Creating A PHP Application

Contents

1. Abstract
2. The Database
3. User CRUD
4. Create A User
5. Verify User
6. Login
7. Log Out
8. Blog CRUD
9. Create A Category
10. Delete A Category
11. Create A Blog Entry
12. Retrieve Blog Entries
13. Update A Blog Entry
14. Delete A Blog Entry
15. Sod This, Just Give Me The Blog
16. Credits

Abstract

In this introductory tutorial the process of building a complete php application is explored. The application is a simple blog and uses a MySQL database to store all the data. The blog application contains a user system for the adminstrator to post new blog entries. The final approval for each blog entry is handle by the administor. Assumed knowledge is basic use of HTML and CSS to render the display.

This tutorial will suit those looking to begin with PHP and have never written an entire application. No external resources will be used in the building of the application and all code will be generated here. This tutorial does not make use of Object Oriented code which may be more efficient.

Each section of the tutorial introduces new concepts from the PHP language that are used frequently in many PHP applications and websites. Many functions are used and explanations given for each as they are introduced.

The Database

As mentioned above, the blog data will be stored and retrieved from a MySQL database. PHP provides many simple to use MySQL functions for this purpose, but first, the database needs to be created. The command line below shows how to create the database from the command line.

Following this the system will prompt the user for the root password and when given the new database, named blog, will be created. From there a username and password will need to be set for the blog application, after all, using root to interface to the database would be poor form.

Once again, a password is required, and when given, the mysql prompt is ready to take commands. Here is the command to create a user for the database named blog.

With the database successfully created, and a username and password in place exit the database and login again using the new username and password.

When prompted, type in the password for the blog_master.

The database tables are themselves quite basic. A table of blog categories, and a table of blog_content. The blog_category table need only contain the blog category id, and the blog category name.

The blog content table has a little extra. This table will contain the blog id, the blog category id, the blog headline, the blog text, and the blog date. The blog id will be an auto incremented value to avoid duplication and provide a primary key to ensure fast indexed lockup's. The blog category id will be a foreign key which references the blog category id in the blog category table. To this end, the tables must make use of the InnoDB table type.

The tables will look like this:

CREATE TABLE blog_users (
  blog_user_id int(11) NOT NULL auto_increment,
  blog_user_name varchar(20) NOT NULL,
  blog_user_password char(40) NOT NULL,
  blog_user_email varchar(254) NOT NULL,
  blog_user_access_level int(1) NOT NULL default 0,
  PRIMARY KEY (blog_user_id),
  UNIQUE KEY blog_username (blog_user_name)
) ENGINE=InnoDB DEFAULT CHARSET=latin1;

CREATE TABLE blog_categories (
  blog_category_id int(11) NOT NULL AUTO_INCREMENT,
  blog_category_name varchar(50) NOT NULL,
  PRIMARY KEY (blog_category_id)
) ENGINE=InnoDB DEFAULT CHARSET=latin1;

CREATE TABLE blog_content (
  blog_content_id int(11) NOT NULL AUTO_INCREMENT,
  blog_category_id int(11) NOT NULL,
  blog_user_id int(11) NOT NULL,
  blog_content_headline varchar(50) NOT NULL,
  blog_content_text text NOT NULL,
  blog_content_date timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
  blog_publish int(1) NOT NULL default 0,
  PRIMARY KEY (blog_content_id),
  FOREIGN KEY (blog_user_id) REFERENCES blog_users(blog_user_id) ON DELETE CASCADE,
  FOREIGN KEY (blog_category_id) REFERENCES blog_categories(blog_category_id) ON DELETE CASCADE
) ENGINE=InnoDB DEFAULT CHARSET=latin1;

Note in the blog_content table that the blog_category_id, and the blog_user_id fields are set as a foreign key and that they are set to ON DELETE CASCADE. This means if a blog category is deleted, all blog content that is related to it will also be deleted from the blog_content table, also, if a blog user is deleted, all blog entries by that user will be deleted. Be careful.

Copy and paste the database schema above into the command line to create the tables. Be careful if using a third party application such as phpmyadmin to talk to MySQL as many of these applications have poor support for foreign keys.

With the database set up complete, the first steps can be made to start blogging.

