Web Programming TL 9. Tutorial. Exercise 1: String Manipulation

Transcription

1 Exercise 1: String Manipulation Tutorial 1) Which statements print the same thing to the screen and why? echo "$var"; value of $var echo '$var'; the text '$var' echo $var ; value of $var 2) What is printed to the screen and is there a problem?: echo "This should be on its own line.\n"; The \n linefeed will only be visible in the source code, not the page 3) What is written to the file and is there a problem?: fwrite($file,"this should be on its own line.<br/>"; The text "<br/>" won't make a newline in a text file 4) What is returned and is there a problem: $haystack="elephant"; $needle="e"; if (strpos($haystack,$needle)) echo "$needle found in $haystack :-)"; else echo "$needle not found in $haystack :-("; strpos() returns 0 which will be "cast" as false in the if statement, so "E" will not be found. Fix: if(strpos($haystack,$needle)!==false) 5) What do the following code samples do and why are they useful?: $address=ucwords($_post['address']); All word first letters turned into uppercase. Neater, not reliant on user $feedback=str_replace("fork", "spork", $_POST['feedback']); A "spork" manufacturer doesn't want their sporks being called 'forks' 6) How can we improve the following code?: $total=100; $split3ways = $total/3; printf("the total is $total and split 3 ways is $split3ways"); printf("the total is $%1.2f and split 3 ways is $%1.2f",$total,$split3ways); $ and $33.33 will now be printed (what's 1 between friends?) The %1 refers to the minimum space $total and $split3ways will take up The.2 makes sure that there are two decimal places The f formats the variable as a float The $ is just a dollar sign, not that tricky php thing COSC2453 SP4, 2013 page 1 of 6

2 7) How would placing the following code snippets in your footer.inc file help you speed up developing and debugging your next assignment?: <pre><?php print_r ($_POST);?><pre> <pre><?php print_r ($_GET);?><pre> <pre><?php print_r ($_COOKIE);?><pre> <pre><?php print_r ($_SESSION);?><pre> Rhetorical question: This will help the student AND the tutor who is asked to help Exercise 2: $_COOKIE and cookies Note: The server will set a cookie that will expire in approximately _100_ years: setcookie("firstvisit", date("y-m-d@h:i:s"), time()+60*60*24*365.25*100); Output at time of writing was: " @20:12:23" or "{now}" below Event Value of client's cookies Value of $_COOKIE New client contacts server for the first time and requests the home page Server replies and sets a cookie on the client's machine Client requests another page Server sends that page Client shuts down computer and goes on holiday for 3 weeks Client returns home, turns on computer, browses to the server's website again firstvisit = {now} Client get paranoid about having cookies and clears browsing COSC2453 SP4, 2013 page 2 of 6

3 history. Client browses to another of the server's webpages. Server doesn't set a cookie Exercise 4: Code Analysis Questions 1) What will be printed to the screen? Is there a problem and how can we fix it? The value of $value is unchanged: a new local variable is created inside the function and it loses scope once the function is finished. We can fix this by passing $value's reference instead (L8.S47): function increment(&$value) { $value++; }... 2) What does the "@" symbol do in the second code sample?: "@" suppresses errors. Whether this is good practice is open to debate. 3) What does the following code do? How would we call it?: This function reads what's inside a directory into an array and in the loop, each file or directory is echo'ed in it's own paragraph. To read the current directory, we can use this: readir('.'); Exercise 5: Storing Form Data in the Session Object What is the following code sample doing? What happens when the session becomes "full"?: The contents of $_POST is put into a nested array called "FormData". It is possible for a website to use many form pages to collect the data (eg a customer satisfaction survey) and keep the data "alive". It is sensible to limit the amount of data to what is expected, just in case a programming bug allows the user to enter an unlimited amount of data. 10 items or more generates a warning messsage. 20 or more items causes session to be emptied, destroyed and a quick and dirty error message is generated with the "die" command. COSC2453 SP4, 2013 page 3 of 6

