Secure PHP Development- P49 potx

■ An SQL SELECTstatement, $stmt, is created to return VIEWER_IDfrom all rows in the message view table that match the given message ID $mid.. ■ Using a SQL DELETEstatement, the method de

◆ modifyMessage() : This method updates an existing message in the

data-base It works as follows:

■ The method is called with message ID ($mid), title ($title), date ($date), body ($msg), and flag ($flag)

■ It sets the current message ID to the given message ID ($mid) using the

setMessageID()method

■ The given title ($title) and message body ($msg) are escaped for char-acters such as quotation marks and slashes using

$this->dbi->quote(addslashes())

■ An SQL statement, $stmt, is created to update the existing message data into the MESSAGEtable The statement uses MSG_IDin the WHERE

clause to ensure that only the given message ($mid) is updated

■ The SQL UPDATEstatement is executed using $this->dbi->query(), and the result of the query is stored in the $resultobject

■ If the update is successful, the method returns true; otherwise, it returns false

◆ getViewers() : This method returns a list of the user IDs who have

viewed a given message It works as follows:

■ The method is called with a message ID ($mid)

■ It sets the current message ID to the given message ID ($mid) using

setMessageID()

■ An SQL SELECTstatement, $stmt, is created to return VIEWER_IDfrom all rows in the message view table that match the given message ID ($mid)

■ If the returned result set object, $result, has no rows, the method returns null Otherwise, it creates an array called $retArr, with the user IDs that are returned per row in the $resultobject

◆ addViewer() : This method adds users in the message view table who can

view a given message It works as follows:

■ The method is called with message ID ($mid) and an array of user IDs for the viewers ($views)

■ It sets the current message ID to the given message ID ($mid) using the

setMessageID()method

■ For each user (viewer), it inserts a row in the message view table

◆ deleteViewers() : This method deletes all the viewers of a given

mes-sage It works as follows:

■ The method is called with the message ID ($mid)

■ It sets the current message ID to the given message ID ($mid) using the

setMessageID()method

■ Using a SQL DELETEstatement, the method deletes all rows from the message view table for the given message

◆ isViewable() : This method determines whether the given message can be

viewed by the given user It works as follows:

■ The method is called with message ID ($mid) and an user ID ($uid)

■ It sets the current message ID to the given message ID ($mid) using

setMessageID()

■ An SQL SELECTstatement, $stmt, is created and executed to return viewer IDs (VIEW_ID) for the given message and viewer ID In other words, if one row for the given message has VIEWER_IDset to the given user ID ($vid), the statement returns a result object, $result, which has a nonzero row count

■ The number of rows is returned A positive number indicates that the current message has the given user ID as a viewer

◆ getMsgIDbyMessageTitle() : This method returns the message ID for a

given message title It works as follows:

■ The method is called with the message title ($title)

■ The given title ($title) is escaped for characters such as quotation marks and slashes using $this->dbi->quote(addslashes())

■ An SQL SELECTstatement, $stmt, is created and executed to return the message ID (MSG_ID) for the given message title The result of the query

is stored in a result object called $result

■ If the $resultobject has no rows, the method returns null

■ Otherwise, the message ID (MSG_ID) is fetched from the row in the

$resultobject and returned This will always return the first message that has the matching title

The following table describes the rest of the methods for this class:

getMessageContents() Returns the contents of the given message while

taking the message ID as input

getMessageTitle() Returns the title of the given message while taking

the message ID as input

getMessagePublishDate() Returns the publishing date of the given message

while taking the message ID as input

setMessageID() Sets the message ID of the message object if a

message ID is passed as a parameter It also returns the message ID

updateTrack() Updates a user’s message tracking information by

inserting a new row in the message track table When this method is called with a user ID ($uid) and message ID ($mid), it inserts the current timestamp in the message track table

deleteMessage() Deletes a given message from the database, using the

given message ID ($mid)

isRead() Determines whether the given message has been read

by querying the message track table for rows matching a given message ID

ActivityAnalyzer class

Each time a user logs in or logs out of the intranet, a record is stored in the

data-base This record is called the activity log We will develop a class called the

