If only one number has a value in the third place, then the return number will have no value in the third place.

0111 & 0101 = 0101
0101 & 1010 = 0000
1111 & 1111 = 1111

If you imagine ’0111′ and ’0101′ as sets of numbers ({4, 2, 1} and {4, 1} respectively), then the result of a bitwise ‘and’ operation is the simple intersection of the two sets.

The bitwise ‘or’ operator – a | in PHP – returns a value in each place that either number has a value. So if only one number has a value in the first place, the result will have a value in the first place. A place will only have no value if neither number had a value there.

0111 | 0101 = 0111
0101 1110 | 1010 0001 = 1111 1111
0000 1111 | 1111 0000 = 1111 1111

These operators aren’t used very much, but it is important to recognize them. If you don’t know what they are, it is easy to confuse them with the standard logical operators – || and &&.

For example, the following two lines of code have very different meanings.

$x = 124;
$y = 36;
$bitwise = $x & $y;
$logical = $x && $y;

In the first comparison ($x & $y), we’re finding the bitwise intersection of the two values. This would be…

0111 1100 & 0010 0100 = 0010 0100

In base ten terms, $bitwise would be equal to 36. In the second example ($x && $y), we’re looking for a simple boolean comparison. In this case, both $x and $y have a value, so the comparison will return ’1′ or ‘true’.

Is This Useful…? Comparing Constant Flags

You may be thinking to yourself, “When will I ever use this?”

While anyone working with computer code should understand how binary numbers work, there will probably be very few cases in which you manipulate numerical values in a binary format. The rest of the world works with decimal numbers – and your programming language is designed to do the same thing.

However, there are some cases where you will want to use bitwise numbers and comparisons. A perfect example is the use of constants and flags.

Let’s say that a function takes 16 parameters. Each of these parameters is a simple “True” or “False.”

You could write the function take sixteen different parameters and use sixteen different variables. However, this would make function calls quite long – especially if you usually only make two or three parameters true.

Instead, you can pass one value as a parameter. This value – 16 bits long – includes 16 individual flags to tell the function whether a specific parameter is true or false.

If every parameter is set to true, this value would be “1111 1111 1111 1111″. If only the first parameter should be set to true, this value would be “0000 0000 0000 0001″.

Each flag is represented by a specific place in this binary number. The first flag is “0001,” the second flag is “0010,” the third flag is “0100,” etc.

Your code wouldn’t be very readable if you referred to each flag by its numerical value. Instead, you can define constant values. For example, FUNCTION_FLAG_ONE would represent “0001,” “FUNCTION_FLAG_TWO would represent “0010,” etc. These constants would follow whatever naming convention you usually use.

The value of this is that you can easily set any number of flags with the use of the bitwise ‘or’ operator.

For example, let’s say you want to set flags one, seven, and fifteen to true.

$flags = FUNCTION_FLAG_ONE | 
    FUNCTION_FLAG_SEVEN | FUNCTION_FLAG_FIFTEEN;

The result would be ’0100 0000 0100 0001.’

Inside the function, you could then use the bitwise ‘and’ operator to see which flags were set. For example, this would let you check to see if the fifteenth flag was set to true.

$fifteen = $flags & FUNCTION_FLAG_FIFTEEN;

Although your function’s code will have to do some legwork to find out which flags were set and which ones were not, this makes the function call itself much more efficient and readable.

In order to maintain the meager search engine and referral traffic that the old pages had, I planned on using 301 Redirects. I figured that I would re-create each of the old articles (~10 total articles) on the new site and set up an individual 301 Redirect to send users and search engine spiders to the new location.

The problem, however, was that the standard .htaccess rewrite that WordPress uses was conflicting with the 301 Redirects. For some reason, they just weren’t working – so I turned to a PHP-based solution.

301 Redirects In htaccess

Normally, you can handle a 301 Redirect with a .htaccess file. You can do this with a single line in your .htaccess file.

redirect 301 /path/to/old/file.html http://newdomain.com/file.html

The first part “redirect 301″ indicates the type of redirect. This tells the browser (or the search engine spider) that the page has permanently moved to the new location. HTTP has several other options. The 302 Redirect, for example, indicates that the move is temporary.

The next two parts indicate the old path to the file and the URL of the new location.

Normally, that’s all there is to it. However, WordPress adds its own layer to the .htaccess file which makes your pretty URLs work. The URL that you request is really just a bunch of variables that tell WordPress what article to pull out of the database and display in the template.

Although you should be able to get the two to work together, I couldn’t. The server was ignoring my 301 Redirect and going directly to the other rewrite rules.

Using PHP to 301 Redirect a WordPress Page

The solution? PHP.

Creating a 301 Redirect in PHP is fairly simple. I’d read about it before, and just the other day I came across a brief article about it in one of my regular RSS feeds.

