Index

Symbols

[] (array element operator), 35

-- (decrement operator), 30–31

== (equal operator), 31–32

$_POST array, 20

$.ajax() method, 508–509

$.get() method, 510

$.getJSON() method, 510

$.getscript() method, 510

$.post() method, 510

$this pointer, 164

(backslash), escape sequences, 125–126

^ (caret symbol), 121

, (comma operator), 33

@ (error suppression operator), 34

`` (execution operator), 34–35

/ (forward slash), 56, 120

% (percent) symbol, printing, 110

& (reference operator), 31

; (semicolon), 16, 222–223

() (parentheses), order of precedence, 37–38

?: (ternary operator), 34

| (vertical pipe), 123

A

absolute path, 56

abstract classes, 188

access control implementing, 366–369

access modifiers, 165, 166

visibility, controlling, 169–170

accessing

array contents, 77–79

array elements, 79

with each() construct, 80–81

with foreach loop, 80

form variables, 20–22

assignment operators, 20

htmlspecialchars() function, 21–22

PHP, 12

accessor functions, 166–168, 178

ACID (atomicity, consistency, isolation, and durability), 317–318

add_bms.php, 588–589

addClass() method, 498

adding

dynamic content, 18–19

locks to files, 71–73

addition operator, 28

address field (Bob’s Auto Parts order form), 54

administrator privileges (MySQL), 229

advantages of reusing code

consistency, 132

cost, 132

reliability, 132

aggregating SQL data, 259–261

AJAX (Asynchronous JavaScript and XML), 493–494

$.ajax() method, 508–509

asynchronous requests, 493

helper methods, 509–510

$.get(), 510

$.getscript(), 510

$.post(), 510

real-time chat application, building chat server, 504–507

aliases

for namespaces, 198

for tables, 257–258

ALTER TABLE command (SQL), 265–268

altering

error reporting settings, 554–556

tables after creation, 265–268

alternative control structure syntax, 51

anchoring regular expressions to beginning or end of string, 123

anonymous functions, 155–157

Apache

HTTP Server

.htaccess files, 374–377

configuring, 356

installing

on UNIX, 600–602

on Windows and Mac, 612–613

applying

functions to arrray elements, 97–98

localization to web pages, 440–445

language selector page, 442–444

software engineering to web development, 530

templates to web pages, 134–139

text to buttons, 461–464

arbitrary lengths, reading, 69

ARCHIVE table type, 316

arguments, 39

arithmetic operators, 28–29

array elements, 76

accessing, 79

with each() construct, 80–81

with foreach loop, 80

applying functions to, 97–98

counting, 98–99

indices, 76

array key-value pairs for getdate() function, 427–428

array operators, 35, 81–82

array_count() function, 98–99

array_multisort() function, 87–88

array_pop() function, 92

array_push() function, 92

array_reverse() function, 92

array_walk() function, 97–98

arrays, 24, 75–76

$_POST, 20

accessing contents, 77–78, 78–79

bounding box contents, 463

converting to scalar variables, 99–100

initializing, 79

loading from files, 92–96

multidimensional arrays, 75, 82–85

sorting, 87–90

three-dimensional arrays, 84–85

two-dimensional arrays, 82–84

navigating, 96–97

numerically indexed arrays, 76–77

reordering, 90–91

with shuffle() function, 90–91

reversing, 92

sorting, 85–87

with asort() function, 86–87

with ksort() function, 86–87

reverse sorting, 83

with sort() function, 85–86

superglobal, 20, 27

asort() function, 86–87

assertions, 126–127

assigning values to variables, 24

assignment operators, 20

combined assignment operators, 30

values returned from, 29

associativity, 37–38

asynchronous requests, 493

atomic column values, 216–217

attackers, 339

attributes, 160, 162, 164–165, 177

access modifiers, 165, 166

accessor functions, 166–168

overriding, 170–172

preventing, 172

authentication, 333

access control, 366–369

basic authentication, 372–377

in PHP, 372–373

custom authentication, creating, 377

identifying visitors, 365–366

passwords

hash functions, 370–371

storing, 369

PHPbookmark project, 569–587

changing passwords, 580–582

logging in, 576–579

logging out, 580

registering users, 569–575

resetting forgotten passwords, 582–587

in session control, 483–491

authmain.php, 483–489

logout.php, 490–491

members_only.php, 489

authmain.php, 483–489

auto_append_file directive, 139–140

_autoload() function, 189

AUTO_INCREMENT keyword (MySQL), 234

auto_prepend_file directive, 139–140

autocommit mode (MySQL), 318

automatically generated images, 456

available extensions, identifying, 522–523

avoiding FTP timeouts, 420

B

backing up

files, 412–420

MySQL databases, 310–311

backreferences, 126

backtraces, 202

balancing security with usability, 342

bar chart, drawing, 465–474

basename() function, 397

basic authentication, 372–377

.htaccess files, 374–377

in PHP, 372–373

basic values, filtering, 346–347

basic_auth.php, 372–373

Bill Gates Wealth Clock, 407

bitwise operators, 33

blank canvas, creating, 452–453

BLOBs (binary large objects), 244

blocks, declaring, 42

Bob’s Auto Parts site

exception handling, 204–208

order form

address field, 54

creating, 12–14

fields, naming, 14

processing, 14

totals, calculating, 36–37

Smart Form Mail application, creating, 101–104

bookmark_fns.php, 567–568

bookmarks (PHPbookmark project), 561

adding, 588–590

deleting, 591–594

displaying, 590–591

Book-O-Rama bookstore application, 213–214

inserting information into database, 282–285

results.php, 273–275

schema, 221

search form, 272–273

Boolean values, 24

bottom-up approach to security, 343

bounding box, 462–463

branching, 123

breaking up code, 535–536

browsedir2.php, 392

browsedir.php, 390

browsers

cookies, 476, 477

session ID, storing, 477–478

setting from PHP, 476–477

outputting images to, 455

session control, 475

authentication, 483–491

configuring, 482–483

sessions

creating, 480–482

registering variables, 478–479

starting, 478

browsing php.ini file, 355–356

