Server Side Scripting Report

Transcription

1 Server Side Scripting Report David Nelson 205CDE Developing the Modern Web Assignment 2 Student ID: Computing BSc 29 th March, Page 1 -

2 Contents Produce a database schema to 3NF covering the data needs of the application...3 Seed the database with some appropriate data for testing purposes and upload data from a web form and store it in the database...8 Pull data from the database and display it on a web page and add the capability to display the data in ascending or descending order based on a a user-selected field...11 NOTE: I have created an account with the Username 'Test' and password 'test' if you wish to log straight into the site. Report is 1,969 words. - Page 2 -

3 Produce a database schema to 3NF covering the data needs of the application Following the HTML stage of this module, I moved onto successfully completing the PHP and MySQL stage of the module. The process began by creating the database structure within MySQL and deciding what tables that I would need. The main purpose of the website is to allow users to create an account and to upload information regarding the lap times they set at each individual circuit. With this in mind, there would be two main tables in my database: UserData which would contain things such as usernames, passwords and addresses and RecordData which would contain things such as the game, circuit and weather conditions. Whilst the majority of data in the UserData table would be unique in nature, as every user will have different details, this would not be the case in the RecordData table. Unlike the UserData table here, users can upload data with the same game, circuit and weather conditions. One of the requirements was for the database to be in third normal form. To achieve that, all repeated data would be moved to separate tables. Therefore, tables such as CircuitData, WeatherData and DifficultyData were created to achieve this. Hence, the database structure is as follows, with the relevant MySQL query located underneath each table: SelectData links RecordData and UserData tables ID DataID UserID Primary Key, Foreign Key, Foreign Key mysql> CREATE TABLE SelectData (id INT NOT NULL AUTO_INCREMENT PRIMARY KEY, DataID INT, UserID INT, FOREIGN KEY(DataID) REFERENCES RecordData(DataID), FOREIGN KEY (UserID) REFERENCES UserData(UserID)); RecordData stores details about the users' laps DataID GameID ConsoleID CircuitID WeatherID DifficultyID TeamID Time Primary Key mysql> CREATE TABLE RecordData (DataID INT NOT NULL AUTO_INCREMENT PRIMARY KEY, GameID INT, ConsoleID INT, CircuitID INT, WeatherID INT, DifficultyID INT, TeamID INT, Time ); - Page 3 -

4 UserData stores details about the user UserID Username Password CircuitID [Favourite Circuit] GameID [Favourite Game] TeamID [Favourite Team] Primary Key Varchar(20) Varchar(20) Varchar(30) mysql> CREATE TABLE UserData (UserID int NOT NULL AUTO_INCREMENT PRIMARY KEY, Username VARCHAR(20), Password VARCHAR(20), VARCHAR(30), CircuitID INT, GameID INT, TeamID INT); GameData stores data about the game GameID Game Primary Key, Foreign Key Varchar(15) mysql> CREATE TABLE GameData (GameID int NOT NULL AUTO_INCREMENT PRIMARY KEY, Game VARCHAR(15), FOREIGN KEY(GameID) REFERENCES RecordData(GameID) ON DELETE RESTRICT, FOREIGN KEY(GameID) REFERENCES UserData(GameID) ON DELETE RESTRICT); ConsoleData stores data about the console ConsoleID Console Primary Key, Foreign Key Varchar(20) mysql> CREATE TABLE ConsoleData (ConsoleID int NOT NULL AUTO_INCREMENT PRIMARY KEY, Console VARCHAR(20), FOREIGN KEY(ConsoleID) REFERENCES RecordData(ConsoleID) ON DELETE RESTRICT); CircuitData stores data about the circuit CircuitID Circuit Primary Key, Foreign Key Varchar(30) mysql> CREATE TABLE CircuitData (CircuitID int NOT NULL AUTO_INCREMENT PRIMARY KEY, Circuit VARCHAR(30), FOREIGN KEY(CircuitID) REFERENCES RecordData(CircuitID) ON DELETE RESTRICT, FOREIGN KEY(CircuitID) REFERENCES UserData(CircuitID) ON DELETE RESTRICT); - Page 4 -