User CRUD

Before any blog entries can be added by users, the users must first be added to the system. An admin user will also be required to oversee, or moderate, the blog entries. The method of creating, retrieving, updating and deleting database entries is commonly referred to as CRUD

• Create
• Retrieve
• Update
• Delete

These a are the basic tasks needed to build the blog most PHP applications. Indeed, they are possibly the most commonly used tasks of all database driven applications and web sites, and hence, get their own acronym. But before any data can go into the database, a database connection needs to be made. This will be the first file and will be included in all files where a database connection is required.

Create a directory called includes in which to keep all the php scripts that are created for the blog. This will keep things tidy and easy for maintenance purposes. In the includes directory create a file called conn.php which will look like this:

If this file were to be accessed on its own, no data would be shown, not even if there was an error. The use of the @ symbol before mysql_connect() is used to suppress errors. This is rarely required and should be used only where appropriate. It is used in this instance to suppress the error as a check will soon be made on the validity of the $db link that follows.

Create A User

Now that a database connection can be made, users can be added to the system. Each user will have a user name, and password, and an access level. The access level will detirmine what files they have access to. Having regular users access the administration files would be disasterous, so care must be taken to ensure that users recieve only the amount of access they require.

Initially, the users will be confronted with a form which prompts for user name and password. When complete an email will be sent to the specified email address and the user will have 24 hours in which to verify the sign up or the entry will be deleted.

The process of verifying a user is quite simple. In the email that is sent to the user, the user id is sent in a link along with a randomly generated verification code. The user must access the link provided, and enter the verification code. Upon success, the user is logged in and can submit blog entries.

To avoid repitition of commonly used HTML components, a simple template can be made of the components and included with the PHP include language construct. As a language construct, include is not really a function, but is often thought of as a function to avoid confustion. Here, a header.php and footer.php file will be created with elements common to all HTML files in the system, such as the DOCTYPE, title, body etc.

Create a directory called includes and in the includes directory, create a template called header.php and in it put the following HTML.

The footer file contains even less and has only the closing body and html tags. Create a file in the includes directory named footer.php an it put the following HTML.

With these two files in place, the form to add users can be created. As the form is part of a CRUD system, it will server two purposes. To add users and then to edit users. This means saves duplication and saves coding time. It is a simple HTML form and will accept a user name and password.

The form itself is included in the adduser.php file which will be created next. The form introduces the PHP isset() function and the PHP ternary operator. The isset() function, as the name suggests, is used to check if a variable is set. The ternary operator is like a PHP if/else. So the following two snippets are the same.

The use of isset() and the ternary operator can make the form quite compact when checks need to be made if variables are set or not. The user_form.php will look like this.

When including the above form, several issues need to be resolved. The form variables need to be set, including the form token. The form token is set to ensure that the form that is being posted to the script, is in fact from the same server and not some malicious users form. The form token variable is destroyed when the form is successfully submited to avoid re-posting the form with the browser refresh button.

The form token is stored in a session. PHP sessions are a method of storing variables and making the available from page to page. A variable set on one page, can be accessed from other pages, quite a neat feature. When using sessions, the first line of a script must be session_start(). More information on sessions can be found in the Introduction To PHP Sessions tutorial.

When accessed with the browser the form is displayed with the relevant variables values filled in, such as the form action, the submit button value, and the form token. The form will post to a PHP script named adduser_submit.php. This script will check the values posted from the form, and if they are valid, put them into a database and then email the user with a verification code which will be used later to activate the account. Sounds easy right?

The adduser_submit.php script will look like this.

The structure of the above script takes the form of an if/elseif/else ladder. This allows the code execution to step through a variety of checks before the operational part of the script is executed. The checks are many and provide the minimum security checking needed to secure a PHP application.

Stepping down the ladder, the first uses isset() to check that the form token has been sent, this ensures the form that POSTed the data is not a hackup on a third party machine. The second check also uses the isset() function, but this time checks four variables in one swoop. This feature of the isset() function makes the if/elseif/else ladder much shorter and saves time on coding mulitple isset()'s for each POST variable.

A check is then performed on the form token to be sure that the token POSTed matches the token stored in the SESSION. If the tokens do not match and error is generated. From there variables are checked for length. This is important as a malicious user may try to inject variables with lengths shorter or longer than the length expected, or the length permitted by the database. This would cause an error that may give away internal information about your system.

