- show_more_db...
- show_more_db1.php (Listing) -- Using mysql_query() with SELECT... and the numerically indexed array (and the common_db12.inc file for functions, "password hiding," etc.)
- show_more_db2.php (Listing) -- (and the common_db12.inc file for functions, "password hiding," etc.)
- show_seek_db.php (Listing) -- Cp. show_more_db2.php (above)
- Some incremental steps to understanding
the functions in common_db12.inc
:
- JavaScript --
- Opening browser window (notice
the difference in the line including "directories.."
between this file and the one in the Choi & the window height
and width are specified):
openwindow.htm - Alert Box
- Opening browser window (notice
the difference in the line including "directories.."
between this file and the one in the Choi & the window height
and width are specified):
- PHP
- Double Equals -- Replaces first two variables with the value of the third: doubleequals1.php (Listing); doubleequals2.php (Listing) ; doubleequals3.php (Listing)
- Generating a simple table with columns for usernumber,
userid and username via an MySQL query of the format equivalent
to:
SELECT usernumber, userid, username FROM user ORDER BY username DESC LIMIT 6;
This is done via:
$query = "SELECT usernumber, userid, username FROM user ORDER BY $default_order_by DESC LIMIT 6";
...
in the PHP code (where $default_order is set in common_db12.inc): table1.php (Listing). Note: The last few lines:
<?php
list_records();
html_footer();
?>
actually give us a non-blank result by calling the appropriate functions. - Query Strings passed to PHP programs via HREF
--
- The next step in developing userviewer.php
(below) is table2a.php
(Listing),
where where two of the elements of the header row is are links
that will re-call a variant of the function list_records().
Code added/changed in list_records():- $query
= "SELECT usernumber, userid, username FROM user
ORDER BY $default_order_by DESC LIMIT 6";
becomes
$query = "SELECT usernumber, userid, username FROM user $order_by_str DESC LIMIT 6"; - $order_by_str
is determined by following code inserted above the $query=
statement:
if(empty($order_by)) {
$order_by_str = "ORDER BY $default_order_by";
$order_by = $default_order_by;
}
else $order_by_str = "ORDER BY $order_by";
Recall, $default_order_by is set at 'usernumber'. At this point the result (since list_records() is only called once) is the same as table1.php.
- $query
= "SELECT usernumber, userid, username FROM user
ORDER BY $default_order_by DESC LIMIT 6";
- Recall selector.php
(Listing)
from Choi's Ch. 8, p.279)
NOTE: The $PHP_SELF is the current script file and ?action=order_food sets the value of the variable $action equal to the string order_food .
Obtain table2b.php (Listing):- Add two links before table as follows:
<A HREF="<?php echo "$PHP_SELF?order_by=userid"; ?>">
User ID
</A><BR>
<A HREF="<?php echo "$PHP_SELF?order_by=username"; ?>">
User Name
</A>
This means that when the first link (for "User ID") the current (table2b.php via $PHP_SELF) PHP script will be called again and $order_by will be set at 'userid' (instead of being empty as it was on the first call to table2b.php) via the query string (see address field in browser).
- Add two links before table as follows:
- Using the same principle as in table2b.php,
but adding a switching mechanism to determine
whether or not to call the list_records() function or view_record()
function. Proceed as follows to generate table2c.php
(Listing):
- Add the Switching code at the
end of the file and delete the call to list_records():
switch($action) {
case "view_record":
view_record();
break;
default:
list_records();
break;
}
- Add the majority of the view_record() function code.
- Add an Action column to the list_records()
function, with each cell having the form:
echo "<TD WIDTH=\"25%\" ALIGN=\"CENTER\">
<A HREF=\"javascript:open_window('$PHP_SELF?action=view_record&
userid=$userid');\">View Record</A></TD>\n";
This causes the vier_records function to be called since $action = view_records when the script is recalled. the JavaScript simply causes a new window to be opened (as noted above). - Recall the substr(string,start,length),
where the start is at 0 for the PHP and 1 for the MySQL
function, and the dates in MySQL are of
the form YYYY-MM-DD.
- Add the Switching code at the
end of the file and delete the call to list_records():
- The next step in developing userviewer.php
(below) is table2a.php
(Listing),
where where two of the elements of the header row is are links
that will re-call a variant of the function list_records().
- JavaScript --
- userviewer.php
(Listing)
-- Is an amplification of the parts broken down and discussed above.
(Aside: For the following discussion we will use Mozilla and its cookie handling facilities.)
- Ch. 15 (Meloni,
et. al) -- Database-Driven User Authentication
- Generate a new table (auth_users),
Using the table generation (auth_users)
programs in Ch. 12:
- Step1: Input the table name and number of fields via a form (show_create.html), which calls this script (do_showfielddef.php).
- Step 2: Generate the MySQL
table using this script
(do_createtable.php).
Generate the following table:
Meloni notes (p. 245): "The MAXLENGTH of the password form field is 25, while the database field maximum length is 100. This discrepancy in length takes into consideration the encryption that will occur. A 25-character plain-text password, such as that entered in this form field, will probably be longer than 25 characters when encrypted. Since only the encrypted password is stored in the database, the greater maximum length will handle the extra data."