You use the header() function to send custom headers to the user’s browser. With these, you can tell the browser that you want to initiate a 301 Redirect. You can then tell the browser where to go to find the article.

header("HTTP/1.1 301 Moved Permanently");
header("Location: http://newdomain.com/article.html");

Simply replace the URL with the URL you want to redirect to.

Making It Work With WordPress

If you look in your site’s directory structure, you may realize that the path to your article doesn’t really exist.

Let’s say we want to redirect the article located at http://www.earn-web-cash.com/2008/03/20/useful-wordpress-plugins/. To use PHP, we’d need to create a PHP file to replace the article that is being redirected, and include the snippet of code above.

The problem is that the directory /2008/03/20/useful-wordpress-plugins/ doesn’t exist. Those are parameters sent to the WordPress script to fetch information out of the database.

To make this type of redirect work, we need to create this directory structure. Start at your root, and create the directory “2008.” Create a directory “03″ inside that. Create a directory “20″ inside that. Finally, create the directory “useful-wordpress-plugins” inside that.

You’ll notice that there is a trailing slash in the URL. In a normal directory structure, “useful-wordpress-plugins” is a directory, even though it would seem to represent the file where your article resides. To get the browser to access a PHP file at this location, we place an index.php file in that directory. Then, accessing the URL will automatically pull up index.php.

In short, create /2008/03/20/useful-wordpress-plugins/index.php, add the snippet of code above, and your redirect should work flawlessly.

This is a good way to move a few articles on a site to a new site. If you’re moving an entire site, you’d definitely want to look into using the .htaccess method, or creating a PHP file that dynamically chooses what page to redirect the user to. I only had to move 10 articles, so I created ten php files to do the work for me.

There is one caveat to keep in mind. If your installation of WordPress uses the URL http://www.earn-web-cash.com/2008 to access the yearly archives, you’ll run into a problem. /2008 will now be an actual directory – so the server will try to serve up the directory. You’ll need to change your settings so that the archives are located in something like http://www.earn-web-cash.com/archives/2008.

You can easily delay the release of your posts into the main indexes (front page, archives, “Recent Posts” list, etc). With a little bit of code, you can also restrict people from viewing the page before its appointed “Published” date.

Delaying Publication: Setting a Date

If all you want to do is delay the date and time that an article is “released” on your page’s index, you don’t have to do a whole lot of work.

Every article you post is “stamped” with a time by WordPress. When you hit the “Publish” button, it checks the current time on the server and attaches that to your post.

You may not have noticed, but there’s an option for you to edit this time while you are working on the article. For example, you could set the date back a week and backdate one of your posts. For our purposes, we’ll set the date ahead – and WordPress won’t display your post in any indexes until that date arrives.

In the “Write” section of your Dashboard, you should have a column of widgets on the righthand side (Categories, Discussion, Post Slug, etc). If you scroll down a bit, there should be one titled “Post Timestamp.” If you don’t see anything, click the “+” button in the title.

To set a custom release date, select “Edit Timestamp.” Then use the inputs to enter the date and time you want the article released. Voila – you’re done.

Restricting Access to the Page

For most people, this is good enough. Your readers aren’t going to be able to find the article without a link to it appearing on your front page or in your RSS feed.

However, if your readers do know the link to the page, somehow, they can still access it directly. If you want to prevent that, you’ll need to add a few lines of code to your template files.

We’re going to edit the “single.php” template file – the file responsible for formatting and displaying a single post. After the page retrieves the post, we’re going to perform a check to see if the published date of the article is in the future.

If it is, we’ll display an alternative message to tell the user the article isn’t published yet. Otherwise, the article will be displayed as normal.

Editing Single.php

Your template file probably doesn’t look exactly like mine, but there should be some very basic similarities.

If you open single.php, the page is displayed within “the loop.” It’s how every WordPress template works. The loop always begins with a line similar to this.

<?php while (have_posts()) : the_post(); ?>

This checks to see if a page was found in the database. If it was, it loads the page into memory and prepares to output it. The loop will eventually end with a line like this.

<?php endwhile; ?>

We’re going to create a new if statement and place it in between these two lines. The new template will look something like this.

<?php while (have_posts()) : the_post(); ?>
<?php if ($pubDate > time()) : ?>
  <h3>Article Not Published Yet</h3>
  <p>Sorry!  The article you request is not published 
    yet.  It should be available soon, so check back in a few days.</p>
<?php else : ?>
  ...  Regular post processing goes here ...
<?php endif; ?>
<?php endwhile; ?>

Creating the Conditional Statement

The only thing we have to do now is create a functioning conditional statement that checks to see if the published date of the article is in the past or the future.

To do that, we’ll use a few functions – get_the_time (a WordPress function to get the post’s timestamp), strtotime (a PHP function to convert a date string to a timestamp), and time (a php function to get the current tie).

get_the_time doesn’t return the actual time stamp – it returns a formatted date string, like “March 9, 2008, 11:13:35.” You can specify how it’s formatted, just like you would with PHP’s date function.

