Secure PHP Development- P67 ppt

Following are the rest of the methods for this class: setCatID If the category ID is passed to this method, it sets the member variable cidto the given category ID.. Following are the me

■ Using the DBI object ($this->dbi), the $stmtstatement is run via the

$this->dbi->query()method in the DBI object, and the result is stored in the $resultvariable

■ If there are more than zero rows in the $resultobject, each row is fetched in the $rowvariable

■ If there are no rows in the $resultobject, the method returns null If the result set is not empty, the row is fetched in the $rowvariable, and the parent category ID from the row is returned

Following are the rest of the methods for this class:

setCatID() If the category ID is passed to this method, it sets the

member variable cidto the given category ID At the end, it returns the category ID

getCategoryName() Uses loadCatInfo()with the given category ID to set all

the attributes for the category, and returns the name of the category

getCategoryParent() Uses loadCatInfo()with the given category ID to set all

the attributes for the category, and returns the parent ID of the category

getCategoryDesc() Uses loadCatInfo()with the given category ID to set all

the attributes for the category, and returns the description of the category

deleteCategory() Deletes the category from the database It takes the category

ID as input and returns TRUEor FALSEdepending on the status of the deletion operation

hasChild() Determines if the given category has a child category under

it and returns TRUEif it has at least one

replaceParentCat() This method will replace the parent ID for one more sub

categories with a new parent ID It returns TRUEor FALSE, depending on the status of the update operation

The Contact class

This Contactclass provides the contact object, which is used to add, modify, delete,

or search contacts The ch9/apps/class/class.Contact.phpfile in the CD-ROM

is an implement of this class Following are the methods available in this class:

◆ Contact() : This is the constructor method, which performs the following

tasks:

■ Sets a member variable named dbito point to the class.DBI.php -provided object, which is passed to the constructor by an application dbiholds the DBI object that is used to communicate with the back-end database

■ Sets a member variable called cat_tblto $CONTACT_CATEGORY_TBL, which is loaded from the contact.conffile $CONTACT_CATEGORY_TBL holds the name of the category table

■ Sets a member variable called contact_tblto $CONTACT_INFO_TBL, which is loaded from the contact.conffile $CONTACT_INFO_TBL holds the name of the contact table

■ Sets a member variable called keyword_tblto

$CONTACT_KEYWORD_TBL, which is loaded from the contact.conffile

$CONTACT_KEYWORD_TBLholds the name of the contact keyword table

■ Sets a member variable called reminder_tblto

$CONTACT_REMINDER_TBL, which is loaded from the contact.conffile

$CONTACT_REMINDER_TBLholds the name of the contact reminder table

■ Sets a member variable called mail_tbl to $CONTACT_MAIL_TBL, which

is loaded from the contact.conffile $CONTACT_MAIL_TBLholds the name of the mail table

■ Sets a member variable named ‘std_fields’, which is an associative array to hold all the attributes (i.e CAT_ID,CONTACT_FIRST,

CONTACT_INITIAL,CONTACT_LAST,EMAIL,PHONE,FAX,URL, COMPANY_NAME,COMPANY_ADDRESS,HOME_ADDRESS,SOURCE, REFERENCE,FLAG) of the CONTACT_INFO table and their types

■ Sets a member variable named ‘fields’, which is a comma-separated list of CONTACT_INFOtable fields

■ Calls setContactID()to set the contact ID of the object

◆ loadContactInfo() : This is the constructor method It performs the

fol-lowing functions:

■ It calls setContactID()to make sure that the passed contact ID (if any) is set to the member variable

■ It creates in $stmta statement to select all the CONTACT_INFOtable attribute values for the given contact ID

■ It uses the DBI object $this->dbito run $stmtvia the

$this->dbi->query()method in the DBI object, and stores the result in $result

■ If there are more than zero rows in the $resultobject, each row is fetched in the $rowvariable

■ For each contact table field of type text, the data is stripped for embedded slash characters, which are used to escape quotation marks and slashes in the value of the field

■ Each contact field data is stored as member variable using the

$this->$fieldnamerun-time variable

◆ searchContact() : This method returns a set of contacts for the given

cri-teria and/or keyword This is how it works:

