Secure PHP Development- P146 pot

4. The row containing the number of votes is retrieved by fetching it from the $result variable using the fetchRow() method. 5. Finally, the number of votes is returned from this method. Creating the Application Configuration Files Like every other application developed in this book, the voting tool application also uses a standard set of configuration and error files. These files are discussed in the following sections. Creating the main configuration file The primary configuration file for the entire system is called vote.conf. Table 20-1 describes each configuration variable. TABLE 20-1 VOTE.CONF VARIABLES Configuration Variable Purpose $PEAR_DIR Set to the directory containing the PEAR package; specifically, the DB module needed for class. DBI.php in our application framework. $PHPLIB_DIR Set to the PHPLIB directory, which contains the PHPLIB packages; specifically, the template.inc package needed for template manipulation. $APP_FRAMEWORK_DIR Set to our application framework directory. $PATH Set to the combined directory path consisting of $PEAR_DIR, $PHPLIB_DIR, and $APP_FRAMEWORK_DIR. This path is used with the ini_set() method to redefine the php.ini entry for include_path to include $PATH ahead of the default path. This enables PHP to find our application framework, PHPLIB, and PEAR-related files. $APPLICATION_NAME Internal name of the application. $DEFAULT_LANGUAGE Set to the two-digit default language code. Continued Chapter 20: Web Site Tools 701 26 549669 ch20.qxd 4/4/03 9:27 AM Page 701 TABLE 20-1 VOTE.CONF VARIABLES (Continued) Configuration Variable Purpose $ROOT_PATH Set to the root path of the application. $REL_ROOT_PATH Relative path to the root directory. $REL_APP_PATH Relative application path as seen from a Web browser. $TEMPLATE_DIR The fully qualified path to the template directory. $CLASS_DIR The fully qualified path to the class directory. $REL_TEMPLATE_DIR The Web-relative path to the template directory used. $VOTE_CLASS Name of the Vote class file. $VOTE_DB_URL The fully qualified URL for the database used to store the VOTE information. $VOTE_TBL Name of the VOTES table in the database. $COOKIE_EXPIRATION_TIME The amount of time, in seconds, that specifies the cookie expiration time for a vote. You may need to tailor to your own system’s requirements the directory struc- ture used in the vote.conf file supplied in the ch20 directory on the CD-ROM. Here is what the current directory structure looks like: / evoknow | + intranet | + htdocs ($ROOT_PATH) | + vote (Voting Tool Applications) | + apps (apps and configuration files) | + class (class files) | + templates (HTML templates) | + images (images for the templates) 702 Part V: Internet Applications 26 549669 ch20.qxd 4/4/03 9:27 AM Page 702 By changing the following configuration parameters in vote.conf, you can mod- ify the directory structure to fit your site requirements: $PEAR_DIR = $_SERVER[‘DOCUMENT_ROOT’] . ‘/pear’ ; $PHPLIB_DIR = $_SERVER[‘DOCUMENT_ROOT’] . ‘/phplib’; $APP_FRAMEWORK_DIR = $_SERVER[‘DOCUMENT_ROOT’] . ‘/framework’; $ROOT_PATH = $_SERVER[‘DOCUMENT_ROOT’]; $REL_ROOT_PATH = ‘/vote’; $REL_APP_PATH = $REL_ROOT_PATH . ‘/apps’; $TEMPLATE_DIR = $ROOT_PATH . $REL_APP_PATH . ‘/templates’; $CLASS_DIR = $ROOT_PATH . $REL_APP_PATH . ‘/class’; $REL_TEMPLATE_DIR = $REL_APP_PATH . ‘/templates/’; Creating an errors file The error messages displayed by the contact manager applications are stored on the CD-ROM in the ch20/apps/vote.errors file. You can modify the error messages using a text editor. Creating the Application Templates The templates used in this application are poll-specific. Every poll will have an out- put template that will be prepared by the user who initiates the poll. You can find an example poll output template on the CD-ROM in the ch20/apps/templates directory. These templates must be named according to the poll ID. For example, a poll with an ID of 99 should have an output template named 099.html. Creating the Vote Application This application, vote.php, is responsible for managing the entire process of the voting system. The application is included on the CD-ROM in the ch20/apps direc- tory. It implements the following functionality: ◆ Allows a user to submit a vote ◆ Displays the poll result This application has the following methods. Chapter 20: Web Site Tools 703 26 549669 ch20.qxd 4/4/03 9:27 AM Page 703 run() When the application is run, this method is called. It first calls the setPollID() method to set the given poll ID to a member variable. Then it creates a member variable named “_voteObj” to hold an object of the Vote class with the member poll ID. It determines whether a cookie has been set, which