To get the timestamp, we’re going to format the time string in a special way so that strtotime() can convert it back to a full timestamp (preserving the exact time the article should be published). Then we compare that timestamp to the system time and see if the date has passed or not.

Use this if statement in the code above, and you should be good to go.

<?php if (strtotime(get_the_time('F j, Y, H:i:s')) > time()) : ?>

If you time delay an article and someone tries to access the article directly, they will now see your alternate message. You should of course personalize that to something appropriate for your site.

You can also apply the same concept to “Pages” in WordPress. You’ll need to edit the page.php template file and insert the same snippet of code there.

What are you waiting for? Go write some articles for the future.

Like the file functions, each method is slightly different. Knowing how each operates will help you choose which function to use when you want to work with directories in your PHP script.

PHP 4 – opendir, readdir, closedir

The traditional method of working with directories is very similar to the traditional method of working with files. You open a directory and save it as a resource in a variable. Then, you read through it until the end. Finally, you close it to tidy things up.

$dirName = 'images';
 
$dir = opendir($dirName);
while ($filename = readdir($dir)) {
  echo $filename . '<br />';
}
 
closedir($dir);

That simple script will open a directory (‘images’), read every filename in the directory, and then clean up the directory resource.

The readdir() function goes through the files as they are stored in the filesystem. There’s no real logic to their order – they just come the way they are. Each time you use readdir(), the pointer in the $dir resource is moved to the next file.

PHP 5 – A Convenience Function, scandir

In PHP 5, a new convenience function was introduced to handle all of the major directory functions with one call. Similar to the way file_get_contents handles all of the file writing, scandir handles all of the directory listing.

With a single function, scandir opens a given directory, reads all of the files into an array, and closes the directory.

$dirname = 'images';
 
$filenames = scandir($dirname);
foreach ($filenames as $file) {
  echo $file . '<br />';
}

This slightly shorter snippet of code accomplishes the same thing as the original example. As an added bonus, the filenames are already stored in an array ($filenames). The filenames are also sorted alphabetically.

You could of course achieve the same end with the original directory functions – but you’d have to add more lines of code to store the data in an array and then sort it. One of the biggest reasons to use scandir() is that it’s a convenience.

There’s also one functional difference between the two. scandir() never actually accesses a file – so it’s “Last Accessed Time” will remain the same. When you use readdir() to cycle through a directory, each file is accessed – resetting the “Last Accessed Time.”

This often won’t matter, but it could play an important role in a script that works directly with a file’s “Last Accessed Time.”

The Versatile Choice – glob

The most versatile choice is glob(). Like scandir, it returns an array of filenames. However, glob allows you to specify a pattern to match – so only the matching filenames are returned.

The pattern follows all of the rules for wildcards when using a command like dir. For example, this will get all of the files in the ‘images’ directory.

$dirName = 'images';
 
$filenames = glob($dirName . '/*.*');
foreach ($filenames as $file) {
  echo $file . '<br />';
}

There is a very important difference between this and the other functions, though.

glob() returns paths, not filenames. In this case, the output will be something like ‘images/image.jpg,’ not just ‘image.jpg.’ The directory listing is based on the current working directory – so specifying a path (like we did) will cause that directory to be included in the returned path.

If you don’t want the full path shown, you can use some other functions to change the working directory – like using ‘cd’ in the command line. By default, the working directory is where the script is executing. In this case, we could change the working directory to ‘images’ to get filenames without the directory as part of the path.

chdir('images');

You can also use the GLOB_BRACE flag to pass multiple file extensions. For example, this would allow you to find all images with extension .jpeg, .png, or .gif.

chdir ('images');
 
$filenames = glob('*.{jpeg,png,gif}', GLOB_BRACE);
//  Notice there are NO spaces after the commas

glob() can be quite a powerful tool, indeed. If all you want is a list of files in a directory, you’ll probably want to stick to scandir() – so you don’t have to go messing with the working directory.

For anything else – like a selective list of files – you should make use of glob’s matching functionality rather than sorting through the filenames yourself.

If you wanted to make custom queries, you could certainly do that by diving straight into the database. However, WordPress comes with some built in functions for helping you query the database and display the results. By using these template tags, you can add custom loops in your template to display other post information.

Looking At the Main Loop

If you look in any of your templates, you’ll see a loop similar to the one below. This basic loop just loops through all the articles, outputs the title and content.

<?php if (have_posts()) : while (have_posts()) : the_post(); ?>
<h2><?php the_title(); ?></h2>
<div><?php the_content(); ?></div>
<?php endwhile; ?>
<?php endif; ?>

WordPress has a nasty habit of using that weird while/if syntax, where things aren’t enclosed in brackets. Aside from the weird sytnax, this is a very simple while loop.

