Information Systems 337 Prof Harry Plantinga PHP Hypertext

  • Slides: 23
Download presentation
Information Systems 337 Prof. Harry Plantinga PHP Hypertext Preprocessor

Information Systems 337 Prof. Harry Plantinga PHP Hypertext Preprocessor

Getting Nice Output How do Drupal and other content management systems work? How can

Getting Nice Output How do Drupal and other content management systems work? How can you customize the look or functionality of your site? To understand theme system and to make your own modules requires PHP

PHP Overview What is it? PHP Hypertext Preprocessor Server-side scripting language Widely used, cross-platform,

PHP Overview What is it? PHP Hypertext Preprocessor Server-side scripting language Widely used, cross-platform, free PHP files contain HTML PHP code

PHP Example <h 2>MSPSP U 14 Boys Classic 3</h 2> <table style='width: 100%' id="standings">

PHP Example <h 2>MSPSP U 14 Boys Classic 3</h 2> <table style='width: 100%' id="standings"> <? php $result = db_query("select name, abbrev, wins, losses, ties, points, goals. For, goals. Against, power from stats. team order by points desc, power desc"); while ($row = db_fetch_array($result)) { echo("<tr><td><a href=”schedule? team=$row[abbrev]”>$row[name]</a></td>"); echo("<td>$row[wins]</td>"); echo("<td>$row[losses]</td>"); echo("<td>$row[ties]</td>"); echo("<td>$row[points]</td>"); echo("<td>$row[goals. For]</td>"); echo("<td>$row[goals. Against]</td>"); $power=round($row[power], 2); echo("<td style='text-align: right'>$power</td></tr>"); } ? > </table>

PHP Basics /* comments */ Variables: loosely typed $var 1 = "hello world"; $var

PHP Basics /* comments */ Variables: loosely typed $var 1 = "hello world"; $var 2 = 7; C/Java. Script-like syntax for expressions, arrays, if, for, while, switch, etc Associative arrays, concatenation like perl: $mascot('calvin')='knight'; $mascot('hope') = 'flying'. ' dutchman'; functions: function add($a, $b) { return $a + $b; }

Question How would I write PHP to Display "Hello world!" <? php echo("<h 1>Hello

Question How would I write PHP to Display "Hello world!" <? php echo("<h 1>Hello world!</h 1>"); ? > Display 1 2 3 4 5 … 100 <? php for ($i=1; $i<=100; $i++) echo("$i "); ? > Display the current date <? php echo date("Y-m-d"); ? > Load in a server side include file <? php include("header. php"); ? >

Question How can you read and use data entered into a form?

Question How can you read and use data entered into a form?

PHP Forms Handling Forms handling, GET and POST hello. html <form action="hello. php" method="post">

PHP Forms Handling Forms handling, GET and POST hello. html <form action="hello. php" method="post"> Name: <input type="text" name="name" /> <input type="submit"/> </form> hello. php <html> <h 3>Welcome, <? php echo $_POST["fname"]; ? >!</h 3> </html> Also, $_GET["attname"] (example)

Question How can you keep track of a user's preferences for your website, say

Question How can you keep track of a user's preferences for your website, say preferred font size?

Cookies Built-in cookie handling: setcookie(name, value, expire, path, domain); $expire = time() + 60*60*24*365;

Cookies Built-in cookie handling: setcookie(name, value, expire, path, domain); $expire = time() + 60*60*24*365; setcookie("fontsize", "120%", $expire); Retrieve a cookie: echo $_COOKIE["fontsize"]; Example

Sessions Session variables are a convenient way to keep track of users over different

Sessions Session variables are a convenient way to keep track of users over different pageviews Kept as a cookie or propagated in the URL Starting a session: <? php session_start(); ? > <html>… Storing a session variable: <? php session_start(); $_SESSION['font. Size. Pref']=14; ? >

Email "We've received your email; someone will get back to you soon…" <? php

Email "We've received your email; someone will get back to you soon…" <? php $to = "hplantin@calvin. edu"; $from = "leroy@calvin. edu"; $subject = "Good job!"; $message = "Just wanted to say…"; $headers = "From: $from"; mail($to, $subject, $message, $headers); echo "Mail Sent. "; ? >

Database access Example <? php $con = mysql_connect("localhost", "peter", "abc 123"); if (!$con) die('Could

Database access Example <? php $con = mysql_connect("localhost", "peter", "abc 123"); if (!$con) die('Could not connect: '. mysql_error()); mysql_select_db("my_db", $con); $result = mysql_query("SELECT * FROM Persons"); while($row = mysql_fetch_array($result)) { echo $row["First. Name"]. " ". $row["Last. Name"]; echo "<br />"; } mysql_close($con); ? >

What if… Web page: <form method=“GET” action=“process. php”> <input type=“text” name=“username”> Server code: $query

What if… Web page: <form method=“GET” action=“process. php”> <input type=“text” name=“username”> Server code: $query = “SELECT * FROM users WHERE name=‘“. $_GET[‘username’]. “’”;

More trouble

More trouble

More trouble

More trouble

A Test… What happens if I log in to a server with the username

A Test… What happens if I log in to a server with the username hi' or 1=1— How about something like this? http: //duck/index. asp? id=10 UNION SELECT TOP 1 COLUMN_NAME FROM INFORMATION_SCHEMA. COLUMNS WHERE TABLE_NAME='admin_login'— How to prevent?

