Zend PHP 5 Certification: Exam Question Assistance (06 May 2010)

[crmpicco]

I have just sat, and passed, another mock exam for the Zend PHP certification. The following questions came up in the test and I wondered if anyone would be able to help me out in obtaining the answers and the reasons (if possible). :-)

<?php
function redirect($url) {
  // Check to make sure we haven't already sent
  // the header:

  if(???????) {
    header("Location: $url");
  }
}

?>

What conditional should replace the ????? above?

Answers:

• !in_array("Location: $url", headers_list())
• !header_exists("Location: $url")
• !header_location($url)
• $_SERVER['HTTP_LOCATION'] != $url

=========================================================

<?php
header("Location: {$_GET['url']}");
?>

Which of the following values of $_GET['url'] would cause session fixation?

Answers:

• Session Fixation is not possible with this code snippet
• http://www.zend.com/?PHPSESSID=123
• PHPSESSID%611243
• Set-Cookie%3A+PHPSESSID%611234
• http%3A%2F%2Fwww.zend.com%2F%0D%0ASetCookie%3A+PHPSESSID%611234

=========================================================

If regular expressions must be used, in general which type of regular expression functions available to PHP is preferred for performance reasons?

• strtok() using regular expressions
• preg_* regular expression functions
• parse_str() using regular expressions
• strregex* regular expression functions
• ereg* regular expression functions

=========================================================

Many thanks,
Picco

[NogDog]

1. Of the 3 functions listed in the answer, only headers_list() is in the manual. But it does not answer the question posed by the code comment, which would be better addressed by the headers_sent() function, in my opinion.

2. I would think only the first URL would, as the others would not actually be well-formed URLs with a fixable query string.

3. I know that the preg_*() (PCRE) functions are preferred over the ereg_*() functions (which are deprecated), while strregex() is not defined and the other two functions are not really regexp functions (though strtok() is somewhat similar and might be preferred in certain specific circumstances where you might consider using a regexp function).