Secure PHP Development- P22 pptx

// Dump the contents of the DBI object to // see what it contains. echo “<pre>”; print_r($dbi); echo “</pre>”; ?> Here, $dbi is an instance of the DBI object created from class.DBI.php. The constructor method has to be passed a database URL which has the following syntax: database_type://username:password↓tabase_host/database_name The $DB_URL variable was set to create a database URL that pointed to a MySQL database (mysql) named mydb on host called localhost The data- base can be accessed using the root user account and foobar password. The DBI() method sets the DB URL passed to itself as db_url member variable and calls the connect() method to connect to the given data- base. The constructor sets the fetch mode to DB_FETCHMODE_OBJECT, which allows us to fetch database rows as objects. ◆ connect(): By default, the DBI() constructor method calls the connect() function directly to establish the connection, so you don’t need to. con- nect() connects to the database specified in db_url member variable of the object. It sets a member variable dbh to the database handle object created by the DB::connect() method, which is found in the PEAR DB package. connect also sets a member variable called connected to Boolean TRUE or FALSE and returns that value. ◆ disconnect(): The disconnect() function disconnects the DBI object from the database. The terminate() function in PHPApplication class (class. PHPApplication.php ) calls the disconnect() function if the applica- tion is connected to a database. See terminate() function in PHPApplication class for details. ◆ query(): This function performs a SQL query on the connected database. The result of the query is stored in a result object called $result. If the query returns SQL error(s), a member variable called $this->dbi->error is set to the error message and null is returned. 76 Part II: Developing Intranet Solutions 07 549669 ch04.qxd 4/4/03 9:24 AM Page 76 If the query is successful, it returns the result object. The result object can be used to fetch rows. For example, the test_query.php script tries to fetch data from a table called PROD_TBL using a database URL such as mysql://root:foobar@localhost/products. <?php // Turn on all error reporting error_reporting(E_ALL); // If you have installed PEAR packages in a different // directory than %DocumentRoot%/pear change the // setting below. $PEAR_DIR = $_SERVER[‘DOCUMENT_ROOT’] . ‘/pear’ ; // If you have installed PHPLIB in a different // directory than %DocumentRoot%/phplib, change // the setting below. $PHPLIB_DIR = $_SERVER[‘DOCUMENT_ROOT’] . ‘/phplib’; // If you have installed framework directory in // a different directory than // %DocumentRoot%/framework, change the setting below. $APP_FRAMEWORK_DIR=$_SERVER[‘DOCUMENT_ROOT’] . ‘/framework’; // Create a path consisting of the PEAR, // PHPLIB and our application framework // path ($APP_FRAMEWORK_DIR) $PATH = $PEAR_DIR . ‘:’ . $PHPLIB_DIR . ‘:’ . $APP_FRAMEWORK_DIR; // Insert the path in the PHP include_path so that PHP // looks for our PEAR, PHPLIB and application framework // classes in these directories ini_set( ‘include_path’, ‘:’ . $PATH . ‘:’ . ini_get(‘include_path’)); // Now load the DB.php class from PEAR require_once ‘DB.php’; // Now load our DBI class from application framework require_once(‘class.DBI.php’); Chapter 4: Architecture of an Intranet Application 77 07 549669 ch04.qxd 4/4/03 9:24 AM Page 77 // Setup the database URL $DB_URL = ‘mysql://root:foobar@localhost/products’; // Create a DBI object that connects to the // database URL $dbi = new DBI($DB_URL); if (! $dbi->isConnected()) { echo “Connection failed for $DB_URL<br>”; exit; } // Create a SQL statement to fetch data $statement = ‘SELECT ID, NAME FROM PROD_TBL’; // Execute the statement using DBI query method $result = $dbi->query($statement); // If the result of query is NULL then show // database error message if ($result == NULL) { echo “Database error:” . $dbi->getError() . “\n”; // Else check if there are no data available or not } else if (! $result->numRows()){ echo “No rows found.”; // Now data is available so fetch and print data } else { echo “<pre>ID\tNAME<br>”; while ($row = $result->fetchRow()) { echo $row->ID, “\t”, $row->NAME, “<br>”; } echo “</pre>”; } ?