indicates that the user has already voted for this poll. If it finds the cookie, it directly calls displayVoteResult() to show the vote result instead of adding the vote to the database. setPollID() This method sets the given poll ID from the user request. It displays an alert mes- sage when it determines that the poll ID has not been supplied from the user form. getPollID() This method is used to retrieve the current poll ID from the member variable _pollID. It simply returns $this->_pollID. addVote() This method is responsible for adding the user vote to the database by using the Vote class. This is how it works: 1. It first determines whether the user has selected a voting option. If not, it displays an alert message and returns null. 2. Next, the addVote() method of the Vote class is used to add the given vote to the database. The vote class object is instantiated with the member poll ID in the run() method, so it is not necessary to pass the poll ID to the addVote() method here. 3. If the vote addition status is successful, this method sets a cookie for the user, indicating that the user submitted a vote for this poll; otherwise, it displays an alert message indicating the failure of the addition operation. 4. Finally, the displayVoteResult() method is called to show the vote result. displayVoteResult() This method shows the poll result to the user. It works as follows: 1. It first determines whether the total number of options for the poll has been supplied. If it hasn’t, it displays an error message and returns null, as a result cannot be found unless the method can ascertain the total number of options available. 704 Part V: Internet Applications 26 549669 ch20.qxd 4/4/03 9:27 AM Page 704 2. Next, the output template for the poll is loaded in a template object called $template. The output template file name is determined from the poll ID. If the output template file does not exist in the template directory, it dis- plays an alert message and returns null. 3. Then it calls the getTotalVoteCount() method of the Vote class to retrieve the total number of votes posted for this poll, and sets the number to the appropriate variable in the template. 4. For each of the poll options, the getVoteCountByChoice() method is called to retrieve the number of votes cast. This number, along with the total number of votes for the poll, is used to determine the percentage of votes for this option. These numbers are set to appropriate variables in the template. 5. Finally, the entire template is parsed and printed to the user to provide a full poll result. Installing the Voting Tool In this section, it is assumed that you are using a Linux system with MySQL and an Apache server installed. Your Internet Web server document root directory is %DocumentRoot%. Of course, if you have a different path, which is likely, you should change this path whenever you see it in a configuration file or instruction in this chapter. It is further assumed that you have installed the PHPLIB and PEAR libraries. Normally, these are installed during PHP installation. For your convenience, we have provided these in the lib/phplib.tar.gz and lib/pear.tar.gz directories on the CD-ROM. In these sample installation steps, it is assumed that these are installed in the %DocumentRoot%/phplib and %DocumentRoot%/pear directories. Because your installation locations for these libraries are likely to be different, make sure you replace these paths in the configuration files. Here is how you can get your voting tool applications up and running: 1. Install the application framework. If you have not yet installed the appli- cation framework discussed in Chapter 4, you must do so before proceed- ing further. 2. Install the VOTE database. The quickest way to create the VOTE database is to run the following commands: mysqladmin –u root –p create VOTE mysql –u root –p –D VOTE < VOTE.mysql The VOTE.mysql can be found in the vote/sql directory created from ch20.tar.gz or you can get it from the CD-ROM’s ch20/sql directory. Chapter 20: Web Site Tools 705 26 549669 ch20.qxd 4/4/03 9:27 AM Page 705 . package; specifically, the DB module needed for class. DBI .php in our application framework. $PHPLIB_DIR Set to the PHPLIB directory, which contains the PHPLIB packages; specifically, the template.inc. of $PEAR_DIR, $PHPLIB_DIR, and $APP_FRAMEWORK_DIR. This path is used with the ini_set() method to redefine the php. ini entry for include_path to include $PATH ahead of the default path. This enables PHP. that you have installed the PHPLIB and PEAR libraries. Normally, these are installed during PHP installation. For your convenience, we have provided these in the lib/phplib.tar.gz and lib/pear.tar.gz