ITCS373/ITCS473: Internet Software Development Chapter 4-2: Server-Side Programming PHP

Dr. Faisal Al-Qaed

PHP and MySQL DB

MySQL is a database server MySQL is ideal for both small and large applications MySQL supports standard SQL MySQL compiles on a number of platforms MySQL is free to download and use PHP combined with MySQL are cross-platform (you can develop in Windows and serve on a Unix platform) PHPMyAdmin: it is a web-based tool that allow you to administrate your MySQL databases over the WWW, built using a set of PHP Scripts.

MySQL DataBase
MySQL is a database. A database is integrated collection of data. The data in MySQL is stored in database objects called tables. A table is a collections of related data entries and it consists of columns and rows. Databases are useful when storing information categorically. A company may have a database with the following tables: "Employees", "Products", "Customers" and "Orders". A database most often contains one or more tables. Each table is identified by a name (e.g. "Customers" or "Orders"). Tables contain records (rows) with data. A databse query is a question or a request. With MySQL, we can query a database (using Structured Query Language (SQL)) for specific information and have a recordset returned.

Assume we have Customer Table

A quick SQL Tutorial

To retrieve data from the table, we use select * from tablename: Select * from Customer Select ID, Name, Age from Customer Select * from Customer where ID=1 Select * from Customer where Age <=20 Select Occupation from Customer where Name Like F% //what about %e% Select * from Customer where Name Like F_r[ei] //what about [ab]_[!ei]% Select * from Customer order by ID DESC Select * from Customer where Occupation=Student order by Name, Age SELECT * FROM Customer WHERE Name=Hesham' AND Age<>34 (try OR)

SQL Insert
INSERT INTO table_name VALUES (value1, value2, value3,...) INSERT INTO Customer VALUES (1,'Nilsen', NN', abc123', 22, Student')

SQL Update
UPDATE table_name SET column1=value, column2=value2,... WHERE some_column=some_value UPDATE Customer SET Age=37, Occupation='Student' WHERE Name=Noor' OR ID=2

SQL Delete
DELETE FROM table_name WHERE some_column=some_value DELETE FROM Customer WHERE Name=Hesham' AND Age>30

Type in: localhost

Click on phpMyAdmin to access MySQL

Enter your username and password (i.e. root and abc123)

First Step: Create DB

Enter DB Name and click create

Create Table

To create table

To add more fields to the table

Insert Data
Select the table students, click on insert, then type in the values, then finally click on go button to insert new data into your table

Browse/Edit/Delete
After inserting data, you can browse the table by clicking Browse (see Top-Left), and then you will see you table, clicking on pencil picture will allow you to edit that row, or clicking on the X picture will allow you to delete that record.

Using SQL
You can use SQL statements to Create Table, Insert records, browse records using Select, Delete records, etc.

Enter your SQL here

Fields name

Execute your SQL

Allow you to export DB and import it to different machine

Allow you to edit and delete database

In the LAB you were given a quick tutorial on using MySQL with PHPMyAdmin and SQL statements. You should now know:
How to create/delete a database? How to create/delete table? How to insert/edit/delete a record? How to browse table contents? How to use SQL to create table, select/update/delete/insert records? How to import/export your database?

MySQL database
Connect <?php $dbh=mysql_connect("localhost", root", abc123") or die ('I cannot connect to the database because: ' . mysql_error()); mysql_select_db ("itcs373"); //do something here echo "Display this text"; //Close Connection mysql_close($dbh); ?>

Displaying the data in the table

Select $result = mysql_query("SELECT * FROM Customer"); Display in a table echo "<table border='1'> <tr> <th>ID</th><th>Name</th><th>Age</th></tr>"; while($row = mysql_fetch_array($result)) { echo "<tr>"; echo "<td>" . $row[ID'] . "</td>"; echo "<td>" . $row[Name'] . "</td>"; echo "<td>" . $row[Age'] . "</td>"; echo "</tr>"; } echo "</table>";

Inserting into the table

mysql_query("INSERT INTO Customer VALUES(10,Ali',un, '23,25,Student )") or die(mysql_error());

More Examples
$result = mysql_query("SELECT * FROM Customer WHERE Age>'18' " ); $result = mysql_query("SELECT * FROM Customer WHERE Age>'18' ORDER By Name" ); mysql_query("UPDATE Customer SET Age = '36 WHERE Name = Ali' ") or die(mysql_error()); mysql_query("DELETE FROM Customer WHERE id='2'") or die(mysql_error());

Examples
Create a database named example Create a table named customers with the following attributes: ID type= int Name type= varchar of size 20 Username type= varchar of size 20 Password type= varchar of size 20 Age type= int Occupation type= varchar of size 30

