PHP ARRAYS, SUPERGLOBALS, AND WORKING WITH FILES. Prof. Assoc. Lule Ahmedi Course: Internet Programming

Transcription

1 PHP ARRAYS, SUPERGLOBALS, AND WORKING WITH FILES Prof. Assoc. Lule Ahmedi Course: Internet Programming

2 Arrays in PHP An data structure to express a collection of related values Associates each value in the array with a key Not only like other languages arrays, but it is also like their vector, hash table, dictionary, and list collections Keys Must be either integers or strings but need not be sequential Cannot use an array or object as a key Values Can be any object, type, or primitive supported in PHP (not restricted to integers and strings), including arrays You can even have objects of your own types

3 Arrays: Declaration and Access Array constructor Example array declarations / value assignments: Example array declarations / key assignments: Default key values if not explicitly assigned: 0, 1, 2,.., n to create an ascending sequence of numbers in an array:

4 Associative Arrays: Declaration and Access Similar to dictionary or hash table data structures in other languages

5 Multidimensional Arrays When a value in the array is an arrays itself Example two-dimensional array

6 Iterating over Arrays Using,, and loops, assisted by In case of associative arrays (non-sequential integer keys) Can t write a simple loop that uses loop with iterators to move through such an array

7 Iterating over Associative Arrays : an array of information about the array This produces:: Four elements defined for $thing:, : the array subscript, : the array element value

8 Iterating over Multidimensional Arrays

9 Arrays: Adding / Deleting Elements Add an element to an array simply by using a key/index that hasn t been used Delete array elements using (causes gaps in the array) Check if a value for a key is set using

10 More Array Operations Sorting array_keys($somearray); array_values($somearray) array_rand($somearray, $num=1) array_reverse($somearray) array_walk($somearray, $callback, $optionalparam) in_array($needle, $haystack) shuffle($somearray)

11 Multidimensional Arrays: User Defined Sort How to compare arrays within a multidimensional array? : a user-defined sort function User himself defines a comparison function for item(s) in the multidimensional array to sort

12 Loading Arrays from Files

13 Superglobal Arrays Superglobal variables: Special predefined associative arrays Always in scope to access (no need for the keyword) Allow the programmer to easily access HTTP headers, query string parameters, and other commonly needed information Name $_GLOBALS $_COOKIES $_ENV $_FILES $_GET $_POST $_REQUEST $_SESSION $_SERVER Description Array for storing data that needs superglobal scope Array of cookie data passed to page via HTTP request Array of server environment data Array of file items uploaded to the server Array of query string data passed to the server via the URL Array of query string data passed to the server via the HTTP header Array containing the contents of $_GET, $_POST, and $_COOKIES Array that contains session data Array that contains session data

14 $_GET and $_POST Superglobals Access data in a query string sent by client If data sent through HTTP GET request: data accessible by PHP within URL and stored in array, say in and If data sent through HTTP POST request: data not visible by PHP in URL but accessible within HTTP POST request body and stored in array, say in and Greatly simplifies accessing data posted by user: (1) no need to parse query string (2) nor the POST request headers CAUTION: Do not use HTTP GET request for transmitting login data. Use POST instead

15 URL Encoding/Decoding Within query strings, characters such as spaces, punctuation, symbols, accented characters are URL encoded and already decodes them Otherwise, URL encoding/decoding (say, for database storage) using and Don t mix it with

16 Determine if Any Data Sent If using the same file to handle both form display as well as the form input Login form example

17 Accessing Form Array Data HTML forms might have multiple values associated with a single name, like in case of checkboxes if the user selects more than one day and submits the form, will only contain the last value from the list selected Solution: change attribute in form for each checkbox from to

18 Using Query Strings in Hyperlinks Make use of query strings not limited to only form data Combine query strings with anchor tags (hyperlinks) which also use HTTP GET method Common to construct URLs for a series of links by appending data from, say, database Imagine a web page with a list of hyperlinks referring to books Write a separate Web page for each book to display? Not a wise approach if hundreds of books in database Instead write a single Display Book page that receives a query string specifying which book to display in form of a unique identifier (ISBN of a book)

19 Sanitizing Query Strings Distrust all user input - what if user edits the value of query string parameter? User removes the parameter or changes its type - empty screen or error page is displayed Especially worrisome is SQL injection (user tries to gain access to the database) All data values potentially modifiable by the user (query strings, form values, or cookie values) must be sanitized before use: If query string parameter doesn t exist If query string parameter doesn t contain a value If query string parameter value isn t the correct type (e.g., ) If value is required for a database lookup, but provided value doesn t exist in database In case of error, e.g., redirect to the generic error handling page: More secure approach to detect user tampering of query string parameters Encode the query string value with a one-way hash - a math algorithm that takes a variable-length input string and turns it into fixed-length binary sequence to

20 $_POST Example: Form

21 $_SERVER Superglobal Access by knowing the key, e.g.: Values filled by the web server => not every key listed in the PHP doc is available array contains: Information within HTTP request headers sent by client Server settings, i.e., many configuration options for PHP itself (mostly in php.ini)

22 $_SERVER: HTTP Request Header Keys : could be one of,,, : IP of the requestor Useful for audit like in finance trans Online poll might limit each IP to a single vote : mostly used; is encoded Useful for re-direction, or analytics (Google Analytics). will work only if browscap.ini in php.ini to browscap.ini : URL of the outbound page Useful for analytics CAUTION: All header Info can be forged!

