Secure PHP Development- P94 pdf

Designing and implementing the Form class
The Form class is used to manipulate each form. It allows an application to create,
modify, and delete a form. The ch13/apps/class/class.Form.php file on the
CD-ROM implements this class. This class implements the following methods.
Form()
This is the constructor method. It works as follows:
◆
First it sets a member variable named dbi to point to the class.DBI.php-
provided object, which is passed to the constructor by an application. The
dbi member variable holds the DBI object, which is used to communicate
with the back-end database.
◆
Then it sets member variables named frm_tbl, submtn_tbl, and sub-
scr_tbl
to store the names of the form table, submission table, and sub-
scription table, respectively.
◆
It also sets member variables named field_arr (to store the form table
attributes and their type as an array) and fields (to hold the attributes as
a comma-separated string).
◆
Then it calls the setFormID() method to set the Form ID that has been
passed as a parameter.
setFormID()
This method is used to set the form ID as member variable fid. It takes the ID as a
parameter and returns it after setting it to the member variable if the ID is not
empty.
getFormInfo()
This method is used to retrieve all the information for a given form. This is how it
works:
◆

First it calls the setFormID() method to set the given form ID.
◆
Then it builds a query statement to retrieve all the attribute values of the
form and stores the statement $stmt.
◆
Using the DBI object ($this->dbi), the $stmt statement is run via the
$this->dbi->query() method in the DBI object. The result of the query
is stored in the $result variable.
◆
The method directly returns null when it finds out, using the numRows()
method, that the $result object has no rows.
◆
Otherwise, the row is fetched using the fetchRow() method and stored in
$row.
436 Part III: Developing E-mail Solutions
17 549669 ch13.qxd 4/4/03 9:26 AM Page 436
◆
Then the member variable field_arr is looped through to store each col-
umn value of the $row object into the $retArr array with the respective
field name as the key for each value. The values are formatted using the
stripslashes() method before storing them in the array.
◆
Then the $retArr array is returned from this method.
getAllForms()
This method is used to retrieve all the forms from the database. This is how it
works:
◆
First a query statement is prepared and stored in $stmt to retrieve the
form number and form name of all the forms.
◆

Using the DBI object ($this->dbi), the $stmt statement is run via the
$this->dbi->query() method in the DBI object. The result of the query
is stored in the $result variable.
◆
The method directly returns null when it finds out, using the numRows()
method, that the $result object has no rows.
◆
Otherwise, each row of the $result object is fetched using the
fetchRow() method and $retArr is prepared with all the form IDs and
form names.
◆
At the end, the $retArr array is returned.
addForm()
This method is used to add new forms to the database. It works as follows:
◆
From the given parameter, all the values that are supposed to be of text
type in the database are escaped for characters such as quotation marks
and slashes using $this->dbi->quote(addslashes()) methods.
◆
Then all the parameter values are taken into a string named
$paramValueStr by imploding a comma among them.
◆
A SQL statement, $stmt, is created to insert the new form data into the
form table using the member variable fields (contains attribute names)
and $paramValueStr.
◆
The SQL statement is executed using the $this->dbi->query() method
and the result of the query is stored in the $result object.
◆
If the $result status is not okay, the method returns false.

◆
Otherwise, another query statement is prepared to retrieve the form ID of
the newly added form by using the form name, which is a unique field, in
the where condition.
◆
The statement is executed as usual and the form ID is returned from the
method.
Chapter 13: Tell-a-Friend System 437
17 549669 ch13.qxd 4/4/03 9:26 AM Page 437
modifyForm()
This method is used to modify forms. This is how it works:
◆
From the given parameter, all the values that are supposed to be of text
type in the database are escaped for characters such as quotation marks
and slashes using $this->dbi->quote(addslashes()) methods.
◆
Then a string named $keyValue is prepared that contains all the attribute
names and values as attr1 = value1, attr2 = value2, . . . format
◆
A SQL statement, $stmt, is created to update the form data using
$keyValue.
◆
The SQL statement is executed using the $this->dbi->query() method
and the result of the query is stored in the $result object.
◆
The method returns TRUE or FALSE depending on the status of the $result.
deleteForm()
This method is used to delete a given form. It takes form ID as the parameter and
returns TRUE or FALSE depending on the status of the deletion operation.
isMaximumSubmitted()

