More about PHP (with some Python references) HTML forms (lots of repetition if needed?) GET and POST Session variables

Size: px

Start display at page:

Download "More about PHP (with some Python references) HTML forms (lots of repetition if needed?) GET and POST Session variables"

Jean Cunningham
5 years ago
Views:

1 More about PHP (with some Python references) HTML forms (lots of repetition if needed?) GET and POST Session variables

2 PHP classes and include Using classes are rather simple and works as in Java, C#, C++ etc. Include your include files (files with shared code) with the include or include_once statement # my gps.php file <?php # Include class file or any other php file include_once "position.php";?> # local lat and long $lat = ''; $lng = ''; # create the position object $pos = new Position(" ", " "); # if we have public members we can do like this $lat = $pos->latitude; $lng = $pos->longitude; # do something with the local variables $lat = $lat - 0.1; $lng = $lng + 0.1; # if the members have been private we need a set method $pos->setposition($lat, $lng); # if the members have been private we need get methods $lat = $pos->getlatitude(); $lng = $pos->getlongitude(); #... # file position.php <?php class Position { #var string public $latitude; public $longitude;?> function construct($latitude="", $longitude=""){ if(!empty($latitude)) $this->latitude($latitude); if(!empty($longitude)) $this->longitude($longitude); public function setposition($latitude="", $longitude="") { if(!empty($latitude)) $this->latitude($latitude); if(!empty($longitude)) $this->longitude($longitude); public function getlatitude() { return $this->latitude; public function getlongitude() { return $this->longitude;

3 The local function scope Unlike JavaScript and most other program languages global scope defined variables are not seen inside local functions <?php include "utils.php"; $a = 1; // global scope $b = 2; // global scope /* Global scope variables as the $a and $b variables and similar variables and functions in the included utils.php will be available within the local script file. However, within user-defined functions a local function scope is introduced. Any variable used inside a function is by default limited to the local function scope. */ function test() { echo $a; /* reference to local scope variable which is undefined */ test(); // will not produce any output! Since local $a is undefined it will raise an exception /* In PHP global variables must be declared global inside a function if they are going to be used in that function. Otherwise use the $GLOBALS array or send/return variables to/from the function */ function sum() { global $a, $b; // equivalent to $b = $a + $b; // using: $GLOBALS['b'] = $GLOBALS['a'] + $GLOBALS['b']; sum(); echo $b; // will output 3?> // receiving function parameters function sum($a, $b){ return $a + $b; //returning the result echo sum($a, $b); // sending function arguments

Debug variables Syntax errors A syntax error in a PHP file will normally prevent the entire program from running, Parse error: in xyz on line # Usually turned off to prevent clues about the

4 Debug variables Syntax errors A syntax error in a PHP file will normally prevent the entire program from running, Parse error: in xyz on line # Usually turned off to prevent clues about the application Coding errors Your best friend is the echo statement or functions as var_dump() and print_r() Configure server debugging and get it working Dumping local variables <?php echo "<html><body>"; # debug example print_r($room) "<br>"; echo "<br>"; echo "XYZ: ". $room[1], "<br>"; exit(); $rooms[1] = "ABC"; $rooms[2] = "DEF"; $rooms[3] = "GHI"; echo "<pre>"; var_dump($rooms); echo "</pre>";?> echo "</body></html>";

5 HTML Forms 1 Forms are user interfaces for data input Main application - to provide user input for Programs and databases located on a web server Local (client-side) scripts associated with the form Server-based scripts/programs may return data to the client as a web page Client-side scripts can read input data To validate the data, prior to sending to server To use in local processing which may output web page content that is displayed on the client Examples Questionnaires to provide feedback on a web site E-commerce, to enter name, address, details of purchase and credit-card number Run a database query and receive results

6 HTML Forms 2 There are two ways of sending information into a server script (PHP, Python, ASP.NET, etc.) One is to use parameters on the URL, and retrieve them with $_GET in PHP (in the form you set: method= get ) Can also be done via REST (hyperlinks), but the form create the URL with parameters in this case The other method, which is more powerful and secure is to use a form with $_POST in PHP (in the form you set: method= post ) The data goes within the HTTP message body (not visible on the browsers address field) To see (debug) what you send, set: method= get or view the form data params in the web developers network tab (F12) There is a variety of form field types that you can use, depending on the type of information that you're requesting from a visitor

7 A form consists of two main components First, one or more input fields into which the visitor types or clicks the information you have requested Second, a "submit" button which, when clicked, sends the contents of the form to a server-side program for processing in whatever way it wishes HTML Forms 3

