#3 working with data stored in files && securing your application

This chapter reveals that you can use files and databases together to build PHP application that waash in binary data.

The application needs to store images.

Firstly, we should use the ALTER statement to change the structure of a database.

ALTER TABLE guitarwars

ADD COLUMN screeshot varchar(64)

Next step, we should understand how can we get an image from the user ?

<input type="file" id="screenshot" name="screenshot" />

This can use a file input field to allow image file uploads.

Then we should Insert the data posted from the form into the table, use the INSERT statment :

INSERT INTO guitarwars VALUES

(0, NOW(), '$name', '$score', '$screenshot')

Here we just need to insert the filename into the table , so $screenshot represents the name of the file

the super variable $_FILES is where PHP stores infomation about an uploaded file.

$screenshot = $_FILES['screenshot']['name']

// some other attributes :

$_FILES['screenshot']['type']

$_FILES['screenshot']['size']

$_FILES['screenshot']['tmp_name']

$_FILES['screenshot']['error']

you may have a question why dont just store the image file into the database ?

Databases excel at storing text data, not raw binary data such as images. so its better to just store a reference to an image in the database .

This reference is the name of the image file.

Another reason is beacese it would be much harderto display them using HTML code. You can see that generating an image tag

in HTML involves using an image filename, not raw image data. just like :

<img src = "phizsscore.jpg" alt = "Score image" />

Here is another question, when we uploads the file, where did they go ?

The answer is the file is actually uploaded to a temporary folder on the server. The temporary folder is created automatically on the server

and usually has a weird name with a bunch of random letter and numbers.

If we want to use the files again, we should control the initial storage location of uploaded files in PHP.

You can move file from the temporary folder to a permanenet folder by using this function :

move_uploaded_file( $_FILES['screenshot']['name'], $target) ;

$target is the destination location where you want to put the file on server .

Every Application needs a image folder. so create a home for uploaded iamge files.

$target = GW_UPLOADPATH.$screenshot ;

There is another problem, if two users uploaded image file with the same filenames, it will overwrite the one before.

A simple way to solve this is to add current server time to the front of the filename:

$target = GW_UPLOADPATH. time() . $screenshot

Just a tips here : If your PHP App is hosted anywhere other than your local computer, you'll need to use FTP to

create the images folder on the server.

If the path changes, you have to change the code in all places, so you can use define() to avoid this :

define('GW_UPLOADPATH', 'images/')

and if you want to access the constants in other scripts, you may use the require_once()

require_once('appvars.php');

Just think of require_onece as "insert" . This statement inserts shared script code into other scripts.

We almost finish our application. But if this would be a real appliaction, is needs the VALIDATION .

Validation on the image file serves two vitial purposes. 1, it can beef up the prevention of large file uploads, providing users with notification that

a file cant be larger than 32kb. 2, it can stop people from uploading files that aren't images.　try the code below:　

if (

( ($screenshot_type == 'image/gif') || ($screenshot_type=='image/jpeg')

   ||($screenshot_type == 'image/pjpeg') || ($screenshot_type == 'image/png'))

   && ($screenshot_size > 0) && ($screenshot_size <= GW_MAXFILESIZE)

) {

  ...

}

IN the real application, we often need some function groups and pages which can only be used by the admin, so the administrator

can manage this application. We will add an admin model in this app too.　　

The project files are as follows :

/****　　　　　　index.php 　　　　　　**** /

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"

  "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">

<head>

  <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />

  <title>Guitar Wars - High Scores</title>

  <link rel="stylesheet" type="text/css" href="style.css" />

</head>

<body>

  <h2>Guitar Wars - High Scores</h2>

  <p>Welcome, Guitar Warrior, do you have what it takes to crack the high score list? If so, just <a href="addscore.php">add your own score</a>.</p>

  <hr />

<?php

  require_once('appvars.php');

  require_once('connectvars.php');

  // Connect to the database

  $dbc = mysqli_connect(DB_HOST, DB_USER, DB_PASSWORD, DB_NAME); 

  // Retrieve the score data from MySQL

  $query = "SELECT * FROM guitarwars ORDER BY score DESC, date ASC";

  $data = mysqli_query($dbc, $query);

  // Loop through the array of score data, formatting it as HTML

  echo '<table>';

  $i = 0;

  while ($row = mysqli_fetch_array($data)) {

    // Display the score data

    if ($i == 0) {

      echo '<tr><td colspan="2" class="topscoreheader">Top Score: ' . $row['score'] . '</td></tr>';

