CS Homework 6. Deadline. Purpose. How to submit. Important notes. Problem 1. Spring CS Homework 6 p. 1

Transcription

1 Spring CS Homework 6 p. 1 Deadline Due by 11:59 pm on Sunday, March 11, Purpose CS Homework 6 To encourage you to look over the course PHP style standards, and to give you more practice with PHP, including using PHP to interact from the application tier with the client tier. How to submit Each time you wish to submit, submit your homework files using ~st10/328submit on nrsprojects, with a homework number of 6. Important notes NOTE: you are welcome to use require_once and include_once in your PHP documents! BUT when you use them in problems' documents, be sure to also SUBMIT copies of all files that you are requiring/including! DO NOT USE ANY PHP FRAMEWORKS FOR THESE PROBLEMS -- one of this course's purposes is to provide you with practice with "plain" PHP. You are required to use normalize.css for all of your web pages for CS 328. EXCEPT for normalize.css, DO NOT USE ANY CSS FRAMEWORKS or PREDEFINED LIBRARIES FOR THIS HOMEWORK (or for this course unless you get prior, explicit permission). One of this homework's purposes is to provide you with some practice with the basics of "plain" CSS3. Note: you may be presenting versions of some of these documents/applications to the class at some point. There are now CS 328 PHP Coding Standards so far posted on the public course web site, under References -- you are also expected to follow these for all course PHP documents. You are expected to follow all course coding standards posted on the public course web site; course documents are also expected to validate as "strict"-style HTML5, and valid CSS3. Make sure that you have executed the scripts create-bks.sql and pop-bks.sql, and that the bookstore tables are successfully created and populated. Problem 1 As a small warm-up -- let's give you an immediate reason to refer to those newly-posted CS PHP coding standards! (Note that they can be found in the References section on the public course web site, AND in the PHP references page linked to from the public course web site, AND on the "Homeworks and handouts" page along with this homework handout.)

2 Spring CS Homework 6 p. 2 Make a file 328hw6-php.txt, and start this file with your name and the last modified date. Then answer the following questions based on the posted CS PHP coding standards, preceding each answer with the part that it is for (1 part a, 1 part b, etc.). 1 part a Write an example of what these style guidelines call a regular PHP tag. 1 part b Write an example of what these style guidelines call a PHP expression tag. 1 part c Where should the opening and closing tags for regular PHP tags be placed? 1 part d In contrast when compared to regular PHP tags, where are you encouraged to put PHP expression tags? 1 part e Where are PHP curly braces, { and }, expected to be placed? 1 part f As you know, you are expected to treat all user input as untrusted -- what is an example of a PHP function mentioned in the PHP coding standards handout that you can use to help guard against crosssite scripting? 1 part g To guard against SQL injection, you are advised to try to avoid dynamic SQL statements built using concatenation. What is an example of one of the alternatives mentioned in the PHP coding standards handout? Submit your file 328hw6-1.txt. Problem 2 In this problem, you will practice with a PHP document that is stand-alone (it does not create a form, it does not respond to a form). Create a PHP document 328hw6-2.php that meets the following requirements: Include your name and last modified date in its opening comment, AND the URL this can be run from. It will be an automatic -10 penalty from your bonus if this URL does not display this page when I/the grader attempt to use it in a browser. Include an appropriate h1 element.

3 Spring CS Homework 6 p. 3 Add your name within its body element in some visible fashion in an appropriate element of your choice. In Section of the course textbook, on p. 157, they mention that PHP has a pseudo-random function rand. Include an h2 element noting that this is rand practice, and note the two arguments you will be using for this demonstration. Then include a ul element whose at-least-five list items are created using a loop -- either a while loop or a for loop, your choice -- that sets the contents of each list item to the result of calling rand with those same two arguments. In Section of the course textbook, on pp , they mention that PHP includes quite a nice set of string-related functions, including one borrowed from the C language, sprintf. sprintf expects a format-string and as many expressions as there format-patterns within that string, and returns a string formatted as specified. For example, <p> Look at the result of 2/3 formatted to 6 fractional places: <?= sprintf("%.6f", 2/3)?> </p>...results in the following in the response document: And: <p> Look at the result of 2/3 formatted to 6 fractional places: </p> <p> <code><?= sprintf("[%5s -*- %05d]", "moo", 13)?></code> </p>...results in the following in the response document: <p> <code>[ moo -* ]</code> </p> Include a p element in which, within its contents: you include at least two PHP expression tags that insert the results of at least two calls to sprintf (each including at least one format-pattern noticeably formatting at least one value). At least one of these two sprintf calls should format a numeric value to 2 fractional places. Arrays are described in Section 5.4.3, starting on p. 181, in the course textbook. (By the way, you can see a list of some of PHP's impressive collection of array-related functions on p. 183!) Within a regular PHP tag, create an array containing at least 10 elements of your choice. Include an h2 element noting that this is array and foreach practice, and note how many elements are in your array. Then, within a ul element, use a PHP foreach loop (described in Week 7 - Lecture 2 and on p. 185 of the course text) that sets the contents of the list items to the contents of your array (one list item per array element).