8 Example form (post) Having designed a form, there are 3 more things you need to do before it's ready for use Ensure that each form object is named properly Add an "action" to the <form> tag which is the server program that processes the data Write some server side code to handle the submitted forms When the site visitor presses the Submit button, the contents of the form will be sent to a server script/program as a series of variables (with values if they are used in the form) The sent variable names will be the name= parameters that you have assigned to the objects in the form <form method="post" action="breakfast.php"> <label>name: </label> <input type="text" name="tb_name" size="40" /> <label>bacon: </label> <input type="checkbox" name="cb_bacon" value="y" /> <label>boiled: </label> <input checked type="radio" name="rb_eggs" value="f" /> <label>order your breakfast?</label> <input type="submit" value="submit" /> </form>

a resonse code will be returned HTTP message Request/response line - the http

9 The HTTP protocol TCP/IP based request/response protocol HTTP requests (known as methods) GET (retrive/select) or POST (create/insert) HTTP response In all cases a resonse code will be returned HTTP message Request/response line - the http method/status Header variables - request metadata Message body - content of message

11 GET and POST difference? The difference between METHOD="GET" (the default) and METHOD="POST" is primarily defined in terms of form data encoding The official recommendations say that "GET" should be used if and only if the form processing is idempotent, which typically means a pure query form (we do not change the back end data). Generally it is advisable to do so There are, however, problems related to long URLs and non-ascii character repertoires which can make it necessary to use "POST" even for idempotent processing The HTML specifications technically define the difference between "GET" and "POST" so that former means that form data is to be encoded (by a browser) into a URL while the latter means that the form data is to appear within a message body But the specifications also give the usage recommendation that the "GET" method should be used when the form processing is "idempotent", and in those cases only As a simplification, we might say that "GET" is basically for just getting (retrieving) data whereas "POST" may involve anything, like storing or updating data, ordering a product or sending

Debug globals and server variables In additon to the print_r() array function we can use the $_SERVER with var_dump() Dumps out a tremendous amout of variables To long to list here Other useful

12 Debug globals and server variables In additon to the print_r() array function we can use the $_SERVER with var_dump() Dumps out a tremendous amout of variables To long to list here Other useful examples get_defined_vars() # dump server variables echo "<pre>"; var_dump($_server); echo "</pre>"; # get_defined_vars() # dump global variables # and all other possible # variables the the program # knows about echo "<pre>"; var_dump(get_defined_vars()); echo "</pre>"; echo "<pre>"; echo $_SERVER["REQUEST_URI"]; echo "</pre>"; ["REQUEST_URI"]=> string(16) "/myhome/test.php" # not alls web servers pass this variable on if (isset($_server["http_referer"])) { echo "You came from ", $_SERVER["HTTP_REFERER"];

Debug POST form input 1 Using get_defined_vars() - showing the empty() vs. isset() function <form action="next.php" method="post"> <table> <tr> <td>paul</td> <td>attuck</td> <td>paulattuck@yahoo.

13 Debug POST form input 1 Using get_defined_vars() - showing the empty() vs. isset() function <form action="next.php" method="post"> <table> <tr> <td>paul</td> <td>attuck</td> <td>paulattuck@yahoo.com</td> <td><input checked type="checkbox" name="cb_1" value="paulattuck@yahoo.com" /></td> </tr> <tr> <td>james</td> <td>bond</td> <td>jamesbond@yahoo.com</td> <td><input type="checkbox" name="cb_2" value="jamesbond@yahoo.com" /></td> </tr> <tr> <td>name</td> <td>last</td> <td>lastname@yahoo.com</td> <td><input type="checkbox" name="cb_3" value="lastname@yahoo.com" /></td> </tr> </table> <input type="submit" name="submit" value="submit" /> </form>

14 Debug POST form input 2 Using get_defined_vars() - showing the empty() vs. isset() function <?php echo "<pre>"; var_dump(get_defined_vars()); echo "</pre>"; for($i=1; $i <=3; $i++) { $var = $_POST["cb_{$i"]; //$var = FALSE; //$var = 0; # empty Determine whether a variable is empty # A variable is considered empty if it does # not exist or if its value equals FALSE // Evaluates to true if $var is empty if (empty($var)) { echo 'empty(): $var is either 0, empty, or not set at all <br>';?> // Evaluates as true if $var is set in any way if (isset($var)) { echo 'isset(): $var is set <br>';

15 HTML Forms Galore For reference to all forms inputs and attributes see slide in the SP- IA_03_html-basics2.pdf presentation Do we need to repeat something particular about the forms subject?