A check is made on the validity of the email as well as on the length. There is no regular expression known to man that will successfully match all valid emails per the RFC. This one will catch all sane email address.

If success, the script then prepares for use with the datbase. It is imperative that any variables that are to be used in an SQL statement are proplerly escaped to prevent SQL injection. It is at this time, the users email address is sanitized also, not only for SQL injection, but for email header injection also. All variables that are to be used in emails should be proplerly sanitized to prevent header injection, which is a leading cause of SPAM. A further check is made to ensure the username, or the email address is not already is not already in use. If it is already in use, an error is generated. If all is well, the new user data is added to the database and and email is sent to the user with a verification code.

Verify User

When a new user is created as above, an email is sent to the users email address with a verification code. The URL in the link contains a section like this:
verify.php?vc=48ba88c9efeef
This means the file verify.php will have access to the verification code via PHP super global named $_GET['vc'].

The verify.php file itself is quite simple in comparison to the previous file. Once again the isset() function is used, this time to check that the verification code is present in $_GET['vc']. Then the length of the string is check and if all is well, the verification code is prepared for use in the database using mysql_real_escape_string().

The SQL query is run and updates the user status of the user with the matching verification code. By using the mysql_affected_rows() function it is possible to check if the SQL query was successful.

Login

Now that a user can be created and register with the system, it is possible for the user to log into the system. But first, a method of navigation is required. The navigation menu will be common to all pages, so can be part of the header. This means only a single copy is every needed and saves code duplication.

The new includes/header.php file will look like this.

The first change that is noticable in the header.php file is that the first block of code at the top contains a check if the SESSION variable named access_level is set. If a user is logged in, the value of the link is set to logout. If the user is not logged in, the values are set to provide a link to log in. The menu is very basic and provides a small CSS unordered link list.

The login form is basic also, and will POST to a login_submit.php file, which will do some checking and attempt to log th e user into the sytem.

The login form will look like this.

No surprises in the login form. It contains the obligatory session_start() function that must be used any time an interaction with session variables is required. The form token is set and the header file is included. The form is simple and contains the form token and inputs for username and password, followed by the inclusion of the footer.php file.

When the form is submitted, something different happens. The form token is checked, the username and passwords are validated and sanitized, but instead of displaying a message, the script will redirect the user to the index.php page, which will be created now.

The index.php file will look like this.

The index file will grow quite substantially further on as blog entries need to be retrieved, but for now, this is all that is required.

The login_submit.php file will look like this.

This time, when the form is submitted, the user is redirected the index.php page if the login is successful. If the login fails, the user is redirected back to the login page to try again. The first line of code begins the output buffering which allows PHP to no send any headers to the browser, which would cause an error as headers are sent when using session_start and again when using the header() function.

The structure maintains the if/elseif/else ladder and traverses through some of the checks used earlier to validate and sanitize the user inputs. At the end of the script, the header() function redirects and finally, the ob_end_flush() function sends the whole thing to the browser.

Note that the Login link in the menu changes to Log Out when a user logs in.

Log Out

Now that a user can log in to the system, a method is required to log out. As the link for the log out is already in the menu, it is simply a matter of creating the logout.php file. This file only needs to check that the access_level SESSION variable is set, and if it is, unset() it, and then redirect the user back to the index.php page.

The logout.php file will look like this.

Blog CRUD

The blog CRUD, as the name suggest comprises four components.

• Create
• Retrieve
• Update
• Delete

To Create or add a blog entry, there must first be some categories to add them to.

Create A Category

Before data can be retrieved from the database, it must first be put in. The most common way of user input into a database with PHP is with a HTML form. Because a form is a client side interface, the door is left open to abuse as the content the end user puts into the form, may not be the type of content expected or, if a malicious users wants to get nasty, may to to compromise the system. It is the job of the PHP developer to close these security doors and the basic lesson is this:

NEVER TRUST USER INPUT

NEVER TRUST USER INPUT

NEVER TRUST USER INPUT

As this blog is a multi-user system, precautions must be taken to avoid mistakes and mis-use. The form itself is quite simple and is simply HTML.

