Secure PHP Development- P146 pot

4. The row containing the number of votes is retrieved by fetching it from
the $result variable using the fetchRow() method.
5. Finally, the number of votes is returned from this method.
Creating the Application
Configuration Files
Like every other application developed in this book, the voting tool application also
uses a standard set of configuration and error files. These files are discussed in the
following sections.
Creating the main configuration file
The primary configuration file for the entire system is called vote.conf. Table 20-1
describes each configuration variable.
TABLE 20-1 VOTE.CONF VARIABLES
Configuration Variable Purpose
$PEAR_DIR Set to the directory containing the PEAR package;
specifically, the DB module needed for class.
DBI.php in
our application framework.
$PHPLIB_DIR Set to the PHPLIB directory, which contains the PHPLIB
packages; specifically, the
template.inc package
needed for template manipulation.
$APP_FRAMEWORK_DIR Set to our application framework directory.
$PATH Set to the combined directory path consisting of
$PEAR_DIR, $PHPLIB_DIR, and
$APP_FRAMEWORK_DIR. This path is used with the
ini_set() method to redefine the php.ini entry for
include_path to include
$PATH ahead of the default path.
This enables PHP to find our application framework,
PHPLIB, and PEAR-related files.
$APPLICATION_NAME Internal name of the application.

$DEFAULT_LANGUAGE Set to the two-digit default language code.
Continued
Chapter 20: Web Site Tools 701
26 549669 ch20.qxd 4/4/03 9:27 AM Page 701
TABLE 20-1 VOTE.CONF VARIABLES (Continued)
Configuration Variable Purpose
$ROOT_PATH Set to the root path of the application.
$REL_ROOT_PATH Relative path to the root directory.
$REL_APP_PATH Relative application path as seen from a Web browser.
$TEMPLATE_DIR The fully qualified path to the template directory.
$CLASS_DIR The fully qualified path to the class directory.
$REL_TEMPLATE_DIR The Web-relative path to the template directory used.
$VOTE_CLASS Name of the Vote class file.
$VOTE_DB_URL The fully qualified URL for the database used to store the
VOTE information.
$VOTE_TBL Name of the VOTES table in the database.
$COOKIE_EXPIRATION_TIME The amount of time, in seconds, that specifies the cookie
expiration time for a vote.
You may need to tailor to your own system’s requirements the directory struc-
ture used in the vote.conf file supplied in the ch20 directory on the CD-ROM. Here
is what the current directory structure looks like:
/ evoknow
|
+ intranet
|
+ htdocs ($ROOT_PATH)
|
+ vote (Voting Tool Applications)
|
+ apps (apps and configuration files)

|
+ class (class files)
|
+ templates (HTML templates)
|
+ images (images for the templates)
702 Part V: Internet Applications
26 549669 ch20.qxd 4/4/03 9:27 AM Page 702
By changing the following configuration parameters in vote.conf, you can mod-
ify the directory structure to fit your site requirements:
$PEAR_DIR = $_SERVER[‘DOCUMENT_ROOT’] . ‘/pear’ ;
$PHPLIB_DIR = $_SERVER[‘DOCUMENT_ROOT’] . ‘/phplib’;
$APP_FRAMEWORK_DIR = $_SERVER[‘DOCUMENT_ROOT’] . ‘/framework’;
$ROOT_PATH = $_SERVER[‘DOCUMENT_ROOT’];
$REL_ROOT_PATH = ‘/vote’;
$REL_APP_PATH = $REL_ROOT_PATH . ‘/apps’;
$TEMPLATE_DIR = $ROOT_PATH . $REL_APP_PATH . ‘/templates’;
$CLASS_DIR = $ROOT_PATH . $REL_APP_PATH . ‘/class’;
$REL_TEMPLATE_DIR = $REL_APP_PATH . ‘/templates/’;
Creating an errors file
The error messages displayed by the contact manager applications are stored on the
CD-ROM in the ch20/apps/vote.errors file. You can modify the error messages
using a text editor.
Creating the Application Templates
The templates used in this application are poll-specific. Every poll will have an out-
put template that will be prepared by the user who initiates the poll. You can find
an example poll output template on the CD-ROM in the ch20/apps/templates
directory. These templates must be named according to the poll ID. For example, a
poll with an ID of 99 should have an output template named 099.html.
Creating the Vote Application