Bubbler, 510

built-in functions, 144

buttons

applying text, 461–464

creating, 457–465

base canvas, setting up, 460–461

outputting to browser, 465

positioning text on, 464

text, writing on, 464–465

C

calculating

dates

in MySQL, 434–435

in PHP, 433–434

totals on order forms, 36–37

calendar functions, 436

_call method, 188–189

callable type, 24

calling

class operations, 165

functions, 19, 141–142

recursive functions, 154–155

undefined functions, 142–143

canvas images

creating, 452–453

printing text on, 453–454

Cartesian product, 254–255

case of strings, changing, 111–112

case sensitivity, of identifiers, 239

catch blocks, 200

CHAR type columns, 235

character class, 121–122

character sets, 120–121, 438–440

multi-byte, 438

security implications, 439–440

single-byte, 438

characters. See also special characters, 123–124

reading, 69

charts, drawing from stored MySQL data, 465–474

chat application

chat server, building, 504–507

user interface, building, 510–517

chat.php, 504–507

checkdate() function, 428–429

checking

for existence of files, 70

length of strings, 115–116

choosing

development environment, 537–538

file mode, 55

keys, 217

chop() function, 104

classes, 161

$this pointer, 164

abstract classes, 188

attributes, 162, 164–165, 177

converting to strings, 194

designing, 176–177

Exception class, 201–202

inheritance, 161–162, 168–169

late static bindings, 186–187

multiple inheritance, 172–173

preventing, 172

instantiating, 163–164

namespaces, 195–197

global namespaces, 197–198

importing, 198

subnamespaces, 197

naming, 177

ObjectIterator, 192

operations, 162–163

calling, 165

polymorphism, 161

structure of, 162–163

traits, 174–176

writing code for, 177–184

accessor functions, 178

metatags, 177

click event, 500

Clifford, John, 510

cloning objects, 187–188

closedir() function, 391

closing files, 63–65

closures, 155–157

code

breaking up, 535–536

checking out, 537

for classes, writing, 177–184

operations, 181

commenting, 534

debugging, 352–353

indenting, 42, 534–535

maintainability, 532

optimizing, 540–541

organizing, 350–351

reusing, 133–134

advantages of, 131–132

functions, 140–157

in large web projects, 531–532

require() statement, 134–139

traits, 174–176

securing, 343

command execution, 353–354

escaping output, 348–350

filtering input data, 343–348

source code, highlighting, 525–526

standards, 532

defining naming conventions, 532–534

testing, 541–542

code blocks, 42

columns, 211, 235–237

atomic column values, 216–217

data types, 240–246

date and time types, 243–244

numeric types, 241–242

string types, 244–246

displaying, 302

indexes, creating, 238

MySQL

CHAR type, 235

VARCHAR type, 235–236

primary key, 211

columns_priv table, 296–298

combined assignment operators, 30

command line

executing scripts on, 526–527

running PHP on, 526–527

commands

executing, 353–354

MySQL

CREATE INDEX, 238

CREATE TABLE, 232–233

CREATE USER, 226

DESCRIBE, 304

EXPLAIN, 304–309

GRANT, 226–227, 230–231

REVOKE, 230, 230–231

SHOW, 301–304

show tables, 237

use, 232

mysql, 223

SQL

ALTER TABLE, 265–268

DELETE, 268

INSERT, 248–249

ORDER BY clause, 259

SELECT, 250–251, 252–253

UPDATE, 265

comments, 17–18

comparing

conditionals, 45–46

constants and variables, 26

SQL and MySQL, 248

strings, 115

comparison operators, 31–32

equal operator, 31–32

for WHERE clause, 252–253

concatenating strings, 22

conditionals, 41

code blocks, 42

comparing, 45–46

else statements, 42–43

elseif statements, 43–44

if statements, 41–42

switch statement, 44–45

configuring

Apache HTTP Server, 356

MySQL users, 225–232

PHP image support, 449–450

session control, 482–483

authentication, 483–491

connecting

to MySQL, 277–278

to network services, interaction failures, 548–549

ODBC, 286

constants, 26

error reporting levels, 553–554

per-class constants, 185

and variables, 26

constructors, 163

consuming data from other websites, 404–408

control structures

alternative syntax, 51

conditionals, 41

code blocks, 42

comparing, 45–46

else statements, 42–43

elseif statements, 43–44

if statements, 41–42

switch statement, 44–45

declare structure, 51–52

repetition structures, 46–50

do.while loops, 50

foreach loops, 49–50

for loops, 49–50

while loops, 47–48

stopping, 50

for stored procedures, 323–327

declare handlers, 325

controlling visibility, 169–170

conversion specification, 109

type codes, 110–111

converting

arrays to scalar variables, 99–100

classes to strings, 194

dates and times to Unix timestamp, 426

Gregorian to Julian calendar, 436

between PHP and MySQL date formats, 431–433

cookies, 476, 477

session ID, 476

setting from PHP, 476–477

correlated subqueries, 264

count() function, 93, 98–99

counted subexpressions, 123

counting array elements, 98–99

crackers, 339

CREATE INDEX command, 238

CREATE TABLE command, 232–233

CREATE USER command, 226

creating

Bob’s Auto Parts order form, 12–14

buttons

base canvas, setting up, 460–461

outputting to browser, 465

text, applying, 461–464

text, positioning, 464

column indexes, 238

directories, 394

files, 398

HTML elements, 497–498

images, 451–455

make_button.php, 458–460

MySQL tables, 232–234

MySQL users, 224

sessions, 480–482

cross joins, 258

crypt() function, 370

CSV table type, 316

current() function, 96–97

cursors, 323, 325

custom authentication, creating, 377

customer feedback form (Bob’s Auto Parts site), creating, 101–104

customer order form

address field, 54

creating, 12–14

fields, naming, 14

processing, 14

totals, calculating, 36–37

D

data hiding, 160

data storage, RDBMSs, 74

data types, 24–25

for MySQL columns, 240–246

date and time types, 243–244

numeric types, 241–242

string types, 244–246

scalar values, 26

type casting, 25

type strength, 25

databases. See also RDBMSs (relational database management systems)