Creating categories is a function of the administrator, and so the script to add a category must only be availble to the admin user. The user access level for the adminstrator is 5. This can be checked as the access level is stored in a session, so when the admin lands on the add_category.php page, access can be checked, and if the access level is not correct, the user will be redirected to the index.php page.

This file makes use of output buffering to manage the headers. Headers are send from the included header.php file with session_start() and this would produce a warning. The script checks that the user who is accessing the page is an administrator by checking first that the access_level variable is set and that its value is 5. If this is not true, the user is forward off to the index page gracefully. I the access is from the administrator, then the form is shown in the page.

The file is a simple HTML form that contains the required input text field to add a category. Note that the name of the input matches the name in the database. This is not strictly required but gives clarity when dealing with variables.

The form action is the add_category_submit.php file. This is the file that will process the form data, and if all is well, will add the category to the database. To achieve this several things need to happen.

• The form field must contain a valid name
• The connection must be made to the database
• The category must be added
• A response is required

As the category name must be a string containing less than 50 characters, because the database field is defined as VARCHAR(50), it is simple to validate that this is what has been supplied by the form. The database connection is made by simply includeing the conn.php file. When a file is included with PHP, it is the same as if the code were written where the include occurs. Following this, the category is added to the database and a thank you message created. The add_category_submit.php file will look like this.

It is quite clear from the above code, that ninety percent of the code is dedicated to error checking. This is perhaps the most important part of dealing with input from users. Note that once again, the blog_category_name variable matches the name in the database, and that the naming convention is maintained throughout the script.

The use of the preg_match() function contains several validation tasks rolled into a single function. Regular expressions are an excellent tool for validating user input to ensure what is posted from a form, is what expected when processing the data. This regular expression allows the use of alpha numeric characters and underscore, space and comma. This permits a good variety of characters to use for any sane category name.

The form and form submit now work as expected and categories can be added easily, A form token has been used to ensure teh validity of the form and to prevent page refresh. The form token can be stored in a session with the add_category.php form, and then checked in the add_category_submit.php script, and if the POST is successful, the token is deleted, thus preventing further POSTings of the form.

Delete A Category

The process of deleting a category is very similar to that of adding a category, with a few small changes the code is mostly the same. The form maintains the session token and the only difference is that the category names and id's are extracted from the database to be used in the form with a drop-down select.

The process of gathering the information for the form is kept at the top of the script. This means all the application logic is separated from the display logic. This will be important as scripts, and indeed, applications, become larger. The form script itself looks like this.

Note the delete button has a small javascript onclick added which pops up a confirm window asking the users to confirm the delete when the button is pressed.

Moving to the includes/del_category_submit.php file, once again there is many similarities with the add_category_submit.php file. The same process is involved with small changes to the error checking to validate that the blog_category_id is indeed a number. The inclusion of the database connection class and connection resource is same and only the SQL query changes. A small addition when the deletion is completed is the mysql_affected_rows() line which returns the number of affected rows from the previous mysql operation. This can be used to display the number of rows deleted which should be one.

The del_category_submit.php file looks like this.

Once again the code shows mostly error checking, this is the life of the PHP programmer. The task is not one of how make things right, but of how to stop things going wrong. There are many aspects of simple scripts which need to be dealt with that are often overlooked. By attending to the smaller details, PHP scripts and applications are robust and easy to maintain.

Add several categories such as Computers, Programming and Cars. These will be the categories used as the tutorial progresses.

Create A Blog Entry

With the categories now available, the real work of CRUD can begin. Of course, the beginning is the creation of a blog entry. Once again a form will be used to enter the data but this form will not be as simple as the previous. A little forward thinking is needed as a blog entry may need to be edited to correct some aspect of the entry. The form fields will be identical, and it would be poor practice to duplicate the form and use separate forms for both add and editing a blog entry.

Like any other piece of reusable code, the form can be included in a php script. The main difference with a reusable piece of HTML code is that any PHP variables within the code must be available to it. Also, the form action will be directed to two different scripts, so this too must be a variable set in the parent script, that is, the script that includes the form.

The includes/blog_form.php file, which contains the form, will look like this

The form is much the same as the add_category form from used earlier, with the exception that this form has more fields. The category drop-down menu is identical to that of the add category form and a text input field is supplied for the heading along with a textarea for the blog_content_text. Once again the field names are identical to those in the database table that the form is designed for.

