Optimizing Page Load Time: Fixing Your HTTP Pipeline Problem

Defined here by Wikipedia.org, “HTTP pipelining is a technique in which multiple HTTP requests are written out to a single socket without waiting for the corresponding responses.”

Mozilla talks a bit more about the topic: “Normally, HTTP requests are issued sequentially, with the next request being issued only after the response to the current request has been completely received. Depending on network latencies and bandwidth limitations, this can result in a significant delay before the next request is seen by the server.”

I have accepted the fact that HTTP pipelining is pretty much disabled in all modern browsers, but that doesn’t mean I have to like it!

I have a widget in Firefox that allow me to bypass this missing “feature” and it sure seems to speed up my browsing quite a bit. However, why can’t everyone get together and work this problem out so we don’t need extensions/widgets/hacks to get around the limitations?

I attempted to harass Microsoft about it and never received an answer (I didn’t really harass them per say). Firefox isn’t mum on the subject (here), but it seems to come down to compatibility issues with certain servers, routers, et cetera in some specific cases (even if the HTTP/1.1 spec allows it).

So what does a web developer do (programmatically)?

Do we just accept the fact and move on or is there something we can do about it? How can we speed up our page loads to a world that can’t use pipelining?

It turns out there is a relatively simple way to “fake HTTP pipelining”. When I read through the article “Optimizing Page Load Time“�, I had a very revealing moment of self-inflicted-disrespect. The solution is so obvious, but it never dawned on me previously. Why not simply source content on the page from different locations? It doesn’t even have to be different servers, just different domains. Pretty simple right?

For example, we could do something like this for a single web page:

- Static Images: images.ashishlakhotia.com
- Javascript Includes: includes.ashishlakhotia.com
- CSS: css.ashishlakhotia.com
- Static Content: static.ashishlakhotia.com
- Dynamic Content: dynamic.ashishlakhotia.com

Now this is a pretty extreme example that I wouldn’t recommend for production (except in very specific cases), but let me explain what happens in simple terms. Instead of your browser making a request to one domain for all the content, data, files, and everything for a page; it splits up the requests amongst the various sub domains (of which could be hosted separately or together).

What does splitting up the content get us?

The advantage is that the browser isn’t sitting around waiting on previous requests to complete before moving on to the next item. It really only makes sense for larger pages. In fact there is a drawback, according to Aaron, “Beware that each additional hostname adds the overhead of an extra DNS lookup and an extra TCP three-way handshake. If your users have pipelining enabled or a given page loads fewer than around a dozen objects, they will see no benefit from the increased concurrency and the site may actually load more slowly. The benefits only become apparent on pages with larger numbers of objects. Be sure to measure the difference seen by your users if you implement this.”

Perhaps now you can consider playing around with this idea a bit on your own. Given plenty of tinkering time and careful examination, it could help decrease page load times noticeably.

If you’d like some more tips on this subject, check out Optimizing Page Load Time.

PHP Security - Ensuring A Safe PHP Setup

One of the inherent flaws with any popular web language like PHP is the serious potential of security vulnerabilities from improperly set up installations and servers. Although ensuring a secure server installation (whether Apache or IIS) is extremely important, that process is outside the scope of this article.

Instead, I’d like to recommend one simple tool that will should enable you to pro actively plug most “holes” in your PHP setup.

The ironic part about this article is that just a short while ago I thought I had everything “plugged” myself. I had done my reading up on PHP security and felt confident that I had a secure setup. Unfortunately, in an upgrade to a more recent PHP version, I accidentally overwrote my “secure” php.ini from the previous install. This caused one particular web site to be infiltrated by a nefarious ‘hacker’. Fortunately, there was no serious damage and I quickly found the problem.

However, if I had dropped PhpSecInfo onto the server and checked it out before going live, I would’ve immediately known there was a problem.

So here’s how it works: PhpSecInfo is just a single script and a small library that does the work. You simply drop the PHP files onto your server and execute index.php in your browser. You’ll be treated with a nice looking, clean, and easy-to-understand table of security information about your current PHP setup.

There are a mighty large number of security tests performed and all you have to do is analyze the results. Using the highly familiar red, yellow, green color schemes (from stop lights)… you know which tests have failed miserably, which ones you should probably check on, and which ones you can safely ignore. I realize that it’s not the end-all security check-up for a PHP installation, but I think it’s truly helpful to anyone operating a public facing PHP web server.

So, if you’re interested, check out PhpSecInfo from the PHP Security Consortium.

Whether or not you make any changes to your setup, it’s always good to be aware of your vulnerabilities. Oh yeah, it’s also totally free!

JQuery: The Best Javascript Library?

After stumbling across this article, I was in awe to see what has recently transpired in the world of Javascript libraries/frameworks. I had recently fell in love with Yahoo UI, but I was truly surprised to see that jQuery has gained remarkable traction in the market.

According to This Google Trend, it has leaped far ahead of even script.aculo.us in raw search volume. This is a particulary good sign for jQuery. As search volume increases, so will the number of pages related to jQuery obviously and vice versa.

In my experience, rapidly growing popularity is usually a pretty good sign of success for an open-source project. If problems exist with the project, usually the overwhelming interest helps to spur on solutions and increase the capability of the product because of the massive interest. I’ve seen this same trend previously with with CakePHP, an excellent framework alternative for PHP based loosely off of Ruby on Rails.

Regardless, it appears that I will start learning jQuery. Even if it turns out to lose the “battle”, it can’t help to learn more about advanced javascript without being forced to climb a steep learning curve.

Any truthfully, if this popularity trend continues, I think it’s safe to say jQuery is here to stay.

jQuery.com if interested.

