Secure PHP Development- P7

Chia sẻ: Cong Thanh | Ngày: | Loại File: PDF | Số trang:5

Thêm vào BST

Báo xấu

74
lượt xem 5
download

Download Vui lòng tải xuống để xem tài liệu đầy đủ

Secure PHP Development- P7: Welcome to Secure PHP Development: Building 50 Practical Applications. PHP has come a long way since its first incarnation as a Perl script. Now PHP is a powerful Web scripting language with object-oriented programming support. Slowly but steadily it has entered the non-Web scripting arena often reserved for Perl and other shell scripting languages. Arguably, PHP is one of the most popular Web platforms.

Chủ đề:

Bình luận(0) Đăng nhập để gửi bình luận!

Lưu

Nội dung Text: Secure PHP Development- P7

Part I Designing PHP Applications CHAPTER 1 Features of Practical PHP Applications CHAPTER 2 Understanding and Avoiding Security Risks CHAPTER 3 PHP Best Practices
Chapter 1 Features of Practical PHP Applications IN THIS CHAPTER ◆ Exploring the features of a practical PHP application ◆ Putting the features to work in applications PHP BEGAN AS A PERSONAL home page scripting tool. Today PHP is widely used in both personal and corporate worlds as an efficient Web application platform. In most cases, PHP is introduced in a corporation because of its speed, absence of license fees, and fast development cycle. The last reason (fast development cycle) is often misleading. There is no question that PHP development is often faster than other Web-development platforms like Java. However, the reasons for PHP development’s faster cycle are often questioned by serious non-PHP developers. They claim that PHP development lacks design and often serves as a glue logic scripting platform — thrown together in a hurry. Frankly, I’ve seen many such scripts on many commercial engagements. In this book, I introduce you to a PHP application design that is both well planned and practical, therefore, highly maintainable. Features of a Practical PHP Application When developing a practical PHP application you should strongly consider the fol- lowing features: ◆ An object-oriented code base: Granted, most freely available PHP appli- cations are not object oriented, but hopefully they will change soon. The benefits of object-oriented design outweigh the drawbacks. The primary benefits are a reusable, maintainable code base. You’ll find that there are similar objects in every application you develop, and reusing previously developed, tested, and deployed code gives you faster development time as you develop more and more applications. 3
4 Part I: Designing PHP Applications I developed all the applications in this book using a single object frame- work (discussed in Chapter 4). Being able to develop more than 50 appli- cations using the same framework means that I can easily fix any bugs, because the framework object code base is shared among almost all the applications. ◆ External HTML interfaces using templates: Having user interface ele- ments within an application makes it difficult to adapt to the changing Web landscape. Just as end users like to change their sites’ look and feel, they also like to make sure the application-generated screens match their sites’ overall design. Using external HTML templates to generate applica- tion screens ensures that an end user can easily change the look and feel of the application as frequently as he or she wants. ◆ External configuration: When designing a practical application, the developer must ensure that end-user configuration is not within the code. Keeping it in an external-configuration-only file makes it very easy for end users to customize the application for their sites. The external config- uration file should have site configuration data such as database access information (host name, username, password, port, etc.), path information, template names, etc. ◆ Customizable messages: The messages and error messages shown by the application should be customizable, because a PHP application could find its way into many different locales. A basic internationalization scheme would be to keep all the status and error messages in external files so that they can be customized per the local language. ◆ Relational data storage: Storing data on flat files or comma-separated value (CSV) files is old and a lot less manageable than storing data in a fast relational database such as MySQL. If the Web application collects lots of data points from the Web visitors or customers, using a relational database for storing data is best. Using a database can often increase your data security, because proper database configuration and access control make it difficult for unauthorized users to access the stored data. ◆ Built-in access control: If a Web application has sensitive operations that are to be performed by only a select group of people and not the entire world of Web visitors, then there has to be a way for the application to control access to ensure security. ◆ Portable directory structure: Because most PHP applications are deployed via the Web, it’s important to make the applications easy to install by making the required directory structure as portable as possible. In most cases, the PHP application will run from a directory of its own inside the Web document root directory.
Chapter 1: Features of Practical PHP Applications 5 Employing the Features in Applications Now let’s look at how you can implement those features in PHP applications. Creating object-oriented design The very first step in designing a practical application is to understand the problem you want the application to solve and break down that problem into an object- oriented design. For example, say you’re to develop a Web-based library check-in/checkout sys- tem. In this situation, you have to identify the objects in your problem space. We all know that a library system allows its members to check in and check out books. So the objects that are immediately visible are members (that is, users) and books. Books are organized in categories, which have certain attributes such as name, description, content-maturity ratings (adults, children), and so on. A closer look reveals that a category can be thought of as an object as well. By observing the actual tasks that your application is to perform, you can identify objects in the sys- tem. A good object-oriented design requires a great deal of thinking ahead of cod- ing, which is always the preferred way of developing software. After you have base object architecture of your system, you can determine whether any of your previous work has objects that are needed in your new appli- cation. Perhaps you have an object defined in a class file that can be extended to create a new object in the new problem space. By reusing the existing proven code base, you can reduce your application’s defects probability number significantly. Using external HTML templates Next, you need to consider how user interfaces will be presented and how can you allow for maximum customization that can be done without changing your core code. This is typically done by introducing external HTML templates for interface. For example, instead of using HTML code within your application, you can use HTML templates. HTML templates are used for all application interfaces in this book so that the applications are easy to update in terms of look and feel. To understand the power of external HTML user-interface templates, carefully examine the code in Listing 1-1 and Listing 1-2. Listing 1-1: A PHP Script with Embedded User Interface