    }

    echo '<tr><td class="scoreinfo">';

    echo '<span class="score">' . $row['score'] . '</span><br />';

    echo '<strong>Name:</strong> ' . $row['name'] . '<br />';

    echo '<strong>Date:</strong> ' . $row['date'] . '</td>';

    if (is_file(GW_UPLOADPATH . $row['screenshot']) && filesize(GW_UPLOADPATH . $row['screenshot']) > 0) {

      echo '<td><img src="' . GW_UPLOADPATH . $row['screenshot'] . '" alt="Score image" /></td></tr>';

    }

    else {

      echo '<td><img src="' . GW_UPLOADPATH . 'unverified.gif' . '" alt="Unverified score" /></td></tr>';

    }

    $i++;

  }

  echo '</table>';

  mysqli_close($dbc);

?>

</body>

</html>

/****　　　　　　addscore.php　　　　****/

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"

  "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">

<head>

  <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />

  <title>Guitar Wars - Add Your High Score</title>

  <link rel="stylesheet" type="text/css" href="style.css" />

</head>

<body>

  <h2>Guitar Wars - Add Your High Score</h2>

<?php

  require_once('appvars.php');

  require_once('connectvars.php');

  if (isset($_POST['submit'])) {

    // Grab the score data from the POST

    $name = $_POST['name'];

    $score = $_POST['score'];

    $screenshot = $_FILES['screenshot']['name'];

    $screenshot_type = $_FILES['screenshot']['type'];

    $screenshot_size = $_FILES['screenshot']['size']; 

    if (!empty($name) && !empty($score) && !empty($screenshot)) {

      if ((($screenshot_type == 'image/gif') || ($screenshot_type == 'image/jpeg') || ($screenshot_type == 'image/pjpeg') || ($screenshot_type == 'image/png'))

        && ($screenshot_size > 0) && ($screenshot_size <= GW_MAXFILESIZE)) {

        if ($_FILES['screenshot']['error'] == 0) {

          // Move the file to the target upload folder

          $target = GW_UPLOADPATH . $screenshot;

          if (move_uploaded_file($_FILES['screenshot']['tmp_name'], $target)) {

            // Connect to the database

            $dbc = mysqli_connect(DB_HOST, DB_USER, DB_PASSWORD, DB_NAME);

            // Write the data to the database

            $query = "INSERT INTO guitarwars VALUES (0, NOW(), '$name', '$score', '$screenshot')";

            mysqli_query($dbc, $query);

            // Confirm success with the user

            echo '<p>Thanks for adding your new high score! It will be reviewed and added to the high score list as soon as possible.</p>';

            echo '<p><strong>Name:</strong> ' . $name . '<br />';

            echo '<strong>Score:</strong> ' . $score . '<br />';

            echo '<img src="' . GW_UPLOADPATH . $screenshot . '" alt="Score image" /></p>';

            echo '<p><a href="index.php">&lt;&lt; Back to high scores</a></p>';

            // Clear the score data to clear the form

            $name = "";

            $score = "";

            $screenshot = "";

            mysqli_close($dbc);

          }

          else {

            echo '<p class="error">Sorry, there was a problem uploading your screen shot image.</p>';

          }

        }

      }

      else {

        echo '<p class="error">The screen shot must be a GIF, JPEG, or PNG image file no greater than ' . (GW_MAXFILESIZE / 1024) . ' KB in size.</p>';

      }

      // Try to delete the temporary screen shot image file

      @unlink($_FILES['screenshot']['tmp_name']);

    }

    else {

      echo '<p class="error">Please enter all of the information to add your high score.</p>';

    }

  }

?>

  <hr />

  <form enctype="multipart/form-data" method="post" action="<?php echo $_SERVER['PHP_SELF']; ?>">

    <input type="hidden" name="MAX_FILE_SIZE" value="<?php echo GW_MAXFILESIZE; ?>" />

    <label for="name">Name:</label>

    <input type="text" id="name" name="name" value="<?php if (!empty($name)) echo $name; ?>" /><br />

    <label for="score">Score:</label>

    <input type="text" id="score" name="score" value="<?php if (!empty($score)) echo $score; ?>" /><br />

    <label for="screenshot">Screen shot:</label>

    <input type="file" id="screenshot" name="screenshot" />

    <hr />

    <input type="submit" value="Add" name="submit" />

  </form>

</body>

</html>

/****　　　　　　appvars.php　　　　****/

<?php

  // Define application constants

  define('GW_UPLOADPATH', 'images/');

  define('GW_MAXFILESIZE', 32768);      // 32 KB

?>

/****　　　　　　connectvars.php　　　　****/

<?php

  // Define database connection constants

  define('DB_HOST', 'localhost');

  define('DB_USER', 'root');

  define('DB_PASSWORD', 'root');

  define('DB_NAME', 'gwdb');

