Secure PHP Development- P144 ppt

◆ Create a database table in your WEBFORMS database using the name given (FORM_TABLE) in askform.conf. This table should have all the fields in your Web form and the ID and SUBMIT_TS fields. The following CREATE TABLE statement is used for our sample ask.php form: # # Table structure for table `ASK_TBL` # CREATE TABLE ASK_TBL ( id bigint(20) NOT NULL auto_increment, fname varchar(30) NOT NULL default ‘’, lname varchar(30) NOT NULL default ‘’, company varchar(30) NOT NULL default ‘’, email varchar(70) NOT NULL default ‘’, url varchar(127) NOT NULL default ‘’, about tinytext NOT NULL, subject tinytext NOT NULL, details text NOT NULL, SUBMIT_TS bigint(20) NOT NULL default ‘0’, PRIMARY KEY (id,email) ) TYPE=MyISAM ◆ Once you have created the appropriate database table, you are ready to submit requests. Make sure that you configure the rest of askform.conf to match your requirements. For example, to control access to your Web form via an IP address, you can use the ACL_ALLOW_FROM and ACL_DENY_FROM lists. The $FORM_FIELDS_ARRAY should be used to define the fields that you have in your Web form (exactly as they appear in your Web form), whether they are required or not; and the type of validation and clean-up operations you want to perform on them before submission is stored in the database. For example, the askform.conf shown in Listing 19-2 shows the following: ‘fname’ => ‘1:text:size=3-30:name:trim|lower|ucwords’, Here, the Web form has a field called fname. The above configuration line states that this field is required and can be of size 3 to 30 characters long. The field is to be validated using the validate_name() method. If the field is valid, the value of the field is to be cleaned up using trim, lower, and ucwords functions. This means that a valid fname field value will be trimmed for whitespaces and lowercases and, finally, each word of the value will be uppercased before storing in the WEBFORMS database. Similarly, the URL field (url) is defined using the following: ‘url’ => ‘0:text:size=3-60:url:trim|lower’, 686 Part V: Internet Applications 25 549669 ch19.qxd 4/4/03 9:27 AM Page 686 However, it is not required (0), and it is considered text data; it is consid- ered to be of size 3 to 60 and validated using validate_url() method. Once validated, the field data is trimmed and lowercased before being stored in a database. As you can see, each field is defined in terms of required/not required, type (text, number, name, e-mail, and so on), size requirements, validation method, and cleanup functions. ◆ If you have a file upload field, make sure that you create the UPLOAD_FILE_DIR directory (/webforms/apps/site_forms/askform/ uploadfile ) and make it writable by the Web server user. You also have to define $UPLOAD_FILE_FIELDS_ARRAY to list the Web form fields that are file names. For example, the sample ask form configuration shows a field called attachment as the file upload field, as follows: ‘attachment’ => ‘0:size=0-60KB’, The uploaded file is not required (0) and cannot exceed size 60 kilobytes. ◆ If you do not want to use the default templates used for the thank-you response and inbound (to whomever you wish) and outbound mail (to the submitter), you can store your own templates per form in the FRM_ TEMPLATE_DIR directory. Make sure that this directory is stored in /webforms/apps/site_forms/askform/templates for the current example. ◆ If you want to send an e-mail message to the submitter upon submission, set SEND_OUTBOUND_MAIL to 1 as done in askform.conf. Set EMAIL_FIELD to point to the e-mail field in your Web form. The OUTBOUND_MAIL_ TEMPLATE template is used for mailing the message. You should customize this message as needed. The OUTBOUND_MAIL_SUBJECT defines the subject line used in the message. Note that if you do not supply a custom mail tem- plate, the default mail template from /webforms/apps/templates is used. ◆ To receive an e-mail for each successful form submission, set SEND_ INBOUND_MAIL to 1 as done in askform.conf. The INBOUND_MAIL_ TEMPLATE template is used for mailing this message to you. You should customize this message as needed. The INBOUND_MAIL_SUBJECT defines the subject line used in the message. Note that if you do not supply a custom mail template, the default mail template from /webforms/apps/ templates is used. The users who can receive inbound messages are listed in INBOUND_MAIL_TO. ◆ The thank-you template is specified using SHOW_THANKYOU_TEMPLATE. If you do not have a Web form–specific thank-you template in the form’s own template directory, the default template is used. Chapter 19: Web Forms Manager 687 25 549669 ch19.qxd 4/4/03 9:27 AM Page 687 ◆ Upon successful completion of a Web form, if you want to automatically redirect users to an URL other than the one from which they came, you can set AUTO_REDIRECT to 1 and specify a value for AUTO_REDIRECT_URL. Note that if your Web form is a PHP script, you can redirect users to the URL from which they clicked the Web form by incorporating the following lines in the Web form: <input type=hidden name=”return_url” value=”<?php echo $_SERVER[‘HTTP_REFERER’]; ?