Secure PHP Development- P30 ppt

This configuration file creates a multidimensional array called $ERRORS and sets two error codes to appropriate error messages in U.S. English. If the sample appli- cation is to be used in a different language region, say in Spain, then this file can be modified to create the ES (shorthand for Spanish) language-specific errors by replacing US as ES and also translating the actual error messages. When internationalizing the error messages, the error code such as UNAUTHORIZED_ACCESS should not be translated because that code name is the key to locate the “Unauthorized access” error message. Only the error message should be translated, and the appropriate language identifier needs to be set. The sample application then loads the sample.messages file, which is shown in Listing 4-8. Listing 4-8: sample.messages <?php $MESSAGES[‘US’][‘APP_FAILED’] = “Application Failed.”; $MESSAGES[‘US’][‘DEFAULT_MSG’] = “Hello World”; ?> Like the error message files, this file loads a multidimensional array called $MESSAGES with language support for each message. The sample.conf file also loads the constants.php file, which defines a set of constants needed by the framework classes. The same sample configuration file also loads the framework classes along with a class called class.sampleApp.php, which is shown in Listing 4-9. This class extends the PHPApplication class and overrides the run() and authorize() function. It implements another function called doSomething(), which is specific to itself. We will discuss the details of this class in the next sec- tion. Now let’s look at the rest of the sample.php code. Once the class.sampleApp.php class is loaded, the session is automatically started by the sampleApp object, which extends the PHPApplication object. Next the application creates an instance of the sampleApp object called $thisApp. This is the application object. The application name, version, type, and debugger ON or OFF flag are set when creating this object. 116 Part II: Developing Intranet Solutions 07 549669 ch04.qxd 4/4/03 9:24 AM Page 116 After the $thisApp object has been created, the sample application enables debug message buffering by calling the buffer_debugging() method in class. PHPApplication.php class. It then calls the run() function, which has been overridden in class. sampleApp.php . This is the main function that runs the application. After the application has run, more debugging information is buffered and the debug information is dumped: $thisApp->buffer_debugging(); $thisApp->run(); $thisApp->debug(“Version : “ . $thisApp->get_version()); $thisApp->dump_debuginfo(); Figure 4-6 shows what is displayed when the sample.php application is run after a user has already logged in. Figure 4-6: Output of the sample application with debugging turned on. You have to have the application framework created in this chapter installed on your system and at least one user created to run this application.To learn about how to create a user, see Chapter 5. Chapter 4: Architecture of an Intranet Application 117 07 549669 ch04.qxd 4/4/03 9:24 AM Page 117 Figure 4-7 shows the application with the debug flag turned off. Figure 4-7: Output of the sample application with debugging turned off. Listing 4-9 shows the class.sampleApp.php, which extends the PHPApplication class from our framework. Listing 4-9: class.sampleApp.php <?php class sampleApp extends PHPApplication { function run() { // At this point user is authorized // Start business logic driver $this->debug(“Real application code starts here.”); $this->debug(“Call application specific function here.”); $this->doSomething(); } function authorize($email = null) { return TRUE; } function doSomething() { global $MESSAGES, $DEFAULT_LANGUAGE; 118 Part II: Developing Intranet Solutions 07 549669 ch04.qxd 4/4/03 9:24 AM Page 118 $this->debug(“Started doSomething()”); echo $MESSAGES[$DEFAULT_LANGUAGE][‘DEFAULT_MSG’]; $this->debug(“Finished doSomething()”); } } // Class ?> This sampleApp class has only three functions: run(), authorize(), and doSomething(). The run() function overrides the abstract run() method provided in class.PHPApplication.php and it is automatically called when the application is run. Therefore, sampleApp run() method is needed to application logic in sample.php. In the example, the authorization check always returns TRUE, because this isn’t a real-world application and the run() function calls the doSomething() function, which simply prints a set of debug messages along with a status message. Notice that although the application status message $MESSAGES[$DEFAULT_LANGUAGE] [‘DEFAULT_MSG’] is internationalized, the debug messages are in English. As you can see the application framework makes writing new applications quite easy; development time is greatly reduced, because you can build onto the frame- work instead of starting from scratch every time. Summary In this chapter I have shown you how to develop a complete application framework consisting of a few object-oriented classes. These classes provide a set of facilities for writing applications that use a standard approach to writing PHP applications for both intranet and the Web. The application framework developed in this chapter allows you to develop a new application by simply extending the primary class, PHPApplication class, of the framework. Immediately your application inherits all the benefits of the new framework, which includes a database abstraction, an error handler, and a debug- ging facility. This application framework is used throughout the rest of the book for develop- ing most of the applications discussed in this book. The latest version of this frame- work is always available from http://www.evoknow.com/phpbook/. Chapter 4: Architecture of an Intranet Application 119 07 549669 ch04.qxd 4/4/03 9:24 AM Page 119 07 549669 ch04.qxd 4/4/03 9:24 AM Page 120 . 4-9 shows the class.sampleApp .php, which extends the PHPApplication class from our framework. Listing 4-9: class.sampleApp .php < ?php class sampleApp extends PHPApplication { function run() { //. calling the buffer_debugging() method in class. PHPApplication .php class. It then calls the run() function, which has been overridden in class. sampleApp .php . This is the main function that runs the. look at the rest of the sample .php code. Once the class.sampleApp .php class is loaded, the session is automatically started by the sampleApp object, which extends the PHPApplication object. Next