Presentation is loading. Please wait.

Presentation is loading. Please wait.

PHP Hypertext Preprocessor Information Systems 337 Prof. Harry Plantinga.

Similar presentations


Presentation on theme: "PHP Hypertext Preprocessor Information Systems 337 Prof. Harry Plantinga."— Presentation transcript:

1 PHP Hypertext Preprocessor Information Systems 337 Prof. Harry Plantinga

2 Getting Nice Output We’ve been talking mainly about functionality of web sites We’ve been talking mainly about functionality of web sites Many major sites differ mainly in looks Many major sites differ mainly in looks Theme system formats output Theme system formats output To understand the theme system and to make your own modules requires PHP To understand the theme system and to make your own modules requires PHP

3 PHP Overview What is it? What is it? PHP Hypertext Preprocessor PHP Hypertext Preprocessor Server-side scripting language Server-side scripting language Alternative to e.g. Microsoft’s ASP Alternative to e.g. Microsoft’s ASP Widely used, cross-platform, free Widely used, cross-platform, free PHP files contain PHP files contain HTML HTML PHP code PHP code

4 PHP Example MSPSP U14 Boys Classic 3

5 PHP Basics /* comments */ /* comments */ Variables: loosely typed Variables: loosely typed $var1 = "hello world"; $var2 = 7; C/Java/JavaScript-like syntax for expressions, arrays, if, for, while, switch, etc C/Java/JavaScript-like syntax for expressions, arrays, if, for, while, switch, etc Associative arrays, concatenation like perl: $mascot('calvin')='knight'; $mascot('hope') = 'flying'. ' dutchman'; Associative arrays, concatenation like perl: $mascot('calvin')='knight'; $mascot('hope') = 'flying'. ' dutchman'; functions: function add($a, $b) { return $a + $b; } functions: function add($a, $b) { return $a + $b; }

6 Question How would I write PHP to Display "Hello world!" Display "Hello world!" Hello world! "); ?> Hello world! "); ?> Display … 100 Display … 100 Display the current date Display the current date Load in a server side include file Load in a server side include file

7 Question How can you read and use data entered into a form? How can you read and use data entered into a form?

8 PHP Forms Handling Forms handling, GET and POST Forms handling, GET and POST hello.html hello.html Name: Name: hello.php hello.php Welcome, ! Welcome, ! Also, $_GET["attname"] (example) Also, $_GET["attname"] (example)example

9 Question How can you keep track of a user's preferences for your website, say preferred font size? How can you keep track of a user's preferences for your website, say preferred font size?

10 Cookies Built-in cookie handling: setcookie(name, value, expire, path, domain); $expire = time() + 60*60*24*365; setcookie("fontsize","120%",$expire); Built-in cookie handling: setcookie(name, value, expire, path, domain); $expire = time() + 60*60*24*365; setcookie("fontsize","120%",$expire); Retrieve a cookie: echo $_COOKIE["fontsize"]; Retrieve a cookie: echo $_COOKIE["fontsize"]; Example Example Example

11 Sessions Session variables are a convenient way to keep track of users over different pageviews Session variables are a convenient way to keep track of users over different pageviews Kept as a cookie or propagated in the URL Kept as a cookie or propagated in the URL Starting a session: … Starting a session: … Storing a session variable: Storing a session variable:

12 "We've received your ; someone will get back to you soon…" "We've received your ; someone will get back to you soon…"

13 Database access Example mysql_select_db("my_db", $con); $result = mysql_query("SELECT * FROM Persons"); while($row = mysql_fetch_array($result)) { echo $row["FirstName"]." ". $row["LastName"]; echo " "; } mysql_close($con); ?>

14 A Test… What happens if I log in to a server with the username hi' or 1=1— What happens if I log in to a server with the username hi' or 1=1— How about something like this? UNION SELECT TOP 1 COLUMN_NAME FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_NAME='admin_login'— How about something like this? UNION SELECT TOP 1 COLUMN_NAME FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_NAME='admin_login'— Called an SQL Injection attack Called an SQL Injection attackSQL Injection attackSQL Injection attack How to prevent? How to prevent?

15

16 Input filtering Make sure input values are valid and safe Make sure input values are valid and safe ALWAYS FILTER ALL INPUT DATA! ALWAYS FILTER ALL INPUT DATA! Example Example

17 Sanitizing filters Sanitizing filters: remove harmful content Sanitizing filters: remove harmful content FILTER_SANITIZE_STRING, …ENCODED, …SPECIAL_CHARS, …EMAL, …URL, …NUMBER_INT, …MAGIC_QUOTES [apply addslashes()] FILTER_SANITIZE_STRING, …ENCODED, …SPECIAL_CHARS, …EMAL, …URL, …NUMBER_INT, …MAGIC_QUOTES [apply addslashes()] Validation filters Validation filters FILTER_VALIDATE_INT, BOOLEAN, FLOAT, REGEXP, URL, , IP FILTER_VALIDATE_INT, BOOLEAN, FLOAT, REGEXP, URL, , IP

18 Ethical responsibility… How common are these attacks? How common are these attacks?common Do you have any ethical responsibilities here? Do you have any ethical responsibilities here?


Download ppt "PHP Hypertext Preprocessor Information Systems 337 Prof. Harry Plantinga."

Similar presentations


Ads by Google