>”> ◆ Finally, define the error messages that you want to show when a required field is missing. This is done using the following lines in askform.conf: $ERRORS[‘US’][‘ERROR_FNAME’] = “First name - missing.”; $ERRORS[‘US’][‘ERROR_LNAME’] = “Last name - missing.”; $ERRORS[‘US’][‘ERROR_EMAIL’] = “Email address - missing.”; $ERRORS[‘US’][‘ERROR_COMPANY’] = “Company name - missing.”; $ERRORS[‘US’][‘ERROR_SUBJECT’] = “Subject of your question - missing.”; $ERRORS[‘US’][‘ERROR_DETAILS’] = “Details of your question - missing.”; Here, when the fname field is required but missing, the $ERRORS[ERROR_ FNAME] value is displayed using a JavaScript alert window. You can customize these messages as you see fit. Now you are ready to test the ask.php form. Listing 19-2: askform.conf <?php // Name of the Web form define(FORM_NAME, ‘Ask Form’); // Name of the table used define(FORM_TABLE, ‘ASK_TBL’); define(‘ACL_ALLOW_FROM’, ‘’); define(‘ACL_DENY_FROM’, ‘192.168.0.11’); define(‘FORM_LOG_FILE’, $_SERVER[‘DOCUMENT_ROOT’] . ‘/webforms/askform.log’); $FORM_FIELDS_ARRAY = array( ‘fname’ => ‘1:text:size=3-30:name:trim|lower|ucwords’, 688 Part V: Internet Applications 25 549669 ch19.qxd 4/4/03 9:27 AM Page 688 ‘lname’ => ‘1:text:size=3-30:name:trim|lower|ucwords’, ‘company’ => ‘1:text:size=2-60:org_name:trim|lower|ucwords’, ‘email’ => ‘1:text:size=5-60:email:trim|lower’, ‘url’ => ‘0:text:size=3-60:url:trim|lower’, ‘about’ => ‘0:text:size=3-60:any_string:trim|lower|ucwords’, ‘subject’ => ‘1:text:size=3-60:any_string:trim|lower|ucwords’, ‘details’ => ‘1:text:size=0-20KB:any_string:none’ ); //Do we need to upload file from the form 0 - not, 1 - yes define(UPLOAD_FILE, 0); //directory name for storing file define(UPLOAD_FILE_DIR, ‘site_forms/askform/uploadfile/’); //form relative template directory define(FRM_TEMPLATE_DIR, ‘site_forms/askform/templates/’); $UPLOAD_FILE_FIELDS_ARRAY = array( ‘attachment’ => ‘0:size=0-60KB’, ); // Do we send email to person submitting the form? 1= yes 0 = no define(SEND_OUTBOUND_MAIL, 1); define(OUTBOUND_MAIL_TEMPLATE, ‘outbound_mail.html’); define(OUTBOUND_MAIL_SUBJECT, ‘Thank you’); define(EMAIL_FIELD,’email’); // Do we send email to inbound (company hosting the form) per submission? 1= yes 0 = no define(SEND_INBOUND_MAIL, 1); define(INBOUND_MAIL_TEMPLATE, ‘inbound_mail.html’); define(INBOUND_MAIL_TO, ‘you@yourdomain.com,sales@yourdomain.com’); define(INBOUND_MAIL_SUBJECT, ‘Inbound mail for new request’); // If auto redirect is not TRUE then we show a thank you template define(SHOW_THANKYOU_TEMPLATE, ‘thanks.html’); // Should we automatically redirect once form is submitted define(AUTO_REDIRECT, FALSE); Continued Chapter 19: Web Forms Manager 689 25 549669 ch19.qxd 4/4/03 9:27 AM Page 689 Listing 19-2 (Continued) define(AUTO_REDIRECT_URL, ‘http://www.yourdomain.com’); $ERRORS[‘US’][‘ERROR_FNAME’] = “First name - missing.”; $ERRORS[‘US’][‘ERROR_LNAME’] = “Last name - missing.”; $ERRORS[‘US’][‘ERROR_EMAIL’] = “Email address - missing.”; $ERRORS[‘US’][‘ERROR_COMPANY’] = “Company name - missing.”; $ERRORS[‘US’][‘ERROR_SUBJECT’] = “Subject of your question - missing.”; $ERRORS[‘US’][‘ERROR_DETAILS’] = “Details of your question - missing.”; ?> Now on Your Web browser make a request for http://yourserver/ask.php. Figure 19-3 shows one such request. Figure 19-3: A simple Web form called ask.php. This form is managed by the submit.php application developed in this chapter, but that can be noted only if you review the source code, which contains the fol- lowing lines: 690 Part V: Internet Applications 25 549669 ch19.qxd 4/4/03 9:27 AM Page 690 . request for http://yourserver/ask .php. Figure 19-3 shows one such request. Figure 19-3: A simple Web form called ask .php. This form is managed by the submit .php application developed in this. customize these messages as you see fit. Now you are ready to test the ask .php form. Listing 19-2: askform.conf < ?php // Name of the Web form define(FORM_NAME, ‘Ask Form’); // Name of the table. a PHP script, you can redirect users to the URL from which they clicked the Web form by incorporating the following lines in the Web form: <input type=hidden name=”return_url” value=”<?php