Secure PHP Development- P30 ppt

This configuration file creates a multidimensional array called $ERRORSand sets two error codes to appropriate error messages in U.S.. The sample.conf file also loads the constants.php f

This configuration file creates a multidimensional array called $ERRORSand sets two error codes to appropriate error messages in U.S English If the sample appli-cation is to be used in a different language region, say in Spain, then this file can

be modified to create the ES (shorthand for Spanish) language-specific errors by replacing US as ES and also translating the actual error messages

When internationalizing the error messages, the error code such as UNAUTHORIZED_ACCESS should not be translated because that code name

is the key to locate the “Unauthorized access” error message Only the error message should be translated, and the appropriate language identifier needs to be set.

The sample application then loads the sample.messagesfile, which is shown in Listing 4-8

Listing 4-8: sample.messages

<?php

$MESSAGES[‘US’][‘APP_FAILED’] = “Application Failed.”;

$MESSAGES[‘US’][‘DEFAULT_MSG’] = “Hello World”;

?>

Like the error message files, this file loads a multidimensional array called

$MESSAGESwith language support for each message

The sample.conf file also loads the constants.php file, which defines a set of constants needed by the framework classes The same sample configuration file also loads the framework classes along with a class called class.sampleApp.php, which is shown in Listing 4-9

This class extends the PHPApplication class and overrides the run() and

authorize() function It implements another function called doSomething(), which is specific to itself We will discuss the details of this class in the next sec-tion Now let’s look at the rest of the sample.php code

Once the class.sampleApp.php class is loaded, the session is automatically started by the sampleAppobject, which extends the PHPApplicationobject Next the application creates an instance of the sampleApp object called

$thisApp This is the application object The application name, version, type, and debugger ONor OFFflag are set when creating this object

After the $thisApp object has been created, the sample application enables debug message buffering by calling the buffer_debugging() method in class

PHPApplication.php class

It then calls the run() function, which has been overridden in class.

sampleApp.php This is the main function that runs the application

After the application has run, more debugging information is buffered and the debug information is dumped:

$thisApp->buffer_debugging();

$thisApp->run();

$thisApp->debug(“Version : “ $thisApp->get_version());

$thisApp->dump_debuginfo();

Figure 4-6 shows what is displayed when the sample.php application is run after a user has already logged in

Figure 4-6: Output of the sample application with debugging turned on.

You have to have the application framework created in this chapter installed

on your system and at least one user created to run this application.To learn about how to create a user, see Chapter 5.

Chapter 4: Architecture of an Intranet Application 117

Figure 4-7 shows the application with the debug flag turned off.

Figure 4-7: Output of the sample application with debugging turned off.

Listing 4-9 shows the class.sampleApp.php, which extends the PHPApplication

class from our framework

Listing 4-9: class.sampleApp.php

<?php

class sampleApp extends PHPApplication {

function run() {

// At this point user is authorized // Start business logic driver

$this->debug(“Real application code starts here.”);

$this->debug(“Call application specific function here.”);

$this->doSomething();

}

function authorize($email = null) {

return TRUE;

}

function doSomething() {

$this->debug(“Started doSomething()”);

echo $MESSAGES[$DEFAULT_LANGUAGE][‘DEFAULT_MSG’];

$this->debug(“Finished doSomething()”);

} } // Class

?>

This sampleApp class has only three functions: run(), authorize(), and

doSomething() The run()function overrides the abstract run() method provided in class.PHPApplication.php and it is automatically called when the application is run

Therefore, sampleApp run() method is needed to application logic in sample.php

In the example, the authorization check always returns TRUE, because this isn’t a real-world application and the run() function calls the doSomething() function, which simply prints a set of debug messages along with a status message Notice that although the application status message $MESSAGES[$DEFAULT_LANGUAGE]

[‘DEFAULT_MSG’]is internationalized, the debug messages are in English

As you can see the application framework makes writing new applications quite easy; development time is greatly reduced, because you can build onto the frame-work instead of starting from scratch every time

Summary

In this chapter I have shown you how to develop a complete application framework consisting of a few object-oriented classes These classes provide a set of facilities for writing applications that use a standard approach to writing PHP applications for both intranet and the Web

The application framework developed in this chapter allows you to develop a new application by simply extending the primary class, PHPApplication class, of the framework Immediately your application inherits all the benefits of the new framework, which includes a database abstraction, an error handler, and a debug-ging facility

This application framework is used throughout the rest of the book for develop-ing most of the applications discussed in this book The latest version of this frame-work is always available from http://www.evoknow.com/phpbook/.

Chapter 4: Architecture of an Intranet Application 119