This application, vote.php, is responsible for managing the entire process of the
voting system. The application is included on the CD-ROM in the ch20/apps direc-
tory. It implements the following functionality:
◆
Allows a user to submit a vote
◆
Displays the poll result
This application has the following methods.
Chapter 20: Web Site Tools 703
26 549669 ch20.qxd 4/4/03 9:27 AM Page 703
run()
When the application is run, this method is called. It first calls the setPollID()
method to set the given poll ID to a member variable. Then it creates a member
variable named “_voteObj” to hold an object of the Vote class with the member poll ID.
It determines whether a cookie has been set, which indicates that the user has already
voted for this poll. If it finds the cookie, it directly calls displayVoteResult() to
show the vote result instead of adding the vote to the database.
setPollID()
This method sets the given poll ID from the user request. It displays an alert mes-
sage when it determines that the poll ID has not been supplied from the user form.
getPollID()
This method is used to retrieve the current poll ID from the member variable
_pollID. It simply returns $this->_pollID.
addVote()
This method is responsible for adding the user vote to the database by using the
Vote class. This is how it works:
1. It first determines whether the user has selected a voting option. If not, it
displays an alert message and returns null.
2. Next, the
addVote() method of the Vote class is used to add the given

vote to the database. The vote class object is instantiated with the member
poll ID in the run() method, so it is not necessary to pass the poll ID to
the addVote() method here.
3. If the vote addition status is successful, this method sets a cookie for the
user, indicating that the user submitted a vote for this poll; otherwise, it
displays an alert message indicating the failure of the addition operation.
4. Finally, the displayVoteResult() method is called to show the vote result.
displayVoteResult()
This method shows the poll result to the user. It works as follows:
1. It first determines whether the total number of options for the poll has
been supplied. If it hasn’t, it displays an error message and returns null, as
a result cannot be found unless the method can ascertain the total number
of options available.
704 Part V: Internet Applications
26 549669 ch20.qxd 4/4/03 9:27 AM Page 704
2. Next, the output template for the poll is loaded in a template object called
$template. The output template file name is determined from the poll ID.
If the output template file does not exist in the template directory, it dis-
plays an alert message and returns null.
3. Then it calls the getTotalVoteCount() method of the Vote class to
retrieve the total number of votes posted for this poll, and sets the number
to the appropriate variable in the template.
4. For each of the poll options, the getVoteCountByChoice() method is
called to retrieve the number of votes cast. This number, along with the
total number of votes for the poll, is used to determine the percentage of
votes for this option. These numbers are set to appropriate variables in the
template.
5. Finally, the entire template is parsed and printed to the user to provide a
full poll result.
Installing the Voting Tool

In this section, it is assumed that you are using a Linux system with MySQL and an
Apache server installed. Your Internet Web server document root directory is
%DocumentRoot%. Of course, if you have a different path, which is likely, you
should change this path whenever you see it in a configuration file or instruction in
this chapter.
It is further assumed that you have installed the PHPLIB and PEAR libraries.
Normally, these are installed during PHP installation. For your convenience, we
have provided these in the lib/phplib.tar.gz and lib/pear.tar.gz directories on the
CD-ROM. In these sample installation steps, it is assumed that these are installed in
the %DocumentRoot%/phplib and %DocumentRoot%/pear directories. Because
your installation locations for these libraries are likely to be different, make sure
you replace these paths in the configuration files.
Here is how you can get your voting tool applications up and running:
1. Install the application framework. If you have not yet installed the appli-
cation framework discussed in Chapter 4, you must do so before proceed-
ing further.
2. Install the VOTE database. The quickest way to create the VOTE database
is to run the following commands:
mysqladmin –u root –p create VOTE
mysql –u root –p –D VOTE < VOTE.mysql
The VOTE.mysql can be found in the vote/sql directory created from
ch20.tar.gz or you can get it from the CD-ROM’s ch20/sql directory.
Chapter 20: Web Site Tools 705
26 549669 ch20.qxd 4/4/03 9:27 AM Page 705