?>

About the adminuser, you can visit the admin model by : localhost/...path/guitarwars/admin.php

/****　　　　　admin.php　　　　****/

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"

  "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">

<head>

  <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />

  <title>Guitar Wars - High Scores Administration</title>

  <link rel="stylesheet" type="text/css" href="style.css" />

</head>

<body>

  <h2>Guitar Wars - High Scores Administration</h2>

  <p>Below is a list of all Guitar Wars high scores. Use this page to remove scores as needed.</p>

  <hr />

<?php

  require_once('appvars.php');

  require_once('connectvars.php');

  // Connect to the database

  $dbc = mysqli_connect(DB_HOST, DB_USER, DB_PASSWORD, DB_NAME); 

  // Retrieve the score data from MySQL

  $query = "SELECT * FROM guitarwars ORDER BY score DESC, date ASC";

  $data = mysqli_query($dbc, $query);

  // Loop through the array of score data, formatting it as HTML

  echo '<table>';

  while ($row = mysqli_fetch_array($data)) {

    // Display the score data

    echo '<tr class="scorerow"><td><strong>' . $row['name'] . '</strong></td>';

    echo '<td>' . $row['date'] . '</td>';

    echo '<td>' . $row['score'] . '</td>';

    echo '<td><a href="removescore.php?id=' . $row['id'] . '&amp;date=' . $row['date'] .

      '&amp;name=' . $row['name'] . '&amp;score=' . $row['score'] .

      '&amp;screenshot=' . $row['screenshot'] . '">Remove</a></td></tr>';

  }

  echo '</table>';

  mysqli_close($dbc);

?>

</body>

</html>

/****　　　　　removescore.php　　　　****/

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"

  "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">

<head>

  <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />

  <title>Guitar Wars - Remove a High Score</title>

  <link rel="stylesheet" type="text/css" href="style.css" />

</head>

<body>

  <h2>Guitar Wars - Remove a High Score</h2>

<?php

  require_once('appvars.php');

  require_once('connectvars.php');

  if (isset($_GET['id']) && isset($_GET['date']) && isset($_GET['name']) && isset($_GET['score']) && isset($_GET['screenshot'])) {

    // Grab the score data from the GET

    $id = $_GET['id'];

    $date = $_GET['date'];

    $name = $_GET['name'];

    $score = $_GET['score'];

    $screenshot = $_GET['screenshot'];

  }

  else if (isset($_POST['id']) && isset($_POST['name']) && isset($_POST['score'])) {

    // Grab the score data from the POST

    $id = $_POST['id'];

    $name = $_POST['name'];

    $score = $_POST['score'];

  }

  else {

    echo '<p class="error">Sorry, no high score was specified for removal.</p>';

  }

  if (isset($_POST['submit'])) {

    if ($_POST['confirm'] == 'Yes') {

      // Delete the screen shot image file from the server

      @unlink(GW_UPLOADPATH . $screenshot);

      // Connect to the database

      $dbc = mysqli_connect(DB_HOST, DB_USER, DB_PASSWORD, DB_NAME); 

      // Delete the score data from the database

      $query = "DELETE FROM guitarwars WHERE id = $id LIMIT 1";

      mysqli_query($dbc, $query);

      mysqli_close($dbc);

      // Confirm success with the user

      echo '<p>The high score of ' . $score . ' for ' . $name . ' was successfully removed.';

    }

    else {

      echo '<p class="error">The high score was not removed.</p>';

    }

  }

  else if (isset($id) && isset($name) && isset($date) && isset($score)) {

    echo '<p>Are you sure you want to delete the following high score?</p>';

    echo '<p><strong>Name: </strong>' . $name . '<br /><strong>Date: </strong>' . $date .

      '<br /><strong>Score: </strong>' . $score . '</p>';

    echo '<form method="post" action="removescore.php">';

    echo '<input type="radio" name="confirm" value="Yes" /> Yes ';

    echo '<input type="radio" name="confirm" value="No" checked="checked" /> No <br />';

    echo '<input type="submit" value="Submit" name="submit" />';

    echo '<input type="hidden" name="id" value="' . $id . '" />';

    echo '<input type="hidden" name="name" value="' . $name . '" />';

    echo '<input type="hidden" name="score" value="' . $score . '" />';

    echo '</form>';

  }

  echo '<p><a href="admin.php">&lt;&lt; Back to admin page</a></p>';

?>

</body>

</html>

At last, some css styles :

.error {

  font-weight: bold;

  color: #FF0000;

}

.topscoreheader {

  text-align: center;

  font-size: 200%;

  background-color: #36407F;

  color: #FFFFFF;

