Secure PHP Development- P104 ppt

delSurvey()
This method is called when the run() method is passed $cmd=’delete’ from the
user interface. This method uses the deleteSurvey() method of a Survey object to
delete the chosen survey (indicated by $survey_id, which is also passed from user
interface).
saveSurvey()
This method saves a new survey with the data given from the survey add interface.
It uses the addSurvey() method of a Survey object to perform the actual add sur-
vey operation.
The method displays a status message based on the success or failure of the add
operation.
displayMenu()
This method displays a user interface. It can display either the survey management
menu interface or the survey add interface.
When this method is called from the run() method, it displays the survey menu
interface ($SURVEY_MENU_TEMPLATE) and when it is called from the create
SurveyDriver()
it displays the survey add interface ($SURVEY_ADD_TEMPLATE).
authorize()
This method is responsible for authorizing the user to run the application. In this
version, this method always returns TRUE. If you want to implement a user-level
access control for the survey management application, you’ll have to change the
current implementation of the authorize() method. For example, if you want to
allow only a known group of users to administer surveys, you can store their user
ID in a new table within the survey database and perform a query to see if the cur-
rent user is a member of such a group.
Developing Survey List Manager
This application is responsible for managing the survey list. It performs the follow-
ing tasks:
◆
Allows the user to add a new list from a CSV file. The user uploads a CSV

file via the Web interface and assigns it a list name.
◆
Allows the user to delete an existing list.
◆
The ch14/apps/survey_list_mngr.php file in the CDROM is an imple-
mentation of the Survey List Manager application. This application creates
an instance of the PHPApplication class and uses the following methods.
run()
The run method performs the usual checks for authenticated and authorized users
and then uses the global $cmd variable to select either the addDriver() or the
delList() method. The value of the $cmd is set in the user interface displayed by
486 Part III: Developing E-mail Solutions
18 549669 ch14.qxd 4/4/03 9:26 AM Page 486
the Survey Manager application. If the $cmd variable is set to upload or empty the
addDriver() method is called to add a new list. If the $cmd variable is set to any-
thing else, the delList() method is called to delete a list.
addDriver()
This method uses a global variable called $step to determine which phase of the
add list process the user is currently at and selects the next step in the process.
For example, if the $step variable is empty, the first step in the add list process
is assumed and the displayAddListMenu() method is called to display the add list
interface.
If the $step value is anything but empty, the addList() method is called to add
the list in the database.
authorize()
See the authorize() method in the “Developing Survey Manager” section in this
chapter for details.
displayAddListMenu()
This method displays the add list interface. The interface HTML file name is retrieved
from the survey.conf file using the $SURVEY_ADD_LIST_TEMPLATE variable.

The current time stamp is embedded in the add list interface as a hidden
field called today to ensure that the user cannot enter the same list multi-
ple times. Because there is no accidental way for the user to generate the
same time stamp in submitting multiple lists, this field serves as the unique
flag associated with the list in the database.
delList()
This method is used to delete a chosen list. The chosen list is identified using a
global variable called $list_id, which is passed to the application via the user
interface as part of the request.
The actual delete operation is implemented using the deleteList() method
found in the SurveyList object.
The delList() method displays a success or failure status message based on the
status of the delete operation.
addList()
This method adds a list, for which data has been collected via the displayAddList
Menu()
method. This method performs the following tasks:
◆
It first checks to see if the upload has been successful and if the list name
is given. If any of these checks fails, the method returns an error message.
Chapter 14: E-mail Survey System 487
18 549669 ch14.qxd 4/4/03 9:26 AM Page 487
◆
It then copies the uploaded file in the list upload directory pointed by the
$UPLOAD_DIR variable found in survey.conf file.
◆
Next it creates a SurveyList object and uses the addNewSurveyList()
method to add all records in the uploaded CSV file in the new list.
◆
Finally, it displays a status message stating the success or failure of the