Example 1: Login Verification

<html><body> <h2> Querying a MySQL Database </h2> <form method="post" action="e1_select.php"> Username <input name="un" /> <br /> Password <input type="password" name="ps" /> <br /> <input type="submit" value="Sign-in" /> </form></body></html>

e1_select.php
<?php require("noCache.php"); $dbh=mysql_connect("localhost", "root", "abc123") or die (Error' . mysql_error()); mysql_select_db ("example"); extract($_POST); $result = mysql_query("SELECT * FROM customers WHERE Username='$un'"); echo "<html><body>"; if ($row = mysql_fetch_array($result)) { if ($row['Password']==$ps) { echo "Successful Login"; echo "<table border='1'><tr> <th>ID</th><th>Name</th><th>Age</th><th>Occupation</th></tr>"; echo "<tr><td>" . $row['ID'] . "</td><td>" . $row['Name'] . "</td><td>" . $row['Age'] . "</td>"; echo "<td>" . $row['Occupation'] . "</td></tr>"; } else echo "Invalid Password"; } else echo "Invalid Username "; echo "</table></body></html>"; mysql_close($dbh);?>

Example 2: User Sign-Up

Form.htm
<html><body> <form method="post" action="e2_insert.php"><table> <tr><td>ID:</td><td><input type="text" name="id"></td></tr> <tr><td>Name:</td><td><input type="text" name="name"></td></tr> <tr><td>Age:</td><td><input type="text" name="age"></td></tr> <tr><td>Username:</td><td><input type="text" name="un"></td></tr> <tr><td>Password</td><td><input type="password" name="ps"></td></tr> <tr><td>Confirm Password:</td><td><input type="password" name="cps"></td></tr> <tr><td>Occupation:</td><td><Select name="occ"> <option value="Student">Student</option> <option value="Manager">Manager</option> <option value="Messenger">Messenger</option> <option value="Teacher">Teacher</option> </select></td> </tr></table><br /><br /><input type="submit" value="Add New"> <input type="reset" value="Cancel"> </form></body></html>

e2_insert.php
<?php require("noCache.php"); $dbh=mysql_connect("localhost", "root", "abc123") or die (mysql_error()); mysql_select_db ("example"); extract($_POST); if (trim($id)=="" || trim($name)=="" || trim($un)=="" || trim($ps)=="" || trim($cps)=="" || trim($age)=="" || trim($occ)=="") echo ("Missing information"); else if ($ps!=$cps) echo ("Password and Confirm Password are not identical"); else { mysql_query("INSERT INTO Customers VALUES($id,'$name','$un', '$ps',$age,'$occ')") or die (mysql_error()); echo "<h2> User was successfully registered</h2>"; } mysql_close($dbh);?>

Example 3: Update Details

Read only

View.php
<?php require("noCache.php"); $dbh=mysql_connect("localhost", "root", "abc123") or die (mysql_error()); mysql_select_db ("example"); $result = mysql_query("SELECT * FROM customers"); echo "<html><body>"; echo "<table border='1'><tr> <th>ID</th><th>Name</th><th>Age</th><th>Username</th><th>Password </th><th>Occupation</th></tr>"; echo "<form method='post' action='e3_edit.php'>"; while ($row = mysql_fetch_array($result)) { echo "<tr><td><input type='submit' name='ID' value='".$row['ID']."' /></td>"; echo "<td>" . $row['Name'] . "</td>"; echo "<td>" . $row['Age'] . "</td>"; echo "<td>" . $row['Username'] . "</td>"; echo "<td>" . $row['Password'] . "</td>"; echo "<td>" . $row['Occupation'] . "</td></tr>"; } echo </form></table></body></html>"; mysql_close($dbh); ?>

e3_edit.php
<?php require("noCache.php"); $dbh=mysql_connect("localhost", "root", "abc123") or die (mysql_error()); mysql_select_db ("example"); extract($_POST); $result = mysql_query("SELECT * FROM customers WHERE ID=$ID"); if ($row = mysql_fetch_array($result)) { echo "<html><body>"; echo "<form method='post' action='e3_update.php'><br />"; echo "ID: <input name='id' value='".$row['ID']."' readonly/><br />"; echo "Name: <input name='name' value='".$row['Name']."' /><br />"; echo "Age: <input name='age' value='".$row['Age']."' /><br />"; echo "Username: <input name='un' value='".$row['Username']."' /><br />"; echo "Password: <input type='password' name='ps' value='".$row['Password']."' /><br />"; echo "Occupation: <input name='occ' value='".$row['Occupation']."' /><br />"; echo "<input type='submit' value='update' />"; echo "</form></body></html>"; } mysql_close($dbh);?>

e3_update.php
<?php require("noCache.php"); $dbh=mysql_connect("localhost", "root", "abc123") or die (mysql_error()); mysql_select_db ("example"); extract($_POST); if (trim($name)=="" || trim($un)=="" || trim($ps)=="" || trim($age)=="" || trim($occ)=="") echo ("Missing information"); else { $mySql="UPDATE Customers SET Name='$name', Username='$un', Password='$ps', Age=$age, Occupation='$occ' WHERE ID=$id"; mysql_query($mySql) or die (mysql_error()); echo "<h2> User info was successfully updated</h2>"; } mysql_close($dbh); ?>

Example 4: Delete Users

Note: use the same code as view.php for listing all users but change the form action to e4_delete

e4_delete.php
<?php require("noCache.php"); $dbh=mysql_connect("localhost", "root", "abc123") or die (mysql_error()); mysql_select_db ("example"); extract($_POST); $mySql="DELETE FROM Customers WHERE ID=$ID"; mysql_query($mySql) or die (mysql_error()); echo "<h2> User info was deleted successfully</h2>"; mysql_close($dbh); ?>

Required Reading and Useful Functions

Part 8: Databases and MySQL
Mysqli [not required]

Useful Functions:
mysql_num_rows() md5() mysql_fetch_object() and reading data as object mysql_insert_id()

Mini Project Read Part 14

PHP Upload
A very useful aspect of PHP is its ability to manage file uploads to your server. However, allowing users to upload a file to your server opens a whole can of worms, so please be careful when enabling file uploads.