First, if (have_posts()) checks to see if there is any data in the queue to be outputted. If there is, it starts a while loop that uses the same check – have_posts() – to see if it should continue.

The thing that moves this along is the_post(). This loads the next post in the result set into memory and prepares it for outputting.

The next few lines do our basic output. the_title() is the template tag for outputting the title of the current article, while the_content() outputs the text of the article.

Finally, we wrap up the while loop and the if statement. If there were more articles in the queue (like on an index/archive page), it would loop through for each article.

Where Do the Articles Come From?

When you load a page in WordPress, you use a query string. The most basic one would be index.php?p=5. That tells WordPress to load the article where the post id is 5.

You may not realize it if you’re using pretty URLs, but every URL you request on your blog has one of these query strings built-in. It tells WordPress to load a list of articles (for an archive, category, or index) or to simply load one article or page.

There’s nothing stopping you from utilizing this process for other purposes, though. Rather than simply looping through the result-set created by the query string, you can use the query_posts() function to create your own custom queries – and then loop through them.

Example Please…?

Here’s how it works. You call query_posts() with a query string. That loads the database results and prepares for the loop. Then, you loop through like we did above to output information on the articles.

Let’s say you want to fetch the latest article that was tagged with both “foo” and “bar.” Here’s how you do it.

query_posts("tag=foo+bar&showposts=1");
//  Create the loop here

We passed two parameters here. “tag=foo+bar” tells WordPress to fetch articles that have both of those tags. “showposts=1″ tells WordPress to only fetch one article. By default, they’re sorted by date and time, so we automatically fetch the latest one.

You Don’t Always Need Plug-ins

This is such a great tool because it lets you avoid using some basic plug-ins. Plug-ins essentially help you perform these extra queries – like the latest posts, similar posts, etc. But they can also be restricting if they don’t do exactly what you want.

By using query_posts() to fetch your own information, you can get WordPress to do exactly what you want.

For example, let’s say you write movie reviews and you want to display the latest ones in your sidebar. Rather than look for a plug-in that displays exactly what you want it to, you can tag all of your movie reviews with “Movie Review” and query for those specific posts.

Then you can easily create the output you want, rather than the output someone else designed.

This is just a taste of what you can do with query_posts() and custom loops in WordPress. You’ll need to try it out for yourself to fully understand it, and I’d suggest you take a look at the documentation on query_posts() for a list of parameters and the documentation on template tags for a full list of output tags.

Good luck!

However, one reader asked if it was possible to enable a client-side cache of a dynamically resized image. It surely is, and it’s very simple.

Dynamic Image Resizing: Revisited

If you’ve got no clue how to resize an image in PHP, then you ought to go back and re-read the original article. For the rest of you, here’s a quick refresher on what happens.

Our script takes a filename as a $_GET parameter. If the file exists, the script loads it in as an image resource. Using the GD library, we create a new image resource that is the proper size.

Finally, we use a content-type header to tell the browser to interpret the data as an image and we output the image data. Like this…

header("content-type: image/png");
imagepng($dst_img);

Enabling a Client Side Cache

In order to enable a client-side cache, all we need to do is add an extra header to the mix.

There is a set of headers in HTTP to handle this sort of need – Cache-Control. You can use this to enable caching, disable caching, and set some restrictions on what can be cached for how long.

The option we’re most interested in is max-age=[seconds]. This response header is sent along with the data to tell the browser that it can re-use a cached copy as long as it is no older than the specified age.

To enable this with PHP, add another header() call before the imagepng() call, and set a Cache-Control header with an appropriate max-age. Like so…

header("Cache-Control: max-age=3600");
header("content-type: image/png");
imagepng($dst_img);

Keep Request Queries Consistent

With this system, you could set a pretty long max-age for the cache. Assuming that the original image never changes, the user could cache a resized copy for months and your script would be happy.

However, you need to keep your query strings consistent for this to work. Since your request includes a query string, that full string is included in the location that is cached.

According to your browser, it’s not the image that is cached, it’s the location…

http://www.earn-web-cash.com/scripts/resize-image.php?image=http://www.earn-web-cash.com/wp-content/uploads/2008/01/dzone-screenshot.png

If you were to change the query string in any way – leaving out the www, for example – the browser will think it is fetching a new resource and it won’t consult the cache.

This is especially important if you include size parameters in the query string to dynamically choose the new size. You would need to be careful to keep the parameters in the same order every time for the cache to work properly.

A function would be much more useful to us if it was flexible – if it could generate a list of combinations for any size set of numbers. We can’t do this with the hard coded loop solution, so we need to come up with a better method.

The Function Concept

Logically, the best way to do this is to create a function that takes a set of numbers (one combination), the size of the set being chosen from (x in [xCy]), and the size of the set being chosen (y in [xCy]). The function would then use a sequential pattern to calculate the next possible combination and return it.

