Secure PHP Development- P104 ppt

delSurvey() This method is called when the run() method is passed $cmd=’delete’ from the user interface. This method uses the deleteSurvey() method of a Survey object to delete the chosen survey (indicated by $survey_id, which is also passed from user interface). saveSurvey() This method saves a new survey with the data given from the survey add interface. It uses the addSurvey() method of a Survey object to perform the actual add sur- vey operation. The method displays a status message based on the success or failure of the add operation. displayMenu() This method displays a user interface. It can display either the survey management menu interface or the survey add interface. When this method is called from the run() method, it displays the survey menu interface ($SURVEY_MENU_TEMPLATE) and when it is called from the create SurveyDriver() it displays the survey add interface ($SURVEY_ADD_TEMPLATE). authorize() This method is responsible for authorizing the user to run the application. In this version, this method always returns TRUE. If you want to implement a user-level access control for the survey management application, you’ll have to change the current implementation of the authorize() method. For example, if you want to allow only a known group of users to administer surveys, you can store their user ID in a new table within the survey database and perform a query to see if the cur- rent user is a member of such a group. Developing Survey List Manager This application is responsible for managing the survey list. It performs the follow- ing tasks: ◆ Allows the user to add a new list from a CSV file. The user uploads a CSV file via the Web interface and assigns it a list name. ◆ Allows the user to delete an existing list. ◆ The ch14/apps/survey_list_mngr.php file in the CDROM is an imple- mentation of the Survey List Manager application. This application creates an instance of the PHPApplication class and uses the following methods. run() The run method performs the usual checks for authenticated and authorized users and then uses the global $cmd variable to select either the addDriver() or the delList() method. The value of the $cmd is set in the user interface displayed by 486 Part III: Developing E-mail Solutions 18 549669 ch14.qxd 4/4/03 9:26 AM Page 486 the Survey Manager application. If the $cmd variable is set to upload or empty the addDriver() method is called to add a new list. If the $cmd variable is set to any- thing else, the delList() method is called to delete a list. addDriver() This method uses a global variable called $step to determine which phase of the add list process the user is currently at and selects the next step in the process. For example, if the $step variable is empty, the first step in the add list process is assumed and the displayAddListMenu() method is called to display the add list interface. If the $step value is anything but empty, the addList() method is called to add the list in the database. authorize() See the authorize() method in the “Developing Survey Manager” section in this chapter for details. displayAddListMenu() This method displays the add list interface. The interface HTML file name is retrieved from the survey.conf file using the $SURVEY_ADD_LIST_TEMPLATE variable. The current time stamp is embedded in the add list interface as a hidden field called today to ensure that the user cannot enter the same list multi- ple times. Because there is no accidental way for the user to generate the same time stamp in submitting multiple lists, this field serves as the unique flag associated with the list in the database. delList() This method is used to delete a chosen list. The chosen list is identified using a global variable called $list_id, which is passed to the application via the user interface as part of the request. The actual delete operation is implemented using the deleteList() method found in the SurveyList object. The delList() method displays a success or failure status message based on the status of the delete operation. addList() This method adds a list, for which data has been collected via the displayAddList Menu() method. This method performs the following tasks: ◆ It first checks to see if the upload has been successful and if the list name is given. If any of these checks fails, the method returns an error message. Chapter 14: E-mail Survey System 487 18 549669 ch14.qxd 4/4/03 9:26 AM Page 487 ◆ It then copies the uploaded file in the list upload directory pointed by the $UPLOAD_DIR variable found in survey.conf file. ◆ Next it creates a SurveyList object and uses the addNewSurveyList() method to add all records in the uploaded CSV file in the new list. ◆ Finally, it displays a status message stating the success or failure of the list upload. Developing Survey Form Manager This application is responsible for managing survey forms. It allows the user to add or delete survey forms. The following methods are implemented in this application, which can be found in ch14/apps/survey_form_mngr.php file in the CDROM. run() The run method performs the usual checks for authenticated and authorized users and then uses the global $cmd variable to select either the