Secure PHP Development- P94 pdf

◆ The method directly returns null when it finds out, using the numRows method, that the $resultobject has no rows.. This is how it works: ◆ First a query statement is prepared and store

Trang 1

Designing and implementing the Form class

The Formclass is used to manipulate each form It allows an application to create, modify, and delete a form The ch13/apps/class/class.Form.php file on the CD-ROM implements this class This class implements the following methods

Form()

This is the constructor method It works as follows:

◆ First it sets a member variable named dbito point to the class.DBI.php -provided object, which is passed to the constructor by an application The dbimember variable holds the DBI object, which is used to communicate with the back-end database

◆ Then it sets member variables named frm_tbl, submtn_tbl, and sub-scr_tblto store the names of the form table, submission table, and sub-scription table, respectively

◆ It also sets member variables named field_arr(to store the form table attributes and their type as an array) and fields(to hold the attributes as

a comma-separated string)

◆ Then it calls the setFormID()method to set the Form ID that has been passed as a parameter

setFormID()

This method is used to set the form ID as member variable fid It takes the ID as a parameter and returns it after setting it to the member variable if the ID is not empty

getFormInfo()

This method is used to retrieve all the information for a given form This is how it works:

◆ First it calls the setFormID()method to set the given form ID

◆ Then it builds a query statement to retrieve all the attribute values of the form and stores the statement $stmt

◆ Using the DBI object ($this->dbi), the $stmtstatement is run via the

$this->dbi->query()method in the DBI object The result of the query

is stored in the $resultvariable

◆ The method directly returns null when it finds out, using the numRows() method, that the $resultobject has no rows

◆ Otherwise, the row is fetched using the fetchRow()method and stored in

$row

Trang 2

◆ Then the member variable field_arris looped through to store each col-umn value of the $rowobject into the $retArrarray with the respective field name as the key for each value The values are formatted using the stripslashes() method before storing them in the array

◆ Then the $retArrarray is returned from this method

getAllForms()

This method is used to retrieve all the forms from the database This is how it works:

◆ First a query statement is prepared and stored in $stmtto retrieve the form number and form name of all the forms

◆ Using the DBI object ($this->dbi), the $stmtstatement is run via the

$this->dbi->query()method in the DBI object The result of the query

is stored in the $resultvariable

◆ Otherwise, each row of the $resultobject is fetched using the fetchRow()method and $retArris prepared with all the form IDs and form names

◆ At the end, the $retArrarray is returned

addForm()

This method is used to add new forms to the database It works as follows:

◆ From the given parameter, all the values that are supposed to be of text type in the database are escaped for characters such as quotation marks and slashes using $this->dbi->quote(addslashes())methods

◆ Then all the parameter values are taken into a string named

$paramValueStrby imploding a comma among them

◆ A SQL statement, $stmt, is created to insert the new form data into the form table using the member variable fields(contains attribute names) and $paramValueStr

◆ The SQL statement is executed using the $this->dbi->query()method and the result of the query is stored in the $resultobject

◆ If the $resultstatus is not okay, the method returns false

◆ Otherwise, another query statement is prepared to retrieve the form ID of the newly added form by using the form name, which is a unique field, in the wherecondition

◆ The statement is executed as usual and the form ID is returned from the method

Trang 3

This method is used to modify forms This is how it works:

◆ Then a string named $keyValueis prepared that contains all the attribute names and values as attr1 = value1 , attr2 = value2 , format

◆ A SQL statement, $stmt, is created to update the form data using

$keyValue

◆ The method returns TRUEor FALSEdepending on the status of the $result

deleteForm()

This method is used to delete a given form It takes form ID as the parameter and returns TRUEor FALSEdepending on the status of the deletion operation

isMaximumSubmitted()

This method identifies whether the maximum number of friends allowed has exceeded or not for the given originator according to the form configuration This

is how it works:

◆ First it sets the given form ID using the setFormID()method

◆ Then the given originator e-mail is formatted using

$this->dbi->quote(addslashes())methods

◆ Then a query statement is prepared to retrieve the number of friends sub-mitted by the given originator for the given form

◆ Then the number of maximum allowed friends is retrieved using the getFormInfo()method

◆ Then the two numbers are compared to return TRUEwhen the number of friends submitted is already equal to or greater than the maximum allowed; otherwise, it returns FALSE

addSubmissionData()

This method is used to add friend submission data in to the database It works as follows:

◆ First it sets $field_arr(to store the submission table attributes and their type as an array) and $fields(to hold the attributes as a comma-separated string)

Trang 4

$paramValueStrby imploding comma among them

◆ A SQL statement, $stmt, is created to insert the new submission data into the submission table using $fieldsand $paramValueStr

◆ The SQL statement is executed using the $this->dbi->query()method and the result of the query is stored in $resultobject

◆ If the $resultstatus is not okay, the method returns false

◆ Otherwise, another query statement is prepared to retrieve the friend ID of the newly submitted friend by using the friend e-mail and form ID, which are the unique fields, in the wherecondition

◆ The statement is executed as usual and the friend ID is returned from the method

getFriendList()

This method returns the list of all friends for a given form This is how it works:

◆ First it sets the given form ID using the setFormID()method

◆ Then it prepares a query to retrieve the friend ID and e-mail from the sub-mission table for the given form

◆ Otherwise, each row of the $resultobject is fetched using the fetchRow()method and $retArris prepared with all the friend IDs and e-mails

◆ At the end the $retArrarray is returned

addSubscriptionData()

This method is used to add subscription data after a friend decides to subscribe or unsubscribe It works in the following manner:

◆ First it sets $field_arr(to store the subscription table attributes and their type as an array) and $fields(to hold the attributes as a comma-separated string)

Trang 5

$paramValueStrby imploding a comma among them

◆ A SQL statement, $stmt, is created to insert the new subscription data into the submission table using $fieldsand $paramValueStr

◆ The method returns TRUEor FALSEdepending on the status of $result This method is used to determine whether the given friend has already unsub-scribed It takes the friend’s e-mail as the parameter and checks whether the e-mail

is already unsubscribed or not

getNumberOfSubscriber()

This method returns the number of friends that have subscribed for a given form It takes the form ID as a parameter and returns the number of subscribers for that form

getNumberOfUnsubscriber()

This method returns the number of friends that have unsubscribed for a given form

It takes the form ID as a parameter and returns the number of unsubscriber for that form

getOriginSubmissions()

This method returns the originator information for a given form This is how it works:

◆ First it sets the form ID using the setFormID()method

◆ Then it prepares a query statement to retrieve the originator e-mails and number of submission by each of them

◆ Otherwise, each row of the $resultobject is fetched using the fetchRow()method and $retArris prepared with all the originator e-mails and number of submissions by each of them

◆ At the end, the $retArrarray is returned

Định dạng
Số trang	5
Dung lượng	85,55 KB