Secure PHP Development- P57 docx

It performs the following functions: ■ Sets the object variable cat_tblto $LD_CATEGORY_TBL, which is loaded with the category table name LD_CATEGORY from the ld.conffile.. ■ Sets the obj

Figure 8-2: Intranet document publisher system diagram.

The Category class

The Category class is used to manipulate each category It allows an application to cre-ate, modify, and delete a category The ch08/apps/class/class.Category.phpfile

in the CDROM an implementation of this class This class uses the following methods:

◆ Category() : This is the constructor method It performs the following

functions:

■ Sets the object variable cat_tblto $LD_CATEGORY_TBL, which is loaded with the category table name (LD_CATEGORY) from the ld.conffile

■ Sets the object variable doc_tblto $LD_DOC_TBL, which is loaded with the document table name (LD_DOCUMENT) from the ld.conffile

■ Sets the object variable cat_pub_tbl to $LD_CAT_PUB_TBL, which is loaded with the category publisher table from the ld.conffile

■ Sets the object variable cat_view_tblto $LD_CAT_VIEW_TBL, which is loaded with the category viewer table name from the ld.conffile

■ Sets the object variable dbito point to the class.DBI.php-provided object that is passed to the constructor by an application The dbi

member variable holds the DBI object that is used to communicate with the back-end database

■ Sets the object variable CAT_IDto the given category ID (if any)

■ Sets the object variable std_fields, which is an array that contains the LD_CATEGORYtable attributes and their data type

Central Login/Logout

Messages

Categories Documents Response User Home Interface

PHP Application Framework

Message Object

Simple Intranet Document Publisher Applications

Category Object

Doc Object

Response Object

class.Message.php

class.Category.php

class.Doc.php

class.Response.php

◆ loadCatInfo() : This method loads all attribute values into the category

object from the LD_CATEGORYtable by the specified category IDs This is how it works:

■ setCatID()is called to set the passed category ID to the current object If no category ID is passed, the current $this->cidis taken

■ The $this->dbiobject is used to retrieve all the attribute values of the given category from the LD_CATEGORYtable

■ Each of the values is set to the current object so that they can be retrieved

at any time using the other get methods of this class For example

$this->CAT_NAMEis set to the value of the CAT_NAMEof the given category

◆ getCategoryIDbyName() : This method returns the category ID for the

given category name It works as follows:

■ It takes the category name as parameter

■ The category name is quoted using the quote() method of the

$this->dbi object and inserted into the SQL statement, which is needed to retrieve the category ID

■ The query executes, and the resultant category ID is returned If no result is found, it returns null

◆ getCategories() : This method returns all the category names along with

their IDs from the LD_CATEGORYtable This is how it works:

■ It executes a SQL query to retrieve all the field value of the

LD_CATEGORYtable ordered by descending CAT_ORDER

■ The result is stored in an array that contains the category ID and name

■ It returns the prepared array (or null, if the result set is empty)

◆ getPublishers() : This method returns the publisher IDs for a given

category This is how it works:

■ It calls setCatID()to set the passed category ID

■ It executes a SQL query that retrieves all the publisher IDs from the

LD_CAT_PUBLISHERtable for the given category ID

■ It stores the result of the execution in an array (unless the result set is empty), and returns the array It returns null if the result set is empty

◆ getViewers() : This method returns the viewer IDs for a given category

It works as follows:

■ It calls setCatID()to set the passed category ID

■ It executes a SQL query that retrieves all the viewer IDs from the

LD_CAT_VIEWERtable for the given category ID

■ It stores the result of the execution in an array (unless the result set is empty), and returns the array It returns null if the result set is empty

◆ addCategory() : This method adds a new category into to the LD_CATE-GORYtable Category name, category ID, category order, and description are passed into an associative array as a parameter to the method It works as follows:

■ The SQL statement is prepared using the $this->std_fieldsarray that contains all the attributes of the LD_CATEGORYtable and the values from the associative array that has been passed as parameter