With this type of function, we could create a while loop that iterates through the whole set of possible combinations. We initialize it with the first possible combination, continue to execute while the function returns a combination, and finish when the function returns 0 – in which case there are no more combinations.

If we’re finding the possible combinations for (11 Choose 4), the main loop would look something like this.

$combo = array();
$total = 11;
$choose = 4;
 
while ( $combo = getNextCombo($combo, $total, $choose) ) {
  //  Process the combo here
  //  Store it in a file, an array, or something
  //  Or just out put it
  foreach ($combo as $number) {
    echo $number . ' ';
  }
  echo '<br />';
}

This initializes an empty array – $combo. Our function takes the array and populates it with the next possible combination.

If the array is empty, it’ll create the first combination – {1, 2, 3, 4}. Otherwise, it will increment that set by one to get the next possible combination set – {1, 2, 3, 5}. When the function receives a combination set it can’t possibly increment – {8, 9, 10, 11} – it returns false and the loop ends.

Ok… How Do We Build the Function?

Let’s start by creating the function, checking for an empty array, and returning the initial set. Then we can dive into how we go about incrementing one combination set to get the next one.

function getNextCombo($combo, $total, $choose) {
  if ( empty($combo) ) {
    //  Return the first set, i.e. {1, 2, 3, 4}
    for ($x = 1; $x <= $choose; $x++) {
      $combo[$x] = $x;
    }
 
    return $combo;    
  } else {
    //  Here we'll calculate the next combination
  }
 
  //  If we didn't return before, no combination was found
  return false;
}

That should be pretty self-explanatory. Now we can look at our pattern and develop a method of calculating the next possible combination.

The Pattern

In the last article on getting combinations, we identified the basic pattern to follow.

• Find the “deepest” number that can be incremented
• Increment it by one
• Set any “deeper” numbers to one plus the previous number

The “depeest” number would be the last digit. In the set {1, 2, 3, 4}, the fourth position would be considered deepest. Here’s the first step – and the most basic increment to do.

1 2 3 4
1 2 3 5

The fourth position, ’4′, is the deepest. It can be incremented. We increment it by one. There are no deeper numbers, so we’re done.

Let’s say the fourth position is maxed out. What happens?

1 2 3 11
1 2 4 5

We move back on position to the third position. This one, ’3′, is the deepest number that can be incremented. We increment it by one to 4. Then we go down the line and set each number after it to one more than the previous. In this case we only have to set the fourth digit to one more than the third, which is 5.

Let’s take a look at one more example.

1 2 10 11
1 3 4 5

Same thing here. We move back to the second digit to find one we can increment. We increment it. We then drag the others back to be one greater than it.

Writing This in Code

The following code should go in the else { } area of the function above.

The first thing we need to do is find the deepest number that can be incremented. The deepest digit can’t be incremented when it equals $total. The second deepest digit can’t be incremented when it equals ($total – 1). The next one at ($total – 2), then ($total – 3), etc.

This loop puts that pattern into practice.

$moveBack = 0;
  while ( ($combo[$choose - $moveBack] == $total - $moveBack) 
             && ($moveBack < $choose)) {
    $moveBack++;
  }

At the end, $moveBack will hold the number of spaces from the end of the deepest digit. If $moveBack == 0, then the deepest digit can be incremented. If $moveBack == 1, we have to move up one digit to increment. So on and so forth.

If $moveBack == $choose, we can stop counting. That means that no more digits can be incremented – we’ve counted all the way back to digit #0.

Incrementing to the Next Set

Now that we know which digit can be incremented, we can increment the whole set and return the array.

First, we should check if $moveBack == $choose (to see if we’re done). If it doesn’t, we start incrementing.

We start by incrementing $combo[$choose - $moveBack]. Then we loop through, decrementing $moveBack until it is 0 – and we update the deepest digit.

if ($moveBack != $choose) {
  //  Increment the deepest digit that can be incremented
  $combo[$choose - $moveBack]++;
 
  //  Loop through and set all other numbers based on this
  while ($moveBack > 0) {
    $moveBack--;
    $combo[$choose - $moveBack] = $combo[$choose - ($moveBack + 1)] + 1;			
  }
 
  //  $combo now holds the next combination
  return $combo;
} else {
  //  We couldn't increment.  The set passed
  //    to the function was the last possible set.
  return false;	
}

And… We’re Done

If you put all the pieces together correctly, you should now have a function that iterates through all of the possible combinations given a binomial coefficient.

If you were handling large sets (millions of possible combinations), you’d probably want to re-write this in a compiled language. However, the logic is simple and based simply on arrays – so it should be easily portable to any language.

A word of warning about storing the information. Don’t try to store all of the possible combinations in a giant array. It’ll choke up all your RAM and eventually kill the script. I forget how many combinations I tried to calculate that way, but PHP maxed out at 130mb of RAM and died.

Your best bet would be to write the combinations to a data file or a database as you go. This dumps the storage requirements into a more capable format.