5 WeatherData stores data about the weather WeatherID Weather Primary Key, Foreign Key Varchar(4) mysql> CREATE TABLE WeatherData (WeatherID int NOT NULL AUTO_INCREMENT PRIMARY KEY, Weather VARCHAR(4), FOREIGN KEY(WeatherID) REFERENCES RecordData(WeatherID) ON DELETE RESTRICT); DifficultyData stores data about the difficulty level DifficultyID Primary Key, Foreign Key Difficulty Varchar(15) mysql> CREATE TABLE DifficultyData (DifficultyID int NOT NULL AUTO_INCREMENT PRIMARY KEY, Difficulty VARCHAR(15), FOREIGN KEY(DifficultyID) REFERENCES RecordData(DifficultyID) ON DELETE RESTRICT); TeamData stores data about the team TeamID Team Primary Key, Foreign Key Varchar(20) mysql> CREATE TABLE TeamData (TeamID int NOT NULL AUTO_INCREMENT PRIMARY KEY, Team VARCHAR(20), FOREIGN KEY(TeamID) REFERENCES RecordData(TeamID) ON DELETE RESTRICT, FOREIGN KEY(TeamID) REFERENCES UserData(TeamID) ON DELETE RESTRICT); - Page 5 -

6 Here is a screenshot with all the tables in an Excel document and an ER diagram in Visio, showing the thought process used to achieve third normal form: RecordData and the UserData tables are the two main tables. UserData will be used to pull records out about individual users, whilst RecordData is used to pull out records about individual lap times. SelectData is then used to join the two together, and will be vital later on when doing an INNER JOIN. In both tables cases though, the majority of data is pulled out of other tables. - Page 6 -

7 The way this is done through the PHP is through the use of drop down menus. In my HTML website, a drop down list would look like the following: With PHP, as I'm now connecting to the database, the values would be pulled out of the ConsoleData table using a MySQL SELECT query: The benefit of also pulling the information from the database is that it reduces the possibility of making errors when typing data in, and also it reduces the amount of lines of code within the PHP file. This process is repeated for every select statement, so whenever I am selecting from the GameData, CircuitData, WeatherData, DifficultyData and TeamData, I can use the same base code similar to the above. This was frequently used on the create.php and search.php pages, which users can use to create a record and search a record. It is also used on editrecord.php and editmyf1.php, but the above is slightly more advanced as we want one value in the drop down lists already selected this is achieved with an IF and ELSE inside the WHILE statement. - Page 7 -

8 Seed the database with some appropriate data for testing purposes and upload data from a web form and store it in the database As part of my website, users need to be able to insert data into the database. This is most prominent in register.php and create.php as the user will need to be able to register an account. It is possible though for users to abuse the system by entering no username, no password or no address, yet still be able to register an account. To work around this, I coded the page so that they would be unable to register an account without any of these three things. Furthermore, I needed to check if the username already existed in the database, otherwise you could have multiple users with the same username. To check for this, an execution had to be performed on the database, to find the amount of rows a username and e- mail address already registered: If none of those statements are returned true, then a user account is created for the user, and they are automatically logged in. The other insert is from the create.php page. In this case, all of them are drop downs, which, as demonstrated earlier, the data is pulled from the relevant table in the database. This was a fairly simplistic process to insert the data, as there is no room for users to make an error. The only problem comes with the Time, as the format must be in MM:SS.000, which is the usual format used for Formula 1 timing. Two things have to be checked: the data type that the user is entering, in that it must be an integer, and that the user is not entering an 'impossible' lap time, for example under 1 minute. As the data is being inserted into the database table, there was some confusion as to what would me the most logical way of doing it. - Page 8 -

