COM1004 Web and Internet Technology

Transcription

1 COM1004 Web and Internet Technology

2 When a user submits a web form, how do we save the information to a database? How do we retrieve that data later? ID NAME MESSAGE TIMESTAMP 1 Mike mike@dcs Hi there :31:04 2 Steve steve@dcs Gotcha :33:07 3 Mike mike@dcs Great - it works! :17:35

3

4 Design the form Identify the information you want the user to provide Create <input> tags accordingly Here we want the user to provide Name, and Message data

5 Design a MySQL table to hold the data Draw a picture of the required database table(s) There should be a column for each input tag in the form that contain the relevant data You may want to store extra data that isn't in the form (e.g. a timestamp and message ID) ID NAME MESSAGE TIMESTAMP 1 Mike mike@dcs Hi there :31:04 2 Steve steve@dcs Gotcha :33:07 3 Mike mike@dcs Great - it works! :17:35

6 Does the table exist? Don't assume it exists just because you created it earlier - it may have been deleted in the mean time If necessary, create the table CREATE TABLE IF NOT EXISTS mytable (col1, col2, );

7 Submit data If the user provided data, check it makes sense Create an INSERT query to add data to the table Submit the query to MySQL Check for success Retrieve data If the user provided data, check it makes sense Create a SELECT query to get data from the table Submit the query to MySQL Check for success

8 Your request has been processed; you will hear from us within 7 days Sorry, we couldn't handle your request. Please try again later. The data you requested is not available. Please try again later. Here is the data you requested.

9

10 We're told what the form should look like Data Name Message Required activities Submit data Retrieve data

11 Data Name Message Activities Submit data Retrieve data Single-line text inputs <input name='name' > <input name=' ' > Multi-line text input <textarea name='msg'> </textarea> Two buttons <input type='submit' name='submit'> <input type='submit' name='retrieve'>

12 Please enter your name, address, and message. <form action ="mysql-01.php" method="get"> <table cellpadding="4" border="1"> <tr><td align="right">name</td> <td><input name="name" type="text" maxlength="31" /></td></tr> <tr><td align="right"> </td> <td><input name=" " type="text" maxlength="63" /></td></tr> <tr><td align="right">message</td> <td><textarea name="msg" cols="30" rows="10"></textarea></td></tr> <tr><td align="center" colspan="2"> <input type="submit" value=" Submit " name="submit" /> <input type="submit" value=" Retrieve " name="retrieve" /> </td></tr> </table></form>

13 We need to store Name, , Message We will add extra information: Message ID (primary key), timestamp id name msg tstamp 1 Mike mike@dcs Hi there :31:04 2 Steve steve@dcs Gotcha :33:07 3 Mike mike@dcs Great - it works! :17:35 mytable (id, name, , msg, tstamp)

14 id name msg tstamp 1 Mike mike@dcs Hi there :31:04 2 Steve steve@dcs Gotcha :33:07 3 Mike mike@dcs Great - it works! :17:35 Specify the column types. I'll use the following: id INT UNSIGNED NOT NULL AUTO_INCREMENT PRIMARY KEY name VARCHAR(16) VARCHAR(32) msg VARCHAR(100) tstamp DATETIME

15 CHAR(n) Exactly n characters, requires n bytes storage VARCHAR(n) Up to n characters, (length+(1 or 2)) bytes TEXT Up to characters, storage varies MEDIUMTEXT Up to 16,777,215 characters LONGTEXT Up to 4,294,967,295 characters ENUM('square', 'circle', 'triangle') A fixed list of allowed strings

16 DATETIME (8 bytes) :00:00 to :59:59 DATE (3 bytes) to TIME (3 bytes) -838:59:59 to 838:59:59 YEAR(2), YEAR(4) (1 byte) 4-digit: digit: (specified as 00-99) TIMESTAMP (4 bytes) :00:01 to :14:07

17 Before we can create the table, we need to connect to the MySQL server on the DCS network To do so, we need to provide sensitive information (our passwords) How can we make sure no-one can download this information? Technical solutions: htaccess, htpasswd Another solution: input the data from another file

18 <?php /* "info.php" defines the values of * $mydbase - my database * $mypass - my password * $myname - my username * $myhost - my hostname */ $info = "/mysecretpath/info.php"; include $info;?> info.php is NOT under public_html, so can't be accessed online. It is still visible to the script, since it's on the server.

19 <?php $myhost = "my.sql.host.name"; $mydbase = "mydatabase"; $mypass = "mypassword"; $myuser = "myusername";?> Some people use a ".inc" name for these files, but this isn't always safe for sensitive data. Using ".php" should ensure the server executes the code [depends on server configuration].

20 // Connect to the SQL server mysql_pconnect($myhost,$myuser,$mypass) or die("unable to connect to SQL server<br />\n"); If the connect command works, it returns TRUE The or part is executed if the first bit is FALSE The die command tells PHP to abandon the script and print the error message The message will be displayed on a web page, so we need to remember the <br /> tag

21 // Select the database mysql_select_db($mydbase) or die("unable to select database<br />\n"); The server handles lots of databases. We have to say which one we want. As before, abandon processing if things go wrong. We ought to provide a more useful error message (this one is just for illustration).