So what do you do with this? I’m not really sure. I wrote the script for a guy who was working on a statistical program he was using for his doctoral thesis. I’m sure there are other specialized purposes for the script – statistics and probability.

If nothing else, it’s an interesting look at how to write a computer program to tackle a complex math problem.

Here’s the full source of the script, if you had trouble putting the pieces together.

function getNextCombo($combo, $total, $choose) {
  if ( empty($combo) ) {
    //  Return the first set, i.e. {1, 2, 3, 4}
    for ($x = 1; $x <= $choose; $x++) {
      $combo[$x] = $x;
    }
 
    return $combo;    
  } else {
    $moveBack = 0;
    while ( ($combo[$choose - $moveBack] == $total - $moveBack) 
             && ($moveBack < $choose)) {
      $moveBack++;
    }
  }
  if ($moveBack != $choose) {
    //  Increment the deepest digit that can be incremented
    $combo[$choose - $moveBack]++;
 
    //  Loop through and set all other numbers based on this
    while ($moveBack > 0) {
      $moveBack--;
      $combo[$choose - $moveBack] = $combo[$choose - ($moveBack + 1)] + 1;			
    }
    //  $combo now holds the next combination
    return $combo;
  } else {
    //  We couldn't increment.  The set passed
    //    to the function was the last possible set.
    return false;	
  }
  //  If we didn't return before, no combination was found
  return false;
}
 
$combo = array();
$total = 11;
$choose = 4;
 
while ( $combo = getNextCombo($combo, $total, $choose) ) {
  //  Process the combo here
  //  Store it in a file, an array, or something
  //  Or just out put it
  foreach ($combo as $number) {
    echo $number . ' ';
  }
  echo '<br />';
}

We’ve developed mathematical formulas to help us determine the number of possible combinations – and therefore the possibility of getting any single combination – but how can we generate a list of the actual combinations?

Find the Number of Combinations: the Binomial Coefficient

Previously, we looked at how to find the total number of combinations.

Mathematically, we can use the binomial coefficient to figure this out. With a given set size (i.e. 52 cards) and a given sample size (i.e. 7 cards per hand), we can write the equation – (52 Choose 7). We could then re-write the equation as (52! / (7! * 45!) ).

In order to calculate this, we found the most efficient way was to construct two loops. The first loop calculated the numerator – after having canceled out all of the numbers contained in 45!. We then calculated the numerator by looping through 7!. With simple division, we come up with the answer.

Listing the Actual Combinations

A more interesting task, though, is to figure out how to generate a list of these combinations. To do that, let’s take a look at a manually generated list – (6 Choose 3) – and look for a pattern.

Here’s the first few combinations…

123
12 4
12  5
12   6
1 34
1 3 5
1 3  6
1   45
1   4 6
1    56
 234
 23 5

You’ll notice that there’s a pattern and that the combinations seem to be developing sequentially. If we can understand that pattern and write a script to repeat it, we’ll have done our job.

Here’s the gist of the pattern. We look at the last number. If we can increment that, we do. If not, we look back one number. If we can increment, we do. If we increment that number, we “rewind” the next number to be equal to it plus one.

For example, look at this series.

12   6
1 34

We started by incrementing the last number until it maxed out at 6. Then we moved back one space, incremented that number, and set the other number equal to one greater than that. The same thing happens when the last two numbers max out.

1   56
 234

You move back to the number that can be incremented, increment it, and then set the other numbers to one greater than the number incremented.

Using Hard-coded Loops

The easy (and cheating) way to do this is to hard code a series of nested loops that follow this pattern.

The general formula is (k Choose n) – where k is the total number of items in the set and n is the sample size being taken. We will need to create n nested loops – represent each item being chosen in our sample set.

The outer loop will go from 1 to k – (n – 1). Why? Because at k – (n – 1), we can’t increment the outer number anymore. Imagine the real numbers are (6 Choose 3). Once the outer loop gets to 4, we won’t be able to increment it any further – we’ll be at the final combination, 4, 5, 6.

The inner loop will have a beginning value that depends on the outer loop. If the outer loop is in its first iteration, the first inner loop starts at 2. When the outer loop is in its second iteration, the first inner loop starts at 3. It’s always one greater. It’s maximum value is always the same – k – (n – 2) – for the same reason we created the upper limit for the outer loop.

This continues until we get to the inner-most loop.

Here’s what these nested loops might look like in PHP, generating the combinations for (6 Choose 3).

for ($a = 1; $a <= (6 - 2); $a++) {
  for ($b = ($a + 1); $b <= (6 - 1); $b++) {
    for ($c = ($b + 1); $c <= (6 - 0); $c++) {
      echo $a . ' ' . $b . ' ' . $c . "\r\n";
    }
  }
}

You’ll see that that script outputs the correct 20 combinations for (6 Choose 3).

Can We Improve On That?

