Transactions and auto-commit

Now that you're connected via PDO, you must understand how PDO manages transactions before you start issuing queries. If you've never encountered transactions before, they offer 4 major features: Atomicity, Consistency, Isolation and Durability (ACID). In layman's terms, any work carried out in a transaction, even if it is carried out in stages, is guaranteed to be applied to the database safely, and without interference from other connections, when it is committed. Transactional work can also be automatically undone at your request (provided you haven't already committed it), which makes error handling in your scripts easier.

PHP Data Object (PDO)

The PHP Data Objects (PDO) extension defines a lightweight, consistent interface for accessing databases in PHP. Each database driver that implements the PDO interface can expose database-specific features as regular extension functions. Note that you cannot perform any database functions using the PDO extension by itself; you must use a database-specific PDO driver to access a database server.

Connections 

Connections are established by creating instances of the PDO base class. It doesn't matter which driver you want to use; you always use the PDO class name. The constructor accepts parameters for specifying the database source (known as the DSN) and optionally for the username and password (if any).

Example #1 Connecting to MySQL:

$dbh = new PDO('mysql:host=localhost;dbname=test', $user, $pass);

SQL Injection in PHP

Many web developers are unaware of how SQL queries can be tampered with, and assume that an SQL query is a trusted command. It means that SQL queries are able to circumvent access controls, thereby bypassing standard authentication and authorization checks, and sometimes SQL queries even may allow access to host operating system level commands.

Direct SQL Command Injection is a technique where an attacker creates or alters existing SQL commands to expose hidden data, or to override valuable ones, or even to execute dangerous system level commands on the database host. This is accomplished by the application taking user input and combining it with static parameters to build an SQL query. The following examples are based on true stories, unfortunately.

Owing to the lack of input validation and connecting to the database on behalf of a superuser or the one who can create users, the attacker may create a superuser in your database.

Extract uploaded Zip file

I want to give tips for uploading zip files and extract in destination in with PHPs built in Zip Archive class.

Here is the code that runs in xampp (windows)
if($_POST['submit']) {
$zip = new ZipArchive;
if($_FILES) {
if($zip->open($_FILES['uploadfile']['name'],ZipArchive::CREATE) === TRUE) {
echo 'ok';
} else {
echo 'failed';
}
}
else {
echo 'Error in file Upload';
}
}

http://www.wimpyplayer.com/docs/rave/playlist.xml.wxpf.html

http://www.magentocommerce.com/wiki/4_-_themes_and_template_customization/flash_and_media/how_to_add_jw_image_gallery_xml-flash

http://www.triconsole.com/php/calendar_datepicker.php