Secure PHP Development- P48 pdf

Central Login/Logout Messages Messages User Home Interface Login/Logout Activity Intranet User Object deals with user info, preferences class.IntranetUser.php class.Message.php class.Act

T ABLE7-1 INTRANET DATABASE TABLES (Continued)

(MSG_ID), and the viewer ID (VIEWER_ID) It relates which message should be viewed by which user

can be used by the user It contains the theme number (THEME_ID) and the name of the theme (THEME_NAME)

discussed in Chapter 5 It contains the user ID (USER_ID), action type (ACTION_TYPE), and action timestamp (ACTION_TS)

the user ID (USER_ID), first name (FIRST), last name (LAST), address line #1 (ADDRESS1), address line #2 (ADDRESS2), city (CITY), state (STATE), zip code (ZIPCODE), country (COUNTRY), phone number (PHONE), and start date of the user in the intranet (START_DATE)

(USER_ID), preference ID (PREFERENCE_ID), and value (VALUE)

intranet.mysql is an implementation of the intranet database in MySQL It’s included on this book’s CD-ROM (CDROM/ch07/sql/intranet.mysql) To use this database for these applications, create a database called INTRANETin your database server and run the following command:

mysql -u root -p -D INTRANET < INTRANET.sql Make sure that you change the user name (root) to whatever is appropriate for your MySQL database system

classes, which are needed to implement the intranet applications

Designing and Implementing the Intranet Classes

Three new classes are needed to implement the intranet system: Message, ActivityAnalyzer, and IntranetUser Figure 7-2 shows the system design that uses these classes

Figure 7-2: Intranet system diagram.

In the preceding design, you can see that central login/logout applications are used to access user home application The user home application displays links to other intranet applications and allows users to create intranet messages The home application and login/logout activity applications use Userobject, Messageobject, and Activity Analyzerobjects to perform their operations Notice also that all of the intranet applications are based on the PHP Application Framework that we developed earlier in the book The following sections describe these classes

The Messageclass is used to manipulate each message It allows an application to create and delete messages The ch07/home/class/class.Message.phpfile in the CD-ROM is an implementation of the Message class

Central Login/Logout

Messages

Messages User Home Interface

Login/Logout Activity

Intranet User Object (deals with user info, preferences)

class.IntranetUser.php

class.Message.php

class.ActivityAnalyzer.php Activity Analyzer Object

(deals with activity reporting)

Message Object (deals with messages)

PHP Application Framework (Provides application, database abstraction, themes, templates, error handling objects)

This class implements the following methods:

◆ Message() : This is the constructor method It performs the following

functions:

■ Sets an object variable named dbito point to the class.DBI.php -provided object, which is passed to the constructor by an application The dbiobject variable holds the DBI object, which is used to commu-nicate with the backend database

■ Sets an object variable named msg_tblto $MESSAGE_TBL, which is loaded from the configuration file (home.conf) The $MESSAGE_TBL holds the name of the MESSAGEtable

■ Sets an object variable named msg_track_tblto $MSG_TRACK_TBL, which is loaded from the home.conffile The $MSG_TRACK_TBLholds the name of the message tracking table

■ Sets an object variable named msg_view_tbl to $MSG_VIEWER_TBL, which is loaded from the home.conffile The $MSG_VIEWER_TBLholds the name of the message viewer table

■ Sets an object variable called MSG_IDto the given message number (if any) by calling setMessageID()

■ Sets an object variable called fieldsto field names of the MESSAGE table The fieldsvariable is an associative array, which contains both field names and field types in a key = valueformat

◆ loadMessageInfo() : This method loads all the message attributes, such

as message number, message title, message contents, message publishing date, author ID, message type, and flag for a given message Here’s how it works:

■ First, the given message ID ($msg_id) is set as the current Message object’s message ID using setMessageID()

■ A comma-separated list of MESSAGEtable field names are created in the

$fieldStrvariable using the $this->fieldsvalue, which is set in the constructor

■ A statement to select all the message fields for the given message ID is created in $stmt

■ Using the DBIobject ($this->dbi), the $stmtstatement is run via

$this->dbi->query()in DBI object The result of the query is stored

in the $resultvariable

■ If more than zero rows are in the $resultobject, each row is fetched

in the $rowvariable

■ For each message field of type text, the data is stripped for embedded slash characters, which are used to escape quotation marks and slashes

in the value of the field

■ Each message field data is stored as an object variable using the

$this->$fieldnameruntime variable

◆ getMessages() : This method returns all messages for a given user where

messages have been published on or earlier than a given timestamp or today It works as follows:

■ A variable called $fieldsis assigned a comma-separated list of mes-sage fields stored in $this->fields

■ If the method is called without a date ($lastDate), the $lastDateis set to the current timestamp

■ An SQL statement is created in $stmt, which queries the MESSAGEtable for all messages that have been published on or earlier than the

$lastDate The returned rows are ordered using message type (MSG_TYPE) and message timestamp (MSG_DATE) in descending order

■ The query is performed using the $this->dbi->query()method of the DBIobject embedded in $this->dbi The result is stored in $result

■ If no rows are returned in the $resultobject, the method returns null

If there are matching rows, each row is stored in the $rowobject

■ For each row, a SQL statement is created in $stmt, which queries the message tracking table ($this->msg_track_tbl) for messages that have the same ID as the row’s message ID ($row->MSG_ID) and the same user ID as the current user ID The purpose of this query is to find out whether the current message in the row has already been tracked (that is, viewed by the current user) The statement is executed and the result is stored in the $finResultobject

■ If no row is returned for the statement, the current message (

$row->MSG_ID) has not been tracked (that is, viewed) by the current user and, therefore, it ($row) is pushed into an array called $retArr[]

■ The $retArr[]array is returned after all rows in the first result set pointed by the $resultobject are checked The resulting array,

$retArr[]contains a list of message rows that the current user has not viewed yet

◆ getAllMessages() : This method returns all messages in the MESSAGE table It works as follows:

■ A variable called $fieldsis assigned a comma-separated list of MES-SAGEtable fields, which are stored in $this->fields

■ A statement, $stmt, is created to select all data from the MESSAGEtable

in message type and date order

■ The query is performed using the $this->dbi object’s query()method, and the result set is stored in $resultobject If no message is found, the method returns null

■ On the other hand, if rows are in the $resultobject, an associative array called $retArris populated using message ID (MSG_ID) as the key and $row, containing each message data, as the value

■ The $retArrarray is returned

◆ addMessage() : This method adds a new message in the MESSAGEtable The method is called with message title ($title), publication date ($date), contents ($msg), flag ($flag), author ID ($auth), and type ($type) It works as follows:

■ A variable called $fieldsis assigned a comma-separated list of MES-SAGEtable fields stored in $this->fields

■ The given title ($title) and message body ($msg) are escaped for char-acters such as quotation marks and slashes using

$this->dbi->quote(addslashes())

■ An SQL statement, $stmt, is created to insert the new message data into the MESSAGEtable

■ The SQL statement is executed using $this->dbi->query()and the result of the query is stored in $resultobject

■ If the $resultstatus is not okay, the method returns false to indicate insert failure Otherwise, another SQL statement, $stmt, is created to query the database to return the newly created message row’s message

ID This is done by setting the WHEREclause of the SELECTstatement to AUTHOR_ID = $auth, MSG_TYPE = $type, MSG_DATE = $date, and FLAG = $flag, which uniquely identifies the new message

■ If the result of the select query does not return a row, the method returns null and, if it does, it returns the MSG_IDof the newly created message