4 Exercise 6: Submitting a Form to Itself The first if-branch will run only if data has been submitted. The first time a user comes to the page, $_POST will be and the branch will be skipped. First branch puts the file lines into an array and any spaces or line feed characters are trimmed off the bits when each line is exploded. Boolean $userfound is only set if a match has been found and a welcome message is displayed The second if-branch will run only if $_POST is (ie a first time visitor) OR a user / password combination has not been found (ie invalid data has been entered and it needs to be corrected) The form submits to itself "$_SERVER['PHP_SELF']" in action attribute The previous username entry is put into the input box so the user has some feedback that the password was wrong, but the bad password is discarded NB: for the sake of the exercise, I have the password entered into an input box, not a password box so students can see the bad password input. NOTE: No solutions for the self-exercises, please try on your own and post solutions COSC2453 SP4, 2013 page 4 of 6

5 Exercise 3: $_SESSION and sessions A server can keep a track of every user that is currently requesting resources anywhere in the world, and can even distinguish between two housemates who are visiting the same website at home. It does this using sessions: information unique to each user is stored server-side on the hard drive and also in an associative array called $_SESSION. One common way is to store a session id as a cookie on the client's machine. Remember: Any webpage that uses sessions must have <?php session_start();?> near the top, before any HTML code appears. This either starts a session or keeps an existing session going. Which of the following events will end a session?: User opens a new tab in a browse [ NO, as long as browser still open ] User browses to another website [ NO, as long as browser still open ] User's housemate browses to the same webpage [ NO, server can tell them apart ] Client stops interacting with the browser [ YES, but only after a period of inactivity ] User closes the browser [ YES, session cookies will be destroyed ] User uses a different computer [ YES, server will treat client as a new client ] Server destroys a session using session_destroy(); [ YES, but: client cookies not cleared ] Server is shut down and rebooted [ YES, but: client session cookies might not cleared ] Server is destroyed by a comet [ "NO": How would the client know? (perhaps "YES") ] The aim of this exercise is to think about the client - server relationship. How does each track the other? Obviously a comet hitting a server is a serious session ending event, but the client will spend a while waiting for the server to respond before eventually timing out. In the movies, baddies will wait for other baddies to communicate via walkie-talkies before assuming James Bond or Jason Bourne has taken them out. Which of the following things would you store in $_SESSION, $_COOKIE or not at all?: User's colour preferences for the website [ Either, COOKIE good for revisit ] User's logged in status [ Facebook, Google Docs have COOKIE option, but no for banks! ] User's access privileges (eg customer, administrator etc) [ SESSION: cookies can be modified ] Users POST and GET requests [ Good for forms & questionnaires that are on multiple pages ] User's username [ Facebook, Google Docs have COOKIE option, but no for banks! ] User's password [ Facebook, Google Docs have COOKIE option, but no for banks! ] Errors and debugging hints during website development [ $_SESSION['debug']='Line 25: '.$var; ] When deciding where to store information, one has to think about security v/s convenience. Cookies save the server's hard disk space as client machine stores cookie information, but just like javascript, the server should not trust the the client's data UNLESS the information is not important OR the client has given the server permission (eg "remember me" or "keep me logged in" options on Google, Yahoo & Facebook) COSC2453 SP4, 2013 page 5 of 6

6 ** Lab TEST ** NB: NO PARTIAL MARKS! It's 1 or 0 for each exercise! Exercise 1: Prepare and name assignment 3 files correctly (1 mark) Each of the student's required pages should be visible in this page: Make sure it is their student-id at the top of the page! Exercise 2: Create Include Files (1 mark) Page "cut - up" doesn't need to be as severe as my tute example: as long as there are common "header.inc", "navigation.inc" and "footer.inc" files that contain code common to at least two php pages. Exercise 3: Regular Expression (1 mark) All that is required is the expression. The php validation code is completely optional: ^[\w]+(\.php \.html)$ ie an _alphanumeric char, one or more times, followed by.php or.html file extension. [\w ], [a-za-z0-9_ ] and perhaps even [\S ] is allowed too. Note: This regex will be used by the student to generate the beginnings of a dynamic sitemap in the next labtest. What the rules are for the filename BEFORE the file extension are flexible, as long as the student knows the limitations of their chosen regex. COSC2453 SP4, 2013 page 6 of 6