Did you know that PHP has some pretty powerful type casting functionality built-in? It’s no surprise if you comprehend the roots of PHP (since it’s written in C), but I can’t help but think that casting is an often-missed tool when a PHP developer is trying to ensure data integrity.

Just for a moment, let me define type casting in case you weren’t “in the know”:

According to Wikipedia, “in computer science, type conversion or typecasting refers to changing an entity of one data type into another. “

So, in laymen terms, casting is an easy way to turn one type of data into another type. For example: converting a “string” variable filled with essentially text into an integer variable containing the same numbers but now representing a value. This makes it easy to do math with the value of what once was just a random string of characters.

The following cast types are allow in PHP:

• String - (string)
  
• Boolean - (bool), (boolean)
  
• Integer - (int), (integer)
  
• Binary - (binary) [PHP 6]
  
• Floating Point - (float), (double), (real)
  
• Array - (array)
  
• Object - (object)
  

So, in the real world, when does casting actually come in handy?

Normally, PHP handles all this stuff automatically behind the scenes. But, as is normal, dealing with MySQL database interaction is something to always take seriously — and type casting can help you out!

We’re going to assume your aren’t using the PDO Prepare statement (though you should be). As a PHP developer, a major part of your job is containing the inherent security risks of user input. It’s especially important when these inputs interact directly with the database.

So, your simplified (e.g. - don’t complain) database interaction code might look something like this:

$id = mysql_real_escape_string($_POST['input']);

$SQL = 'SELECT * FROM table WHERE id = ' . $id;

Call me an overly nervous Ned, but I’d prefer to use the following code:

$id = mysql_real_escape_string($_POST['input']);
$SQL = 'SELECT * FROM table WHERE id = ' . (int)$id;

Did you notice the subtle change? See the ‘int’ cast of the $id in the SQL statement?

This should certainly help to ensure that I haven’t missed any security holes for this query. Some might say it’s overkill, but I just wanted a simple explanation for using casting, so get off your almighty soapbox already.

Anyways, as you can see, type casting in PHP has real-world uses. Delve into type casting a little more and you’ll find a huge number of cases where it can make your code that much more bullet-proof.

So seriously, try out PHP Type Casting.

Installing CakePHP

Over the past few months I have been getting to grips with CakePHP, a rapid development framework written in PHP that uses the Model, View, Controller (MVC) software design pattern. If you are a PHP programmer then give this framework a try because quite frankly it’s the bee’s knees.

Although it does have quite a steep learning curve once you become familiar with the concepts it will help to improve your programming skills and will also get your database-driven websites up and running extremely quickly. This post is going to be the first of many regarding CakePHP and my plan is to release posts quite regularly that build upon the Blog tutorial found in the manual.
Downloading and Installing CakePHP

Currently there are 2 versions of CakePHP available, 1.1 and 1.2. Version 1.2 is in a pre-beta stage and limited documentation exists and therefore I’m going to be dealing with the stable 1.1 release. Go to the download page and grab the 1.1 zip file. Extract the files to a folder in your local web server (read my previous post about setting one up) , I’ve renamed the folder to “cakephp” and inside you will have a number of folders and files including “app”, “cake”, “docs”, “vendors”, “.htaccess” and “index.php”.



One of the first things you should do when starting with CakePHP is read the manual, especially the first few chapters about the basic concepts and installation. It will help to get your head around everything and although things may seem confusing at first it does get easier.

I setup CakePHP to use the production setup right from the start this makes everything easier when you need to upload your finished site, I do this by setting up a virtual host.
Setting up a Virtual Host

I’m running the excellent Xampp webserver and I use virtual hosts for developing all my websites. Open the Apache Virtual Host file (located at C:\server_directory\apache\conf\extra\httpd-vhosts.conf) and create a new host:

1.
2. DocumentRoot C:/server/htdocs/cakephp/app/webroot
3. ServerName cakephp:80
4.


Don’t forget to add “cakephp” to you Hosts file (C:\windows\system32\drivers\etc\hosts), restart your webserver if you already have it running and you will be able to access your new installation of CakePHP by going to “http://cakephp” in your browser.
Mod_Rewrite

Just a quick note on mod_rewrite, if you have installed Xampp as your local server or use Apache then its best if you enable mod_rewrite, simply open the “httpd.conf” file located at “C:\server\apache\conf” and uncomment the following line by removing the ‘#’ symbol:

1. #LoadModule rewrite_module modules/mod_rewrite.so


There is some more information regarding mod_rewrite in Section 5 of the “Installing CakePHP” part of the manual. Remember to restart Apache when you make any changes like this.
Testing CakePHP in your Browser
CakePHP Image

If you have set everything up correctly then you should be seeing a CakePHP page when you go to “http://cakephp”, if you are not seeing any images or css styling then make sure that you have mod_rewrite enabled and that your virtual host is pointing to the “/app/webroot” directory (with no trailing slash). The page is telling you that you have not set up your database configuration file so we will be doing this next.
Setting up the Database Connection
CakePHP Image

The database configuration file is located at “C:\server\htdocs\cakephp\app\config”, rename the “database.php.default” file to “database.php” and open it in your editor. You need to enter your database username, password and database name into the “$default” connection. If you have not yet created a new database open phpMyAdmin in a browser and create a new database, doesn’t really matter what you call it but I’ve created one called “cakephp”.
CakePHP Image

Reload “http://cakephp” in your browser and CakePHP will now be able to see your database configuration file and it will also be able to connect to your database. Everything is looking good and you now have a fresh install of CakePHP up and running on your local web server.