addDriver() or the delForm() method. The value of the $cmd is set in the user interface displayed by the Survey Manager application. If the $cmd variable is set to anything other than delete or empty, then the addDriver() method is called to add a new survey form. Otherwise, the delForm() method is called to delete an existing survey form. addDriver() Using a global variable $step, which is set in the user interface, this method con- trols the add survey form process. When the $step variable is empty, the displayAddFormMenu() method is called to display the initial add form interface, which collects the form data. The next time the $step variable is set to 2 in the initial form data entry inter- face displayed by displayAddFormMenu(), the addForm() method is called. Finally, the addDriver() method calls the addLabels() method to collect data about the question labels in Step 3. authorize() See the authorize() method in the “Developing Survey Manager” section for details. displayAddFormMenu() This method displays the add form interface. The interface HTML file name is retrieved from the survey.conf file using the $SURVEY_ADD_FORM_TEMPLATE variable. addForm() This method adds the uploaded form to the survey system using the following steps: 488 Part III: Developing E-mail Solutions 18 549669 ch14.qxd 4/4/03 9:26 AM Page 488 ◆ Checks to see if the user has entered the required subject ($subject) and from address ($from) fields. ◆ Checks to see if the form is uploaded or the form name ($formname) is empty. ◆ Checks to see if the user has entered the number of questions ($num_fields) data. ◆ If all of the preceding checks passes, the uploaded file is copied into the forms directory from the $UPLOAD_DIR (set in survey.conf) and renamed with the .ihtml extension. ◆ A SurveyForm object is created and its addNewSurveyForm() method is called to create the form data in the database. ◆ Next, the addForm() method calls the takeFormLabels() method to dis- play the label entry page for each questions unless the survey form could not be added to the database. In case of insert failure, a status message is displayed to notify the user. takeFormLabels() This method displays the interface to collect the question labels. It shows text entry boxes per question so that the user can define question labels that are needed to display the survey report. addLabels() This method adds the question labels entered in the interface displayed by the takeFormLabels() method. The labels are added using the addLabel() method of the SurveyForm object. A status message is displayed to notify the status of the label addition in the database. delForm() This method deletes a survey form from the database. The form ID is selected from the interface shown by the Survey Manager interface. The actual delete operation is implemented using the SurveyForm object’s deleteForm() method. Developing Survey Execution Manager This application executes a survey. Because this execution of each survey is done via the Web, it’s important that this application doesn’t run continuously until the survey finishes. Because web browsers can mistake the long time it takes to process Chapter 14: E-mail Survey System 489 18 549669 ch14.qxd 4/4/03 9:26 AM Page 489 large campaigns as a timeout, I’ve implemented this method such that it will exe- cute a set of records in the given campaign and then create an automatic refresh using meta tags in HTML interface to call itself back after a configurable period of time. This allows the application to continue with small interruptions and also allows it to report the status of the campaign using a status message after each chunk of records has been processed for e-mail delivery. Therefore, the base algorithm of this method can be written in the following pseudo code: Get Last Record Executed If No Last Record then BEGIN Set LastRecord = 0 END Get a Chunk of Records > Last Record Ordered by Record ID (SUID) AND Limit By Maxmimum Records Per Run Get Message Template For Each Record in Current Record List BEGIN Process for Mail using a Copy of the Message Template Send Mail END Set LastRecord in Database to Current Last Record Set Refresh Meta Tag Terminate The ch14/apps/survey_exec_mngr.php file in the CDROM implements this application. This application has the following methods. run() The run method performs the usual checks for authenticated and authorized users and then calls the executeSurvey() method to run the survey. executeSurvey() This method executes the chosen campaign. It works as follows: 490 Part III: Developing E-mail Solutions 18 549669 ch14.qxd 4/4/03 9:26 AM Page 490 . list. ◆ The ch14/apps/survey_list_mngr .php file in the CDROM is an imple- mentation of the Survey List Manager application. This application creates an instance of the PHPApplication class and uses the. following methods are implemented in this application, which can be found in ch14/apps/survey_form_mngr .php file in the CDROM. run() The run method performs the usual checks for authenticated and authorized. Database to Current Last Record Set Refresh Meta Tag Terminate The ch14/apps/survey_exec_mngr .php file in the CDROM implements this application. This application has the following methods. run() The