ActivityAnalyzer, which will be used to determine login/logout statistics for one

or more users

This ActivityAnalyzerclass provides the Activity Analyzerobject The list object is used to manipulate activities There are two types of activities: login (ACTIVITY_TYPE = 1) and logout (ACTIVITY_TYPE = 2)

The class allows an application to create and delete actions or activities The

ch07/home/class/class.ActivityAnalyzer.php file on the CD-ROM is an implementation of this class, which is discussed in the following section

This class implements the following methods:

◆ getDailyStartTS() : This method returns the first activity timestamp for a

given timestamp range ($start, $end) for a given user It works as follows:

■ The method is called using the action timestamp range ($start, $end) and is supplied a user ID ($uid)

■ An SQL SELECTstatement, $stmt, is created to return the minimum (using SQL MIN()function) action timestamp ($ACTION_TS) as

START_TIMEfrom the activity table where the given user ID matches The returned action timestamp is always within the given action time-stamp range ($start, $end)

■ If the result of the SQL query returns no rows, the method returns null; otherwise, the row is fetched and the minimum action timestamp (as

START_TIME) is returned from the result object

◆ getDailyEndTS() : This method returns the last activity timestamp for a

given timestamp range ($start, $end) for a given user It works as follows:

■ The method is called using action timestamp range, which starts with

$start, $endand is supplied a user ID ($uid)

■ An SQL SELECTstatement, $stmt, is created to return the maximum (using the SQL MAX()function) action timestamp ($ACTION_TS) as

END_TIMEfrom the activity table where the given user ID matches The returned action timestamp is always within the given action timestamp range ($start, $end)

■ If the result of the SQL query returns no rows, the method returns null Otherwise, the row is fetched and the minimum action timestamp (as

END_TIME) is returned from the result object

◆ getDailyActivityInfo() : This method returns a list of activity records

for a given user in a given start and end action timestamp It works as follows:

■ The method is called using the action timestamp range, which starts with

$startand ends with $end The method is also supplied a user ID ($uid)

■ An SQL SELECTstatement, $stmt, is created to return action type (ACTION_TYPE) and timestamp (ACTION_TS) from the activity table where the given user ID matches The returned action timestamp is always within the given action timestamp range ($start, $end)

■ If the result of the SQL query returns no rows, the method returns null Otherwise, the list of action records (activity type and timestamp) are returned in an array called $activityArr[]

◆ analyzeDailyActivity() : This method returns the total office hours and

extra (overtime) hours logged by a given user for a given period of time It works as follows:

■ The method is called with an associative parameter array called

$params, which contains the current user ID ($params[‘USER_ID’]), activity start timestamp ($params[‘DAY_START’]), and end timestamp ($params[‘DAY_END’])

■ The method calls getDailyActivityInfo()to find a list of activities

in the given range for the current user The list is stored in

$activityArr If this list is empty, the method returns null

■ The method breaks down each element of $activityArrinto activity type ($type) and timestamp ($ts)

■ By looping through the list of activities, it finds the first instance of a login activity ($type = 1) and sets $startcountto the login time-stamp ($ts) It also finds the logout activity ($type = 2) for which login activity is already found ($startcountis set) and calls

getOfficeAndExtraBreakdown()to find the total office and extra hours breakdown getOfficeAndExtraBreakdown()returns the break-down into an associative array, which is stored in $breakdown

■ The $totalOfficetime is incremented using the breakdown informa-tion for each complete activity (login and logout) session

■ Finally, the total office hours and the extra hours are returned in an associative array called $analysis

◆ getDailyLog() : This method returns the activity log of given user for a

day It works as follows:

■ The method is called with an associative parameter array called

$params, which contains the current user ID ($params[‘USER_ID’]), activity start timestamp ($params[‘DAY_START’]), and end timestamp ($params[‘DAY_END’])

■ The method calls getDailyActivityInfo()to find a list of activities

in the given range for the current user The list is stored in

$activityArr If this list is empty, the method returns null

■ The method breaks down each element of $activityArrinto activity type ($type) and timestamp ($ts)

■ By looping through the list of activities, it finds the first instance of a login activity ($type = 1) and sets $startcountto the login time-stamp ($ts) It also finds the logout activity ($type = 2) for which login activity is already found ($startcountis set) and calls

getLogs()to find the office and extra hours breakdown getLogs()

returns the breakdown into an associative array, which is stored in an