Secure PHP Development- P22 pptx

The constructor method has to be passed a database URL which has the following syntax: database_type://username:password↓tabase_host/database_name The $DB_URLvariable was set to create a

// Dump the contents of the DBI object to // see what it contains

echo “<pre>”;

print_r($dbi);

echo “</pre>”;

?>

Here, $dbiis an instance of the DBI object created from class.DBI.php The constructor method has to be passed a database URL which has the following syntax:

database_type://username:password↓tabase_host/database_name

The $DB_URLvariable was set to create a database URL that pointed to a MySQL database (mysql) named mydbon host called localhostThe data-base can be accessed using the rootuser account and foobarpassword The DBI()method sets the DB URL passed to itself as db_urlmember variable and calls the connect()method to connect to the given data-base The constructor sets the fetch mode to DB_FETCHMODE_OBJECT, which allows us to fetch database rows as objects.

◆ connect(): By default, the DBI()constructor method calls the connect()

function directly to establish the connection, so you don’t need to con-nect()connects to the database specified in db_urlmember variable of the object It sets a member variable dbhto the database handle object created by the DB::connect()method, which is found in the PEAR DB package connectalso sets a member variable called connectedto Boolean TRUEor FALSEand returns that value.

◆ disconnect(): The disconnect()function disconnects the DBI object from the database

The terminate() function in PHPApplication class (class PHPApplication.php) calls the disconnect()function if the applica-tion is connected to a database See terminate() function in

PHPApplicationclass for details

◆ query(): This function performs a SQL query on the connected database.

The result of the query is stored in a result object called $result If the query returns SQL error(s), a member variable called $this->dbi->error

is set to the error message and null is returned.

If the query is successful, it returns the result object The result object can

be used to fetch rows For example, the test_query.php script tries to fetch data from a table called PROD_TBL using a database URL such as

mysql://root:foobar@localhost/products

<?php

// Turn on all error reporting error_reporting(E_ALL);

// If you have installed PEAR packages in a different // directory than %DocumentRoot%/pear change the // setting below

$PEAR_DIR = $_SERVER[‘DOCUMENT_ROOT’] ‘/pear’ ;

// If you have installed PHPLIB in a different // directory than %DocumentRoot%/phplib, change // the setting below

$PHPLIB_DIR = $_SERVER[‘DOCUMENT_ROOT’] ‘/phplib’;

// If you have installed framework directory in // a different directory than

// %DocumentRoot%/framework, change the setting below

$APP_FRAMEWORK_DIR=$_SERVER[‘DOCUMENT_ROOT’] ‘/framework’;

// Create a path consisting of the PEAR, // PHPLIB and our application framework // path ($APP_FRAMEWORK_DIR)

$PATH = $PEAR_DIR ‘:’

$PHPLIB_DIR ‘:’

$APP_FRAMEWORK_DIR;

// Insert the path in the PHP include_path so that PHP // looks for our PEAR, PHPLIB and application framework // classes in these directories

ini_set( ‘include_path’, ‘:’

$PATH ‘:’ ini_get(‘include_path’));

// Now load the DB.php class from PEAR require_once ‘DB.php’;

// Setup the database URL

$DB_URL = ‘mysql://root:foobar@localhost/products’;

// Create a DBI object that connects to the // database URL

$dbi = new DBI($DB_URL);

if (! $dbi->isConnected()) {

echo “Connection failed for $DB_URL<br>”;

exit;

}

// Create a SQL statement to fetch data

$statement = ‘SELECT ID, NAME FROM PROD_TBL’;

// Execute the statement using DBI query method

$result = $dbi->query($statement);

// If the result of query is NULL then show // database error message

if ($result == NULL) {

echo “Database error:” $dbi->getError() “\n”;

// Else check if there are no data available or not } else if (! $result->numRows()){

echo “No rows found.”;

// Now data is available so fetch and print data } else {

echo “<pre>ID\tNAME<br>”;

while ($row = $result->fetchRow()) {

echo $row->ID, “\t”, $row->NAME, “<br>”; }

echo “</pre>”;

}

?>

The SQL statement SELECT ID, NAME FROM PROD_TBLis stored in

$statementvariable and passed to the DBI::query()method The result

is tested first for null If the result is null, the database error is printed using the DBI::getError()method.

If there are no database errors, the next check is made to see if there are any rows using the numRow()method from the $resultobject If there are no rows, an appropriate message is printed.

If there are data in the returned $resultobject, the result is printed in a loop using the fetchRow()method.

The row data is fetched in $rowobject The $row->DATA_FIELDmethod is used to get the data for each field For example, to retrieve the NAMEfield data, the $row->NAMEvalue is accessed.

◆ quote(): This is a utility function that puts a pair of single quotes around

a string to protect the string from being passed without quotation Here’s

an example in which the $namefield is single-quoted using

$this->dbi->quote($name)call:

<?php

// Turn on all error reporting error_reporting(E_ALL);

// If you have installed PEAR packages in a different // directory than %DocumentRoot%/pear change the // setting below

$PEAR_DIR = $_SERVER[‘DOCUMENT_ROOT’] ‘/pear’ ;

// If you have installed PHPLIB in a different // directory than %DocumentRoot%/phplib, change // the setting below

$PHPLIB_DIR = $_SERVER[‘DOCUMENT_ROOT’] ‘/phplib’;

// If you have installed framework directory in // a different directory than

// %DocumentRoot%/framework, change the setting below

$APP_FRAMEWORK_DIR=$_SERVER[‘DOCUMENT_ROOT’] ‘/framework’;

// Create a path consisting of the PEAR, // PHPLIB and our application framework // path ($APP_FRAMEWORK_DIR)

$PATH = $PEAR_DIR ‘:’

// Insert the path in the PHP include_path so that PHP // looks for our PEAR, PHPLIB and application framework // classes in these directories

ini_set( ‘include_path’, ‘:’

$PATH ‘:’ ini_get(‘include_path’));

// Now load the DB.php class from PEAR require_once ‘DB.php’;

// Now load our DBI class from application framework require_once(‘class.DBI.php’);

// Setup the database URL

$DB_URL = ‘mysql://root:foobar@localhost/foobar’;

// Create a DBI object that connects to the // database URL

$dbi = new DBI($DB_URL);

if (! $dbi->isConnected()) {

echo “Connection failed for $DB_URL<br>”;

exit;

}

$id = 100;

$name = “Joe Gunchy”;

$name = $dbi->quote($name);

$statement = “INSERT INTO PROD_TBL (ID,NAME) “

“VALUES($id, $name)”;

$result = $dbi->query($statement);

if ($result == NULL) {

echo “Database error:” $dbi->getError() “<BR>\n”;

} else {

echo “Added $name in database.<BR>\n”;

}

?>