advantages of, 209

designing, 213–220

dropping, 268–269

MySQL, 209

backing up, 310–311

chat server, building, 504–507

DATE_FORMAT() function, 431–432

dates, calculating, 434–435

displaying, 302

inserting data, 282–285

interaction failures, 547–548

restoring, 311

security, 299–301

UNIX_TIMESTAMP() function, 432–433

users, setting up, 225–232

null values, 217–218

ODBC, 286

optimizing, 309–310

design optimization, 309

table optimization, 310

PHPbookmark project, implementing, 565–566

querying, 278

RDBMSs, 74

replication, 311–313

initial data transfer, performing, 313

master, setting up, 312–313

slaves, setting up, 313

schemas, 212

security, 357–359

transactions, 317–319

update anomalies, 215

web database architecture, 218–220, 272

Date, C.J., 220

date and time type columns, 243–244

date() function, 18, 19–20, 424–427

format codes, 424–425

Unix timestamps, 426–427

DATE_FORMAT() function, 431–432

dates

calculating

in MySQL, 434–435

in PHP, 433–434

calendar functions, 436

converting between PHP and MySQL formats, 431–433

Gregorian dates, 436

Julian dates, 436

validating with checkdate() function, 428–429

db table, 295–296

DDL (Data Definition Language), 248

debugging, 352–353

variables, 551–553

declare handlers, 325

declare structure, 51–52

declaring

blocks, 42

constants, 26

functions, 144

decrement operators, 30–31

define() function, 26

defining naming conventions for large projects, 532–534

DELETE command (SQL), 268

delete_bms.php, 592–593

deleting

bookmarks, 591–594

files, 70, 398

records from database, 268

deletion anomalies, 215

delimiters, 120

denial of service, 335–337, 361

descenders, 463

DESCRIBE command, 304

designing

classes, 176–177

RDBMSs, 213–220

destroying

image identifiers, 455

sessions, 479

destructors, 163

die() function, 520–522

directories

creating, 394

reading from, 390–393

retrieving information, 394

submission form, 408

directory structure for large projects, 536

directory_submit.php, 409–412

disaster planning, 362–364

disconnecting from MySQL database, 281

disgruntled employees, threats posed by, 339

displaying

bookmarks, 590–591

columns, 302

databases, 302

MySQL privileges, 302

tables, 237

division operator, 28

DML (Data Manipulation Language), 248

DMZs (demilitarized zones), 360–361

documentation

function libraries, 536

PHP manual, 531

project documentation, 538

dot notation, 255

double-quoted strings, interpolation, 22

do.while loops, 50

drawing bar charts, 465–474

dropping

databases, 268–269

tables, 268

DSN (data source name), 288

dump_array() function, 552–553

dump_variables.php, 551–553

dynamic content, adding, 18–19

E

each() construct, accessing array contents, 80–81

each() function, 80

echo statement, 22

else statements, 42–43

elseif statements, 43–44

email, sending and reading, 404

embedding PHP in HTML, 14–19

comments, 17–18

statements, 16

tags, 16

whitespace, 17

empty() function, 40

encapsulation, 160

end() function, 96–97

environment variables, 401–402

equal operator, 31–32

equi-joins, 258

error handling, 208

error reporting levels, 553–554

logging errors, 560

graceful error logging, 557–559

logic errors, 549–551

opening files, 58–61

programming errors, 543–551

runtime errors, 544–549

causes of, 545–549

syntax errors, 543–544

triggering your own errors, 556

error messages for undefined functions, 142–143

error reporting levels, 553–554

error reporting settings, altering, 554–556

error suppression operator, 34, 60

escape sequences, 125–126

escapeshellcmd() function, 354

escaping

from HTML, 16

output, 348–350

eval() function, 519–520

evaluating

SELECT queries, 304–309

strings, 519–520

event handling

jQuery, 499–504

click event, 500

focusout event, 503

on() method, 499–500

ready event, 499

submit event, 504

triggers, 327–329

Exception class, 201–202

exception handling, 199–201, 557

in Bob’s Auto Parts site, 204–208

catch blocks, 200

Exception class, 201–202

finally blocks, 200

throw keyword, 200

try blocks, 199

user-defined exceptions, 202–204

executing commands, 353–354

execution directives, 51–52

execution operator, 34–35

existence of files, checking for, 70

exit() function, 520–522

EXPLAIN command, 304–309

explode() function, 95–96

splitting strings with, 112–113

extensions

loaded extensions, identifying, 522–523

PDO data access abstraction extension, 286–289

php_gd2.dll extension, registering, 450

extract() function, 99–100

F

fclose() function, 63–65

feedback form (Bob’s Auto Parts site), creating, 101–104

feof() function, 66–67

fgetc() function, 69

fgetcsv() function, 67–68

fgets() function, 67–68

fgetts() function, 67–68

fields, naming, 14

file formats, 62–63

file() function, 68–69, 93

file mode, 55

choosing, 55

fopen() function, 57

file systems

absolute path, 56

file information, retrieving, 395–397

relative path, 56

security, 352

file_exists() function, 70

file_get_contents() function, 68–69

file_put_contents() function, 61

fileatime() function, 397

filedetails.php, 395–396

fileowner() function, 397

fileperms() function, 397

files

.htaccess files, 374–377

backing up, 412–420

characters, reading, 69

closing, 63–65

creating, 398

deleting, 70, 398

existence of, checking for, 70

flat files, 53–54

problems with, 73

image files

creating, 451–455

GIFs, 451

JPEGs, 450

PNGs, 450–451

loading arrays from, 92–96

locking, 71–73

logging errors to, 560

moving, 398

navigating inside, 70–71

opening, 55

error handling, 58–61

with fopen() function, 56–58

through FTP or HTTP, 58

in PHPbookmark application, 564–565

processing, 55

properties, changing, 397–398

reading from, 55, 65–66, 67–68, 68–69

as cause for runtime errors, 546–547

line-by-line, 67–68

require() statement, 132–134

size of, determining, 70

uploading, 379–389, 420

HTML form, 381–382

php.ini settings, 380–381

tracking upload progress, 387–388

troubleshooting, 389

writing the file handling script, 382–387

writing to, 55, 61

filesize() function, 70, 397

filtering

input data, 276, 343–348

basic values, 346–347

double-checking expected values, 344–346

strings, 347–348

strings, 105–107

for output to browser, 105–106

for output to email, 106–107

final keyword, 172

finally blocks, 200

finding

non-matching rows, 256–257

strings within strings, 116–117

substrings with regular expressions, 128–129

firewalls, 360

flat files, 53–54

problems with, 73

float data type, 25

floating-point types, 242

floatval() function, 41

flock() function, 71–73

focusout event, 503

fonts, TrueType, 457

fopen() function, 55, 66