Surely we can. The main problem here is that we’ve hard-coded the loops. This is ok for a short-term solution and a small number of items being chosen.

What if you had to choose twenty items from a larger set? You’d have to hard-code twenty loops. It makes the code a bit more unseemly. This is also inflexible – you’ll have to change the code every time you have a different problem.

Instead, we need to look for a generalizable solution. This is always the best bet, but sometimes it can be tempting to look for a one-off short term solution because it’s more readily visible.

There is, however, a generalizable solution to this problem. The key lies in creating a function that finds the next combination using the sequential method outlined above. It takes a combination and returns a combination – and you can continuously call the function to iterate through all of the combinations.

Think on that for a while. It’s an interesting challenge. I’ll explain a solution to it later in the week.

There are some steps you can take later on to protect your applications from this unknown input. But first, let’s take a look at why you can never trust a user’s input and just how easy it is for someone to spoof a form.

What Does It Mean to Spoof a Form?

It could mean a number of related things, but generally speaking it means submitting form information in a manner other than the original form was intended. The form processing script, completely unaware of the situation, processes the input as if it came from the original form.

For example, if a form generates a URL query string, one way to spoof that form would be to modify the query string and re-visit the URL. The new page would think that my query came from the original form – even though I really crafted the query myself.

Why would someone want to do this? It may be curiosity. “I wonder what happens if I change this variable…” Or it may be malicious. A hacker can spoof a form processing script to send dangerous input to your PHP script.

The Problem With the “Get” Method

It is easiest to spoof a form if the information is transmitted through the “Get” method. This means that the variables are placed into a query string and appended to the form’s action URL.

Let’s say you have a form with three elements – a textarea element, a hidden input, and a select element. Logically, you might think that the hidden input is restricted to whatever value you set it to and the select element is restricted to one of the options you provided.

To make this a little more concrete, let’s assume the textarea contains a post to a multi-user blog, the hidden input contains the author’s name, and the select element includes the category number.

When the user enters the values and clicks “submit,” he’s sent to a URL that looks something like this.

processing.php?text=Bla+bla+bla&author=Walkere&catid=2

What if I wanted to pretend to be someone else – like Bob? I could simply change the ‘author’ variable.

processing.php?text=Bla+bla+bla&author=Bob&catid=2

Maybe I want to post my message in a special category – one that isn’t normally open to me. Again, it’s as simple as changing the catid variable to another number.

Now, a well designed script will notice these data flukes and either ignore them or spit out an error. However, if you have too much faith in form input – and you blindly used the values from your form – you’d soon be in a mess of trouble.

But Post Is More Secure… Right?

The “Post” method is somewhat more secure. Why? Because all of the information is transmitted behind the scenes.

When I was younger, I tried to meddle with the $_GET variables of an online game that I played. I never would have known enough about the workings of the script to spoof a “post” form – but it was so blatantly obvious with “get.”

However, someone “in the know” can easily spoof a form using the post method as well. One way to do this is… write your own form.

If I look at the HTML source of your form, I can easily see what values you’re submitting to the processing script. I can recreate those input elements on a form on my site – and then set the action to your processing script.

In this way, I could make the hidden and select statements regular text inputs – and input whatever values I want. If you’re form processing script isn’t savvy, my custom values will get passed on to the database.

One thing you can do to prevent this is to check the referring URL coming into your script. This will prevent someone from simply creating a form off-site to spoof your script.

Sending an Actual HTTP Request

The final, and most devious way, to spoof a form is to craft your own HTTP request in PHP. This is essentially what a form does – but you can manually craft the request to your liking instead of letting a form do it.

How do we do this?

First, we create a stream context. To do that we create a simple array and then call the function stream_context_create.

$params = array();
$params['http']['method'] = 'post';
$params['http']['headers'] = 'Referer: http://www.google.com';
$params['http']['content'] = $data; // A regular query string with parameters
 
$context = stream_context_create($params);
 
$fp = fopen($processingUrl, 'r', false, $context);
fpassthru($fp);
fclose($fp);

The actual form values are placed in the $data variable. This is in a typical query string format – key=var&key2=var2, etc. The values should also be url encoded.

The nifty thing here is that you can manually specify HTTP headers to be sent with your request. In this example, we set the referring URL to Google. If someone knew your processing script checked the referrer’s address – they could simply spoof it with an HTTP header.

Never Trust Input

The bottom line is – never trust input that you haven’t thoroughly tested, validated, and cleaned.

Even if an input item is supposed to be hidden or supposed to come from a specific set of values – you can’t be sure that the form processing script is going to receive the correct value. The script needs to check the info and make sure that it got what it was looking for.

It’s pretty simple for someone to spoof your form and send any input they like to your processing script. If you don’t close the security holes, then someone will eventually blow them open for you.

Today, we’ll tackle the first part. We’ll start with a quick primer on math – what is a binomial coefficient? Then, we’ll look into the most efficient way to calculate that and get the total number of possible combinations.