22 // Define the table name $table = "sql01"; We'll use the table name repeatedly, so put it in a variable (or a constant) The column types will correspond to those in our table design

23 // Create the table if it doesn't yet exist $query = "CREATE TABLE IF NOT EXISTS $table (". "id INT UNSIGNED NOT NULL AUTO_INCREMENT PRIMARY KEY, " mysql_error tells us the. "name VARCHAR(16), " last error encountered. " VARCHAR(32), " MySQL queries need. "msg VARCHAR(100), " semicolons, just like. "tstamp DATETIME" PHP.. ");"; mysql_query($query) or die ("Failed to create table: ". mysql_error(). "<br />\n") ;

24 We have two basic activities (submit & retrieve), one for each button in the form if (user clicked submit) { submit the data to the table; } else if (user clicked retrieve) { retrieve the relevant data; } else do some default action;

25 Clicking: <input name="myname" > Calls: target.php?myname& if (isset($_request{'submit'})) { submit the data to the table; } else if (isset($_request{'retrieve'})) { retrieve the relevant data; } else do some default action;

26 $name = $_REQUEST{'name'}; $ = $_REQUEST{' '}; $msg = $_REQUEST{'msg'}; $query = "INSERT INTO ". "$table(name, ,msg,tstamp) ". "VALUES('$name','$ ','$msg',NOW());"; mysql_query($query) or die("unable to insert new data: ". mysql_error(). "<br />\n"); To add data, use an INSERT query. To submit a query, use the mysql_query function. It returns FALSE if it fails.

27 INSERT INTO sql01(name, ,msg,tstamp) VALUES('mike', 'hello', NOW()); "Insert the following values into the columns called name, , msg and tstamp, in the table called sql01. The values to insert are: name = 'mike' = 'mike@dcs' msg = 'hello' tstamp = the current date/time" Why don't we insert an ID value?

28 Later, we'll be searching for all messages associated with a given address, so make sure the user specified An address A message Can do this using basic JavaScript (and then follow this up using PHP regular expressions)

29 Each form element can access the values of other elements in the form. We can use an event handler (onclick) to invoke JavaScript code when the button is clicked. Returning false abandons form submission

30 <input type="submit" value="submit" name="submit" onclick="if (form. .value=='') { alert('please provide an address.'); return false; } else if (form.msg.value=='') { alert('please provide a message.'); return false; } else return true;" />

31 If onclick returns false the form won't be submitted. Other event handlers are similar. <form onsubmit="return validate(this);" action="target.php"> <input type="text" name=" " /> <input type="submit" value="click me" name="submit" /> </form> If validate returns false, the form won't be submitted.

32 Basic validation can be done using a JavaScript function, e.g. <script type="text/javascript"> function validate(f) { if (f. .value.length == 0) { alert("please give address"); return false; } else return true; } </script>

33 $req = $_REQUEST{' '}; echo "Retrieving data for: ". "<i>$req </i><br />\n"; $query = "SELECT * FROM $table ". "WHERE ='$req ';"; $result = mysql_query($query) or die("failed.<br />\n");

34 If SELECT fails, the query returns FALSE If it works, it returns a PHP resource The resource may contains several records We can extract them one at a time using mysql_fetch_array

35 $query = "SELECT * FROM $table;"; $result = mysql_query($query); $row = mysql_fetch_array($result); if ($row) { initialise stuff; while($row) { do something; $row = mysql_fetch_array($result); } tidy up; } else { no rows were returned; }

36 $id = $row{'id'}? $row{'id'} : ' '; One of the columns is called 'id', so this is the key we use to extract its value. Because I'll be placing values in an HTML table, I convert empty results into non-breaking spaces. Otherwise the cell borders may not be displayed properly in some browsers.

37 if ($row) { open HTML table; while ($row) { add $row data to table; get next $row; } close table; } else { tell user there's nothing to display; }

38 mysql_close(); Be sure to close your connection to the database when you no longer need it, especially during development Servers can only handle a limited number of connections at once If 100 students each have 10 old connections open, that's 1000 connections wasted

39 $query = "SELECT * FROM sql01 ". "WHERE ='$req ';"; If $req is the string maths'r'us, this becomes $query = "SELECT * FROM sql01 ". "WHERE ='maths'r'us ';"; This is valid PHP, but the query contains a syntax error so MySQL will complain.

40 Malicious code injection. Consider this: SELECT * FROM users WHERE name = '" + $username + "'; If the user says their name is me ; DROP TABLE users; SELECT * FROM private WHERE 0' = 0 This becomes SELECT * FROM users WHERE name = me ; DROP TABLE users; SELECT * FROM private WHERE 0' = 0 ; This deletes the users table and lists the entire contents of the private table

41 This week we've looked at how PHP/MySQL can be used to Respond to a form Submit data to a database Retrieve data from a database Next week we'll be looking at something a bit different Data encryption Decryption Cracking codes Later we'll look at e- commerce