file mode, 57

opening files with, 56–58

parameters, 56

foreach loops, 49–50, 190

accessing array elements, 80

FOREIGN KEY keyword (MySQL), 235

foreign keys, 212, 319

Book-O-Rama bookstore application, 221

forgot_passwd.php, 583–584

format codes, date() function, 424–425

formatting

strings

changing case of, 111–112

conversion specification, 109

for printing, 109–111

timestamps, 429–431

forms

Book-O-Rama bookstore application

HTML form, 282–285

search form, 272–273

customer order form

creating, 12–14

fields, naming, 14

processing, 14

Smart Form Mail application

creating, 101–104

regular expressions, 127–128

submission form, 408

variables, accessing, 20–22

fpassthru() function, 68–69

fputs() function, 61

fread() function, 69

front end interface, building for chat application, 504–507

fseek() function, 70–71

ftell() function, 70–71

FTP

avoiding timeouts, 420

backing up files with, 412–420

files, opening, 58

ftp_mirror.php, 413–416

ftp_nlist() function, 421

ftp_size() function, 420

full joins, 254–255

func_num_args() function, 148

functions, 140

_autoload(), 189

_get(), 166–168

_set(), 166–168

accessor functions, 166–168, 178

aggregate functions (MySQL), 259–261

applying to array elements, 97–98

arguments, 39

array_count(), 98–99

array_multisort(), 87–88

array_pop(), 92

array_push(), 92

array_reverse(), 92

array_walk(), 97–98

asort(), 86–87

backtraces, 202

basename(), 397

built-in, 144

calling, 19, 141–142

case functions, 112

case sensitivity, 143

checkdate(), 428–429

chop(), 104

closedir(), 391

closures, 155–157

count(), 93, 98–99

crypt(), 370

current(), 96–97

date(), 18, 19–20, 424–427

format codes, 424–425

DATE_FORMAT(), 431–432

define(), 26

die(), 520–522

dump_array(), 552–553

each(), 80

empty(), 40

end(), 96–97

escapeshellcmd(), 354

eval(), 519–520

exit(), 520–522

explode(), 95–96

splitting strings with, 112–113

extract(), 99–100

fclose(), 63–65

feof(), 66–67

fgetc(), 69

fgetcsv(), 67–68

fgets(), 67–68

fgetts(), 67–68

file(), 68–69, 93

file_exists(), 70

file_get_contents(), 68–69

file_put_contents(), 61

fileatime(), 397

fileowner(), 397

fileperms(), 397

filesize(), 70, 397

floatval(), 41

flock(), 71–73

fopen(), 55, 66

file mode, 57

opening files with, 56–58

parameters, 56

fpassthru(), 68–69

fputs(), 61

fread(), 69

fseek(), 70–71

ftell(), 70–71

ftp_nlist(), 421

ftp_size(), 420

func_num_args(), 148

fwrite(), 61

parameters, 62

get_loaded_extensions(), 523

getdate(), 427–428

array key-value pairs, 427–428

getenv(), 401–402

getlastmod(), 524

gettext(), 444–448

gettype(), 39

header(), 455

highlight_string(), 525

htmlspecialchars(), 21–22, 105–106

imagecolorallocate(), 453

imagecreatetruecolor(), 452–453

imagecreatfrompng(), 461

imagefill(), 453–454

imagefilledrectangle(), 472

imageline(), 472

imagestring(), 454

imagettftext(), 462

implode(), 113

ini_get(), 524–525

ini_set(), 524

intval(), 41

isset(), 40, 152

join(), 113

krsort(), 83

ksort(), 86–87

libraries, 536

lookup functions, 408–412

ltrim(), 104

mail(), 104, 404

microtime(), 435

mkdir(), 394

mktime(), 426–427

multibyte string functions, 440

mysqli(), 547

namespaces, 195–197

global namespaces, 197–198

importing, 198

subnamespaces, 197

naming, 145–146

next(), 96–97

nl2br(), 70, 107–109

nonexistent, as cause for runtime errors, 545–546

number_format(), 37

in ObjectIterator class, 192

opendir(), 391

overloading, 145

parameters, 146–148

passing, 141

passing by reference, 150–151

passthru(), 399

phpinfo(), 26, 141

pollServer(), 515–516

pos(), 96–97

preg_match(), 128–129

preg_split(), 129–130

prev(), 96–97

printf(), 109–111

program execution, 398–401

prototype, 141–142

putenv(), 401–402

range(), 77

readdir(), 391

readfile(), 68–69

recursive, 154–155

reset(), 96–97

return keyword, 152–153

returning values from, 153

rewind(), 70–71

rmdir(), 394

rsort(), 83

scope, 148–150

serialize(), 521

session_start(), 478

set_error_handler(), 557–558

setcookie(), 476

settype(), 39

show_source(), 525

shuffle(), 90–91

sizeof(), 98–99

sort(), 76, 85–86

sprintf(), 109

str_replace(), 107, 118–119

strcasecmp(), 115

strchr(), 117

strcmp(), 115

strftime(), 429–431

stristr(), 117

strnatcmp(), 115

strpos(), 117–118

strstr(), 116–117

strtok(), 113–114

strtolower(), 112

strtoupper(), 112

structure of, 144–145

strval(), 41

substr(), 114

system(), 399

trigger_error(), 556

trim(), 104

uasort(), 89

ucfirst(), 112

ucwords(), 112

uksort(), 89

umask(), 394

undefined functions, calling, 142–143

UNIX_TIMESTAMP(), 432–433

unlink(), 70

unserialize(), 521

urlencode(), 407

user-defined, 144

usort(), 88–89

variable functions, 146

variable handling functions, 39–40

vprintf(), 111

vsprintf(), 111

fwrite() function, 61

parameters, 62

G

GD2 image library, 449

generating

bar charts from stored MySQL data, 465–474

charts from stored MySQL data, 465–474

generators, 192–193

_get() function, 166–168

get_loaded_extensions() function, 523

getdate() function, 427–428

array key-value pairs, 427–428

getenv() function, 401–402

getlastmod() function, 524

gettext() function, 444–448, 446

gettype() function, 39

GIF (Graphics Interchange Format) files, 451

Git, 537

global keyword, 150

global namespaces, 197–198

GNU gettext

installing, 444–445

translation files, 445–447

graceful error logging, 557–559

GRANT command, 226–227, 230–231

grant tables, 291–299

columns_priv table, 296–298

connection verification, 298

db table, 295–296

procs_priv table, 296–298

request verification, 298

tables_priv table, 296–298

user table, 293–295

Greenspun, Philip, 407

Gregorian dates, 436

grouping SQL data, 259–261

H

handle.php, 558

handles, 161

hash functions, 370–371

header() function, 455

headers, 438–439

locale-specific, 441–442

helper methods, 509–510

$.get(), 510

$.getJSON(), 510

$.getscript(), 510

$.post(), 510

heredoc syntax, 23

highlight_string() function, 525

highlighting source code, 525–526

hosting providers, 599–600

HTML

Book-O-Rama form, 282–285

elements

creating, 497–498

selecting with jQuery selectors, 496–497

escaping, 16

file upload form, 381–382

PHP, embedding, 14–19, 16

comments, 17–18

statements, 16

whitespace, 17

reusing, applying templates to web pages, 134–139

submission form, 408

htmlspecialchars() function, 21–22, 105–106

HTTP files, opening, 58

I

identifiers, 23–24, 239–240

case sensitivity, 239

rules, 239

identifying script owner, 523

IETF (Internet Engineering Task Force), 404

if statements, 41–42

image identifiers, destroying, 455