4 Spring CS Homework 6 p. 4 Submit your file 328hw6-2.php. Problem 3 With PHP, it is reasonably common to have ONE PHP document create several related pages (a form AND its response, for example). You will see this in class examples on Week 8 - Lecture 1, but here is the basic information you need to try this out: FIRST: there is a superglobal associative array $_SERVER that has useful server-related information in it. SECOND: there is a superglobal named constant, PHP_SELF, that when used as the key in $_SERVER ($_SERVER[PHP_SELF]), contains the value of the file name for the PHP document. So -- if you are writing a PHP document where one part of the logic creates a form that leads to a screen generated by another part of the same PHP document, you COULD put: action="$_server[php_self]"...and KNOW it will lead to this same PHP document (even if you move it to another file name or directory later -- convenient!) HOWEVER --.it turns out that $_SERVER[PHP_SELF] is subject to cross-site scripting! If I am understanding correctly, this can appropriately sanitize this expression: <form action="<?= htmlentities($_server['php_self'], ENT_QUOTES)?>" method="post"> So, you should use the above in the form element of the PHP document you are about to create for this problem. That is, you can have a PHP document that contains an if statement, such that: SO... IF an expected value is NOT a key in the $_POST array (appropriately using array_key_exists!), it assumes the user wants to see a document including a form element they can use to enter desired values. (And, the action attribute of this form element is the sanitized value of $_SERVER[PHP_SELF], so that it leads BACK to this very PHP document.) ELSE it assumes it should craft a response to that form. I'm calling an input element with type="number" a number-field, and an input element with type="submit" a submit button. Create a PHP document 328hw6-3.php, formatted just by normalize.css, that meets the following requirements: Include your name and last modified date in its opening comment, AND the URL this can be run from. It will be an automatic -10 penalty from your bonus if this URL does not display this page when I/the grader attempt to use it in a browser.

5 Spring CS Homework 6 p. 5 Include an appropriate h1 element. Add your name within its body element in some visible fashion in an appropriate element of your choice. Its initial form should contain at least: one number-field, at least ONE OTHER form control element a submit button Its response should VISIBLY do something, based on the "other" form control element(s), the number of times entered into the number-field. (This could be as simple as, for example, printing something entered into a textfield the number of times entered into the number-field, or the response could be something more involved -- you get to decide!) The response should ALSO include a hypertext link with appropriate text that links back to 328hw6-3.php. Make sure you appropriately sanitize the inputs provided by the user! (And remember that this care is necessary regardless of the form control in use -- the actual request might NOT be coming from your form!) Submit your file 328hw6-3.php. Problem 4 You will now develop another PHP document that creates an initial form and also responds to that form. But now we'll also add some PHP functions and require_once practice. You have seen an example of a PHP function in a separate PHP file -- function square in file square.php from Week 7 Lecture 1. And, you have seen how we can include that function in the head element of a PHP document using require_once, as demonstrated in Week 7 Lecture 1's expr-play1.php. First create a PHP file 328hw6-4-functs.php that meets the following requirements: It includes a comment giving the name, what it expects (or noting that it expects nothing if that is the case), and what its side-effects are, followed by the definition for a function make_form that creates a form containing at least: four checkboxes three other types of form controls of your choice (for example, a textfield, a number field, a logical set of radio buttons, a select/drop-down box, a textarea, etc.) a submit button...and the resulting form's action attribute should be set to "<?= htmlentities($_server['php_self'], ENT_QUOTES)?>" (make_form does not have to expect any arguments, but it can design it to expect some if you

6 Spring CS Homework 6 p. 6 would like) It also includes a comment giving the name, what it expects (or noting that it expects nothing if that is the case), and what its side-effects are, followed by the definition for a function make_response that : VISIBLY does something based on the input submitted from make_form's form control element(s) (This could be as simple as, for example, summarizing the user's form responses, or the response could be something more involved -- you get to decide!) Make sure you appropriately sanitize the inputs provided by the user! (And remember that this care is necessary regardless of the form control in use -- the actual request might NOT be coming from your form!) (make_response does not have to expect any arguments, but it can design it to expect some if you would like) Then also create a PHP document 328hw6-4.php, formatted by 328hw6-4.css, that meets the following requirements: Include your name and last modified date in its opening comment, AND the URL this can be run from. It will be an automatic -10 penalty from your bonus if this URL does not display this page when I/the grader attempt to use it in a browser. Use require_once in the head element to include your functions from 328hw6-4-functs.php Include an appropriate h1 element. Add your name within its body element in some visible fashion in an appropriate element of your choice. Within its if statement, it appropriately calls functions make_form and make_response to create either the desired form or its response. Your 328hw6-4.css should attractively and readably style this form and its response. Submit your files 328hw6-4-functs.php, 328hw6-4.php and 328hw6-4.css.