Secure PHP Development- P140 doc

isNodeOf This method determines whether the current IP is a part of the given network.. Then it determines whether the given IP is a network address by matching it with any of the follow

isNodeOf( )

This method determines whether the current IP is a part of the given network This

is how it works:

◆ It first takes the octets of both IPs (the current IP and the network IP) into two arrays named $currentOctetsand $networkOctets

◆ It removes the fourth octet of the network IP (if it exists) and the current IP

◆ Each octet (three in total) of the current IP is matched with the octets of the network IP The match counter $matchCountis incremented with each successful match

◆ The method returns TRUEif the match counter is exactly equal to the number of octets of the network; otherwise, it returns FALSE

isNetworkAddr( )

This method determines whether the given IP is a network address It first takes the octets of the IP in an array Then it determines whether the given IP is a network address by matching it with any of the following three conditions: whether the length of the array is less than four; whether the second to last element of the octet array is a zero; and whether the second to last element of the octet array is an “x”

Designing and implementing the DataCleanup class

The DataCleanupclass is used to clean up form data collected from the user The ch19/apps/class/class.DataCleanup.phpfile on the CD-ROM implements this class, which implements the methods described in the following sections

DataCleanup( )

This is the constructor method Basically, it is used by the caller application to instantiate the class

cleanup_none( )

This is the basic cleanup method, which does the simple job of returning the string passed to the method as a parameter without any formatting

cleanup_ucwords( )

This method takes a string as a parameter and returns it after formatting the first character of each word into an uppercase character

cleanup_ltrim( )

This method returns the given string after removing all whitespace from the left of it

cleanup_rtrim( )

This method returns the given string after removing all whitespace from the right

of it

cleanup_trim( )

This method returns the given string after removing all whitespace around it

cleanup_lower( )

This method takes a string as a parameter and returns it after converting all the characters to lowercase characters

Designing and implementing the DataValidator class

The DataValidatorclass is used to validate form data collected from the user The ch19/apps/class/class.DataValidator.php file on the CD-ROM implements this class, which implements the methods described in the following sections

DataValidator( )

This is the constructor method Basically, it is used by the caller application to instantiate the class

validate_size( )

This method validates the size of the input This is how it works:

◆ It takes as parameters the data to be validated ($str), the size permitted ($size), and the type of the data ($type)

◆ The $sizeparameter is provided as a string that has “size=”at the beginning Therefore, the method first gets the actual permitted size by removing the string “size=”from the given $size

◆ The method directly returns TRUEif it finds that the permitted size is “any”

◆ Otherwise, $sizeis passed into the get_size()method to find the mini-mum and maximini-mum allowed size

◆ Depending on the type (text/number) of the data, the validate_string_

size()method or the validate_number_range()method is called to validate the size of the data

get_size( )

This method takes the permitted size as a string and returns an array with informa-tion about the minimum and maximum allowed size This is how it works:

◆ It first checks whether there is a ‘-’in the given size string, which means that two sizes are provided on either side of the ‘-’, indicating both a minimum and a maximum Otherwise, the method assumes that the given size is the only size allowed, and hence it returns the given size as both minimum and maximum size

◆ If there is a ‘-’in the given parameter, the method explodes the string and determines the minimum and maximum allowed size

◆ It then looks for a ‘KB’or ‘MB’in the string that identifies the maximum size If it finds such a string, this method converts the sizes accordingly (it multiplies by 1024 in the case of ‘KB’) and keeps them in the associative array

◆ Finally, the array indicating the minimum and maximum allowed size is returned

validate_number_range( )

This method takes three numbers as input (the number to be validated, the upper bound, and the lower bound) and determines whether the first number falls within the other two numbers

validate_string_size( )

This method validates the length of the string It takes the string and the two bounds (minimum and maximum length) and determines whether the string length

is within the boundary allowed

validate_name( )

This method determines whether the given string is a valid name by checking it for numbers and unusual characters (anything other than the alphabets)

validate_org_name( )

This method determines whether the given string is a valid organization name by checking it for unusual characters (anything other than the alphabet, numeric char-acters, or the comma, period, and hyphen)

validate_number( )

This method determines whether the given string is a valid number by allowing only numeric characters and the period (“.”)

validate_any_string( )

This method takes a string as input and always returns TRUE

validate_email( )

This method takes a string as input and determines whether it is a valid e-mail address by using a complex regular expression taken from http://www.php.net/

manual/en/function.preg-match.php

validate_url( )

This method validates the given string by checking it for valid schemes (http, https, or ftp)

validate_file_size( )

This method determines whether the given file size falls within the specified allowed size This method uses the get_size()method to determine the allowed maximum and minimum size

Designing and implementing the FormSubmission class

The FormSubmissionclass is used to process the submission of the form The ch19/

apps/class/class.FormSubmission.php file on the CD-ROM implements this class, which implements the methods described in the following sections

FormSubmission( )

This is the constructor method It sets member variables $DBI (to hold the DBI object), $ID (to hold the form ID), $KNOWN_FORMS (to hold the array of known forms), and $ERRORS(to hold the array of errors)

hasError( )

This method determines whether the array for holding the errors is empty, returning either TRUE or FALSE

getErrors( )

This method returns the member variable $ERROR, which is an array of the errors

getErrorMessage( )

This method is used to retrieve the form-specific error messages This is how it works:

◆ This method takes two parameters: $lang(for the language of the error message) and $err(for the error/array of errors)

◆ If $erris not supplied, this method takes $ERROR, the member variable of the class

◆ If $erris given as a string and not an array, this method gets the single error message from the member variable $FORM_ERRORS, which is set in the loadConfigFile()method

◆ If $erris an array, each of the error messages is retrieved from

$FORM_ERRORSand returned as one string (by imploding a line break among them)

setupForm( )

This method is used for the form setup This is how it works:

◆ It uses the member variable $FORM_FIELDS, which is set in the loadConfigFile()method

◆ $FORM_FIELDSis an associative array that holds all the field names of the form and their configurations This method breaks down each of the field’s configurations and sets them as member variables to be used later

isKnownForm( )

This method determines whether the current form is one of the known and config-ured forms by matching its ID with IDs of the $KNOWN_FORMSarray

loadConfigFile( )

This method is responsible for loading the configuration file specific to the form Every form to be managed has its own configuration file Therefore, this method identifies the configuration file for the current form and includes it for later usage

It sets member variables $FORM_FIELDS, $FORM_ERRORS, and $FILE_LOAD_FIELDS from that configuration file

processForm( )

This method takes care of the entire processing of the form submission This is how

it works:

◆ It first calls the haveRequiredData()method to determine whether all

of the form’s required data has been submitted If not, it returns with the proper error signal

◆ It then calls the validateData()method to validate the given data If it fails, it returns with the proper failure signal

◆ The cleanupData()method is called to clean up the given data

◆ After that, submitData()is invoked to insert the data into the database

◆ The uploadFile()method is called to manage any file uploads

◆ The method then sends outbound (to user) and/or inbound (to admin) e-mails, if specified in the form configuration