Secure PHP Development- P80 pptx

This method is called with resource ID $rid and an array $params, which contains the keywords.. deleteKeywords This method deletes all the keywords for the given resource from the databa

This method inserts keywords in the RESOURCE_KEYWORDtable This method is called with resource ID ($rid) and an array ($params), which contains the keywords Each keyword is inserted into the table using a foreachloop It returns TRUE if it adds keywords successfully; otherwise, it returns FALSE

deleteKeywords()

This method deletes all the keywords for the given resource from the database This method is called with the resource ID ($rid) It returns TRUE if it successfully deletes all the keywords; otherwise, it returns FALSE

getKeywords()

This method returns keyword(s) for the given resource It works as follows:

◆ This method is called with the resource ID ($rid)

◆ A SQL statement, $stmt, is created which queries the RESOURCE_KEYWORD table for all keywords for the given resource ID

◆ The SQL statement is executed using the $this->dbi->query()method and the result of the query is stored in the $resultobject

◆ If no rows are returned in the $resultobject, the method returns null

◆ On the other hand, it fetches the $resultobject and each row is stored in the $rowobject and the keyword is stored in the $retArrarray Then the array $retArris returned

searchResource()

This method searches resource in the RESOURCEtable This method works as follows:

◆ This method is called with an associative array ($params), which contains search criteria

◆ If the resource category ($params[RESOURCE_CATEGORY]) is provided in the parameter, then the method checks whether the given category is the main category or not If it is the main category, then it generates SQL conditions for each subcategory of the given category along with the main category On the other hand, it generates the SQL condition only for the main category These conditions are stored in a variable called $category

◆ Then It checks whether the rating $params[RESOURCE_RATING]criteria is provided or not If the rating criteria is provided, then the SQL condition

is generated and stored in a variable called $rating

◆ If the resource added by criteria $params[RESOURCE_ADDED_BY]is given, then it generates the SQL condition for the resources, which is added by a particular user

◆ If the resource visited by criteria $params[RESOURCE_VISITED_BY]is given, then it generates the SQL condition for the resources, which is visited by a particular user

◆ Next This method checks whether the keywords are provided for searching

or not If they are provided, then it generates the SQL condition that will search for resources that have the given keywords

◆ A SQL statement, $stmt, is created which queries for the resources falling under all the given criterion

◆ The SQL statement is executed using the $this->dbi->query()method and the result of the query is stored in the $resultobject

◆ If no rows are returned in the $resultobject, the method returns null

◆ On the other hand, it fetches the $resultobject and each row is stored in the $rowobject and the $rowobject is stored in the $retArrarray Then the array $retArris returned

modifyResource()

This method updates existing resource information in the database It works as follows:

◆ The method is called with an associative array ($params), which contains the fields name of the RESOURCEtable, its new value, and the resource ID ($resource_id) for which it will update

◆ The given resource title ($params[RESOURCE_TITLE]), resource location ($params[RESOURCE_LOCATION]), and resource description ($params[RESOURCE_DESCRIPTION]) are escaped for characters such as quotation marks and slashes using $this->dbi->quote(addslashes()) methods

◆ A SQL statement, $statement, is created to update the new resource data into the RESOURCEtable

◆ The SQL statement is executed using the $this->dbi->query()method and the result of the query is stored in the $resultobject

◆ If the resource is successfully updated, then this method returns TRUE; otherwise, it returns FALSE

trackResourceVisit()

When a user clicks on a URL for a resource displayed in a category or as a search result, the URL click event is tracked This method is responsible for inserting a track record in the RESOURCE_TRACKtable for such URL clicks

This method deletes a resource from RESOURCE table of the database It deletes a resource by the given resource ID ($rid)

getNumOfResourceInCat()

This method returns the number of resources that reside in the given category This method is called with a category ID ($catID) as parameter

getResourceByCategory()

This method returns all the resources that fall under the given category This method

is called with a category ID ($catID)

getResourceUrl()