9 The way that I eventually chose to do it was to turn the format within the PHP file from MM:SS.000 to milliseconds, and then it would be turned back into MM:SS.000 whenever the user requests data from the database. When the data is inserted into the database though, it has to link the DataID with the UserID of the user that is inputting the data. This requires several SELECT queries, as the UserID needs to be selected from the UserData table, with the DataID and UserID being inserted into the SelectData table. There is a different style of insert as well within the website, which concerns the myf1.php and editmyf1.php files. These are the user profiles pages. For example, if I am logged in as 'Dave', myf1.php pulls all of my data out of the database, whilst I can then edit it by clicking the edit button, which will take me to editmyf1.php. The layout of the page is broadly similar in nature to register.php. The difference here however is that instead of using the INSERT operation, the UPDATE function is used. INSERT is only used when you are inserting new data into the database, whereas UPDATE is used when you are changing data that already exists within the database. As with the register.php page, data that is entered by the user has to be fully checked to make sure it is compliant with what is required. The way I approached this was with several IF statements. If the username that is entered through the field matches the original username (same with address), then no checks need to be made, as the data is already in the database, and therefore is already compliant as it successfully went through the checks on register.php. If the details do not match, ie. the user has decided to change them, then the - Page 9 -

10 details need to be checked again, to make sure: a) no one has that username or address b) neither box is blank As demonstrated above, condition A selects all rows from the database where the username is identical to the new username that the user has requested. If anyone has that username (ie if the number of rows bigger than 0) then it returns that particular statement. It then checks the ELSE IF to check that $username has some content within it. If it doesn't, then it returns that statement. If neither of those two IF's are true, then it updates the database where UserID is equal to the user's UserID. The password can be updated, but only needs to be checked against condition b as it is possible (although highly unlikely) for many users to have the same password. No checks need to be made for favourite circuit, team and game, because these are dropdowns, so no errors can be possibly made. - Page 10 -

11 Pull data from the database and display it on a web page and add the capability to display the data in ascending or descending order based on a a user-selected field There are many pages in my website where data is pulled from the database and displayed on the webpage. The main case of this happening is when searching. The user chooses the search conditions that they want to search for, with result.php displaying the resulting data. The basis of the SQL statement is that I am selecting all data from the RecordData table where X = x, Y = y and Z = z. What happens regarding the where statements dependent on what the user chose to search. In the search.php page, the user has the option to select 'All' teams for example, or choose a specific team. In the database, All is option 1, with the teams option 2, 3, 4 and so on. Therefore, because of this, the next phase of the page consists of IF statements which appends information to the SQL query if the user has not selected all information for that particular part of the search. - Page 11 -

12 The data is then displayed in a table. Although the above is successful, because there is a Username column, the Username needs to be retrieved from the UserData table. An INNER JOIN is therefore performed on the UserID from SelectData to retrieve the Username from the table. From there, the game names, circuit names and so on are displayed depending on what is in $gameid, $circuitid and so on, as they are retrieved from their respective tables. To finish that file off, we need the time which is a reversal of what I did earlier. - Page 12 -

13 I believe the way I have formatted the data here is in a professional, well laid out manner that the user can read, and navigate through in a straightforward way. An extra capability when searching is for the user to sort information by whichever field they wish to. I have only done it where it should logically apply though, and for that reason, Username is not sorted in any way as there is no logical reason to do so. The other fields can all be sorted by ascending order. The reason I have not done it by descending order is again because there is no logical reason to so. For example, where the lap time is concerned, there is no reason to sort by descending order, as users are aiming to have the fastest time, not the slowest, therefore there is no reason to have the fastest time at the top of the page. A similar process for displaying data on the webpage is used for the myf1.php file, except in that case, only that users details are retrieved. This can be done via $_SESSION['username']. As that variable holds the username, I can use that for the basis of my SELECT query which will retrieve that particular user's record data from the database. Again, an INNER JOIN is required, this time on the UserID: The information is then displayed in tabular form, in the same way as the result.php page. The only addition here is the addition of an 'Edit' problem. Clicking the link takes the user to editrecord.php?id=id the latter ID dependent on whichever DataID it is that the user has clicked on. When editing information from the database, the information is pulled out into a form, similar to the registration form, except the information is already in each field ready for the user to edit. It makes logical sense to have it displayed in a form, given that is the method that the user used to enter it a originally hence it uses a consistent displaying format across all pages. The information here does not need to be error checked before displaying first time as it would have been error checked before being processed into the database. I think displaying in a form is the most logical way of doing it, and also beneficiary for screen readers due to the layout used. - Page 13 -