Workshop in Computational Bioskills

Workshop in Computational Bioskills - Lesson 9


Workshop in Computational Bioskills - Spring 2005

Lesson 9 - PHP Advanced (1)

Making Web Forms
Handling File System

Making Web Forms
Web forms are essential in almost any dynamic web application. We saw how to write a form in HTML, and here we'll see how to process the user input.


Let's start with an example we already saw:

simple_form.html:

<html>
 <head>
  <title>PHP Test</title>
 </head>
 <body>
  <form action="action.php" method="get">
   <p>Your name: <input type="text" name="my_name"> </p>
   <p>Your age:  <input type="text" name="my_age"> </p>
   <p><input type="submit" ></p>
  </form>
 </body>
</html>


The user fills the 2 windows, and the script action.php is 
called. The result is displayed on the browser: 

<html>
 <head>
  <title>PHP Action</title>
 </head>
 <body>
  Hi <?php echo $_GET['my_name']; ?>.
  You are <?php echo $_GET['my_age']; ?> years old.
 </body>
</html>




Can we do it in a single php file?

simple_form.php:

<html>
 <head>
  <title>PHP Form</title>
 </head>
 <body>

<?php
if array_key_exists('my_name',$_GET)
{
 print "Hi ".$_GET['my_name'];
 print "You are ".$_GET['my_age']." years old.";
}
else
{
print<<< _HTML_
<form method="get" action="$_SERVER[PHP_SELF]">
 <p>Your name: <input type="text" name="my_name" /></p>
 <p>Your age: <input type="text" name="my_age" /></p>
 <p><input type="submit" /></p>
</form>
_HTML_;
}
?>
</body>
</html>

$_POST Hash holding the variables that were send using "POST" method
array_key_exists($_POST['var']) True whenever the form is submitted - also when the var value is empty.
$_SERVER Holds various information about the server and the php request.

PHP_SELF Holds the path to the current URL (/~bioskill/Lesson9/simple_form.php)
SERVER_NAME The server name (www.cs.huji.ac.il)
DOCUMENT_ROOT The path in the server file system (/cs/course/current/bioskill/www/Lesson9/)
REMOTE_ADDR IP address of the user
HTTP_USER_AGENT User agent ID

Input Validation

Display error message (or the original form) upon empty input
Running your program with bad parameters may cause crashes
Preventing cross-site scripting attack - a user can insert JavaScript in the text area...


if ( $_GET['_submit_check'] == 1 ) 
{ 
    $form_errors = validate_form();
    if ($form_errors != '') {
        show_form($form_errors);
    } else {
        process_form();
    }
}
else {
    show_form();
}

_submit_check is hidden variable - it is not seen on the browser.
The functions can be implemented in any way.
To check numeric values, use intval(), floatval() that extract the number from the string,
and strval() that return the number as a string.

A simple check:



function validate_form() 
{
$error = '';
if (strlen( trim($_POST['product'])) < 1 ) 
  {
    $error = 'Please enter a product name';
  }

if ($_POST['price'] != strval(floatval($_POST['price'])))
  {
    $error = 'Please enter a valid price.';
  }
return $error;
}


Run valid_price.php

<select> Menus


o Displays a list of options (option to select one item or several items)


<form method="get" action="order.php">
<select name="order">
<option>Book</option>
<option>Ball</option>
<option>Car</option>
</select>
</form>





o To validate it, just check that the given value is one of the options. 
o Run valid_list.php
o valid_multiple_list.php enables the choice of multiple items.



Displaying default parameters


o With HTML we can display a default parameters in the form example.
o PHP you can just print these default options to the HTML file.

File System

$content = file_get_contents($file_name): returns a string with the file content. $file_name can be a local file or a URL.
file_put_contents($file_name,$string): writes $string into $file_name
$fh = fopen($file_name, 'permission_code'): opens the file for reading. If everything is OK, returns a file handler. Otherwise returns false.
fclose($fh): dump the buffer and try to close the file. return false if an error occurred during writing
$line = fgets($fh): return the next line in the file
feof($fh): return true when end of file
fwrite($fh,$line): write the next $line to the file

Permission code: specifies read/write permissions:

mode	action	starts from	file does not exist
rb	read	file beginning	return false
rb+	read,write	file beginning	return false
wb	write	file beginning	create it
wb+	read,write	file beginning	create it
ab	write	end of file	create it
ab+	read,write	end of file	create it
xb	write	file beginning	create it, if exists return false
xb+	read,write	file beginning	create it, if exists return false

To check permissions use file_exists($file_name), is_readable($file_name), is_writable($file_name).

Uploading a file


o Uploading file from the user file system to the server.
o Basically it's just another type of form.
o Possible in CS only under a special secured directory.


     <form action="upload.php" method="post">
         Choose a file to upload: <input name="userfile" type="file" />
         <input type="submit" enctype='multipart/form-data' value="Upload File" />
	 </form>

File upload.php handle the file. PHP stores all the uploaded file information in the $_FILES autoglobal array.

$_FILES['userfile']['name'] The original name of the file on the client machine.
$_FILES['userfile']['type'] The mime type of the file, if the browser provided this information.
$_FILES['userfile']['size'] The size, in bytes, of the uploaded file.
$_FILES['userfile']['tmp_name'] The temporary filename of the file in which the uploaded file was stored on the server.
$_FILES['userfile']['error'] The error code associated with this file upload.
Files will by default be stored in the server's default temporary