Secure PHP Development- P94 pdf

Designing and implementing the Form class The Form class is used to manipulate each form. It allows an application to create, modify, and delete a form. The ch13/apps/class/class.Form.php file on the CD-ROM implements this class. This class implements the following methods. Form() This is the constructor method. It works as follows: ◆ First it sets a member variable named dbi to point to the class.DBI.php- provided object, which is passed to the constructor by an application. The dbi member variable holds the DBI object, which is used to communicate with the back-end database. ◆ Then it sets member variables named frm_tbl, submtn_tbl, and sub- scr_tbl to store the names of the form table, submission table, and sub- scription table, respectively. ◆ It also sets member variables named field_arr (to store the form table attributes and their type as an array) and fields (to hold the attributes as a comma-separated string). ◆ Then it calls the setFormID() method to set the Form ID that has been passed as a parameter. setFormID() This method is used to set the form ID as member variable fid. It takes the ID as a parameter and returns it after setting it to the member variable if the ID is not empty. getFormInfo() This method is used to retrieve all the information for a given form. This is how it works: ◆ First it calls the setFormID() method to set the given form ID. ◆ Then it builds a query statement to retrieve all the attribute values of the form and stores the statement $stmt. ◆ Using the DBI object ($this->dbi), the $stmt statement is run via the $this->dbi->query() method in the DBI object. The result of the query is stored in the $result variable. ◆ The method directly returns null when it finds out, using the numRows() method, that the $result object has no rows. ◆ Otherwise, the row is fetched using the fetchRow() method and stored in $row. 436 Part III: Developing E-mail Solutions 17 549669 ch13.qxd 4/4/03 9:26 AM Page 436 ◆ Then the member variable field_arr is looped through to store each col- umn value of the $row object into the $retArr array with the respective field name as the key for each value. The values are formatted using the stripslashes() method before storing them in the array. ◆ Then the $retArr array is returned from this method. getAllForms() This method is used to retrieve all the forms from the database. This is how it works: ◆ First a query statement is prepared and stored in $stmt to retrieve the form number and form name of all the forms. ◆ Using the DBI object ($this->dbi), the $stmt statement is run via the $this->dbi->query() method in the DBI object. The result of the query is stored in the $result variable. ◆ The method directly returns null when it finds out, using the numRows() method, that the $result object has no rows. ◆ Otherwise, each row of the $result object is fetched using the fetchRow() method and $retArr is prepared with all the form IDs and form names. ◆ At the end, the $retArr array is returned. addForm() This method is used to add new forms to the database. It works as follows: ◆ From the given parameter, all the values that are supposed to be of text type in the database are escaped for characters such as quotation marks and slashes using $this->dbi->quote(addslashes()) methods. ◆ Then all the parameter values are taken into a string named $paramValueStr by imploding a comma among them. ◆ A SQL statement, $stmt, is created to insert the new form data into the form table using the member variable fields (contains attribute names) and $paramValueStr. ◆ The SQL statement is executed using the $this->dbi->query() method and the result of the query is stored in the $result object. ◆ If the $result status is not okay, the method returns false. ◆ Otherwise, another query statement is prepared to retrieve the form ID of the newly added form by using the form name, which is a unique field, in the where condition. ◆ The statement is executed as usual and the form ID is returned from the method. Chapter 13: Tell-a-Friend System 437 17 549669 ch13.qxd 4/4/03 9:26 AM Page 437 modifyForm() This method is used to modify forms. This is how it works: ◆ From the given parameter, all the values that are supposed to be of text type in the database are escaped for characters such as quotation marks and slashes using $this->dbi->quote(addslashes()) methods. ◆ Then a string named $keyValue is prepared that contains all the attribute names and values as attr1 = value1, attr2 = value2, . . . format ◆ A SQL statement, $stmt, is created to update the form data using $keyValue. ◆ The SQL statement is executed using the $this->dbi->query() method and the result of the query is stored in the $result object. ◆ The method returns TRUE or FALSE depending on the status of the $result. deleteForm() This method is used to delete a given form. It takes form ID as the parameter and returns TRUE or FALSE depending on the status of the deletion operation. isMaximumSubmitted() This method identifies whether the maximum number of friends allowed has exceeded or not for the given originator according to the form configuration. This is how it works: ◆ First it sets the given form ID using the setFormID() method. ◆ Then the given originator e-mail is formatted using $this->dbi- >quote(addslashes()) methods. ◆ Then a query statement is prepared to retrieve the number of friends sub- mitted by the given originator for the given form. ◆ Then the number of maximum allowed friends is retrieved using the getFormInfo() method. ◆ Then the two numbers are compared to return TRUE when the number of friends submitted is already equal to or greater than the maximum allowed; otherwise, it returns FALSE. addSubmissionData() This method is used to add friend submission data in to the database. It works as follows: ◆ First it sets $field_arr (to store the submission table attributes and their type as an array) and $fields (to hold the attributes as a comma- separated string). 