The form also contains several pieces of PHP code in the inputs to echo the value of form field if they are set. The form action is set with a variable along with the value of the submit button. These variables make the form re-usable later when updating blog data.

Following from there, the variables that are in the form are set. If one of them is omitted, an error will be produced, so it is important to make sure all variables have a value, even if the value is an empty string.

The add_blog.php file will look like this.

The final part of adding a blog entry is to create the add_blog_submit.php file. Like the add_category_submit.php file, the task of INSERTing the data into the database is quite simple. The same process is repeated with a new SQL query for the blog table. The session token is destroyed in the same way to prevent multiple posting by hitting the refresh button.

The add_blog_submit.php file will look like this.

Retrieve Blog Entries

Now that blog entries can be created, they need to be retrieved in order to be displayed. This is achieved with the use of a single SELECT statement. The page to view the last 5 blog entries will be the main index.php page.

This file is far less complex than the previous examples as it requires only a single query to extract the data and then display it. The conn.php file is included and a check is made for a valid database connection. Further checks are then made to ensure a valid database resource is available and if all is well, the blog data is SELECTed from the database.

The data is put into an array of blog data for use further down the script in the display where a simple foreach loop echoes each record in a little box that can later be styled with CSS.

Update A Blog Entry

Once a blog entry has been added, it will become the first item displayed on the index page. It is about this time that a spelling error is noticed, so a method to update or edit the entry is required. The form to do this has already been created, and is the same for that was used to add a blog entry, that is, the blog_form.php file in the includes directory.

By creating a page with a table to select and list all the blog entries, a simple hypertext link can be used to forward to the edit blog page. The ID of the blog entry is sent along with the URL and is retrieved using GET.

Each blog entry should only be able to be editted by the user who posted it, or the admin user, so it is important to check both the user id of the user, and the access level. Remember, and access level of 5 is the administrator.

The list_blogs.php file will look like this.

By now, the format of the list_blog.php file should be quite apparent. The header file is included along with the database connection file, conn.php. A simple SQL SELECT pulls the blog id and headline from the and an array is created which is used in the creation of a HTML table to display each headline. The hypertext link contains the blog_content_id which will be used by the edit_blog.php file to SELECT the data for that ID.

Note that if the user access level is equal to 1, the WHERE clause is added to the SQL query to ensure only the results for that users are displayed.

Like all data supplied from userland, the blog id, called "bid" for short, must be checked and escaped with the mysql_real_escape_string() function to protect against SQL injection. An abbreviated version of the variable named in this case as it will be used in the URL and URL's should be kept as short as possible.

The edit_blog.php file will look like this.

With the edit_blog.php file in place, and all the variables set, it is now simply a matter of creating the file to submit to that will perform the updates made in the form. Note that the correct category for the blog entry is selected in the drop down menu and and can be changed.

Create a file in the includes directory called edit_blog_submit.php. This file will, as with previous scripts, collect all the information coming in, validate it to be sure it is what is expected, escape it to prevent SQL injection, and finally UPDATE the database record, saving the changes. If the process of continually checking and re-checking data seems laborious, think of the task of having the site and/or database compromised and having to rebuild it.

The edit_blog_submit.php file will look like this.

Delete A Blog Entry

The final part of the CRUD is the Delete. This process is much the same as seen previously in this tutorial when deleting a category. Like the edit blog process, a method is needed to list all the blog entries so a selection can be made. Creating a new list identical to the one just created would be further, and unnecessary duplication. With a small change to the list_blogs.php file, a delete option can be provided next to the edit option.

Note also in the Delete link a small javascript onclick confirm has been provided so when the delete link is clicked, the user will be prompted with a confirmation box with a message. If javascript is disabled, the script will simply delete the relevant blog entry without warning.

The del_blog_submit.php file is very much like the delete category page and performs the same function, it checks that a valid number has been submitted to the page, and if all is will, the link is deleted, and a message appears to say the task is done.

The delete_blog.php file will look like this.

With this file in place, the blog is complete and ready for action.

Sod This, Just Give Me The Blog

The entire source code for this blog application is available for download and users are free to use it, or build on it however they wish.

• Download blog.tar.gz

Credits

Thanks to Captain Cook for discovering Australia, and to the British, for sending us here.