Secure PHP Development- P48 pdf

TABLE 7-1 INTRANET DATABASE TABLES (Continued) Table Description MSG_VIEWER Holds the message viewer data, the message number ( MSG_ID), and the viewer ID (VIEWER_ID). It relates which message should be viewed by which user. THEME Holds information about the available intranet themes that can be used by the user. It contains the theme number ( THEME_ID) and the name of the theme (THEME_NAME). ACTIVITY Holds information about the user login/logout activities, discussed in Chapter 5. It contains the user ID ( USER_ID), action type ( ACTION_TYPE), and action timestamp ( ACTION_TS). USER_DETAILS This table contains detailed user information. This table holds the user ID ( USER_ID), first name (FIRST), last name ( LAST), address line #1 (ADDRESS1), address line #2 ( ADDRESS2), city (CITY), state (STATE), zip code ( ZIPCODE), country (COUNTRY), phone number (PHONE), and start date of the user in the intranet ( START_DATE). USER_PREFERENCE Contains the user preference information: the user ID ( USER_ID), preference ID (PREFERENCE_ID), and value (VALUE). intranet.mysql is an implementation of the intranet database in MySQL. It’s included on this book’s CD-ROM (CDROM/ch07/sql/intranet.mysql). To use this database for these applications, create a database called INTRANET in your database server and run the following command: mysql -u root -p -D INTRANET < INTRANET.sql Make sure that you change the user name (root) to whatever is appropriate for your MySQL database system. The INTRANET database must be set up before you start designing the PHP classes, which are needed to implement the intranet applications. 206 Part II: Developing Intranet Solutions 10 549669 ch07.qxd 4/4/03 9:25 AM Page 206 Designing and Implementing the Intranet Classes Three new classes are needed to implement the intranet system: Message, ActivityAnalyzer, and IntranetUser. Figure 7-2 shows the system design that uses these classes. Figure 7-2: Intranet system diagram. In the preceding design, you can see that central login/logout applications are used to access user home application. The user home application displays links to other intranet applications and allows users to create intranet messages. The home application and login/logout activity applications use User object, Message object, and Activity Analyzer objects to perform their operations. Notice also that all of the intranet applications are based on the PHP Application Framework that we developed earlier in the book. The following sections describe these classes. Message class The Message class is used to manipulate each message. It allows an application to create and delete messages. The ch07/home/class/class.Message.php file in the CD-ROM is an implementation of the Message class. Central Login/Logout Messages Messages User Home Interface Login/Logout Activity Intranet User Object (deals with user info, preferences) class.IntranetUser.php class.Message.php class.ActivityAnalyzer.php Activity Analyzer Object (deals with activity reporting) Message Object (deals with messages) PHP Application Framework (Provides application, database abstraction, themes, templates, error handling objects) Chapter 7: Intranet System 207 10 549669 ch07.qxd 4/4/03 9:25 AM Page 207 This class implements the following methods: ◆ Message(): This is the constructor method. It performs the following functions: ■ Sets an object variable named dbi to point to the class.DBI.php- provided object, which is passed to the constructor by an application. The dbi object variable holds the DBI object, which is used to commu- nicate with the backend database. ■ Sets an object variable named msg_tbl to $MESSAGE_TBL, which is loaded from the configuration file (home.conf). The $MESSAGE_TBL holds the name of the MESSAGE table. ■ Sets an object variable named msg_track_tbl to $MSG_TRACK_TBL, which is loaded from the home.conf file. The $MSG_TRACK_TBL holds the name of the message tracking table. ■ Sets an object variable named msg_view_tbl to $MSG_VIEWER_TBL, which is loaded from the home.conf file. The $MSG_VIEWER_TBL holds the name of the message viewer table. ■ Sets an object variable called MSG_ID to the given message number (if any) by calling setMessageID(). ■ Sets an object variable called fields to field names of the MESSAGE table. The fields variable is an associative array, which contains both field names and field types in a key = value format. ◆ loadMessageInfo(): This method loads all the message attributes, such as message number, message title, message contents, message publishing date, author ID, message type, and flag for a given message. Here’s how it works: ■ First, the given message ID ($msg_id) is set as the current Message object’s message ID using setMessageID(). ■ A comma-separated list of MESSAGE table field names are created in the $fieldStr variable using the $this->fields value, which is set in the constructor. ■ A statement to select all the message fields for the given message ID is created in $stmt. ■ Using the DBI object ($this->dbi), the $stmt statement is run via $this->dbi->query() in DBI object. The result of the query is stored in the $result variable. 