Secure PHP Development- P142 pot

T ABLE19-2 THE X.CONF CONFIGURATION VARIABLES ContinuedConfiguration Variable Purpose $FRM_TEMPLATE_DIR Form-specific template directory.. $OUTBOUND_MAIL_TEMPLATE The template file used

T ABLE 19-1 THE WEBFORMS.CONF VARIABLES THAT NEED TO BE CHANGED

(Continued)

Configuration Variable Purpose

$DEFAULT_COLOR Default color used as background in any row in the

report

$MAX_YEAR The maximum year to be used in the report prompt

$MIN_YEAR The minimum year to be used in the report prompt

$REPORTER The name of the application that manages the report

$CSV_EXPORTER The name of the application that exports form data

as CSV

$DOWNLOAD_TRACK_TBL The name of the table that tracks download information

$DOWNLOAD_TYPE_LATEST The code for identifying the type of download for which

only the latest data is downloaded

$DOWNLOAD_TYPE_ALL The code for identifying the type of download for which

all data is downloaded

The directory structure used in the webforms.conf file supplied in the ch19 directory on the CD-ROM might need to be tailored to your own system’s require-ments The current directory structure looks like the following:

htdocs ($ROOT_PATH == %DocumentRoot%)

| + -webforms (Web Forms Manager Applications)

| + -apps (apps and configuration files)

| + -class (class files)

| + -templates (HTML templates)

| + -temp (Temporary folder to store the files to be downloaded)

| + -site_forms (form configuration files)

|

By changing the following configuration parameters in webforms.conf, you can modify the directory structure to fit your site requirements:

$PEAR_DIR = $_SERVER[‘DOCUMENT_ROOT’] ‘/pear’ ;

$PHPLIB_DIR = $_SERVER[‘DOCUMENT_ROOT’] ‘/phplib’;

$APP_FRAMEWORK_DIR = $_SERVER[‘DOCUMENT_ROOT’] ‘/framework’;

$ROOT_PATH = $_SERVER[‘DOCUMENT_ROOT’];

$REL_ROOT_PATH = ‘/webforms’;

$REL_APP_PATH = $REL_ROOT_PATH ‘/apps’;

$TEMPLATE_DIR = $ROOT_PATH $REL_APP_PATH ‘/templates’;

$CLASS_DIR = $ROOT_PATH $REL_APP_PATH ‘/class’;

Creating a sample form configuration file

Now to examine a sample form configuration file Assuming the name of the form

is x, the configuration file name should be x.conf Table 19-2 describes the config-uration variables of x.conf, a typical form configuration file

T ABLE 19-2 THE X.CONF CONFIGURATION VARIABLES Configuration Variable Purpose

$ FORM_NAME The name of the form to be configured

$FORM_TABLE The name of the table in which the form data will be

stored

$ACL_ALLOW_FROM Comma-separated list of IP addresses that are allowed to

access this form

$ACL_DENY_FROM Comma-separated list of IP addresses that are denied

access to this form

$FORM_LOG_FILE The name and path of the log file for the form

$FORM_FIELDS_ARRAY The array of form fields, along with their configurations

$UPLOAD_FILE The code to identify whether there is an upload for this

form or not

$UPLOAD_FILE_DIR The name and path of the directory to store the uploaded

file

Continued

T ABLE19-2 THE X.CONF CONFIGURATION VARIABLES (Continued)

Configuration Variable Purpose

$FRM_TEMPLATE_DIR Form-specific template directory Whenever a template

is required, the application first searches for it here If it doesn’t find it here, it searches the default application template directory

$UPLOAD_FILE_FIELDS_ARRAY The array to identify any upload-related field names and

their configurations

$SEND_OUTBOUND_MAIL The code to identify whether there should be outbound

mail or not

$OUTBOUND_MAIL_TEMPLATE The template file used to send outbound mail

$OUTBOUND_MAIL_SUBJECT The subject line to be used in outbound mail

$EMAIL_FIELD The name of the form field containing the e-mail address

of the user

$SEND_INBOUND_MAIL The code to identify whether there should be inbound

mail or not

$INBOUND_MAIL_TEMPLATE The template file used to send outbound mail

$INBOUND_MAIL_TO The e-mail address to which inbound mail will be sent

$INBOUND_MAIL_SUBJECT The subject line to be used in outbound mail

$SHOW_THANKYOU_TEMPLATE The name of the template file used to thank the user

after filling out the form

$AUTO_REDIRECT The code to identify whether the page should be

redirected after the form is submitted

$AUTO_REDIRECT_URL The URL to which the page should be redirected after

form submission

$ERRORS The array of error messages related to different fields

Creating the errors file

The error messages displayed by the Web Forms Manager applications are stored in the ch19/apps/webforms.errors file on the CD-ROM You can modify the error messages by using a text editor

Creating Application Templates

The HTML interface templates needed for the applications are included on the CD-ROM These templates contain various template tags for displaying necessary information dynamically These templates are described in Table 19-3

T ABLE 19-3 HTML TEMPLATES Configuration Variable Template File Purpose

$REPORT_TEMPLATE report.html This template is used to

show reports data collected via Web forms

$OUTBOUND_MAIL_TEMPLATE Outbound_mail.html This template is used to

send mail to the user who fills out the form

$INBOUND_MAIL_TEMPLATE Inbound_mail.html This template is used to

send mail to the form owner

or the administrator

$SHOW_THANKYOU_TEMPLATE thanks.html This template is used to

thank the user after the form has been filled out

Creating the Web Forms Submission Manager Application

This application, submit.php, is responsible for managing the entire form-submission process This application is included on the CD-ROM in the ch19/appsdirectory

It implements the following functionality:

◆ Adds submitted data to the database

◆ Sends mail to the appropriate recipient

◆ Shows error messages in case of invalid data

◆ Displays a thank-you page or redirects the user to a specified URL after form submission

This application contains the methods described in the following sections.

run( )

When the application is run, this method is called This is how it works:

◆ First, it creates a FormSubmissionobject Then it determines whether the

idof the form for which the request is being made is configured If it isn’t, it displays an error alert and returns null

◆ Otherwise, the loadConfigFile()method of the FormSubmissionclass is called to load the configuration file for the form Then the setupForm() method of the same class is called to set up the form variables

◆ Next, the authorize()method is called to authorize the request If autho-rization is successful, the processForm()method is called to process the form data

◆ If processForm()returns a positive status, this method determines whether an auto redirect for this form exists If yes, the user is redirected

to the specified URL; otherwise, a thank-you message for submitting the form is displayed to the user by calling the showPage()method

◆ If processFormreturns a negative status, the error message is prepared using the getErrorMessage()method of the Formsubmissionclass Then the exact violation issue is retrieved, and the error message is displayed as

an alert to the user

showPage( )

This method renders the given template on the user’s browser This is how it works:

◆ It first determines whether the requested template exists in the form-specific template directory If it does, the template directory for the template class is assumed to be the form template directory; otherwise, the default application template directory is assumed to be the template directory for the template class

◆ After the template class is instantiated with the appropriate template directory, all the data posted by the user is set to the template

◆ Finally, the template is parsed and printed to the user’s browser