imagecolorallocate() function, 453

imagecreatetruecolor() function, 452–453

imagecreatfrompng() function, 461

imagefill() function, 453–454

imagefilledrectangle() function, 472

imageline() function, 472

ImageMagick image library, 449

images

automatically generated, 456

bar chart, drawing from stored SQL data, 465–474

buttons

creating, 457–465

outputting to browser, 465

positioning text on, 464

text, applying, 461–464

writing text on, 464–465

canvas images

creating, 452–453

printing text on, 453–454

creating, 451–455

make_button.php, 458–460

GIFs, 451

JPEGs, 450

libraries, 449

outputting to browser, 455

php_gd2.dll extension, registering, 450

PNGs, 450–451

simplegraph.php, 451–452

support in PHP, configuring, 449–450

imagestring() function, 454

imagettftext() function, 462

IMAP4 (Internet Message Access protocol), 404

implode() function, 113

importing namespaces, 198

increment operators, 30–31

indenting code, 42

indexes, creating, 310

indices, 76

numerically indexed arrays, 76–77

inheritance, 161–162, 168–169

late static bindings, 186–187

multiple inheritance, 172–173

overriding, 170–172

preventing, 172

ini_get() function, 524–525

ini_set() function, 524

initializing arrays, 79

numerically indexed arrays, 76–77

inner joins, 258

InnoDB table type, 316

transactions, 318–319

input data, filtering, 343–348

basic values, 346–347

double-checking expected values, 344–346

strings, 347–348

INSERT command (SQL), 248–249

inserting data into SQL database, 248–250, 282–285

insertion anomalies, 215

installing

Apache

on UNIX, 600–602

on Windows and Mac, 612–613

GNU gettext, 444–445

MySQL on UNIX, 602–605

PEAR, 613–614

PHP

with other web servers, 614

on UNIX, 605–609

on Windows and Mac, 612–613

instanceof operator, 35, 185–186

instantiating classes, 163–164

integers, 25

integral data types, 241

interacting with the environment, 401–402

interfaces, 173–174

Book-O-Rama HTML form, 282–285

Iterator, 190–191

PDO data access abstraction extension, 286–289

internationalization, 437–438

applying to web pages, 440–445

language selector page, 442–444

locale-specific headers, 441–442

gettext() function, 444–448

GNU gettext, installing, 444–445

translation files, 445–447

interpolation, 22

intval() function, 41

isset() function, 40, 152

iteration, 46–50, 190–192

accessing array contents, 78–79

do.while loops, 50

foreach loops, 49–50

for loops, 49–50

while loops, 47–48

Iterator interface, 190–191

J

JavaScript. See also AJAX; jQuery

AJAX, 493–494

join() function, 113

joining strings, 113

joins

cross joins, 258

equi-joins, 258

full joins, 254–255

inner joins, 258

joining more than two tables, 255–256

left joins, 256–257

JPEG (Joint Photographic Experts Group) files, 450

jQuery, 494–504

$.ajax() method, 508–509

addClass() method, 498

AJAX helper methods, 509–510

$.get(), 510

$.getJSON(), 510

$.getscript(), 510

$.post(), 510

events, 499–504

click event, 500

focusout, 503

on() method, 499–500

ready event, 499

submit, 504

namespace, 495

pseudo-selectors, 497

selectors, 495–498

acting on, 498

syntax, 496–497

selectors (jQuery), creating HTML elements, 497–498

val() method, 498

in web applications, 494–495

Julian dates, 436

K

keys, 76, 211–212

Book-O-Rama bookstore application, 221

choosing, 217

foreign keys, 212, 319

success, 507

keywords

clone, 187–188

final, 172

global, 150

MySQL

AUTO_INCREMENT, 234

FOREIGN KEY, 235

NOT NULL, 234

PRIMARY KEY, 234–235

return, 152–153

static, 185

throw, 200

trait, 174–176

yield, 192–193

krsort() function, 83

ksort() function, 86–87

L

languages

headers, 438–439

multi-byte, 438

single-byte, 438

large web application projects, 529

choosing a development environment, 537–538

coding standards, 532

breaking up code, 535–536

commenting your code, 534

defining naming conventions, 532–534

indenting, 534–535

directory structure, 536

documenting, 538

function libraries, 536

optimizing code, 540–541

prototyping, 538–539

reusing code, 531–532

separating logic from content, 539–540

testing code, 541–542

version control, 536–537

writing maintainable code, 532

late static bindings, 186–187

left joins, 256–257

length of strings, checking, 115–116

libraries

function libraries, 536

image libraries, 449

jQuery library, loading, 494–495

LIMIT clause (SELECT command), 261–262

line-by-line reading from files, 67–68

linking tables, 218

list() construct, 81

list_functions.php, 522–523

literals, 23

LOAD DATA INFILE statement, 315

loaded extensions, identifying, 522–523

loading

arrays from files, 92–96

files with require() statement, 132–134

jQuery library, 494–495

local variables, 323

locales, 438

localization, 437–438

applying to web pages, 440–445

language selector page, 442–444

character sets, 438–440

multi-byte, 438

security implications, 439–440

single-byte, 438

gettext() function, 444–448

GNU gettext, installing, 444–445

translation files, 445–447

headers, 438–439

locale-specific, 441–442

locales, 438

multibyte string functions, 440

locking files, 71–73

logging errors

graceful error logging, 557–559

to log file, 560

logging in to MySQL, 223–224

logic, separating from content, 539–540

logic errors, 549–551

logical operators, 32–33

login.php, 566–567

logout.php, 490–491

lookup functions, 408–412

lookup.php, 405

for loops, 49–50

loops

accessing array contents, 78–79

do.while loops, 50

foreach loops, 49–50, 190

for loops, 49–50

while loops, 47–48

ltrim() function, 104

M

Mac OS, installation packages, 612–613

mail() function, 104, 404

maintainability of code, 532

make_button.php, 458–460

many-to-many relationships, 213

master, setting up for replication, 312–313

matching

special characters, 123–124

substrings with string functions, 116

max_execution_time directive, 524

member.php, 576–577

members_only.php, 489

MEMORY table type, 316

Mercurial, 537

MERGE table type, 316

meta characters, 124–125

metatags, 177

on() method, 499–500

methods

$.ajax(), 508–509

AJAX helper methods, 509–510

$.get(), 510

$.getJSON(), 510

$.getscript(), 510

$.post(), 510

in Exception class, 201–202

jQuery

on(), 499–500

addClass(), 498

val(), 498

overloading, 188–189

static, 185

microseconds, 435

microtime() function, 435

mirroring files, 412–420

mkdir() function, 394

mktime() function, 426–427

modification anomalies, 215

modification date of scripts, obtaining, 523–524

modulus operator, 28

monitoring security, 342–343

moving files, 398

multibyte string functions, 440

multidimensional arrays, 75, 82–85

sorting, 87–90

with array_multisort() function, 87–88