HTML Form needed for upload

<form enctype="multipart/form-data" action="uploader.php" method="POST"> <input type="hidden" name="MAX_FILE_SIZE" value="100000" /> Choose a file to upload: <input name=myFile" type="file" /><br /> <input type="submit" value="Upload File" /> </form>

Here is a brief description of the important parts of the above code: enctype="multipart/form-data" - Necessary for our to-be-created PHP file to function properly. action="uploader.php" - The name of our PHP page that will be created, shortly. method="POST" - Informs the browser that we want to send information to the server using POST. input type="hidden" name="MA... - Sets the maximum allowable file size, in bytes, that can be uploaded. This safety mechanism is easily bypassed and we will show a solid backup solution in PHP. We have set the max file size to 100KB in this example. input name=myFile" - myFile is how we will access the file in our PHP script.

 When the uploader.php file is executed, the uploaded file exists in a temporary storage area on the server. If the file is not moved to a different location it will be destroyed! To save our precious file we are going to need to make use of the $_FILES associative array. The $_FILES array is where PHP stores all the information about files. There are two elements of this array that we will need to understand for this example.
myFile - is the reference we assigned in our HTML form. We will need this to tell the $_FILES array which file we want to play around with. $_FILES[myFile']['name'] - name contains the original path of the user uploaded file. $_FILES[myFile']['tmp_name'] - tmp_name contains the path to the temporary file that resides on the server. The file should exist on the server in a temporary directory with a temporary name.

Simple File Upload Example

<?php $target_path = "uploads/"; // Add the original filename to our target path. Result is "uploads/filename.extension" $target_path = $target_path.basename($_FILES[myFile']['name']); If (move_uploaded_file($_FILES[' myFile']['tmp_name'], $target_path)) { echo "The file ".basename( $_FILES[' myFile']['name']). " has been uploaded"; } else{ echo "There was an error uploading the file, please try again!"; } ?> Note: You will need to create a new directory in the directory where uploader.php resides, called "uploads", as we are going to be saving files there.

PHP - File Upload: Safe Practices!

Note: This script is for education purposes only. We do not recommend placing this on a web page viewable to the public. These few lines of code we have given you will allow anyone to upload data to your server. Because of this, we recommend that you do not have such a simple file uploader available to the general public. Otherwise, you might find that your server is filled with junk or that your server's security has been compromised.

Practical Upload Example

<html> <body> <form action="upload_file.php" method="post" enctype="multipart/form-data"> Filename: <input type="file" name="file" /><br /> <input type="submit" name="submit" value="Submit" /> </form></body></html>

upload_file.php
<?php if ((($_FILES["file"]["type"] == "image/gif") || ($_FILES["file"]["type"] == "image/jpeg") || ($_FILES["file"]["type"] == "image/pjpeg")) && ($_FILES["file"]["size"] < 20000)) {
if ($_FILES["file"]["error"] > 0) {
echo "Return Code: " . $_FILES["file"]["error"] . "<br />"; }

else {
echo "Upload: " . $_FILES["file"]["name"] . "<br />"; echo "Type: " . $_FILES["file"]["type"] . "<br />"; echo "Size: " . ($_FILES["file"]["size"] / 1024) . " Kb<br />"; echo "Temp file: " . $_FILES["file"]["tmp_name"] . "<br />"; if (file_exists("upload/" . $_FILES["file"]["name"])) {
echo $_FILES["file"]["name"] . " already exists. "; }

else {
move_uploaded_file($_FILES["file"]["tmp_name"], "upload/" . $_FILES["file"]["name"]); echo "Stored in: " . "upload/" . $_FILES["file"]["name"]; } }

else { echo "Invalid file"; } ?>

List of Mime Types

Pdf = application/pdf Doc = application/msword Css = text/css Bmp = image/bmp Htm/html = text/html Mov = video/quicktime Mp3 = audio/mpeg3 Mpg = video/mpeg Ppt = application/powerpoint Txt = text/plain For Complete Reference: check this website http://www.webmaster-toolkit.com/mime-types.shtml

PHP what else?

You can still do many many more things with PHP and SS scripts:
You can create/manage/delete/rename directories/files on the server (i.e.
mkdir($dirName,0777);)

You can access and manipulate XML data easily. You can interact with networking applications such as DNS, mail server, ftp, open network sockets etc. PHP also has a great number of functions that will secure sensitive website data (i.e. encryptions, hash functions, etc.) PHP regular expression is useful for complex data validation