This method returns URL of the resource This method is called with a resource ID ($rid)

getTotalResourceNum()

This method returns the total number of resources in the RESOURCEtable

getResourceInfo()

This method returns information related to the given resource This method is called with resource ID ($rid)

getNewResource()

This method returns the number of newly added resources This method is called with category ID ($catid) and time limit ($timeLimit) It finds the number of the resources that fall under the given category ID and are added after the given time limit

getTopRankingList()

This method returns the top-ranking resource list This method is called with a parameter that can be considered as the lower bound of the top ranking list (that is, this method finds all the resources that have ranking higher than or equal to this parameter) It returns an associative array, which contain the resource ID and its information

Designing and implementing the Message class

The Messageclass is used to manipulate each message It allows an application to create and delete messages This class is discussed in Chapter 7

Creating Application Configuration Files

Like all other applications we’ve developed in this book, the Internet Resource Manager applications also use a standard set of configuration, message, and error files These files are discussed in the following sections

Creating the main configuration file

The primary configuration file for the entire Internet Resource Manager is called irm.conf Table 11-1 discusses each configuration variables

T ABLE 11-1 IRM.CONF VARIABLES Configuration Variable Purpose

$PEAR_DIR Set to the directory containing the PEARpackage;

specifically the DBmodule needed for class.DBI.php

in our application framework

$PHPLIB_DIR Set to the PHPLIBdirectory, which contains the

PHPLIBpackages; specifically the template.inc package needed for template manipulation

$APP_FRAMEWORK_DIR Set to our application framework directory

$PATH Set to the combined directory path consisting

of the $PEAR_DIR, $PHPLIB_DIR, and

$APP_FRAMEWORK_DIR This path is used with the ini_set()method to redefine the php.ini entry for include_pathto include $PATHahead of the default path This allows PHP to find our application framework, PHPLIB, and PEAR-related files

$AUTHENTICATION_URL Set to the central login application URL

$LOGOUT_URL Set to the central logout application URL

$HOME_URL Set to the topmost URL of the site If the URL

redirection application doesn’t find a valid URL in the e-campaign database to redirect to for a valid request,

it uses this URL as a default

$APPLICATION_NAME The internal name of the application

Continued

T ABLE11-1 IRM.CONF VARIABLES (Continued)

Configuration Variable Purpose

$DEFAULT_LANGUAGE Set to the default (two characters) language code

$ROOT_PATH Set to the root path of the application

$REL_ROOT_PATH Relative path to the root directory

$REL_APP_PATH Relative application path as seen from Web browser

$TEMPLATE_DIR The fully qualified path to the template directory

$THEME_TEMPLATE_DIR The fully qualified path to the theme template directory

$REL_PHOTO_DIR The Web-relative path to the photo directory used to

store user photos

$PHOTO_DIR The fully qualified path to the photo directory

$DEFAULT_PHOTO Name of the default photo file, which is used when a

user does not have a photo in the photo directory

$CLASS_DIR The fully qualified path to the class directory

$REL_TEMPLATE_DIR The Web-relative path to the template directory used

$IRM_CATEGORY_CLASS Name of the Categoryclass file

$IRM_RESOURCE_CLASS Name of the Resourceclass file

$IRM_MESSAGE_CLASS Name of the Messageclass file This class is developed

for the MOTD application discussed in Chapter 10

$IRM_RESOURCE_MNGR Name of the application that manages resources

$IRM_SEARCH_MNGR Name of the application that is used to search for

resources

$IRM_RESOURCE_TRACK_MNGR Name of the application that tracks user visits to

resources

$IRM_CAT_MNGR Name of the application that manages categories

$IRM_DB_URL The fully qualified URL for the database used to store

the resources and categories

$IRM_CATEGORY_TBL Name of the category table in the database

$IRM_RESOURCE_TBL Name of the resource table in the database

$IRM_RESOURCE_KEYWORD_TBL Name of the resource keyword table in the database