Secure PHP Development- P74 ppsx

It holds the event number EVENT_ID, user ID USER_ID, event title EVENT_TITLE, event date EVENT_DATE, event description EVENT_DESC, reminder ID REMINDER_ID, and a check flag FLAG.. The In

◆ Sharing and assigning events among users: Users can create events for

themselves or assign events to others or even share events with multiple users

◆ Automatic reminders: Users can choose to be reminded about an event

when they log in to the intranet on the day of the event

Let’s look at the prerequisites of the calendar system

Understanding Prerequisites

The event calendar builds on the intranet classes discussed in the Chapters 4 through 7 For example, it uses the Message class (discussed in Chapter 7) to announce event reminders That class enables the application to create and delete messages

The intranet calendar applications that you’ll develop require the central login/logout, user management, and intranet home applications discussed in those earlier chapters

Now let’s look at the database design and implementation needed for creating the intranet calendar manager

Designing the Database

Figure 10-1 shows the database diagram for the intranet calendar manager Here the CALENDAR_EVENT table holds the event data, CALENDAR_EVENT_VIEWER table holds the viewer list for an event in the CALENDAR_EVENT table The CALENDAR_REPETITIVE_EVENTS table stores information about how an event is repeated

Figure 10-1: Intranet calendar manager database diagram.

Table 10-1 provides the details of the database tables.

T ABLE 10-1 CALENDAR DATABASE TABLES

CALENDAR_EVENT This table is the integral part of this database It holds

the event number (EVENT_ID), user ID (USER_ID), event title (EVENT_TITLE), event date

(EVENT_DATE), event description (EVENT_DESC), reminder ID (REMINDER_ID), and a check flag (FLAG)

The event number (EVENT_ID) is automatically generated by the database

CALENDAR_EVENT_VIEWER Holds the calendar event viewer information The

calendar event viewer consists of the EVENT_IDand VIEWER_ID

CALENDAR_REPETITIVE_EVENTS Holds the calendar repetitive event information The

calendar repetitive event consists of EVENT_IDand repeat mode (REPEAT_MODE)

The ch10/sql/calendar.sqlfile in the CDROM contains all the table creation statements for the CALENDAR database You can create this CALENDAR database

in your MySQL server by running the following commands

mysqladmin -u root -p create CALENDAR mysql -u root -p -D CALENDAR < calendar.sql

Make sure you change the user name (root) to whatever is appropriate for your system

With the intranet calendar manager database established, it’s time to look at the PHP classes that are needed to implement the applications

The Intranet Calendar Application Event Class

We need only one new object, the Eventobject, to implement the intranet calendar manager, as you can see in Figure 10-2, which shows the system diagram The

Messageobject was discussed in Chapter 7

Figure 10-2: Intranet calendar manager system diagram.

The Event class provides the Event object The class is used to manipulate each event It allows an application to create and delete events The ch10/apps/class/ class.Event.php in the CDROM is an implementation of this class

This class implements the following methods:

◆ Event () : This is the constructor method It performs the following

functions:

■ Sets an object variable named dbito point to the class.DBI.php -provided object, which is passed to the constructor by an application

dbiholds the DBI object that is used to communicate with the back-end database

■ Sets a member variable named event_tblto $CALENDAR_EVENT_TBL, which is loaded from the calendar.conffile $CALENDAR_EVENT_TBL

holds the name of the calendar event table

■ Sets a member variable named event_view_tblto $CALENDAR_EVENT_ VIEW_TBL, which is loaded from the calendar.conffile $CALENDAR_ EVENT_VIEW_TBLholds the name of the event view table

■ Sets a member variable named event_repeat_tblto $CALENDAR_ EVENT_REPEAT_TBL, which is loaded from the calendar.conffile

$CALENDAR_EVENT_REPEAT_TBLholds the name of the event repeat table

■ Sets a member variable called ‘std_fields’as an associative array to hold the attributes of the calendar event table and their data types (text/number)

Central Login/Logout

Messages

Calendar Events User Home Interface

PHP Application Framework

Message Object

Intranet Calendar Applications

Event Object

class.Message.php

class.Events.php

■ Sets a member variable named ‘fields’, which is a comma-separated list of calendar event table fields

■ Calls setEventID()to set the given event ID to this object

◆ loadEventInfo () : This method sets all the attribute values for a given

event as member variables to this class This is how it works:

■ The given event ID is set to a member variable called to eidusing

setEventID()

■ A statement to select all the event table fields for the given event ID is created in $stmt

■ Using the DBI object $this->dbi, the $stmtstatement is run via the

$this->dbi->query()method in DBI object The result of the query is stored in the $resultvariable

■ If there are more than zero rows in the $resultobject, each row is fetched in the $rowvariable

■ For each message field of type text, the data is stripped for embedded slash characters

■ Each message field data is stored as object variable using $

this->$fieldnamerun-time variable

◆ getEvents () : This method returns all the events that are to be shown to

the given user on a given date It works as follows:

■ The date string (mm-dd-yyyy format) passed to this method is used to find out these three formats of the given date: the day of the week string, the day of the month string, and the month-day string These formats are later used to check whether the given date is a weekly, monthly, or yearly repetitive date

■ A statement to select all the events that are to be viewed by the given user on the given date is prepared This statement also selects the events viewable by the given user that fall on this day because of the repetitive event feature The statement is stored in a variable named $stmt

■ Using the DBI object ($this->dbi), the $stmtstatement is run via the

$this->dbi->query()method in the DBI object The result of the query is stored in the $resultvariable

■ If there are more than zero rows in the $resultobject, each row is fetched in the $rowvariable

■ An associative array is prepared using each row’s event ID and Event Title

■ The method returns the array If the result set is found to be empty, the method returns null

◆ getOwnEvents () : This method returns the events that are created by the

given user for a given day This is how it works:

■ The date string parameter is formatted using addslashesand the

quote()method of the DBI object

■ A statement to select all the events that are created by this user for the given date is prepared and stored in $stmt

■ Using the DBI object $this->dbi, the $stmtstatement is run via the

$this->dbi->query()method in the DBI object The result of the query is stored in the $resultvariable

■ If there are more than zero rows in the $resultobject, each row is fetched in the $rowvariable

■ An associative array is prepared using each row’s event ID and event title

■ The method returns the array If the result set is empty, the method returns null

◆ getViewers () : This method returns all viewer IDs for a given event This

is how it works:

■ It sets the event ID using setEventID()

■ A statement to select all the viewer IDs (user ID) of the event viewer table for the given event ID is prepared and stored in $stmt

■ Using the DBI object ($this->dbi), the $stmtstatement is run via the

$this->dbi->query()method in the DBI object The result of the query is stored in the $resultvariable

■ If there are more than zero rows in the $resultobject, each row is fetched in the $rowvariable

■ An associative array is prepared using each row’s event ID and event title

■ The method returns the array In case the result set found is empty, the method returns null

◆ addEvent () : This method adds a new event into to the CALENDAR_EVENT

table Attributes such as user ID, event title, event date, event description, reminder ID, and flag are passed as an associative array to this method It works as follows:

■ From the given parameter, all the values of texttype in the database are escaped for characters such as quotation marks and slashes using

$this->dbi->quote(addslashes())