reverse sorting, 89–90

user-defined sorts, 88–89

three-dimensional arrays, 84–85

two-dimensional arrays, 82–84

multiline comments, 17

multiple inheritance, 172–173

multiplication operator, 28

MyISAM storage engine, 316

MySQL, 209, 221–222. See also MySQL monitor

aggregating data, 259–261

autocommit mode, 318

chat server, building, 504–507

columns

data types, 240–246

date and time types, 243–244

indexes, creating, 238

numeric types, 241–242

string types, 244–246

commands

AUTO_INCREMENT keyword, 234

CREATE USER, 226

DESCRIBE, 304

EXPLAIN, 304–309

FOREIGN KEY keyword, 235

GRANT, 226–227, 230–231

mysql, 223

NOT NULL keyword, 234

PRIMARY KEY keyword, 234–235

REVOKE, 230–231

SHOW, 301–304

SHOW command, 303–304

databases

backing up, 310–311

creating, 224

restoring, 311

selecting, 232

date format, converting to PHP, 431–433

DATE_FORMAT() function, 431–432

dates, calculating, 434–435

drawing charts from stored data, 465–474

identifiers, 239–240

case sensitivity, 239

rules, 239

installing

on UNIX, 602–605

on Windows and Mac, 612–613

joins

cross joins, 258

equi-joins, 258

full joins, 254–255

inner joins, 258

joining more than two tables, 255–256

left joins, 256–257

logging in, 223–224

optimizing databases, 309–310

design optimization, 309

table optimization, 310

privileges, 291–299

columns_priv table, 296–298

db table, 295–296

displaying, 302

procs_priv table, 296–298

tables_priv table, 296–298

updating, 299

user table, 293–295

querying from the Web, 275–281

disconnecting from database, 281

filtering input data, 276

prepared statements, 279–280

retrieving the results, 280–281

selecting the database, 278

setting up connection, 277–278

runtime errors, 547–548

security, 299–301

passwords, 300

web issues, 301

stored procedures, 320–327

control structures, 323–327

cursors, 323, 325

declare handlers, 325

example of, 320–323

local variables, 323

tables

aliases, 257–258

altering after creation, 265–268

columns, 235–237

creating, 232–234

dropping, 268

viewing, 237–238

UNIX_TIMESTAMP() function, 432–433

user privileges, 300–301

users, 225–232

creating, 224

principle of least privilege, 225

privileges, 225–231, 227–230

web access, 231–232

mysql command, 223

MySQL monitor, 222–223

mysqli() function, 547

mysqli library, 277

prepared statements, 279–280

N

namespaces, 195–197

aliasing, 198

global namespaces, 197–198

importing, 198

jQuery, 495

subnamespaces, 197

naming

classes, 177

fields, 14

functions, 145–146

tables, 257–258

navigating

within arrays, 96–97

inside files, 70–71

network security, 360–361

denial of service attacks, 361

DMZ, 360–361

firewalls, 360

network services, interaction failures, 548–549

next() function, 96–97

Nginx servers, 614

nl2br() function, 70, 107–109

nonexistent functions, as cause for runtime errors, 545–546

non-matching rows, finding, 256–257

NOT NULL keyword (MySQL), 234

NOT operator, 32–33

NULL type, 24

null values, 217–218

number_format() function, 37

numeric type columns, 241–242

floating-point types, 242

integral data types, 241

numerically indexed arrays, 76–77

O

ObjectIterator class, 192

objects, 24, 160, 161

classes, 161

cloning, 187–188

instantiating a class, 163–164

interfaces, 160, 173–174

serializing, 521

ODBC (Open Database Connectivity), 286

one-to-many relationships, 213

one-to-one relationships, 213

one-way hash functions, 370

OO (object-oriented) development, 159

_autoload() function, 189

accessor functions, 166–168

attributes, 160

overriding, 170–172

classes, 161

abstract classes, 188

attributes, 162, 164–165, 177

constructors, 163

converting to strings, 194

designing, 176–177

destructors, 163

Exception class, 201–202

instantiating, 163–164

ObjectIterator, 192

operations, 162–163

structure of, 162–163

writing code for, 177–184

encapsulation, 160

generators, 192–193

inheritance, 161–162, 168–169

multiple inheritance, 172–173

preventing, 172

instanceof operator, 185–186

interfaces, 173–174

Iterator, 190–191

iteration, 190–192

late static bindings, 186–187

namespaces, 195–197

global namespaces, 197–198

importing, 198

subnamespaces, 197

objects, 160, 161

cloning, 187–188

serializing, 521

operations, 160

calling, 165

per-class constants, 185

polymorphism, 161

reflection API, 194–195

static methods, 185

traits, 174–176

type hinting, 185–186

opendir() function, 391

opening files, 55

error handling, 58–61

with fopen() function, 56–58

through FTP or HTTP, 58

operands, 28

operating system, securing, 361–362

operations, 160, 162–163, 181

calling, 165

constructors, 163

destructors, 163

overriding, 170–172

preventing, 172

AND operator, 32–33

OR operator, 32–33

operators, 28

arithmetic operators, 28–29

array operators, 35, 81–82

assignment operators, 20, 29–31

combined assignment operators, 30

values returned from, 29

associativity, 37–38

bitwise operators, 33

comparison operators, 31–32

equal operator, 31–32

decrement operators, 30–31

error suppression operator, 34, 60

execution operator, 34–35

increment operators, 30–31

instanceof, 185–186

logical operators, 32–33

precedence, 37–38

reference operator, 31

string concatenation operator, 22

string operators, 29

for subqueries, 263

ternary operator, 34

type operator, 35

optimizing

code, 540–541

databases, 309–310

design optimization, 309

table optimization, 310

options for session configuration, 482–483

ORDER BY clause, 259

order forms

address field, 54

creating, 12–14

fields, naming, 14

processing, 14

storing and retrieving orders, 54

strings, 115

totals, calculating, 36–37

organizing code, 350–351

outputting

buttons to browser, 465

images, 455

overloading methods, 188–189

overriding, 170–172

preventing, 172

owner of scripts, identifying, 523

P

parameters, 146–148

extract() function, 100

fopen() function, 56

fwrite() function, 62

htmlspecialchars() function, 105–106

passing, 141

parser errors, 543–544

passing by reference, 150–151

passing by value, 150–151

passing parameters, 141

passthru() function, 399

passwords, 369–371

hash functions, 370–371

MySQL, 300

storing, 369

pattern matching, delimiters, 120

PEAR (PHP Extension and Application Repository), installing, 613–614

per-class constants, 185

performance, optimizing databases

design optimization, 309

table optimization, 310

permissions, 59

PHP

accessing, 12

basic authentication, 372–373

dates, calculating, 433–434

embedding in HTML, 14–19

comments, 17–18

tags, 16

whitespace, 17

English language manual, 531

environment information, obtaining, 522