SQL Injection Called an SQL Injection attack How to prevent? Filter inputs Parameterized queries

SQL Injection Called an SQL Injection attack How to prevent? Filter inputs Parameterized queries

Parameterized input

Parameterized input

Input filtering Make sure input values are valid and safe ALWAYS FILTER ALL INPUT

Input filtering Make sure input values are valid and safe ALWAYS FILTER ALL INPUT DATA! Example <? php $int = "I 23"; if(!filter_var($int, FILTER_VALIDATE_INT)) echo("Integer is not valid"); else echo("Integer is valid"); ? >

Sanitizing filters Sanitizing filters: remove harmful content FILTER_SANITIZE_STRING, …ENCODED, …SPECIAL_CHARS, …EMAL, …URL, …NUMBER_INT, …MAGIC_QUOTES

Sanitizing filters Sanitizing filters: remove harmful content FILTER_SANITIZE_STRING, …ENCODED, …SPECIAL_CHARS, …EMAL, …URL, …NUMBER_INT, …MAGIC_QUOTES [apply addslashes()] Validation filters FILTER_VALIDATE_INT, BOOLEAN, FLOAT, REGEXP, URL, EMAIL, IP

Ethical responsibility… How common are these attacks? Do you have any ethical responsibilities here?

Ethical responsibility… How common are these attacks? Do you have any ethical responsibilities here?

Information Systems 337 Prof Harry Plantinga Development andInformation Systems 337 Prof Harry Plantinga Development and
Information Systems 337 Prof Harry Plantinga Content strategiesInformation Systems 337 Prof Harry Plantinga Content strategies
Information Systems 337 Prof Harry Plantinga Website AdministrationInformation Systems 337 Prof Harry Plantinga Website Administration
PHPPHP Hypertext Preprocessor Introduction PHP or PHP HypertextPHPPHP Hypertext Preprocessor Introduction PHP or PHP Hypertext
Concept of Hypertext What is Hypertext Hypertext andConcept of Hypertext What is Hypertext Hypertext and
DBW PHP DBW 2017 PHP PHP hypertext processorDBW PHP DBW 2017 PHP PHP hypertext processor
7 5 PHP Development Definition PHP PHP Hypertext7 5 PHP Development Definition PHP PHP Hypertext
PHP PHP STAND FOR HYPERTEXT PREPROCESSOR PHP HISTORYPHP PHP STAND FOR HYPERTEXT PREPROCESSOR PHP HISTORY
PHP PHP Hypertext Preprocessor PHP banyak digunakan karenaPHP PHP Hypertext Preprocessor PHP banyak digunakan karena
PERTEMUAN 3 PENGENALAN PHP PHP Hypertext Prepocessor PHPPERTEMUAN 3 PENGENALAN PHP PHP Hypertext Prepocessor PHP
PERTEMUAN 3 PENGENALAN PHP PHP Hypertext Prepocessor PHPPERTEMUAN 3 PENGENALAN PHP PHP Hypertext Prepocessor PHP
PHP I PHP or PHP Hypertext Preprocessor isPHP I PHP or PHP Hypertext Preprocessor is
DBW PHP DBW 2018 PHP PHP hypertext processorDBW PHP DBW 2018 PHP PHP hypertext processor
PHP PHP Hypertext Preprocessor PHP An HTML embeddedPHP PHP Hypertext Preprocessor PHP An HTML embedded
index php input php regist php logincheck phpindex php input php regist php logincheck php
PHP Intro PHP Webintegrator PHP Baggrund PHP erPHP Intro PHP Webintegrator PHP Baggrund PHP er
PHP AVAudio Visual PHP PHP 20110910 yoya PHPPHP AVAudio Visual PHP PHP 20110910 yoya PHP
php PHP 4 Internals php Andi Gutmans PHPphp PHP 4 Internals php Andi Gutmans PHP
PHP Apa itu PHP PHP singkatan dari PHPPHP Apa itu PHP PHP singkatan dari PHP
Pemrogaman Web PHP PHP PHP akronim dari PHPPemrogaman Web PHP PHP PHP akronim dari PHP
Introduction to PHP HTML HTML PHP PHP phpIntroduction to PHP HTML HTML PHP PHP php
index php input php regist php logincheck phpindex php input php regist php logincheck php