}

.score {

  font-size:150%;

  color: #36407F;

}

.scoreinfo {

  vertical-align: top;

  padding-right:15px;

}

#3 working with data stored in files && securing your application的更多相关文章

#3 working with data stored in files && securing your application (PART II)
Security problems is more and more important on the internet today. You can see the problems . This ...
Enabling granular discretionary access control for data stored in a cloud computing environment
Enabling discretionary data access control in a cloud computing environment can begin with the obtai ...
安装mysql时出现initialize specified but the data directory has files in in.Aborting.该如何解决
eclipse中写入sql插入语句时,navicat中显示的出现乱码(???). 在修改eclipse工作空间编码.navicate中的数据库编码.mysql中my.ini中的配置之后还是出现乱码. ...
The multi-part request contained parameter data (excluding uploaded files) that exceeded the limit for maxPostSize set on the associated connector.
springboot 表单体积过大时报错: The multi-part request contained parameter data (excluding uploaded files) tha ...
Springboot 上传报错： Failed to parse multipart servlet request; nested exception is java.lang.IllegalStateException: The multi-part request contained parameter data (excluding uploaded files) that exceede
Failed to parse multipart servlet request; nested exception is java.lang.IllegalStateException: The ...
MYSQL常见安装错误集:[ERROR] --initialize specified but the data directory has files in it. Abort
1.[ERROR] --initialize specified but the data directory has files in it. Abort [错误] -初始化指定,但数据目录中有文件 ...
启动MySQL5.7时报错:initialize specified but the data directory has files in it. Aborting.
启动MySQL5.7时报错:initialize specified but the data directory has files in it. Aborting 解决方法: vim /etc/m ...
Data caching per request in Owin application
Data caching per request in Owin application 解答1 Finally I found OwinRequestScopeContext. Very simpl ...
Fast data loading from files to R
Recently we were building a Shiny App in which we had to load data from a very large dataframe. It w ...

随机推荐

方法和函数,isinstance/issubclass/type以及反射
一丶,isinstance/issubclass/type 1.issubclass检查第一个参数是否是第二个参数的子子孙孙类 class Foo(): pass class Boo(Foo): p ...
ps钢笔工具路径问题
问题描述:ps钢笔工具画出路径后用文字工具打字路径出现一个空心圆点字,不能在路径上打字或者无法确认终止的位置. 解决:1.如果要在路径上全都打满字,要将文字对齐改为左对齐,2.如果要实现自定义结束位 ...
es6-async
含义 ES2017 标准引入了 async 函数,使得异步操作变得更加方便. async 函数是什么?一句话,它就是 Generator 函数的语法糖. 前文有一个 Generator 函数,依次读取 ...
正则表达式---01 js篇
本文主要针对js中正则表达式的实践操作,来让大家对正则表达式有一个入门清晰的了解. 正则表达式推荐学习网址:http://www.runoob.com/regexp/regexp-tutorial.h ...
LeetCode Merge Sorted Array 合并已排序的数组
void merge(int A[], int m, int B[], int n) { int *a=A,*b=B; ,j=; ||m==){ //针对特殊情况,比如A或B中无元素的情况 & ...
java Vamei快速教程05 实施接口
作者:Vamei 出处:http://www.cnblogs.com/vamei 欢迎转载,也请保留这段声明.谢谢! 在封装与接口中,private关键字封装了对象的内部成员.经过封装,产品隐藏了内部 ...
SAP Netweaver的负载均衡消息服务器 vs CloudFoundry的App Router
Message server for ABAP Netweaver SAP传统应用经典的三层架构: 起到负载均衡的消息服务器(Message Server)在图中没有得到体现.然后,消息服务器在我们每 ...
POJ-2226 Muddy Fields---二分图匹配+巧妙构图
题目链接: https://vjudge.net/problem/POJ-2226 题目大意: 用宽度为1长度不限的木板将水洼‘*’盖住而不盖住草‘.' Sample Input 4 4 *.*. . ...
JDBC开发,数据库的连接
JDBC开发步骤 1.建完工程后,右击工程,new,新建一个文件夹Folder,装jar包, 2.将下载好的驱动包打开,找到jar文件,CTRL+C,选中装jar包的文件夹,CTRL+V ...
IDEA Tomcat 日志和输出中文乱码问题
说明:该方法是在网上查找的其他方法均无效的情况下自己摸索出的设置.既然别人有效的设置在我这里无效,那么以下设置自然有可能无效.建议综合多个搜索结果进行尝试. 仅需要进行两处设置 1. 更改 IDEA ...

#3 working with data stored in files && securing your application

#3 working with data stored in files && securing your application的更多相关文章

随机推荐

热门专题