Secure PHP Development- P9 ppt

You cannot define the embedded block first.The next line in Listing 1-2 sets a template variable NAMEto the value of $name variable: $t->set_var“NAME”, $name; In Listing 1-3, you will se

You cannot define the embedded block first.

The next line in Listing 1-2 sets a template variable NAMEto the value of $name

variable:

$t->set_var(“NAME”, $name);

In Listing 1-3, you will see a line such as the following:

<td> {NAME} </td>

Here the template variable is {NAME} When setting the value for this template variable using the set_var()method, you didn’t have to use the curly braces, as it

is automatically assumed

Now that the script has set the value for the only template variable in the tem-plate, you can parse the block as done in the next line:

$t->parse(“main”, “mainBlock”, false);

This line calls the parse() method of the $t template object to parse the

mainBlock, which is internally named as “main.” The third parameter is set to

false, because we don’t intend to loop through this block Because nested blocks are often used in loops, you’d have to set the third parameter to true to ensure that the block is parsed properly from iteration to iteration

Finally, the only remaining thing to do is print and parse the entire page:

$t->pparse(“OUT”, “page”);

This prints the output page

What all this additional code bought us is an implementation that uses an exter-nal HTML template, which the end user can modify without knowing anything about the PHP code This is a great achievement, because most of the time the end user is interested in updating the interface look and feel as his or her site goes through transitions over time

Using external configuration files

An external configuration file separates code from information that is end-user configurable

By separating end-user editable information to a separate configuration file we reduce the risk of unintentional modification of core application code Experienced commercial developers will tell you that this separation is a key timesaver when customers make support calls about PHP applications As a developer, you can instruct the end user to only modify the configuration file and never to change anything in the core application files This means any problem created at the end-user site is confined to the configuration file and can be identified easily by the developer

In Listing 1-2, we had the following lines:

$PHPLIB_DIR = $_SERVER[‘DOCUMENT_ROOT’] ‘/phplib’;

ini_set( ‘include_path’, ‘:’ $PHPLIB_DIR ‘:’

ini_get(‘include_path’));

include(‘template.inc’);

include(‘template.inc’);

$TEMPLATE_DIR = $_SERVER[‘DOCUMENT_ROOT’]

‘/ch1/templates’;

$OUT_TEMPLATE = ‘listing2out.html’;

These lines are configuration data for the script Ideally, these lines should be stored in an external configuration file For example, Listing 1-4 shows a modified version of Listing 1-2

Listing 1-4: Modified Version of Listing 1-2

<?php

require_once(‘app_name.conf’);

// Enable all reporting error_reporting(E_ALL);

// Get name from GET or POST request

$name = (! empty($_REQUEST[‘name’])) ? $_REQUEST[‘name’] : null;

// Create a new template object

$t = new Template($TEMPLATE_DIR);

// Set the template file for this object to // application’s template

$t->set_file(“page”, $OUT_TEMPLATE);

// Setup the template block

$t->set_block(“page”, “mainBlock” , “main”);

// Set the template variable = value

$t->set_var(“NAME”, $name);

// Parse the template block with all // predefined key=values

$t->parse(“main”, “mainBlock”, false);

// Parse the entire template and print the output

$t->pparse(“OUT”, “page”);

?>

Notice that all the configuration lines from the Listing 1-2 script have been removed with the following line:

require_once(‘app_name.conf’);

The require_once() function loads the configuration file The configuration lines now can be stored in the app_name.conffile, as shown in Listing 1-5

Listing 1-5: Configuration File for Listing 1-4 Script

<?php

// Set PHPLIB path

$PHPLIB_DIR = $_SERVER[‘DOCUMENT_ROOT’] ‘/phplib’;

// Add PHPLIB path to PHP’s include path ini_set( ‘include_path’, ‘:’ $PHPLIB_DIR ‘:’

ini_get(‘include_path’));

// Include the PHPLIB template class include(‘template.inc’);

// Setup this application’s template // directory path

$TEMPLATE_DIR = $_SERVER[‘DOCUMENT_ROOT’]

‘/ch1/templates’;

// Setup the output template filename

$OUT_TEMPLATE = ‘listing2out.html’;

?>

Another great advantage of a configuration file is that it allows you to define global constants as follows:

define(YOUR_CONSTANT, value);

For example, to define a constant called VERSION with value 1.0.0 you can add the following line in your configuration file:

define(VERSION, ‘1.0.0’);

Because constants are not to be modified by design, centralizing then in a con-figuration file makes a whole lot of sense

Using customizable messages

To understand the importance of customizable messages that are generated by an application, let’s look at a simple calculator script

Listing 1-6 shows the script, called calc.php The configuration file used by

calc.php is calc.conf, which is similar to Listing 1-5 and not shown here This script expects the user to enter two numbers (num1, num2) and an operator (+ for addition, – for subtraction, * for multiplication, or / for division) If it doesn’t get one or more of these required inputs, it prints error messages which are stored in an

$errorsvariable

Listing 1-6: calc.php

<?php

// Enable all error reporting error_reporting(E_ALL);

require_once(‘calc.conf’);

// Get inputs from GET or POST request

$num1 = (! empty($_REQUEST[‘num1’])) ? $_REQUEST[‘num1’] : null;

$num2 = (! empty($_REQUEST[‘num2’])) ? $_REQUEST[‘num2’] : null;

$operator = (! empty($_REQUEST[‘operator’])) ?

$_REQUEST[‘operator’] : null;

// Set errors to null

$errors = null;

// If number 1 is not given, error occurred

if ($num1 == null) {

$errors = “<li>You did not enter number 1.”;

}

// If number 2 is not given, error occurred

if ($num2 == null) {

$errors = “<li>You did not enter number 2.”;

}

// If operator is not given, error occurred

if (empty($operator)) {

$errors = “<li>You did not enter the operator.”;

}

// Set result to null

$result = null;

// If operation is + do addition: num1 + num2

if (!strcmp($operator, ‘+’)) {

$result = $num1 + $num2;

// If operation is - do subtraction: num1 - num2 } else if(! strcmp($operator, ‘-’)) {

$result = $num1 - $num2;

// If operation is * do multiplication: num1 * num2 } else if(! strcmp($operator, ‘*’)) {

$result = $num1 * $num2;

// If operation is / do division: num1 / num2 } else if(! strcmp($operator, ‘/’)) {

// If second number is 0, show divide // by zero exception

if (! $num2) {

$errors = “Divide by zero is not allowed.”;

} else {

$result = sprintf(“%.2f”, $num1 / $num2);

} }

// Create a new template object

$t = new Template($TEMPLATE_DIR);

// Set the template file for this // object to application’s template

$t->set_file(“page”, $OUT_TEMPLATE);

Continued