> 78 Part II: Developing Intranet Solutions 07 549669 ch04.qxd 4/4/03 9:24 AM Page 78 The SQL statement SELECT ID, NAME FROM PROD_TBL is stored in $statement variable and passed to the DBI::query() method. The result is tested first for null. If the result is null, the database error is printed using the DBI::getError() method. If there are no database errors, the next check is made to see if there are any rows using the numRow() method from the $result object. If there are no rows, an appropriate message is printed. If there are data in the returned $result object, the result is printed in a loop using the fetchRow() method. The row data is fetched in $row object. The $row->DATA_FIELD method is used to get the data for each field. For example, to retrieve the NAME field data, the $row->NAME value is accessed. ◆ quote(): This is a utility function that puts a pair of single quotes around a string to protect the string from being passed without quotation. Here’s an example in which the $name field is single-quoted using $this->dbi- >quote($name) call: <?php // Turn on all error reporting error_reporting(E_ALL); // If you have installed PEAR packages in a different // directory than %DocumentRoot%/pear change the // setting below. $PEAR_DIR = $_SERVER[‘DOCUMENT_ROOT’] . ‘/pear’ ; // If you have installed PHPLIB in a different // directory than %DocumentRoot%/phplib, change // the setting below. $PHPLIB_DIR = $_SERVER[‘DOCUMENT_ROOT’] . ‘/phplib’; // If you have installed framework directory in // a different directory than // %DocumentRoot%/framework, change the setting below. $APP_FRAMEWORK_DIR=$_SERVER[‘DOCUMENT_ROOT’] . ‘/framework’; // Create a path consisting of the PEAR, // PHPLIB and our application framework // path ($APP_FRAMEWORK_DIR) $PATH = $PEAR_DIR . ‘:’ . $PHPLIB_DIR . ‘:’ . $APP_FRAMEWORK_DIR; Chapter 4: Architecture of an Intranet Application 79 07 549669 ch04.qxd 4/4/03 9:24 AM Page 79 // Insert the path in the PHP include_path so that PHP // looks for our PEAR, PHPLIB and application framework // classes in these directories ini_set( ‘include_path’, ‘:’ . $PATH . ‘:’ . ini_get(‘include_path’)); // Now load the DB.php class from PEAR require_once ‘DB.php’; // Now load our DBI class from application framework require_once(‘class.DBI.php’); // Setup the database URL $DB_URL = ‘mysql://root:foobar@localhost/foobar’; // Create a DBI object that connects to the // database URL $dbi = new DBI($DB_URL); if (! $dbi->isConnected()) { echo “Connection failed for $DB_URL<br>”; exit; } $id = 100; $name = “Joe Gunchy”; $name = $dbi->quote($name); $statement = “INSERT INTO PROD_TBL (ID,NAME) “ . “VALUES($id, $name)”; $result = $dbi->query($statement); if ($result == NULL) { echo “Database error:” . $dbi->getError() . “<BR>\n”; } else { echo “Added $name in database.<BR>\n”; } ?> 80 Part II: Developing Intranet Solutions 07 549669 ch04.qxd 4/4/03 9:24 AM Page 80 . terminate() function in PHPApplication class (class. PHPApplication .php ) calls the disconnect() function if the applica- tion is connected to a database. See terminate() function in PHPApplication class. ; // If you have installed PHPLIB in a different // directory than %DocumentRoot%/phplib, change // the setting below. $PHPLIB_DIR = $_SERVER[‘DOCUMENT_ROOT’] . ‘/phplib’; // If you have installed. PEAR, // PHPLIB and our application framework // path ($APP_FRAMEWORK_DIR) $PATH = $PEAR_DIR . ‘:’ . $PHPLIB_DIR . ‘:’ . $APP_FRAMEWORK_DIR; // Insert the path in the PHP include_path so that PHP //