438 Part III: Developing E-mail Solutions 17 549669 ch13.qxd 4/4/03 9:26 AM Page 438 ◆ From the given parameter, all the values that are supposed to be of text type in the database are escaped for characters such as quotation marks and slashes using $this->dbi->quote(addslashes()) methods. ◆ Then all the parameter values are taken into a string named $paramValueStr by imploding comma among them. ◆ A SQL statement, $stmt, is created to insert the new submission data into the submission table using $fields and $paramValueStr. ◆ The SQL statement is executed using the $this->dbi->query() method and the result of the query is stored in $result object. ◆ If the $result status is not okay, the method returns false. ◆ Otherwise, another query statement is prepared to retrieve the friend ID of the newly submitted friend by using the friend e-mail and form ID, which are the unique fields, in the where condition. ◆ The statement is executed as usual and the friend ID is returned from the method. getFriendList() This method returns the list of all friends for a given form. This is how it works: ◆ First it sets the given form ID using the setFormID() method. ◆ Then it prepares a query to retrieve the friend ID and e-mail from the sub- mission table for the given form. ◆ The SQL statement is executed using the $this->dbi->query() method and the result of the query is stored in the $result object. ◆ The method directly returns null when it finds out, using the numRows() method, that the $result object has no rows. ◆ Otherwise, each row of the $result object is fetched using the fetchRow() method and $retArr is prepared with all the friend IDs and e-mails. ◆ At the end the $retArr array is returned. addSubscriptionData() This method is used to add subscription data after a friend decides to subscribe or unsubscribe. It works in the following manner: ◆ First it sets $field_arr (to store the subscription table attributes and their type as an array) and $fields (to hold the attributes as a comma- separated string). Chapter 13: Tell-a-Friend System 439 17 549669 ch13.qxd 4/4/03 9:26 AM Page 439 ◆ From the given parameter, all the values that are supposed to be of text type in the database are escaped for characters such as quotation marks and slashes using $this->dbi->quote(addslashes()) methods. ◆ Then all the parameter values are taken into a string named $paramValueStr by imploding a comma among them. ◆ A SQL statement, $stmt, is created to insert the new subscription data into the submission table using $fields and $paramValueStr. ◆ The SQL statement is executed using the $this->dbi->query() method and the result of the query is stored in the $result object. ◆ The method returns TRUE or FALSE depending on the status of $result. This method is used to determine whether the given friend has already unsub- scribed. It takes the friend’s e-mail as the parameter and checks whether the e-mail is already unsubscribed or not. getNumberOfSubscriber() This method returns the number of friends that have subscribed for a given form. It takes the form ID as a parameter and returns the number of subscribers for that form. getNumberOfUnsubscriber() This method returns the number of friends that have unsubscribed for a given form. It takes the form ID as a parameter and returns the number of unsubscriber for that form. getOriginSubmissions() This method returns the originator information for a given form. This is how it works: ◆ First it sets the form ID using the setFormID() method. ◆ Then it prepares a query statement to retrieve the originator e-mails and number of submission by each of them. ◆ The SQL statement is executed using the $this->dbi->query() method and the result of the query is stored in the $result object. ◆ The method directly returns null when it finds out, using the numRows() method, that the $result object has no rows. ◆ Otherwise, each row of the $result object is fetched using the fetchRow() method and $retArr is prepared with all the originator e-mails and number of submissions by each of them. ◆ At the end, the $retArr array is returned. 440 Part III: Developing E-mail Solutions 17 549669 ch13.qxd 4/4/03 9:26 AM Page 440 . form. It allows an application to create, modify, and delete a form. The ch13/apps/class/class.Form .php file on the CD-ROM implements this class. This class implements the following methods. Form() This. method. It works as follows: ◆ First it sets a member variable named dbi to point to the class.DBI .php- provided object, which is passed to the constructor by an application. The dbi member variable