■ The values of the parameter are formatted using the quote()method

of the $this->dbiobject

■ After executing the SQL statement, the newly added category’s CAT_ID

is retrieved using another SQL statement

■ If the insertion query is successful, this method returns the category ID

of the newly added category Otherwise, it returns FALSE

◆ modifyCategory() : This method updates category information for a

given category Update information is passed in an associative array as a parameter to this method It works as follows:

■ The SQL statement is prepared using the $this->std_fieldsarray that contains all the attributes of the LD_CATEGORYtable and the values from the associative array that has been passed as parameter

■ The values of the parameter are formatted using the quote()method

of the $this->dbiobject

■ If the update query is successful, this method returns TRUE Otherwise,

it returns FALSE

◆ updateCategoryOrders() : This method updates the orders of the

cate-gories This takes an array of category ID and new order and assigns the new orders to each category This is how it works for each category:

■ It updates the category by assigning it a temporary value (–1) This is done to avoid having the same order for two categories, which would forbid you to execute the query, because the ORDERattribute is unique

■ After assigning the temporary value, the category is updated with the new order value for it

■ The method returns TRUEupon successful update Otherwise, it returns

FALSE

Method Description

setCatID() Sets the category ID of the category object It takes a

non-empty category ID as the parameter

getCategoryName() Returns the name of the category object from the

LD_CATEGORYtable It calls loadCatInfo()to set all the field properties of the class and then returns

$this->CAT_NAME getCategoryOrder() Returns the order of the category object from the

LD_CATEGORYtable It calls loadCatInfo()to set all the field properties of the class and then returns

$this->CAT_ORDER getCategoryDesc() Returns the description of the category object from

the LD_CATEGORYtable It calls loadCatInfo()to set all the field properties of the class and then returns $this->CAT_DESC

getHighestOrder() Returns the highest order of the LD_CATEGORYtable deleteCategory() Deletes the category from the database It deletes all

data related to the category from the ld_tool database It takes the category ID as a parameter and returns TRUEor FALSEdepending on the status of the deletion operation

deleteDocsByCatID() Deletes all document records related to a category It

takes category ID as a parameter and returns TRUEor FALSEdepending on the status of the deletion operation

deleteCategoryViewers() Deletes all viewer records related to a category It

takes category ID as a parameter

deleteCategoryPublishers() Deletes all publisher records related to a category It

takes category ID as a parameter

isViewable() Determines if a category is viewable by a specific

viewer It takes category ID and user ID as parameters and returns TRUEif the user is authorized to view documents under the given category; otherwise, it returns FALSE

Method Description

isPublishable() Determines if the given publisher is allowed to publish

in a specific category It takes category ID and user ID

as parameter and returns TRUEif the user is authorized to publish documents under the given category; otherwise, it returns FALSE

addCategoryPublishers() Adds publishers to a specific category It takes

category ID and user IDs as parameters and returns TRUEupon successful insertion of the data It returns FALSEif it fails to add the publishers for the category

addCategoryViewers() Adds viewers to a specific category It takes category

ID and user IDs as parameters and returns TRUEupon successful insertion of the data It returns FALSEif it fails to add the viewers for the category

The Doc class

The Doc class provides the docobject, which is used to manipulate doc It allows publishers to create and delete doc The ch08/apps/class/class.Doc.php file in the CDROM is an implementation of this class The following are the methods avail-able in this class:

◆ Doc() : This is the constructor method, which performs the following

tasks:

■ Sets the object variable cat_tbl, which holds the category table name,

to $LD_CATEGORY_TBL, which is loaded from the ld.conffile

■ Sets the object variable doc_tbl, which holds the LD_DOCUMENT table name, to $LD_DOC_TBL, which is loaded from the ld.conffile

■ Sets the object variable resp_tbl, which holds the response table name, to $LD_RESPONSE_TBL, which is loaded from the ld.conffile

■ Sets the object variable track_tbl, which holds the track table name,

to $LD_TRACK_TBL, which is loaded from the ld.conffile

■ Sets an object variable called std_fields, which is an array that con-tains the LD_DOCUMENTtable attributes and their data type