installing

with other web servers, 614

on UNIX, 605–609

on Windows and Mac, 612–613

statements, 16

tags

short style, 16

XML style, 16

PHP interpreter, 600

php_gd2.dll extension, registering, 450

PHPbookmark project, 561

add_bms.php, 588–589

basic site, implementing, 566–569

bookmark_fns.php, 567–568

bookmarks

adding, 588–590

deleting, 591–594

displaying, 590–591

database, implementing, 565–566

delete_bms.php, 592–593

files, 564–565

forgot_passwd.php, 583–584

implementing recommendations, 594–597

login.php, 566–567

member.php, 576–577

recommend.php, 595–597

register_form.php, 569–570

register_new.php, 570–572

solution components, 561–565

user authentication, 569–587

changing passwords, 580–582

logging in, 576–579

logging out, 580

registering users, 569–575

resetting forgotten passwords, 582–587

phpinfo() function, 26, 141

php.ini file

browsing, 355–356

date.timezone setting, 424

file upload settings, 380–381

session upload progress configuration settings, 387

planning web application projects, 530–531

PNG (Portable Network Graphics) files, 450–451

PO (Portable Object) files, 445–446

Poedit, 446

pollServer() function, 515–516

polymorphism, 161

POP (Post Office Protocol), 404

pos() function, 96–97

position of substrings, identifying, 117–118

positioning text on buttons, 464

POSIX-style regular expressions, 119

precedence, 37–38

preg_match() function, 128–129

preg_split() function, 129–130

prepared statements, 279–280

Pressman, Roger, 542

prev() function, 96–97

preventing inheritance, 172

primary key, 211

PRIMARY KEY keyword (MySQL), 234–235

primary keys, Book-O-Rama bookstore application, 221

principle of least privilege, 225

printf() function, 109–111

printing

echo statement, 22

formatting strings for, 109–111

percent symbol, 110

text on canvas images, 453–454

private access modifier, 166

visibility, controlling, 169–170

privileges (MySQL), 225–231, 227–230, 291–299, 300–301

administrator privileges, 229

columns_priv table, 296–298

CREATE USER command, 226

db table, 295–296

displaying, 302

GRANT command, 226–227

principle of least privilege, 225

procs_priv table, 296–298

revoking, 230

special privileges, 230

tables_priv table, 296–298

updating, 299

user privileges, 228

user table, 293–295

processfeedback_v2.php, 108–109

processing

customer order form, 14

files, 55

processorder.php, 14–19

creating, 14

dynamic content, adding, 18–19

with exception handling, 205–208

form variables, accessing, 20–22

functions, calling, 19

procs_priv table, 296–298

progex.php, 400–401

program execution functions, 398–401

programming errors, 543–551

logic errors, 549–551

runtime errors, 544–549

causes of, 545–549

syntax errors, 543–544

properties of files, changing, 397–398

protected access modifier, 166

protecting multiple web pages, 371

protocols, 403–404

prototype, 141–142

prototyping web applications, 538–539

pseudo-selectors, 497

public access modifier, 166

visibility, controlling, 169–170

putenv() function, 401–402

Q

querying databases

SELECT queries, evaluating, 304–309

subqueries, 262–263

correlated subqueries, 264

operators, 263

row subqueries, 264

as temporary table, 264

from the Web, 275–281

disconnecting from database, 281

filtering input data, 276

prepared statements, 279–280

retrieving the results, 280–281

selecting the database, 278

setting up connection, 277–278

R

range() function, 77

RDBMSs (relational database management systems), 74

atomic column values, 216–217

columns, 211

design principles, 213–220

keys, 211–212

choosing, 217

MySQL

databases, creating, 224

databases, selecting, 232

logging in, 223–224

mysql command, 223

privileges, 225–231

tables, creating, 232–234

users, creating, 224

null values, 217–218

relationships, 213

rows, 211

schemas, 212

tables, 210, 218

update anomalies, 215

values, 211

readdir() function, 391

readfile() function, 68–69

reading

arbitrary lengths, 69

characters, 69

email, 404

from files, 55, 65–66, 67–68, 68–69

as cause for runtime errors, 546–547

line-by-line, 67–68

form directories, 390–393

ready event, 499

real-time chat application, chat server, building, 504–507

recommend.php, 595–597

records

deleting, 268

storing, 62

updating, 265

recursive functions, 154–155

reducing web application security risks

access to sensitive data, 332–333

denial of service, 336–337

loss of data, 334–335

malicious code injection, 337

reference operator, 31

reflection API, 194–195

register_form.php, 569–570

register_new.php, 570–572

registering

php_gd2.dll extension, 450

session variables, 478–479

regular expressions, 119–130

anchoring to beginning or end of string, 123

assertions, 126–127

backreferences, 126

branching, 123

character class, 121–122

character sets, 120–121

counted subexpressions, 123

delimiters, 120

escape sequences, 125–126

meta characters, 124–125

POSIX, 119

repetition, 122

in Smart Form Mail application, 127–128

special characters, matching, 123–124

strings, splitting, 129–130

substrings, finding, 128–129

substrings, replacing, 129

relationships, 213

relative path, 56

reordering arrays, 90–91

with shuffle() function, 90–91

repetition in regular expressions, 122

repetition structures, 46–50

accessing array contents, 78–79

do.while loops, 50

foreach loops, 49–50

for loops, 49–50

while loops, 47–48

replacing substrings

with regular expressions, 129

with string functions, 116

replication, 311–313

initial data transfer, performing, 313

master, setting up, 312–313

slaves, setting up, 313

repudiation, 338–339

require() statement, 132–134

adding templates to web pages, 134–139

reset() function, 96–97

resource type, 24

restoring MySQL databases, 311

results.php, 273–275

querying from the Web, filtering input data, 276

retrieving data from SQL databases, 250–259

criteria, specifying, 251–253

joining more than two tables, 255–256

from multiple tables, 253–258

finding rows that don’t match, 256–257

full joins, 254–255

ORDER BY clause, 259

SELECT command, 250–251

return keyword, 152–153

returning values from functions, 153

reusing code

advantages of, 131–132

consistency, 132

cost, 132

reliability, 132

functions, 140

built-in functions, 144

calling, 141–142

case sensitivity, 143

closures, 155–157

naming, 145–146

parameters, 146–148

parameters, passing, 141

prototype, 141–142

recursive functions, 154–155

return keyword, 152–153

returning values from, 153

scope, 148–150

structure of, 144–145

undefined functions, calling, 142–143

user-defined, 144

variable functions, 146