■ It checks whether the method has been called with keywords in the cri-teria The second parameter ($keyword_exists) to the method is responsible for checking this When the method is called with TRUE value set for $keyword_exists, it knows that the criteria (the first parameter) supplied includes keywords

■ If it finds out that there is a keyword involved, the search query state-ment includes the CONTACT_KEYWORD table in it Otherwise the query statement involves only the CONTACT_INFOtable

■ The query statement is prepared with the $criteriaparameter, and is run via the $this->dbi->query()method in the DBI object The result

is stored in the $resultvariable

■ If there are more than zero rows in the $resultobject, each row is fetched in the $rowvariable

■ For each contact found, the CONTACT_INFOtable attributes are stored in

a single associative array

■ The method returns the array if the result set is not empty; otherwise, it returns null

◆ getKeywords() : This method returns keyword(s) for a given contact It

works the following way:

■ It uses setContactID()to set the given contact ID

■ It creates in $stmta statement to select the keyword for the given con-tact ID

■ It uses the DBI object $this->dbito run $stmtvia the

$this->dbi->query()method in the DBI object, and stores the result in $result

■ If there are more than zero rows in the $resultobject, each row is fetched in the $rowvariable

■ All keywords found in the result set are stored in an array

■ The method returns the array if the result set is not empty; otherwise, it returns null

◆ addContact() : This method adds new contact information to the

CONTACT_INFOtable The category number, first name, middle initial, last name, e-mail, phone, fax, URL, company name, company address, home address, source, reference, and flag are passed in an associative array as a parameter to the method It works in the following manner:

■ From the given parameter, all the values of texttype in the database are escaped for characters such as quotation marks and slashes using

$this->dbi->quote(addslashes())methods

■ A variable called $valuesis assigned a comma-separated list of all the parameter values

■ A SQL statement, $stmt, is created to insert the new contact data into the contact table using the member variable ‘fields’(contains attribute names) and $values

■ The SQL statement is executed using $this->dbi->query(), and the result of the query is stored in the $resultobject

■ If the $resultstatus is not okay, the method returns FALSEto indicate

an insert failure Otherwise, it returns the newly created contact’s ID by executing a second query

◆ modifyContact() : This method updates the contact information for a

given contact Update information is passed in an associative array as parameter to this method The method works as follows:

■ From the given parameter, all the values that are supposed to be of text type in the database are escaped for characters such as quotation marks and slashes using $this->dbi->quote(addslashes())methods

■ A SQL statement, $stmt, is created to update the given contact data to the contact table using the associative array that has been passed as a parameter

■ The SQL statement is executed using the $this->dbi->query() method

■ The method returns TRUEon successful update operation; otherwise, it returns FALSE

◆ deleteContact() : This method deletes the contact from the database It

takes the ID of the contact to be deleted as a parameter This is how it works:

■ It sets the given contact ID by the setContactID()method

■ It executes the delete query statement to delete the given contact

■ After successful deletion, it calls the deleteKeywordsByContactID() method to delete all the related keywords, and the

deleteRemindersByContactID()method to delete all the related reminders

◆ getContactsByCatID() : This method returns all contacts that fall under

the given category This is how it works:

■ A SQL statement, $stmt, is created to select the contacts that fall under the given category ID

■ The SQL statement is executed using $this->dbi->query(), and the result is stored in $result

■ If there are more than zero rows in the $resultobject, each row is fetched in the $rowvariable

■ All contacts found in the result set are stored in an array The method returns the array if the result set is not empty; otherwise, it returns null

◆ getRelatedMOTDs() : This method returns MOTDs related to the given

contact A MOTD message is only found for a contact when the adminis-trator has set one or more reminders, which are displayed using MOTD feature of the intranet In other words, if an administrator creates one or more reminders when adding a contact in the contact database, these MOTD messages are going to have to be removed if the contact is to be removed The getRelatedMOTD method retrieves the ID(s) for such MOTD messages (if any) It works as follows:

■ It sets the given contact ID using the setContactID()method

■ A SQL statement, $stmt, is created to select the related MOTDs for the given category ID

■ The SQL statement is executed using the $this->dbi->query() method and the result is stored in $result

■ If there are more than zero rows in the $resultobject, each row is fetched in the $rowvariable

■ All MOTD messages found in the result set are stored in an array

■ The method returns the array if the result set is not empty; otherwise, it returns null