Secure PHP Development- P23 pdf

◆ apiVersion(): This is a utility method that returns the version number of the DBI object. The DBI abstraction class enables you to connect to any database and perform any SQL query, such as SELECT, INSERT, UPDATE, DELETE, and so forth. Because it hides the database vendor-specific details from your application, porting to other databases become a much easier task. Now let’s look at how we can develop an error handler class. Creating an Error Handler Class Every application needs to display error messages. In the old days, error messages were usually hard-coded in the executable programs and were very difficult to understand, let alone modify! Now, in the days of Web interface, we should not resort to the old way of show- ing hard-coded error messaging because the application can be used in so many parts of the world. Error messages written in English are just not friendly enough for the world in this Internet age. So applications that have internationalizable error message support will have broader reach. Listing 4-2 shows an error message handler, which loads and displays error mes- sages in the application’s default language. Because an application’s default lan- guage can be changed in the configuration file, it becomes very easy to display error messages in different languages. Listing 4-2: class.ErrorHandler.php <?php /* * CVS ID: $Id$ */ /* * Centalizes all error messages. * Supports internationalization of error messages. * * @author EVOKNOW, Inc. <php@evoknow.com> * @access public */ define(‘ERROR_HANDLER_LOADED’, TRUE); class ErrorHandler { function ErrorHandler($params = null) { global $DEFAULT_LANGUAGE; $this->language = $DEFAULT_LANGUAGE; Continued Chapter 4: Architecture of an Intranet Application 81 07 549669 ch04.qxd 4/4/03 9:24 AM Page 81 Listing 4-2 (Continued) $this->caller_class = (!empty($params[‘caller’])) ? $params[‘caller’] : null; $this->error_message = array(); //error_reporting(E_ERROR | E_WARNING | E_NOTICE); $this->load_error_code(); } function alert($code = null, $flag = null) { $msg = $this->get_error_message($code); if (!strlen($msg)) { $msg = $code; } if ($flag == null) { echo “<script>alert(‘$msg’);history.go(-1);</script>”; } else if (!strcmp($flag,’close’)){ echo “<script>alert(‘$msg’);window.close();</script>”; } else { echo “<script>alert(‘$msg’);</script>”; } } function get_error_message($code = null) { if (isset($code)) { if (is_array($code)) { $out = array(); foreach ($code as $entry) { array_push($out, $this->error_message[$entry]); } return $out; } else { return (! empty($this->error_message[$code])) ? $this- >error_message[$code] : null; } } else { return (! empty($this->error_message[‘MISSING’])) ? $this- >error_message[‘MISSING’] : null; } 82 Part II: Developing Intranet Solutions 07 549669 ch04.qxd 4/4/03 9:24 AM Page 82 } function load_error_code() { global $ERRORS; if (empty($ERRORS[$this->language])) { return FALSE; } while (list($key, $value) = each ($ERRORS[$this->language])) { $this->error_message[$key] = $value; } return TRUE; } } ?> The class.ErrorHandler.php class assumes that the application has all its error messages defined in an application-specific configuration file and all error mes- sages are stored in a multidimensional array called $ERRORS. For example: <?php // US English $ERRORS[‘US’][‘SAMPLE_ERR_CODE’] = “This is an error message.”; // Spanish $ERRORS[‘ES’][‘SAMPLE_ERR_CODE’] = “Esto es un mensaje de error.”; //German $ERRORS[‘DE’][‘SAMPLE_ERR_CODE’] = “Dieses ist eine Fehlermeldung.”; ?> If this code is stored in appname.errors file and loaded by an application using require_once(‘appname.errors’), then the ErrorHandler class can print the SAMPLE_ERR_CODE error message in any of the three languages, depending on the default language settings. You can translate your error messages in multiple languages using Language Translation Tools provided by Google at http://translate. google.com/translate_t . Be aware that not all automatic translations are perfect. Chapter 4: Architecture of an Intranet Application 83 07 549669 ch04.qxd 4/4/03 9:24 AM Page 83 You can set an application’s default language using the $DEFAULT_LANGUAGE variable in a configuration file for your application. For example, <?php // appname.conf // Default language for $DEFAULT_LANGUAGE = ‘US’; ?> If this configuration is loaded by an application using the ErrorHandler class, all error messages will be displayed in U.S. English. ErrorHandler() is the constructor function for the class.ErrorHandler.php. This function sets the default language of the error handler to what is set in the application configuration as global $DEFAULT_LANGUAGE variable. This method can be passed an associative array as a parameter. If the parameter array has a key=value pair called caller=class_name, then it sets the member variable called caller_class to the value. The constructor also initializes a member array called error_message and loads the error code for the default language by calling the load_error_code() method. The error handler class ErrorHandler is automatically invoked by the PHPApplication class so you don’t need to create an error handler manually in your application code. Now let’s look at the other functions available in ErrorHandler class. ◆ alert(): This function displays an internationalized error message using a simple JavaScript pop-up alert dialog box. It is called with the error code. The get_error_message() method is used to retrieve the appropri- ate error message in default application language from the application’s error configuration file. ◆ get_error_message(): This function retrieves the error messages for given error code. If an array of error codes is supplied as parameter, the function returns an array of error messages. If no error code is supplied, the function returns a default error message using the MISSING error code. ◆ load_error_code(): This function loads the application’s error code in from the global $ERRORS array to its own member array variable error_message. This function is called from the constructor method and does not need to be called manually, unless you want to reload error mes- sages from $ERRORS. 84 Part II: Developing Intranet Solutions 07 549669 ch04.qxd 4/4/03 9:24 AM Page 84 Creating a Built-In Debugger Class When developing applications, each developer uses at least some form of debug- ging. Although PHP-supported Integrated Development Environments (IDEs) are becoming available, they’re still not the primary development tools for most PHP developers, who are still using echo, print, and printf functions to display debugging information during development. The debugging class called class.Debugger.php is a bit more advanced than the standard echo, print, and printf messages. It provides a set of facilities that include ◆ Color-coding debug messages ◆ Automatically printing debug line numbers ◆ Optionally buffering debug messages ◆ Prefixing debug messages with a given tag to make it easy to identify messages in a large application Listing 4-3 shows the debugger class that is part of our application framework. It can be used to perform basis application debugging. Listing 4-3: class.Debugger.php <?php /* * CVS ID: $Id$ */ define(‘DEBUGGER_LOADED’, TRUE); class Debugger { var $myTextColor = ‘red’; function Debugger($params = null) { // Debugger constructor method $this->color = $params[‘color’]; $this->prefix = $params[‘prefix’]; $this->line = 0; $this->buffer_str = null; $this->buffer = $params[‘buffer’]; $this->banner_printed = FALSE; Continued Chapter 4: Architecture of an Intranet Application 85 07 549669 ch04.qxd 4/4/03 9:24 AM Page 85 . 4-2: class.ErrorHandler .php < ?php /* * CVS ID: $Id$ */ /* * Centalizes all error messages. * Supports internationalization of error messages. * * @author EVOKNOW, Inc. < ;php@ evoknow.com> *. form of debug- ging. Although PHP- supported Integrated Development Environments (IDEs) are becoming available, they’re still not the primary development tools for most PHP developers, who are still. framework. It can be used to perform basis application debugging. Listing 4-3: class.Debugger .php < ?php /* * CVS ID: $Id$ */ define(‘DEBUGGER_LOADED’, TRUE); class Debugger { var $myTextColor