Secure PHP Development- P22 pptx

// Dump the contents of the DBI object to
// see what it contains.
echo “<pre>”;
print_r($dbi);
echo “</pre>”;
?>
Here, $dbi is an instance of the DBI object created from class.DBI.php.
The constructor method has to be passed a database URL which has the
following syntax:
database_type://username:password↓tabase_host/database_name
The $DB_URL variable was set to create a database URL that pointed to a
MySQL database (mysql) named mydb on host called localhost The data-
base can be accessed using the root user account and foobar password.
The DBI() method sets the DB URL passed to itself as db_url member
variable and calls the connect() method to connect to the given data-
base. The constructor sets the fetch mode to DB_FETCHMODE_OBJECT,
which allows us to fetch database rows as objects.
◆
connect(): By default, the DBI() constructor method calls the connect()
function directly to establish the connection, so you don’t need to. con-
nect()
connects to the database specified in db_url member variable of
the object. It sets a member variable dbh to the database handle object
created by the DB::connect() method, which is found in the PEAR DB
package. connect also sets a member variable called connected to
Boolean TRUE or FALSE and returns that value.
◆
disconnect(): The disconnect() function disconnects the DBI object
from the database.
The terminate() function in PHPApplication class (class.
PHPApplication.php

) calls the disconnect() function if the applica-
tion is connected to a database. See terminate() function in
PHPApplication class for details.
◆
query(): This function performs a SQL query on the connected database.
The result of the query is stored in a result object called $result. If the
query returns SQL error(s), a member variable called $this->dbi->error
is set to the error message and null is returned.
76 Part II: Developing Intranet Solutions
07 549669 ch04.qxd 4/4/03 9:24 AM Page 76
If the query is successful, it returns the result object. The result object can
be used to fetch rows. For example, the test_query.php script tries to fetch
data from a table called PROD_TBL using a database URL such as
mysql://root:foobar@localhost/products.
<?php
// Turn on all error reporting
error_reporting(E_ALL);
// If you have installed PEAR packages in a different
// directory than %DocumentRoot%/pear change the
// setting below.
$PEAR_DIR = $_SERVER[‘DOCUMENT_ROOT’] . ‘/pear’ ;
// If you have installed PHPLIB in a different
// directory than %DocumentRoot%/phplib, change
// the setting below.
$PHPLIB_DIR = $_SERVER[‘DOCUMENT_ROOT’] . ‘/phplib’;
// If you have installed framework directory in
// a different directory than
// %DocumentRoot%/framework, change the setting below.
$APP_FRAMEWORK_DIR=$_SERVER[‘DOCUMENT_ROOT’] . ‘/framework’;
// Create a path consisting of the PEAR,

// PHPLIB and our application framework
// path ($APP_FRAMEWORK_DIR)
$PATH = $PEAR_DIR . ‘:’ .
$PHPLIB_DIR . ‘:’ .
$APP_FRAMEWORK_DIR;
// Insert the path in the PHP include_path so that PHP
// looks for our PEAR, PHPLIB and application framework
// classes in these directories
ini_set( ‘include_path’, ‘:’ .
$PATH . ‘:’ .
ini_get(‘include_path’));
// Now load the DB.php class from PEAR
require_once ‘DB.php’;
// Now load our DBI class from application framework
require_once(‘class.DBI.php’);
Chapter 4: Architecture of an Intranet Application 77
07 549669 ch04.qxd 4/4/03 9:24 AM Page 77
// Setup the database URL
$DB_URL = ‘mysql://root:foobar@localhost/products’;
// Create a DBI object that connects to the
// database URL
$dbi = new DBI($DB_URL);
if (! $dbi->isConnected())
{
echo “Connection failed for $DB_URL<br>”;
exit;
}
// Create a SQL statement to fetch data
$statement = ‘SELECT ID, NAME FROM PROD_TBL’;
// Execute the statement using DBI query method

$result = $dbi->query($statement);
// If the result of query is NULL then show
// database error message
if ($result == NULL)
{
echo “Database error:” . $dbi->getError() . “\n”;
// Else check if there are no data available or not
} else if (! $result->numRows()){
echo “No rows found.”;
// Now data is available so fetch and print data
} else {
echo “<pre>ID\tNAME<br>”;
while ($row = $result->fetchRow())
{
echo $row->ID, “\t”, $row->NAME, “<br>”;
}
echo “</pre>”;
}
?>
78 Part II: Developing Intranet Solutions
07 549669 ch04.qxd 4/4/03 9:24 AM Page 78
The SQL statement SELECT ID, NAME FROM PROD_TBL is stored in
$statement variable and passed to the DBI::query() method. The result
is tested first for null. If the result is null, the database error is printed
using the DBI::getError() method.
If there are no database errors, the next check is made to see if there are
any rows using the numRow() method from the $result object. If there
are no rows, an appropriate message is printed.
If there are data in the returned $result object, the result is printed in a
loop using the fetchRow() method.

The row data is fetched in $row object. The $row->DATA_FIELD method is
used to get the data for each field. For example, to retrieve the NAME field
data, the $row->NAME value is accessed.
◆
quote(): This is a utility function that puts a pair of single quotes around
a string to protect the string from being passed without quotation. Here’s
an example in which the $name field is single-quoted using $this->dbi-
>quote($name)
call:
<?php
// Turn on all error reporting
error_reporting(E_ALL);
// If you have installed PEAR packages in a different
// directory than %DocumentRoot%/pear change the
// setting below.
$PEAR_DIR = $_SERVER[‘DOCUMENT_ROOT’] . ‘/pear’ ;
// If you have installed PHPLIB in a different
// directory than %DocumentRoot%/phplib, change
// the setting below.
$PHPLIB_DIR = $_SERVER[‘DOCUMENT_ROOT’] . ‘/phplib’;
// If you have installed framework directory in
// a different directory than
// %DocumentRoot%/framework, change the setting below.
$APP_FRAMEWORK_DIR=$_SERVER[‘DOCUMENT_ROOT’] . ‘/framework’;
// Create a path consisting of the PEAR,
// PHPLIB and our application framework
// path ($APP_FRAMEWORK_DIR)
$PATH = $PEAR_DIR . ‘:’ .
$PHPLIB_DIR . ‘:’ .
$APP_FRAMEWORK_DIR;

Chapter 4: Architecture of an Intranet Application 79
07 549669 ch04.qxd 4/4/03 9:24 AM Page 79
// Insert the path in the PHP include_path so that PHP
// looks for our PEAR, PHPLIB and application framework
// classes in these directories
ini_set( ‘include_path’, ‘:’ .
$PATH . ‘:’ .
ini_get(‘include_path’));
// Now load the DB.php class from PEAR
require_once ‘DB.php’;
// Now load our DBI class from application framework
require_once(‘class.DBI.php’);
// Setup the database URL
$DB_URL = ‘mysql://root:foobar@localhost/foobar’;
// Create a DBI object that connects to the
// database URL
$dbi = new DBI($DB_URL);
if (! $dbi->isConnected())
{
echo “Connection failed for $DB_URL<br>”;
exit;
}
$id = 100;
$name = “Joe Gunchy”;
$name = $dbi->quote($name);
$statement = “INSERT INTO PROD_TBL (ID,NAME) “ .
“VALUES($id, $name)”;
$result = $dbi->query($statement);
if ($result == NULL)
{

echo “Database error:” . $dbi->getError() . “<BR>\n”;
} else {
echo “Added $name in database.<BR>\n”;
}
?>
80 Part II: Developing Intranet Solutions
07 549669 ch04.qxd 4/4/03 9:24 AM Page 80