Secure PHP Development- P79 potx

getCategoryList This method returns the list of main categories or categories that do not have any parent categories.. getSubCategoryList This method returns the list of all subcategorie

RESOURCE_KEYWORD table

The RESOURCE_KEYWORDtable holds the resource keyword information The resource keyword consists of resource number (RESOURCE_ID) and keyword (KEYWORD)

Figure 11-1: A Resource Manager database diagram.

RESOURCE_VISITOR table

The RESOURCE_VISITOR table contains visitor(s) of resources This table holds the resource number (RESOURCE_ID), visitor ID (VISITOR_ID), and visit timestamp (VISIT_TS)

The ch11/sql/irm.sqlfile in the CDROM has a set of create table statements, which can be used to create the IRM database in MySQL To create the IRM data-base and its tables run the following commands:

mysqladmin -u root -p create IRM mysql -u root -p -D IRM < irm.sql

Make sure you change the user name (root) to whatever is appropriate for your system

After you have the Resource Manager database designed, you need to design the PHP classes that will be needed to implement the applications In the following sec-tions, I discuss these classes

Designing and Implementing the Internet Resource Manager Application Classes

As shown in the system diagram, Figure 11-2, there are three objects that are needed to implement the Internet Resource Manager

Figure 11-2: A system diagram for the IRM.

Here you will develop three classes that will provide these objects for your resource applications

Designing and implementing the IrmCategory class

The IrmCategoryclass is used to manipulate each category It allows an applica-tion to create and delete a category The ch11/apps/class/class.IrmCategory phpfile in the CDROM is an implementation of this class This class implements the following methods

IrmCategory( )

This is the constructor method It performs the following functions:

◆ Sets a member variable named category_tblto $IRM_CATEGORY_TBL, which is loaded from the irm.conffile The $IRM_CATEGORY_TBLholds the name of the category table

Central Login/Logout

Messages

IRM User Home Interface

PHP Application Framework

Message Object

IRM Applications

IrmCategory Object

IrmContact Object

class.Message.php

class.IrmCategory.php

class.IrmContact.php

◆ Sets a member variable named dbito point to the class.DBI.php -provided object, which is passed to the constructor by an application

The dbimember variable holds the DBIobject, which is used to communi-cate with the back-end database

getCategoryList()

This method returns the list of main categories or categories that do not have any parent categories It works as follows:

◆ First, it initializes an array named $listArr, which will be used for storing the category list

◆ A SQL statement is created in $stmt, which queries the category table for the entire main category list It returns all the names and IDs of the main category

◆ Then It fetches the result of the query and return the $listArrarray con-taining the list of category IDs and category names

If the result of the query is empty, then it returns null

getSubCategoryList()

This method returns the list of all subcategories for a given category It works as follows:

◆ This method is called with category ID ($p_id)

◆ It initializes an array named $listArrfor containing the list of subcate-gory ID and name

◆ A SQL select statement, $stmt, is created to return all the category IDs and their names for which the parent category ID matches the given category ID ($p_id)

◆ If the result of the SQL query returns no rows, the method returns null

◆ Otherwise, the list of subcategory IDs and names are returned in an array called $listArr

getCategoryName()

This method returns the name of the category from the CATEGORYtable This method takes the category ID ($catID) as a parameter

getParentCategory()

This method returns the parent category of the given category from the CATEGORY table This function takes category ID ($catID) as a parameter

This method determines the existence of a category in the CATEGORYtable It takes category name ($catName) as a parameter It returns the category ID if the given name matches with the existing category name in the CATEGORYtable; otherwise, it return zero

addCategory()

This method adds a new category into to the CATEGORYtable This method is called with category name ($name), parent category ID ($pcat), and created by ($uid) Along with this, information about the new category adding time is also entered into the database If the category is successfully added, then it returns TRUE; other-wise, it returns FALSE

deleteCategory()

This method deletes the category from the database This method is called with category ID ($catID) If it successfully deletes the category, then it returns TRUE; otherwise, it returns FALSE

modifyCategory()

This method updates the category information for a given category This method is called with category ID ($catID), name ($newcategory), parent category ID ($pid) and the user ID ($uid) If it updates successfully, then it returns TRUE; otherwise, it returns FALSE

Designing and implementing the IrmResource class

This class provides the Resourceobject The Resourceobject is used to manipulate Internet resources The ch11/apps/class/class.IrmResource.php file in the CDROM is an implementatio of this class In the following section, I discuss the methods available in this class below

IrmResource()

This is the constructor method, which performs the following tasks:

◆ Sets a member variable called resource_tblto $IRM_RESOURCE_TBL, which is loaded from the irm.conffile The $IRM_RESOURCE_TBLvariable holds the name of the resource table

◆ Sets a member variable called resource_track_tblto

$IRM_RESOURCE_VISITOR, which is loaded from the irm.conffile

The $IRM_RESOURCE_VISITORvariable holds the name of the resource visitor table

◆ Sets a member variable called resource_keyword_tblto

$IRM_RESOURCE_KEYWORD_TBL, which is loaded from the irm.conffile

The $IRM_RESOURCE_KEYWORD_TBLvariable holds the name of the resource keyword table

◆ Sets a member variable named dbito point to the class.DBI.php -provided object, which is passed to the constructor by an application

The dbimember variable holds the DBIobject, which is used to com-municate with the back-end database

◆ Sets an object variable called $std_map_fieldsto field names of the RESOURCEtable The std_map_fieldsvariable is an associative array, which contains both field names and field types in a key = valueformat

◆ A comma-separated list of RESOURCEtable field names are created in the

$fieldsvariable using the $this->std_map_fields

◆ Sets an object variable called $resource_track_map_fieldsto field names of the RESOURCE_VISITORtable The std_map_fieldsvariable

is an associative array, which contains both field names and field types

in a key = value format

◆ A comma-separated list of RESOURCE_VISITORtable field names are created in the $resource_track_fieldsvariable using the $this->

resource_track_map_fields

addResource()

Called with an associative array ($params), which contain the field names of the table and the field value, the method adds new resource in the RESOURCE table It works as follows:

◆ The given resource title ($params[RESOURCE_TITLE]), resource location ($params[RESOURCE_LOCATION]), and resource description ($params[RESOURCE_DESCRIPTION]) are escaped for characters such as quotation marks and slashes using $this->dbi->quote(addslashes()) methods

◆ A SQL statement, $statement, is created to insert the new resource data into the RESOURCEtable

◆ The SQL statement is executed using the $this->dbi->query()method and the result of the query is stored in the $resultobject

◆ Another SQL statement, $stmt, is created to select the newly added resource from the RESOURCEtable and execute the SQL statement in the

$this->dbi->query()method

◆ This method returns the resource ID if it inserts the resource successfully;

otherwise, it return FALSE