Secure PHP Development- P8 ppsx

Listing 1-1 (Continued) // Get name from GET or POST request $name = (! empty($_REQUEST[‘name’])) ? $_REQUEST[‘name’] : null; // Print output print <<<HTML <html> <head><title>Bad Script</title></head> <body> <table border=0 cellpadding=3 cellspacing=0> <tr> <td> Your name is </td> <td> $name </td> </tr> </table> </body> </html> HTML; ?> Listing 1-1 shows a simple PHP script that has HTML interface embedded deep into the code. This is a very unmaintainable code for an end user who isn’t PHP- savvy. If the end user wants to change the page this script displays, he or she has to modify the script itself, which has a higher chance of breaking the application. Now look at Listing 1-2. Listing 1-2: A PHP Script with External User Interface <?php // Enable all error reporting error_reporting(E_ALL); // Set PHPLIB path $PHPLIB_DIR = $_SERVER[‘DOCUMENT_ROOT’] . ‘/phplib’; // Add PHPLIB path to PHP’s include path ini_set( ‘include_path’, ‘:’ . $PHPLIB_DIR . ‘:’ . ini_get(‘include_path’)); // Include the PHPLIB template class include(‘template.inc’); 6 Part I: Designing PHP Applications 03 549669 ch01.qxd 4/4/03 9:24 AM Page 6 // Setup this application’s template // directory path $TEMPLATE_DIR = $_SERVER[‘DOCUMENT_ROOT’] . ‘/ch1/templates’; // Setup the output template filename $OUT_TEMPLATE = ‘listing2out.html’; // Get name from GET or POST request $name = (! empty($_REQUEST[‘name’])) ? $_REQUEST[‘name’] : null; // Create a new template object $t = new Template($TEMPLATE_DIR); // Set the template file for this object to // application’s template $t->set_file(“page”, $OUT_TEMPLATE); // Setup the template block $t->set_block(“page”, “mainBlock” , “main”); // Set the template variable = value $t->set_var(“NAME”, $name); // Parse the template block with all // predefined key=values $t->parse(“main”, “mainBlock”, false); // Parse the entire template and print the output $t->pparse(“OUT”, “page”); ?> This application looks much more complex than the one shown in Listing 1-1, right? At first glance, it may look that way, but it’s really a much better version of the script. Let’s review it line by line: $PHPLIB_DIR = $_SERVER[‘DOCUMENT_ROOT’] . ‘/phplib’; The first line of the script sets a variable called $PHPLIB_DIR to a path where PHPLIB library files are stored. The path is set to PHPLIB (phplib) subdirectory document root (hereafter %DocumentRoot%). This means if your Web document root is set to /usr/local/apache/htdocs, the script assumes your PHPLIB directory is Chapter 1: Features of Practical PHP Applications 7 03 549669 ch01.qxd 4/4/03 9:24 AM Page 7 /usr/local/apache/htdocs/phplib. Of course, if that is not the case, you can change it as needed. For example: $PHPLIB_DIR = ‘/www/phplib’; Here the PHPLIB path is set to /www/phplib, which may or may not be within your document root. As long as you point the variable to the fully qualified path, it works. However, the preferred path is the %DocumentRoot%/somepath, as shown in the script. The next bit of code is as follows: ini_set( ‘include_path’, ‘:’ . $PHPLIB_DIR . ‘:’ . ini_get(‘include_path’)); It adds the $PHPLIB_DIR path to PHP’s include_path setting, which enables PHP to find files in PHPLIB. Notice that we have set the $PHPLIB_DIR path in front of the existing include_path value, which is given by the ini_get(‘include_path’) function call. This means that if there are two files with the same name in $PHPLIB_DIR and the original include_path, the $PHPLIB_DIR one will be found first. Next, the code sets the $TMEPLATE_DIR variable to the template path of the script: $TEMPLATE_DIR = $_SERVER[‘DOCUMENT_ROOT’] . ‘/ch1/templates’; The path is set to %DocumentRoot%/ch1/templates. You can change it to what- ever the exact path is. Again, the ideal path setting should include $_SERVER [‘DOCUMENT_ROOT’] so that the script is portable. If an exact path is hard coded, such as the following, then the end user is more likely to have to reconfigure the path because the %DocumentRoot% may vary from site to site: $TEMPLATE_DIR = ‘/usr/local/apache/htdocs/ch1/templates’; The next line in Listing 1-2 sets the output template file name to $OUT_ TEMPLATE : $OUT_TEMPLATE = ‘listing2out.html’; This file must reside in the $TEMPLATE_DIR directory. The code then sets $name