16 Example included in lab 4 HTML Forms and result

17 breakfast.php <?php echo "<link href='style2.css' rel='stylesheet'>"; # in <head> function checkbox_value($name) { return (isset($_post[$name])? 1 : 0); if(!empty($_post["tb_name"])) $name = $_POST["tb_name"]; # Diner's name else { echo "Must give Diner's name"; die(); $name_san = preg_replace("/[^a-za-z]/", "", $name); if(checkbox_value("cb_eggs")) $cb_eggs = $_POST["cb_eggs"]; else $cb_eggs = "N"; # Will be Y if user wants eggs # omitted for brevity $eggs_style = $_POST["rb_eggs"]; # Will be F, P or S echo "<p>" # omitted for brevity if ($cb_eggs == "Y") { if ($eggs_style == "F") { echo "Fried eggs<br><br>"; if ($eggs_style == "P") { echo "Poached eggs<br><br>"; if ($eggs_style == "S") { echo "Scrambled eggs<br><br>"; echo "</p>";?>

18 Forms checkbox Works as expected <html> <body> <form action="checkbox.py" method="post" target="_blank"> <input type="checkbox" name="maths" value="on" /> Maths <input type="checkbox" name="physics" value="on" /> Physics <input type="submit" value="select Subject" /> </form> </body> </html>> #!"\dev\python37\python.exe" # Import modules for CGI handling import cgi, cgitb # Create instance of FieldStorage form = cgi.fieldstorage() # Get data from fields if form.getvalue('maths'): math_flag = "ON" else: math_flag = "OFF" if form.getvalue('physics'): physics_flag = "ON" else: physics_flag = "OFF" print("content-type: text/html;charset=utf-8;\n\n") print() print("<html><head>") print("<title>checkbox CGI Program</title>") print("</head><body>") print("<h2> CheckBox Maths is : %s</h2>" % math_flag) print("<h2> CheckBox Physics is : %s</h2>" % physics_flag) print("</body></html>")

19 Radio, dropdown, textarea <html><body> <p>select a Subject </p> <form action="radiobtn_dropdwn_textarea.py" method="post" target="_blank"> <input type="radio" name="subject" value="mechanics" /> Mechanics <input type="radio" name="subject" value="astronomy" /> Astronomy <p>select a Course</p> <select name="dropdown"> <option value="maths" selected>maths</option> <option value="physics">physics</option> </select> <p>text area</p> <textarea name="textcontent" cols ="40" rows="4"> Type your text here... </textarea> <input type="submit" value ="Submit" /> </form> </body></html> #!"\dev\python37\python.exe" import cgi, cgitb form = cgi.fieldstorage() if form.getvalue('subject'): subject = form.getvalue('subject') else: subject = "Not set" if form.getvalue('textcontent'): text_content = form.getvalue('textcontent') else: text_content = "Not entered" if form.getvalue('dropdown'): course = form.getvalue('dropdown') else: course = "Not entered" print("content-type: text/html;charset=utf-8;\n\n") print() print("<html><head>") print("<title>radio, Dropdown, Textarea CGI Program</title>") print("</head><body>") print("<h2> Selected Subject is: %s</h2>" % subject) print("<h2> Selected Course is: %s</h2>" % course) print("<h2> Entered Text Content is: %s" % text_content) print("</body></html>")

20 Populate a form from DB Here's the code we originally used in form.html to create the menu: Eggs <input type="checkbox" name="cb_eggs" value="y" /> Bacon <input type="checkbox" name="cb_bacon" value="y" /> Sausages <input type="checkbox" name="cb_sausages" value="y" /> Beans <input type="checkbox" name="cb_beans" value="y" /> And here's a PHP file version of it, based on an array of items that we have read from the database <?php for ($i = 0; $i < count($items); $i++) { echo $items[$i]; echo "<input type='checkbox' name='cb_"; echo $items[$i]. "' value='y' /> <br />"; # The ' is the same as \" and can be used inside strings for ($i = 0; $i < count($items); $i++) { echo $items[$i]; echo "<input type=\"checkbox\" name=\"cb_" ; echo $items[$i]. "\" value=\"y\" /> <br />"; # or a third option using string/variable interpolation which maybe is the best solution for ($i = 0; $i < count($items); $i++) { echo $items[$i]; echo "<input type='checkbox' name='cb_{$items[$i]' value='y' /> <br />";?> For an array called $items[] that contains values of "eggs", "bacon", "sausages" and "beans", the code above will produce: eggs<input type='checkbox' name='cb_eggs' value='y' /> bacon<input type='checkbox' name='cb_bacon' value='y' /> sausages<input type="checkbox" name="cb_sausages" value="y" /> beans<input type="checkbox" name="cb_beans" value="y" />

