Secure PHP Development- P66 pps

Central Login/Logout Messages Categories Contacts User Home Interface PHP Application Framework Message Object Intranet Contact Manager Applications Category Object Contact Object class.

T ABLE9-1 [NAME OF DATABASE] DATABASE TABLES (Continued)

CONTACT_KEYWORD Holds the contact keyword information The contact

keyword consists of the contact number (CONTACT_ID) and keyword (KEYWORD)

CONTACT_MAIL Holds information about the contact e-mail information:

the e-mail ID (MAIL_ID), CONTACT_ID, CC To list (CC_TO), the subject of the e-mail (SUBJECT), body (BODY) of the e-mail, sending time stamp (SEND_TS), and the check flag (CHECK_FLAG) The e-mail ID (MAIL_ID)

is automatically generated by the database

CONTACT_REMINDER Contains reminder(s) of contacts A reminder can be set

up during contact creation to remind the administrator to call/email the contact at a later date For example, say you got a contact from a trade show and would like to contact the person after a week or so, in such case you can set up a reminder when you add the contact to the database Each reminder consists of IDCONTACT_ID, reminder created by (CREATED_BY), reminder about (REMIND_ABOUT), reminder date (REMIND_DATE), and MOTD ID (MOTD_ID)

The ch9/sql/contact.sql file in the CDROM is a MySQL script to create the contact manager database To create the contact manager database in MySQL, cre-ate a database called CONTACTS in your database server and run the following commands

mysqladmin -u root -p create CONTACTS mysql -u root -p -D CONTACTS < contact.sql Make sure you change the user name (root) to whatever is appropriate for your system

With the contact manager database ready, let’s look at the PHP classes that will

be needed to implement the applications

The Intranet Contact Manager Application Classes

Now lets look at how we can design the contact manager system to work within our intranet Figure 9-2 shows the system diagram for the objects needed to develop the contact manager The category and contact objects are the only new objects in this diagram All other objects and the framework have been already developed in ear-lier chapters

Figure 9-2: The contact manager system diagram.

The category and contact objects can be created with two new classes: the Categoryclass and the Contactclass

The Message class needed for the contact manager has already been built

in Chapter 7.

Central Login/Logout

Messages

Categories Contacts User Home Interface

PHP Application Framework

Message Object

Intranet Contact Manager Applications

Category Object

Contact Object

class.Message.php

class.Category.php

class.Contact.php

The Category class

The Categoryclass is used to manipulate each category It allows an application to create, modify, and delete a category The ch09/apps/class/class.Category.php file on the CD-ROM implements this class This class implements the following methods:

◆ Category() : This is the constructor method It performs the following

functions:

■ Sets a member variable named dbito point to the class.DBI.php -provided object, which is passed to the constructor by an application dbiholds the DBI object that is used to communicate with the back-end database

■ Sets a member variable named cat_tbl to $CONTACT_CATEGORY_TBL, which is loaded from the contact.conffile $CONTACT_CATEGORY_TBL holds the name of the category table

■ Sets a member variable named std_fields, which is an associative array to hold all the attributes of the CONTACT_CATEGORYtable and their types

■ Sets a member variable named fields, which is a comma-separated list of CONTACT_CATEGORYtable fields

■ Calls setCatID()to set a member variable called cidto the given cat-egory ID (if any)

◆ loadCatInfo() : This is the constructor method It performs the following

functions:

■ Calls setCatID()to make sure that the passed category ID (if any) is set to the member variable

■ Creates in $stmta statement to select all the table attribute values for the given category ID

■ Uses the DBI object ($this->dbi) to run the $stmtstatement via the

$this->dbi->query()method in the DBI object, and stores the result

in $result

■ If there are more than zero rows in the $resultobject, each row is fetched in the $rowvariable For each CONTACT_CATEGORYtable field of type text, the data is stripped for embedded slash characters, which are used to escape quotation marks, and slashes in the value of the field Each category field data is stored as an object variable using

$this->$fieldnamerun-time variable

◆ getCategoryIDbyName() : This method returns the category ID of the

cat-egory object from the given catcat-egory name This is how it works:

■ It formats the given category name to convert it to a SQL-capable string by adding slashes and quotes

■ It creates in $stmta statement to select all category IDs for the given category name

■ It uses the DBI object $this->dbito run the $stmtstatement via the

$this->dbi->query()method in the DBI object, and stores the result

in $resultvariable

■ If there are no rows in the $resultobject, the method returns null If the result set is not empty, the row is fetched in the $rowvariable, and the category ID from the row is returned

◆ addCategory() : This method adds a new category into to the

CONTACT_CATEGORYtable The category name, category ID, category par-ent, and description are passed in an associative array as a parameter to the method It works in the following manner:

■ From the given parameter all the values that are supposed to be of text typein the database are escaped for characters such as quotation marks and slashes using $this->dbi->quote(addslashes())methods

■ A variable called $valuesis assigned a comma-separated list of all the parameter values

■ A SQL statement, $stmt, is created to insert the new category data into the CONTACT_CATEGORYtable using the member variable ‘fields’

(contains attribute names) and $values

■ The SQL statement is executed using $this->dbi->query(), and the result of the query is stored in the $resultobject

■ If the $resultstatus is not okay, the method returns FALSEto indicate insert failure Otherwise, getCategoryIDbyName()is used to return the newly created category’s ID

◆ getParentCategories() : This method returns all the parent (main)

cate-gories It works as follows:

■ A statement to select all the table (CONTACT_CATEGORY) attribute val-ues for the categories having parent ID as zero (the main categories) is created in $stmt

■ The DBI object $this->dbiruns the $stmtstatement via the

$this->dbi->query()method in the DBI object, and the result is stored in the $resultvariable

■ If there are more than zero rows in the $resultobject, each row is fetched in the $rowvariable

■ For each category, the category name and the category ID is stored in a single associative array The method returns the array if the result set is not empty; otherwise, it returns null

◆ getSubCategories() : This method returns all the children (subcategories)

of a given parent category This works as follows:

■ A statement to select all the table attribute values for the categories having parent IDs as the given category ID is created in $stmt

■ Using the DBI object $this->dbi, the $stmtstatement is run via the

$this->dbi->query()method in the DBI object, and the result is stored in the $resultvariable

■ If there are more than zero rows in the $resultobject, each row is fetched in the $rowvariable

■ For each category found, the category name and the category ID is stored in a single associative array

■ The method returns the array if the result set is not empty; otherwise, it returns null

◆ modifyCategory() : This method updates the category information for a

given category Update information is passed in an associative array as a parameter to this method The method works as follows:

■ From the given parameter list, all the values that are of texttype in the database are escaped for characters such as quotation marks and slashes using $this->dbi->quote(addslashes())methods

■ A SQL statement, $stmt, is created to update the given category data to the CONTACT_CATEGORYtable using the associative array that has been passed as parameter

■ The SQL statement is executed using $this->dbi->query()

■ The method returns TRUEon successful update operation; otherwise, it returns FALSE

◆ getParentOf() : This method returns the parent of the given category.

This is how it works:

■ setCatID()is called to set the given category ID

■ A statement to select the parent category ID for the given category ID

is created in $stmt