list upload.
Developing Survey Form Manager
This application is responsible for managing survey forms. It allows the user to add
or delete survey forms. The following methods are implemented in this application,
which can be found in ch14/apps/survey_form_mngr.php file in the CDROM.
run()
The run method performs the usual checks for authenticated and authorized users
and then uses the global $cmd variable to select either the addDriver() or the
delForm() method. The value of the $cmd is set in the user interface displayed by
the Survey Manager application. If the $cmd variable is set to anything other than
delete or empty, then the addDriver() method is called to add a new survey
form. Otherwise, the delForm() method is called to delete an existing survey form.
addDriver()
Using a global variable $step, which is set in the user interface, this method con-
trols the add survey form process.
When the $step variable is empty, the displayAddFormMenu() method is called to
display the initial add form interface, which collects the form data.
The next time the $step variable is set to 2 in the initial form data entry inter-
face displayed by displayAddFormMenu(), the addForm() method is called.
Finally, the addDriver() method calls the addLabels() method to collect data
about the question labels in Step 3.
authorize()
See the authorize() method in the “Developing Survey Manager” section for
details.
displayAddFormMenu()
This method displays the add form interface. The interface HTML file name is
retrieved from the survey.conf file using the $SURVEY_ADD_FORM_TEMPLATE
variable.
addForm()
This method adds the uploaded form to the survey system using the following steps:

488 Part III: Developing E-mail Solutions
18 549669 ch14.qxd 4/4/03 9:26 AM Page 488
◆
Checks to see if the user has entered the required subject ($subject) and
from address ($from) fields.
◆
Checks to see if the form is uploaded or the form name ($formname) is
empty.
◆
Checks to see if the user has entered the number of questions ($num_fields)
data.
◆
If all of the preceding checks passes, the uploaded file is copied into the
forms directory from the $UPLOAD_DIR (set in survey.conf) and renamed
with the .ihtml extension.
◆
A SurveyForm object is created and its addNewSurveyForm() method is
called to create the form data in the database.
◆
Next, the addForm() method calls the takeFormLabels() method to dis-
play the label entry page for each questions unless the survey form could
not be added to the database. In case of insert failure, a status message is
displayed to notify the user.
takeFormLabels()
This method displays the interface to collect the question labels. It shows text entry
boxes per question so that the user can define question labels that are needed to
display the survey report.
addLabels()
This method adds the question labels entered in the interface displayed by the
takeFormLabels() method. The labels are added using the addLabel() method of

the SurveyForm object.
A status message is displayed to notify the status of the label addition in the
database.
delForm()
This method deletes a survey form from the database. The form ID is selected from
the interface shown by the Survey Manager interface.
The actual delete operation is implemented using the SurveyForm object’s
deleteForm() method.
Developing Survey
Execution Manager
This application executes a survey. Because this execution of each survey is done
via the Web, it’s important that this application doesn’t run continuously until the
survey finishes. Because web browsers can mistake the long time it takes to process
Chapter 14: E-mail Survey System 489
18 549669 ch14.qxd 4/4/03 9:26 AM Page 489
large campaigns as a timeout, I’ve implemented this method such that it will exe-
cute a set of records in the given campaign and then create an automatic refresh
using meta tags in HTML interface to call itself back after a configurable period of
time.
This allows the application to continue with small interruptions and also allows
it to report the status of the campaign using a status message after each chunk of
records has been processed for e-mail delivery. Therefore, the base algorithm of this
method can be written in the following pseudo code:
Get Last Record Executed
If No Last Record then
BEGIN
Set LastRecord = 0
END
Get a Chunk of Records > Last Record
Ordered by Record ID (SUID) AND

Limit By Maxmimum Records
Per Run
Get Message Template
For Each Record in Current Record List
BEGIN
Process for Mail using a Copy of the Message Template
Send Mail
END
Set LastRecord in Database to Current Last Record
Set Refresh Meta Tag
Terminate
The ch14/apps/survey_exec_mngr.php file in the CDROM implements this
application. This application has the following methods.
run()
The run method performs the usual checks for authenticated and authorized users
and then calls the executeSurvey() method to run the survey.
executeSurvey()
This method executes the chosen campaign. It works as follows:
490 Part III: Developing E-mail Solutions
18 549669 ch14.qxd 4/4/03 9:26 AM Page 490