21 Retrieving Textarea and Dropdown Data A textarea's content is retrieved in the same way as a textbox the same goes for the dropdown box etc. Use $_POST["ab_xyz"], where ab_xyz is the name of the textarea, dropdown etc. as defined in the form CR (\r) and LF (\n) can be removed with preg_replace() Another option that you may find useful is a select with values $_POST[] will return 1, 2, 3 or 4 respectively instead of Spring, Summer,... which could be an advantage <form method="post" action="script.php"> <textarea name="ta_comments" rows="4" cols="20"></textarea> <select name="dd_season"> <option>spring</option> <option>summer</option> <option>autumn</option> <option>winter</option> </select> </form> <select name="dd_season"> <option value="1">spring</option> <option value="2">summer</option> <option value="3">autumn</option> <option value="4">winter</option> </select>

22 Checkbox arrays When you're creating HTML forms, you'll often find yourself creating a large set of checkboxes. We can use the auto increment feature for arrays in PHP The $rooms array will contain only those checkboxes that were ticked If the visitor ticks boxes 2 and 4, the $rooms array will contain 2 elements (numbered 0 and 1) with values 2 and 4 respectively Room 1 <input type="checkbox" name="rooms[]" value="1" /> <br> Room 2 <input type="checkbox" name="rooms[]" value="2" /> <br> Room 3 <input type="checkbox" name="rooms[]" value="3" /> <br> Room 4 <input type="checkbox" name="rooms[]" value="4" /> <br> $rooms = $_POST["rooms"]; $room_count = count($rooms); echo "There were ". $room_count. " rooms chosen.<br>"; echo "The rooms you ticked were:<br>"; echo "<br>"; for ($i=0; $i < $room_count; $i++) { echo $rooms[$i]. "<br>";

Feedback forms <form action="formtoemail.

23 Feedback forms <form action="formto .php" method="post"> <table border="1" bgcolor="#ececec" cellspacing="5" width="550"> <tr><td>name:</td><td> <input type="text" size="40" name="name" style="width: 350px"></td></tr> <tr><td> address:</td><td> <input type="text" size="40" name=" " style="width: 350px"></td></tr> <tr><td valign="top">comments:</td><td> <textarea name="comments" rows="6" cols="50"></textarea></td></tr> <tr><td></td><td> <div align="right"> <input type="submit" value="send" /> </div> </td></tr> </table> </form>

24 Sending the <?php # formto .php, note that you must have a SMTP server on the web server! # $_REQUEST is a merging of $_GET and $_POST where $_POST overrides $_GET $name = $_REQUEST['name']; $to = "webadmin@example.net"; $subject = "FormTo Comments"; # we may need some filtering and validation, this is however not present here! $message = $_REQUEST['comments']; $headers = "From: ". $_REQUEST[' ']; $date = date("d"); $date.= " at "; $date.= date("h:i"); $message = "Comments from ". $name. ", ". $date. ", ". $message; # bool mail ( string $to, string $subject, string $message # [, string $additional_headers [, string $additional_parameters ]] ) $m = mail($to, $subject, $message, $headers); echo "Return code from mail was ". $m; exit();?> # Return code from mail was 1 # Comments from Hans Jones, Mon at 14:39, Hello Form!

25 Send from Python 1 Using Gmail with the Google Account > Sign-in & security > Allow less secure apps setting ON for the sending account #!"\dev\python37\python.exe" import cgi, cgitb import smtplib cgitb.enable() form = cgi.fieldstorage() # send_ .py # def send_ (sender, password, tolist, message): try: smtpobj = smtplib.smtp('smtp.gmail.com:587') smtpobj.ehlo() smtpobj.starttls() smtpobj.login(sender, password) smtpobj.sendmail(sender, tolist, message) smtpobj.close() print("successfully sent {".format(message)) except BaseException as e: print("unable to send error: {".format(e)) # continues on next slide

$Send email from Python 2 print("content-type: text/html;charset=utf-8;\n\n") print() print("<html><head>") print("<title>send Email CGI Program</title>") print("</head><body>") send_email.$