This method identifies whether the maximum number of friends allowed has
exceeded or not for the given originator according to the form configuration. This
is how it works:
◆
First it sets the given form ID using the setFormID() method.
◆
Then the given originator e-mail is formatted using $this->dbi-
>quote(addslashes())
methods.
◆
Then a query statement is prepared to retrieve the number of friends sub-
mitted by the given originator for the given form.
◆
Then the number of maximum allowed friends is retrieved using the
getFormInfo() method.
◆
Then the two numbers are compared to return TRUE when the number of
friends submitted is already equal to or greater than the maximum
allowed; otherwise, it returns FALSE.
addSubmissionData()
This method is used to add friend submission data in to the database. It works as
follows:
◆
First it sets $field_arr (to store the submission table attributes and
their type as an array) and $fields (to hold the attributes as a comma-
separated string).
438 Part III: Developing E-mail Solutions
17 549669 ch13.qxd 4/4/03 9:26 AM Page 438
◆
From the given parameter, all the values that are supposed to be of text

type in the database are escaped for characters such as quotation marks
and slashes using $this->dbi->quote(addslashes()) methods.
◆
Then all the parameter values are taken into a string named
$paramValueStr by imploding comma among them.
◆
A SQL statement, $stmt, is created to insert the new submission data into
the submission table using $fields and $paramValueStr.
◆
The SQL statement is executed using the $this->dbi->query() method
and the result of the query is stored in $result object.
◆
If the $result status is not okay, the method returns false.
◆
Otherwise, another query statement is prepared to retrieve the friend ID of
the newly submitted friend by using the friend e-mail and form ID, which
are the unique fields, in the where condition.
◆
The statement is executed as usual and the friend ID is returned from the
method.
getFriendList()
This method returns the list of all friends for a given form. This is how it works:
◆
First it sets the given form ID using the setFormID() method.
◆
Then it prepares a query to retrieve the friend ID and e-mail from the sub-
mission table for the given form.
◆
The SQL statement is executed using the $this->dbi->query() method
and the result of the query is stored in the $result object.

◆
The method directly returns null when it finds out, using the numRows()
method, that the $result object has no rows.
◆
Otherwise, each row of the $result object is fetched using the
fetchRow() method and $retArr is prepared with all the friend IDs and
e-mails.
◆
At the end the $retArr array is returned.
addSubscriptionData()
This method is used to add subscription data after a friend decides to subscribe or
unsubscribe. It works in the following manner:
◆
First it sets $field_arr (to store the subscription table attributes and
their type as an array) and $fields (to hold the attributes as a comma-
separated string).
Chapter 13: Tell-a-Friend System 439
17 549669 ch13.qxd 4/4/03 9:26 AM Page 439
◆
From the given parameter, all the values that are supposed to be of text
type in the database are escaped for characters such as quotation marks
and slashes using $this->dbi->quote(addslashes()) methods.
◆
Then all the parameter values are taken into a string named
$paramValueStr by imploding a comma among them.
◆
A SQL statement, $stmt, is created to insert the new subscription data
into the submission table using $fields and $paramValueStr.
◆
The SQL statement is executed using the $this->dbi->query() method

and the result of the query is stored in the $result object.
◆
The method returns TRUE or FALSE depending on the status of $result.
This method is used to determine whether the given friend has already unsub-
scribed. It takes the friend’s e-mail as the parameter and checks whether the e-mail
is already unsubscribed or not.
getNumberOfSubscriber()
This method returns the number of friends that have subscribed for a given form. It
takes the form ID as a parameter and returns the number of subscribers for that
form.
getNumberOfUnsubscriber()
This method returns the number of friends that have unsubscribed for a given form.
It takes the form ID as a parameter and returns the number of unsubscriber for that
form.
getOriginSubmissions()
This method returns the originator information for a given form. This is how it
works:
◆
First it sets the form ID using the setFormID() method.
◆
Then it prepares a query statement to retrieve the originator e-mails and
number of submission by each of them.
◆
The SQL statement is executed using the $this->dbi->query() method
and the result of the query is stored in the $result object.
◆
The method directly returns null when it finds out, using the numRows()
method, that the $result object has no rows.
◆
Otherwise, each row of the $result object is fetched using the

fetchRow() method and $retArr is prepared with all the originator
e-mails and number of submissions by each of them.
◆
At the end, the $retArr array is returned.
440 Part III: Developing E-mail Solutions
17 549669 ch13.qxd 4/4/03 9:26 AM Page 440