208 Part II: Developing Intranet Solutions 10 549669 ch07.qxd 4/4/03 9:25 AM Page 208 ■ If more than zero rows are in the $result object, each row is fetched in the $row variable. ■ For each message field of type text, the data is stripped for embedded slash characters, which are used to escape quotation marks and slashes in the value of the field. ■ Each message field data is stored as an object variable using the $this->$fieldname runtime variable. ◆ getMessages(): This method returns all messages for a given user where messages have been published on or earlier than a given timestamp or today. It works as follows: ■ A variable called $fields is assigned a comma-separated list of mes- sage fields stored in $this->fields. ■ If the method is called without a date ($lastDate), the $lastDate is set to the current timestamp. ■ An SQL statement is created in $stmt, which queries the MESSAGE table for all messages that have been published on or earlier than the $lastDate. The returned rows are ordered using message type (MSG_TYPE) and message timestamp (MSG_DATE) in descending order. ■ The query is performed using the $this->dbi->query() method of the DBI object embedded in $this->dbi. The result is stored in $result. ■ If no rows are returned in the $result object, the method returns null. If there are matching rows, each row is stored in the $row object. ■ For each row, a SQL statement is created in $stmt, which queries the message tracking table ($this->msg_track_tbl) for messages that have the same ID as the row’s message ID ($row->MSG_ID) and the same user ID as the current user ID. The purpose of this query is to find out whether the current message in the row has already been tracked (that is, viewed by the current user). The statement is executed and the result is stored in the $finResult object. ■ If no row is returned for the statement, the current message ($row- >MSG_ID ) has not been tracked (that is, viewed) by the current user and, therefore, it ($row) is pushed into an array called $retArr[]. ■ The $retArr[] array is returned after all rows in the first result set pointed by the $result object are checked. The resulting array, $retArr[] contains a list of message rows that the current user has not viewed yet. Chapter 7: Intranet System 209 10 549669 ch07.qxd 4/4/03 9:25 AM Page 209 210 Part II: Developing Intranet Solutions ◆ getAllMessages(): This method returns all messages in the MESSAGE table. It works as follows: ■ A variable called $fields is assigned a comma-separated list of MES- SAGE table fields, which are stored in $this->fields. ■ A statement, $stmt, is created to select all data from the MESSAGE table in message type and date order. ■ The query is performed using the $this->dbi object’s query() method, and the result set is stored in $result object. If no message is found, the method returns null. ■ On the other hand, if rows are in the $result object, an associative array called $retArr is populated using message ID (MSG_ID) as the key and $row, containing each message data, as the value. ■ The $retArr array is returned. ◆ addMessage(): This method adds a new message in the MESSAGE table. The method is called with message title ($title), publication date ($date), contents ($msg), flag ($flag), author ID ($auth), and type ($type). It works as follows: ■ A variable called $fields is assigned a comma-separated list of MES- SAGE table fields stored in $this->fields. ■ The given title ($title) and message body ($msg) are escaped for char- acters such as quotation marks and slashes using $this->dbi- >quote(addslashes()) . ■ An SQL statement, $stmt, is created to insert the new message data into the MESSAGE table. ■ The SQL statement is executed using $this->dbi->query() and the result of the query is stored in $result object. ■ If the $result status is not okay, the method returns false to indicate insert failure. Otherwise, another SQL statement, $stmt, is created to query the database to return the newly created message row’s message ID. This is done by setting the WHERE clause of the SELECT statement to AUTHOR_ID = $auth, MSG_TYPE = $type, MSG_DATE = $date, and FLAG = $flag, which uniquely identifies the new message. ■ If the result of the select query does not return a row, the method returns null and, if it does, it returns the MSG_ID of the newly created message. 10 549669 ch07.qxd 4/4/03 9:25 AM Page 210 . info, preferences) class.IntranetUser .php class.Message .php class.ActivityAnalyzer .php Activity Analyzer Object (deals with activity reporting) Message Object (deals with messages) PHP Application Framework (Provides. to perform their operations. Notice also that all of the intranet applications are based on the PHP Application Framework that we developed earlier in the book. The following sections describe. message. It allows an application to create and delete messages. The ch07/home/class/class.Message .php file in the CD-ROM is an implementation of the Message class. Central Login/Logout Messages Messages User