26 Send from Python 2 print("content-type: text/html;charset=utf-8;\n\n") print() print("<html><head>") print("<title>send CGI Program</title>") print("</head><body>") send_ .py # Get data from fields - if we have pressed the send button a value (Send) is defined if form.getvalue('send '): sender = 'username@gmail.com' password = 'secret_pass' tolist = ['another.user@example.com'] subject = 'SMTP Gmail test' body_text = 'This is a test Gmail message.' message = """From: %s\nto: %s\nsubject: %s\n\n%s""" % (sender, tolist, subject, body_text) send_ (sender, password, tolist, message) # Show the form using multi line text with \ else: print('<p>send Example</p> \ <form action="send_ .py" method="get"> \ <p><input type="submit" name="send " value="send" /></p> \ </form>') print("</body></html>")

27 Hidden form elements Can be used to remember values on the webpage if the page is reloaded remember HTTP is a stateless protocol! A better method is to use session variables Can also be used to hide values in the form which are sent in to adjust the running script in some way For example to know the time between the HTML form code was loaded and when it is received in the FormTo .php # creates something like: <input type="hidden" name="timecode" value="12345" /> <?php $tm = time(); # returns the number of seconds since echo "<input type='hidden' name='timecode' value='". $tm. "' />"; echo $tm. "<br />";?> # at response check to see if the form was answered to quickly spam-proofing <?php $timecode = $_POST["timecode"]; if($timecode + 5 > time()) # old time + 5 sec vs. current time exit(); else { response time was not to short...?>

Saving State Sessions are a combination of a server-side cookie and a client-side cookie The session cookie reference is passed back and forth between the server and the client Server loads the

$session_start(); # must ALWAYS be on the first line if using sessions if(!isset($_session["my_session_var_name1"])) { $_SESSION["my_session_var_name1"] = "I like session variables!$

28 Saving State Sessions are a combination of a server-side cookie and a client-side cookie The session cookie reference is passed back and forth between the server and the client Server loads the corresponding session data from an unique file on the server <?php # Initialize session data # creates a session or resumes the current one based on a session # identifier passed via a GET or POST request, or passed via a cookie. session_start(); # must ALWAYS be on the first line if using sessions if(!isset($_session["my_session_var_name1"])) { $_SESSION["my_session_var_name1"] = "I like session variables!"; else { $_SESSION["my_session_var_name1"].= "!"; # Get and/or set the current session name $sess_name = session_name(); echo "The session name was $sess_name","<br />"; echo $_SESSION["my_session_var_name1"];?> <?php # Ending a session must always be done like this! session_start(); $_SESSION = array(); session_destroy();?>

php An ordinary listing of all products SELECT id, name, price FROM products echo "<td><a href=cart.php? action=add&id=",$row["id"],"> Add To Cart</a></td>"; cart.

29 Shopping cart - db-shop-content Use an unique session variable name on utb-mysql.du.se to avoid collision Session behaviour is configured in the [session] part of the php.ini file session.xxx = value products.php An ordinary listing of all products SELECT id, name, price FROM products echo "<td><a href=cart.php? action=add&id=",$row["id"],"> Add To Cart</a></td>"; cart.php session_start() - first line! var_dump($_session['cart']); products table: CREATE TABLE `products` ( `id` INT NOT NULL AUTO_INCREMENT, `name` VARCHAR( 255 ) NOT NULL, `description` TEXT, `price` DOUBLE DEFAULT '0.00' NOT NULL, PRIMARY KEY ( `id` ) );

30 Shopping cart - db-shop-content <?php session_start(); # must ALWAYS be on the first line if using sessions ///... shortened for brevity... $product_id = empty($_get['id'])? "" : $_GET['id']; // the product id from the URL $action = empty($_get['action'])? "" : $_GET['action']; // the action from the URL if(!isset($_session['cart'])) $_SESSION['cart'] = array(); // if there is an product_id and that product_id doesn't exist display an error message if($product_id &&!productexists($product_id, $DBH, $products)) { die("error. Product Doesn't Exist");?> switch($action) { // decide what to do case "add": if (!isset($_session['cart'][$product_id])) $_SESSION['cart'][$product_id] = 0; $_SESSION['cart'][$product_id]++; // add one to the quantity of the product with id $product_id break; case "remove": // remove one from the quantity of the product with id $product_id $_SESSION['cart'][$product_id]--; // if the quantity is zero, remove it completely (using the 'unset' function) - // otherwise is will show zero, then -1, -2 etc when the user keeps removing items. if($_session['cart'][$product_id] == 0) unset($_session['cart'][$product_id]); break; case "empty": unset($_session['cart']); //unset the whole cart, i.e. empty the cart. break; ///... shortened for brevity... Example included in lab 5

NETB 329 Lecture 13 Python CGI Programming

NETB 329 Lecture 13 Python CGI Programming 1 of 83 What is CGI? The Common Gateway Interface, or CGI, is a set of standards that define how information is exchanged between the web server and a custom