What Is a Binomial Coefficient?

If it’s been a while since you took statistics or calculus, you might be scratching your head thinking about what a binomial coefficient is and what it has to do with combinations.

If you’re looking at a set of random items – let’s say 52 playing cards – and you want to pick out a number of them – let’s say a 7 card poker hand – the binomial coefficient tells you how many possible combinations you can make.

The general formula for that is usually written:

(x Choose y) = (x!) / (y! * (x-y)!)

In our example above, the total number of combinations you can get in a 7-card poker game is (52! / (7! * 45!)) or somewhere around 130,000,000.

How Do We Calculate That (in PHP)?

These methods of calculation will work for any language, really. We’ll just use PHP as an example.

The simplest way to calculate the binomial coefficient would be to loop through, calculate each factorial, and then evaluate the equation. Notice I said simple, not efficient.

$x = 52;
$y = 7;
 
$num = 1;  //  This is the numerator, 52!
for ($a = 1; $a <= $x; $a++) {
  $num *= $a;
}
 
$denOne = 1;  //  This is the first part of the denominator, 7!
for ($b = 1; $b <= $y; $b++) {
  $denOne *= $b;
}
 
$denTwo = 1;  //  This is the second part of the denominator, 45!
for ($c = 1; $c <= ($x - $y); $c++) {
  $denTwo *= $c;
}
 
$combinations = ($num) / ($denOne * $denTwo);

PHP will evaluate this properly because it’s nice and flexible with data types. Do you know how large 52! is? Try 8.06581751709E+67 large.

This is clearly too big to be an integer value, but PHP quietly converts the values to floats and keeps running. There should be a better way – one where we don’t have to calculate all of the factorials.

Method Two – Using array_diff

This method is a bit more along the lines of human logic. However, it’s still not going to be efficient. Although it’ll work with smaller numbers than the first method, it’ll take more time and memory to compute.

Basically, we’ll create three arrays. One for each set – {1, 2, 3, … 52}, {1, 2, 3, … 7}, {1, 2, 3, … 45}.

Since we know that the third set (45!) will be in the denominator and the first set (52!) will be in the numerator, we can use a nifty function called array_diff to cancel out all of the common values and shrink the numerator for us.

$newNumerator = array_diff($oldNumerator, $oldDenominator);

Then we can calculate the factorials by multiplying all of the values in the array. We can also make use of another PHP function here – array_product. It does more or less what it sounds like – it finds the product of all the values in an array.

$num = array();
for ($a = 1; $a <= $x; $a++) {
  $num[] = $a;  // the numerator array, 52!
}
 
$denOne = array();
for ($b = 1; $b <= $y; $b++) {
  $denOne[] = $b;  //  The first denominator array, 7!
}
 
$denTwo = array();
for ($c = 1; $c <= ($x - $y); $c++) {
  $denTwo[] = $c;  // The second denominator array, 45!
}
 
//  Use array_diff to cancel out the common values in 52! and 45!
$num = array_diff($num, $denTwo);
$combinations = array_product($num) / array_product($denOne);

This keeps the numbers much smaller. Therefore we can work with bigger combinations before PHP putts out. However, the arrays can eat up a lot of memory and processing power… so there still should be a better way.

Combine the Two Concepts

The more efficient way is to combine the two concepts. We’ll use the first method of multiplying through a loop to generate the factorials. This is far more efficient than iterating an array.

However, we’ll still cancel out the common values between 52! and 45!. To do this, we modify the first loop so that it counts down from $x (52) to $x – $y (45). Then we simply ignore the third loop – since it’s values were essentially counted when we calculated the first loop.

$num = 1;
for ($a = $x; $a > $x - $y; $a--) {
  $num *= $a;
}
 
$den = 1;
for ($b = 1; $b <= $y; $b++) {
  $den *= $b;
}
 
$combinations = $num / $den;

At this point, our script is pretty efficient. It doesn’t use up a lot of memory, it executes quickly, and it’s not calculating very many redundant values.

However, there’s still a limit to what we can do. The biggest number PHP seems to be able to calculate is 170!. After PHP sees the value 7.25741561531E+306 it just seems to give up. Geez, like 300 zeroes is a lot.

You could improve this a bit more, and increase the number of combinations it could compute. Rather than calculating the $numerator and $denominator separate, as we did here, you’d want to calculate the $denominator first and then cancel out values as you multiply the numerator.

In other words, calculate the $denominator as normal. Then, while you’re looping through to calculate the numerator, you factor out any common values in the $denominator and the number about to be multiplied into the numerator.

Who Cares About How Many Combinations… I Want to See Them

This is really the boring part. Who cares how many combinations there are? We can easily find that with a calculator.

The interesting part – where we definitely need a computer to help us – is to iterate through the set and find all of the possible combinations. We’ll come back to this later in the week.