23 $_SERVER: Internationalization Example : Checks what language the browser accepts, respond accordingly! REMOTE_ADDR: IP of the requestor Useful for audit like in finance trans Useful for analytics

24 $_FILES Superglobal Access files uploaded from the client to the server HTML form required at the client side to enable file upload Use method since file transmission through URL not possible Add to allow submission of HTTP post body & HTTP file attachment itself Add to create the user interface for file upload will show a browse button for a client to select a file for upload to the server) PHP file specified in attribute of HTML form handles the file upload using array which contains: contains key=value pair for each uploaded file key: attribute in HTML form value: an array containing (1) info about file, (2) file itself; keys in that array are name: includes file extension; no path type: MIME; not reliable since provided by the browser tmp_name: full path where the file is temporarily stored in the server error: error code in integer of the file upload process; UPLOAD_ERR_OK (int 0) if successful size: an integer expressing bytes of the uploaded file

25 $_FILES Superglobal: Example

26 $_FILES: Checking for Errors prior to Upload Error Code Integer Meaning UPLOAD_ERR_OK 0 Upload was successful. UPLOAD_ERR_INI_SIZE 1 The uploaded file exceeds the upload_max_filesize directive in php.ini. UPLOAD_ERR_FORM_SIZE 2 The uploaded file exceeds the max_file_size directive that was specified in the HTML form. UPLOAD_ERR_PART IAL 3 The file was only partially uploaded. UPLOAD_ERR_NO_FILE 4 No file was uploaded. Not always an error, since the user may have simply not chosen a file for this field. UPLOAD_ERR_NO_TMP_DIR 6 Missing the temporary folder. UPLOAD_ERR_CANT_WRITE 7 Failed to write to disk. UPLOAD_ERR_EXTENSION 8 A PHP extension stopped the upload.

27 $_FILES: File Size Limit to Upload File size restrictions via: HTML or JavaScript in the input form, or PHP PHP option preferred due to: Client might easily override the MAX_FILE_SIZE hidden form value Imagine you wait for a large upload to finish, then get an error the uploaded file was too large!

28 $_FILES: File Type Limit to Upload Imagine you wait for an image, a MS Word file is uploaded instead! Check file extension and type field prior to upload: Extension and type transmitted by client => could be forged Remember how easy it is to change a file extension Therefore, check e.g. Exif data (metadata about image)

29 $_FILES: Storing the Uploaded File Move the temporary file to a permanent location on the server Works only if source file exists & server destination location writable Otherwise, false returned and warning message

30 Versions and Originals You can change any PHP variable you can get to! Original values are still available Example: Result:

31 Reading/Writing Files Although Deep Web (Websites with databases at the backend) is prevailing, working with files is still relevant Two basic techniques to read/write files in PHP: Stream access Reads just a small portion of the file at a time Requires more careful programming Is most memory-efficient approach when reading very large files All-In-Memory access Can read the entire file into memory (i.e., into a PHP variable) Not appropriate for large files Makes processing of the file extremely easy

32 Reading Files: Stream Access Old-school like in C:,,,, to open a file for reading/writing Input parameters: file location or URL, and access mode like r for read, rw for read and write, c, to create a new file for writing Returned value: a stream resource, which you can then read sequentially to close a file when finished with processing it to read a single line Returns false if no more lines, otherwise reads a line and advances to the next line to read an arbitrary amount of data (typically for binary files) to read a single character

33 Writing Files: Stream Access to write data to a file, similar to Passing the file handle and the string to write

34 Reading Files: All-In-One Memory In stream access: programming requires care in dealing with streams, file handles, and other low-level issues This approach: easier to use, but no fine-grained control to read file into an array of lines to read file into a string variable

35 Writing Files: All-In-One Memory to write the contents of a string to a file

36 Reading and Writing Files - Directories Reading directories: - Begins reading a directory and returns a reference to it (directory handle) - Read the file names in the referenced directory - Stop reading the directory Example:

37 Working with Files: Summary Example

38 References [2] Fundamentals of Web Development. Randy Connolly, Ricardo Hoar. Pearson, 2014 [1] PHP and MySQL Web Development (4th Edition). Luke Welling, Laura Thompson. Addison-Wesley Professional, 2014 php.net Lecture notes of Tufts University, Web Programming, 2011; Advanced Web Programming, 2007