To highlight how easy it is to do database backed websites I wrote a simple guestbook using PHP

University Degree Mathematical and Computer Sciences

The Guestbook

To highlight how easy it is to do database backed websites I wrote a simple guestbook using PHP. The code will be examined here to explain how the PHP code works and why I did certain things. One of my goals in writing database backed websites is to keep related pages and functions as simple as possible, but where possible to use a single file to make troubleshooting easier. This might make things more confusing at first, but it will work better in the long term.

The application is very simple. When you go to the page it loads the "Add A Message" form and then connects to the database to get all the guestbook entries. Once is has selected the data it builds the html to display the output and delivers it to the browser.

When someone fills out the form and hits the submit button, the form action reloads the page, adds the data to the database, then selects all the data again including the new entry and builds the html to display the output and delivers it to the browser.

The code I have commented on this page is available in my . In my comments I have used teal to represent comments, red to indicate PHP code and blue to indicate HTML.

Getting Started

The first item of note about PHP is how the server knows whether a bit of text in the file is PHP or HTML. The server is alerted to begin processing PHP code when it encounters a <?. It continues to process the text as PHP code until it encounters a ?>. The wonderful part about PHP is that you can break into and out of PHP processing mode for little snippets of code.

Lets start by looking at the guestbook program as an example. The very first line of code <? tells the server to enter PHP mode. The next line /* should look familiar to any Perl, C or Java programmers out there as the beginning of a comment. That kind of comment will run until it hits a */

PHP Guestbook

Written by Tony Awtrey

Anthony Awtrey Consulting

See http://www.awtrey.com/support/dbeweb/ for more information

1.1 - Oct. 20, 1999 - changed the SQL statement that reads data

back out of the database to reverse the order putting the

newest entries at the top and limiting the total displayed

by default to 20. Added the ability to get the complete list

by appending the URL with '?complete=1'. Added the code and

additional query to count and list the total number of entries

and included a link to the complete list.

1.0 - Initial release

This is the SQL statement to create the database required for

this application.

CREATE TABLE guests (

guest_id

int(4)

unsigned

zerofill

DEFAULT '0000'

NOT NULL

auto_increment,

guest_name varchar(50),

guest_email varchar(50),

guest_time timestamp(14),

guest_message text,

PRIMARY KEY (guest_id)

);

This next section of code demonstrates a second kind of comment that PHP shares with C++, Perl and Javascript. Any line that starts with // is taken as a comment. The next line of actual PHP code tests to see if this page is being loaded as a HTTP POST query. When HTML forms are processed, they can either put data to the server using the GET method or the POST method. GET is the one that puts a ? after the page followed by a string of key=value pairs. POST methods hide the data being input by listing it is a special environment variable called HTTP_POST_VARS. If we are posting, this is the beginning of how we put data into the database.

////////////////////////////////

// This checks to see if we need to add another guestbook entry.

////////////////////////////////

if (($REQUEST_METHOD=='POST')) {

This next section of code removes the dangerous characters from the data from the form. Any input recieved from an unverified source like the Internet should be treated as if it were an attack or crack attempt. To prevent this I remove the redirection characters (< >) and the "pipe" character ( | ) and replace them with spaces. PHP provides a complete set of string handling functions, including the strtr or "string translate" function.

Another nice thing it does is automatically adds the backslashes to quote characters for you to keep from causing problems sending the string data to the database.

The last item of note is the use of the $$key to indirectly refer to a variable. This code basically walks through each key=value pair and temporarily assigns the value to a variable called $this. Once the data has been untainted it is assigned back into the original value statement

////////////////////////////////

// This loop removed "dangerous" characters from the posted data

// and puts backslashes in front of characters that might cause

// problems in the database.

////////////////////////////////

for(reset($HTTP_POST_VARS);

$key=key($HTTP_POST_VARS);

next($HTTP_POST_VARS)) {

$this = addslashes($HTTP_POST_VARS[$key]);

$this = strtr($this, ">", " ");

$this = strtr($this, "<", " ");

$this = strtr($this, "|", " ");

$$key = $this;

}

Now we need to check that all the fields were filled in completely. If they were filled out we are ready to put the data into the table.

////////////////////////////////

// This will catch if someone is trying to submit a blank

// or incomplete form.

////////////////////////////////

if ($name && $email && $message ) {

First we define the INSERT query we are going to send. PHP automatically puts the data on the form into variables named the same as the form INPUT tags. $name, $email and $message are all created by PHP when the form is posted. These expand out in the definition of the $query variable. Note the .= symbol. This concatenates the subsequent $query definitions with the first instead of redefining $query.

The three lines that begin with "mysql" are all it takes to put data into a database. The first line connects to the database host using the supplied username and password, the second line selects the database to have the data updated to and the third line issues the query. the "or die" statements are a primitive error handler that will tell you at least what failed if you did something wrong.

////////////////////////////////

// This is the meat of the query that updates the guests table

////////////////////////////////

$query = "INSERT INTO guests ";

$query .= "(guest_id, guest_name, ";

$query .= "guest_email, guest_time, guest_message) ";

$query .= " values(0000,'$name','$email',NULL,'$message')";

mysql_pconnect("db2.pair.com","tator_w","password")

or die("Unable to connect to SQL server");

mysql_select_db("tator_awtrey") or die("Unable to select database");

mysql_query($query) or die("Insert Failed!");

If the form was NOT completely filled out a variable called $notall is created and set to "1". If the form was NOT called via the POST method all the preceding code was skipped down to the last bracket. Then the ?> indicates we are back in HTML land.