- Add records (users; this is where
we diverge from Ch. 12's generic model) to the table using the form
(show_adduser.html) and the script
(do_adduser.php) it calls.
Note: Concerning the MySQL password() function (not a PHP function), Meloni states: "The password() function inserts a hash of the password, not the password itself. This alleviates the security risk of having plain-text passwords sitting in your database." Add a record and look at the result using the command-line MySQL client.
Furthermore, Dubois (p.458) notes: "Passwords are listed in the user table as encrypted strings, so you can't tell what a user's password is even if you have read access to this table. It seems to be a common assumption that the PASSWORD() function performs the same kind of encryption as is used for UNIX passwords, but it doesn't.
The two kinds of encrption are similar in that both are one-way and not reversible, but MySQL doesn't use the same encryption algorithm that UNIX does. This means that even if you use your UNIX password as your MySQL password, you shouldn't expect the encrypted password strings to match. If your want UNIX encryption for an application,use the CRYPT() function rather thant PASSWORD()."
See also this information from the mysql.com site.
- Authenticating the username and
password with the form
(show_login.html) and the script
(do_authuser.php)
To delete a user (record) you might recall:
DELETE FROM table_name WHERE expression;
- Generate a new table (auth_users),
Using the table generation (auth_users)
programs in Ch. 12:
- Ch. 16 (Meloni,
et. al) -- Using Cookies (A review? Recall,
previous discussions.)
- Meloni notes: "Cookies are little pieces of text that are sent to a user's Web browser. Cookies can help you create shopping cards, user communities, and personalized sites. It's not recommended that you store sensitive data in a cookie, but you can store a unique identification string that will match a user with datqa held securely in a database."
- PHP has its own setcookie function (see also php.net)
- First Example, A "bad cookie:" Listing & Execution (Why?)
- Second Example, Setting a cookie: Listing & Execution. Recall, "When a Web browser accepts a cookie, you can't extract its value until the next HTTP request is made." Why? -- Show cookies (Listing), recall the environment variable .$_COOKIE or $HTTP_COOKIE_VARS .
- Third Example, Using cookies with authentication: Uses the authentication form (cp. show_login.html in Ch. 15) and the script (a variation of do_authuser.php in Ch.15) and if login successful, allows for execution of secretA and secretB scripts, and these scripts allow noting but the login form if the cookie is not set. Show cookies (Listing)
- Ch. 17 (Meloni,
et. al. and Meloni2)
-- Session (Persistence of State) Basics
(See also Lerdorf on Maintaining State)- Williams notes the following concerning the need to store the state of the application between HTTP requests: "There are two ways to achieve this: variables that hold the state can be stored in the browser and included with each request or variables can be stored on the server." Sessions use the latter method and we saw cookies applied (above) for the former.
- A session begins with the setting of a special cookie: PHPSESSID . The value of this cookie specifies a temporary file on the server containing "registered" variables to be used during the session.
- Starting a session: [Listing] & [Execution]. Using the [session_start()] function (Note: This function must be placed at the beginning of your script. Why?). Check with [Show cookies] ([Listing]). Although it is not very enlightening at this point, consider the use of the [session_get_cookie_params()] function, which returns an array (associative) of values: [Listing] & [Execution]
- (From Meloni2 ) Stating a session and retrieving the session id with the [session_id()] function: [Listing] & [Execution]. Reload the page and note there is no change. Check with Show cookies (Listing).
- Using session variable: Counting
the number of times a page is visited during a session: [Listing]
& [Execution].
Using the [session_start()]
and the [session_register()] functions.
Click refresh several times to test. Browse to other sites and come
back and test. Check with [Show
cookies] ([Listing])
. Further check with a listing of all the session variables and
their
values: [Listing]
& [Execution]
(Note the $_SESSION environment variable and that
to see its values we must use session_start().).
Aside from Williams:- Using cookies can also be used to count visits consider this example : Listing & Execution.
- Using a session to accomplish the same task: [Listing] & [Execution].
Aside from Lerdorf : - Managing User Preferences with Sessions: The
- Starting the Session and Registering Defaults: [Listing] & Execution. Further check with a listing of all the session variables and their values: [Listing] & [Execution] . Further check with a listing of all the session variables and their values: [Listing] & [Execution]
- Executing the preference of the previous script/form: Listing
- More from Meloni2
for possible amplification and illumination:
- Display cookies (to see if session cookie is still set): [Listing] & [Execution].
- Storing session variable in $_SESSION: [Listing] & [Execution].
- Accessing the Stored Session Variables: [Listing] & [Execution] . Hence we have access to these variables in an entirely new Web page. Further check with a listing of all the session variables and their values: [Listing] & [Execution]
- [session_save_path()]
shows where the session files reside:[Listing]
& [Execution]
.
Although we do not have access to \tmp Meloni states: "A glance at my /tmp directory reveals a number of files with names like the following:
sess_f3fc242dd7947542fed830dd2f79d258
Opening the file that matches the session ID I was allocated when I first ran Listing 16.1, I can see how the registered variables have been stored:
product1|s:17:"Sonic Screwdriver";product2|s:8"HAL 2000";