variable to the ‘name’ value found from an HTTP GET or POST request: $name = (! empty($_REQUEST[‘name’])) ? $_REQUEST[‘name’] : null; 8 Part I: Designing PHP Applications 03 549669 ch01.qxd 4/4/03 9:24 AM Page 8 The script creates a template object called $t using the following line: $t = new Template($TEMPLATE_DIR); The Template class is defined in the template.inc file, which comes from the PHPLIB library. The $t template object will be used in the rest of the script to load the HTML template called $OUT_TEMPLATE from $TEMPLATE_DIR, parse it, and display the resulting contents. The HTML template file listing2out.html is shown in Listing 1-3. Notice that in creating the object, the $TEMPLATE_DIR variable is passed as a parameter to the Template constructor. This sets the $t object’s directory to $TEMPLATE_DIR, which is where we are keeping our listing2out.html HTML template. The following line is used to set the $t object to the $OUT_TEMPLATE file. This makes the $t object read the file and internally reference the file as “page”. $t->set_file(“page”, $OUT_TEMPLATE); The following line defines a template block called “mainBlock” as “main” from the “page” template: $t->set_block(“page”, “mainBlock” , “main”); A block is a section of template contents that is defined using a pair of HTML com- ments, like the following: <! BEGIN block_name > HTML CONTENTS GOES HERE <! END block_name > A block is like a marker that allows the template object to know how to manip- ulate a section of an HTML template. For example, Listing 1-3 shows that we have defined a block called mainBlock that covers the entire HTML template. Listing 1-3: The HTML Template (listing2out.html) for Listing 1-2 Script <! BEGIN mainBlock > <html> <head><title>Bad Script</title></head> <body> <table border=1> Continued Chapter 1: Features of Practical PHP Applications 9 03 549669 ch01.qxd 4/4/03 9:24 AM Page 9 Listing 1-3 (Continued) <tr> <td> Your name is </td> <td> {NAME} </td> </tr> </table> </body> </html> <! END mainBlock > You can define many blocks; blocks can be nested as well. For example: <! BEGIN block_name1 > HTML CONTENTS GOES HERE <! BEGIN block_name2 > HTML CONTENTS GOES HERE <! END block_name2 > <! END block_name1 > block_name1 is the block that has block_name2 as a nested block. When defin- ing nested blocks, you have to use set_block() method carefully. For example: $t->set_block(“page”, “mainBlock” , “main”); $t->set_block(“main”, “rowBlock” , “rows”); The mainBlock is a block in “page” and rowBlock is a block within “main” block. So the HTML template will look like this: <! BEGIN mainBlock > HTML CONTENTS GOES HERE <! BEGIN rowBlock > HTML CONTENTS GOES HERE <! END rowBlock > <! END mainBlock > 10 Part I: Designing PHP Applications 03 549669 ch01.qxd 4/4/03 9:24 AM Page 10 . 1-2: A PHP Script with External User Interface < ?php // Enable all error reporting error_reporting(E_ALL); // Set PHPLIB path $PHPLIB_DIR = $_SERVER[‘DOCUMENT_ROOT’] . ‘/phplib’; // Add PHPLIB. ‘:’ . $PHPLIB_DIR . ‘:’ . ini_get(‘include_path’)); It adds the $PHPLIB_DIR path to PHP s include_path setting, which enables PHP to find files in PHPLIB. Notice that we have set the $PHPLIB_DIR. line: $PHPLIB_DIR = $_SERVER[‘DOCUMENT_ROOT’] . ‘/phplib’; The first line of the script sets a variable called $PHPLIB_DIR to a path where PHPLIB library files are stored. The path is set to PHPLIB

Secure PHP Development- P8 ppsx

Thông tin tài liệu

Từ khóa liên quan

Mục lục

Secure PHP Development

Front Matter

Preface

Is This Book for You?

How This Book Is Organized

Tell Us What You Think

Acknowledgments

Contents at a Glance

Contents

Part I

Chapter 1: Features of Practical PHP Applications

Features of a Practical PHP Application

Employing the Features in Applications

Summary

Chapter 2: Understanding and Avoiding Security Risks

Identifying the Sources of Risk

Minimizing User-Input Risks

Not Revealing Sensitive Information

Summary

Chapter 3: PHP Best Practices

Best Practices for Naming Variables and Functions

Best Practices for Function/Method

Best Practices for Database

Best Practices for User Interface

Best Practices for Documentation

Best Practices for Web Security

Best Practices for Source Configuration Management

Tài liệu cùng người dùng

Tài liệu liên quan