in large web projects, 531–532

maintainability, 532

require() statement, 132–134

applying templates to web pages, 134–139

traits, 174–176

reverse sorting functions, 83, 89–90

reversing arrays, 92

REVOKE command, 230, 230–231

rewind() function, 70–71

RFCs (Requests for Comments), 404

rmdir() function, 394

row subqueries, 264

rows, 211

inserting into SQL database, 248–250

non-matching rows, finding, 256–257

rsort() function, 83

rules

for identifiers, 239

of variable scope, 27

running PHP on command line, 526–527

runtime environment, temporarily modifying, 524–525

runtime errors, 544–549

causes of, 545–549

calls to nonexistent functions, 545–546

connections to network services, 548–549

failure to check input data, 549

interaction with MySQL, 547–548

reading or writing files, 546–547

S

SaaS version control systems, 537

scalar values, 26

scalar variables, creating from arrays, 99–100

scandir.php, 393

schemas, 212

scope, 27, 148–150

<script> tag, 494–495

scripts

add_bms.php, 588–589

adding locks to, 71–73

authmain.php, 483–489

basic_auth.php, 372–373

bookmark_fns.php, 567–568

browsedir2.php, 392

browsedir.php, 390

chat.php, 504–507

delete_bms.php, 592–593

directory_submit.php, 409–412

dump_variables.php, 551–553

executing on command line, 526–527

filedetails.php, 395–396

forgot_passwd.php, 583–584

ftp_mirror.php, 413–416

functions, calling, 19

handle.php, 558

list_functions.php, 522–523

login.php, 566–567

logout.php, 490–491

lookup.php, 405

make_button.php, 458–460

member.php, 576–577

members_only.php, 489

modification date, obtaining, 523–524

owner, identifying, 523

processfeedback_v2.php, 108–109

processfeedback.php, 101–104

processorder.php

creating, 14

dynamic content, adding, 18–19

with exception handling, 205–208

progex.php, 400–401

recommend.php, 595–597

register_form.php, 569–570

register_new.php, 570–572

results.php, 273–275

scandir.php, 393

secret.php, 369

show poll.php, 468–474

simplegraph.php, 451–452

stopping, 50

terminating, 520–522

upload.php, 382–387

vieworders.php, 65–66

search form (Book-0-Rama bookstore application), 272–273

secret.php, 367–369

security

application security threats

access to sensitive data, 331–333

actors, 339–340

compromised server, 338

denial of service, 335–337

loss of data, 334–335

malicious code injection, 337

modification of data, 334

repudiation, 338–339

attackers, 339

authentication

access control, 366–369

basic authentication, 372–377

custom authentication, creating, 377

passwords, 369–371

PHPbookmark project, 569–587

in session control, 483–491

visitors, identifying, 365–366

character sets, 439–440

code, securing, 343

bugs, 352–353

escaping output, 348–350

filtering user input, 343–348

organizing code, 350–351

crackers, 339

database servers, securing, 357–359

disaster planning, 362–364

file systems, 352

MySQL, 299–301

passwords, 300

user privileges, 300–301

web issues, 301

networks, securing, 360–361

denial of service attacks, 361

DMZ, 360–361

firewalls, 360

operating system, securing, 361–362

permissions, 59

strategies for handling, 341–343

balancing security and usability, 342

monitoring, 342–343

starting with the right mindset, 342

twofold approach to, 343

web pages, protecting, 371

web servers, securing, 354–357

browsing php.ini file, 355–356

shared hosting of web applications, 356–357

updating software, 354–355

SELECT command (SQL), 250–251

evaluating, 304–309

LIMIT clause, 261–262

ORDER BY clause, 259

WHERE clause, 252–253

comparison operators, 252–253

selecting

HTML elements with selectors, 496–497

MySQL database, 232

SQL databases from the web, 278

table types, 316

selectors (jQuery), 495–498

acting on, 498

HTML elements, creating, 497–498

pseudo-selectors, 497

syntax, 496–497

sending email, 404

serialization, 521

serialize() function, 521

session control, 475

authentication, 483–491

authmain.php, 483–489

logout.php, 490–491

members_only.php, 489

configuring, 482–483

cookies, 476, 477

setting from PHP, 476–477

session ID, storing, 477–478

sessions

creating, 480–482

destroying, 479

registering variables, 478–479

starting, 478

session ID, 476

storing, 477–478

session variables, 476, 479

unsetting, 479

session_start() function, 478

set_error_handler() function, 557–558

_set() function, 166–168

setcookie() function, 476

settype() function, 39

SGML (Standard Generalized Markup Language), 16

shared hosting of web applications, security issues, 356–357

short style PHP tags, 16

SHOW command (MySQL), 301–304

syntax, 303–304

show poll.php, 468–474

show tables command, 237

show_source() function, 525

shuffle() function, 90–91

simple tables, 218

simplegraph.php, 451–452

single-byte languages, 438

single-line comments, 18

size of files, determining, 70

sizeof() function, 98–99

slaves, setting up for replication, 313

Smart Form Mail application

creating, 101–104

regular expressions, 127–128

SMTP (Simple Mail Transfer Protocol), 404

software, updating, 354–355

Software Engineering: A Practitioner’s Approach, 542

software engineering, applying to web development, 530

solution components for PHPbookmark project, 561–565

sort() function, 76, 85–86

sorting arrays, 85–87

with asort() function, 86–87

with ksort() function, 86–87

multidimensional arrays, 87–90

reverse sorting, 83

with sort() function, 85–86

source code, highlighting, 525–526

special characters

meta characters, 124–125

pattern matching, 123–124

special privileges (MySQL), 230

splitting strings

explode() function, 112–113

with regular expressions, 129–130

with strtok() function, 113–114

with substr() function, 114

sprintf() function, 109

SQL (Structured Query Language), 247–248. See also MySQL

aggregating data, 259–261

INSERT command, 248–249

inserting data, 248–250

joins

cross joins, 258

equi-joins, 258

full joins, 254–255

inner joins, 258

joining more than two tables, 255–256

left joins, 256–257

querying from the Web, 275–281

disconnecting from database, 281

filtering input data, 276

prepared statements, 279–280

retrieving the results, 280–281

selecting the database, 278

setting up connection, 277–278

retrieving data, 250–259

from multiple tables, 251–253

SELECT command, 250–251

with specific criteria, 251–253

subqueries, 262–263

correlated subqueries, 264

operators, 263

row subqueries, 264

as temporary table, 264

SSL (Secure Sockets Layer), troubleshooting, 610–612

stand-alone functions, _autoload(), 189

starting sessions, 478

statements, 16. See also commands

echo, 22

else, 42–43

elseif, 43–44

if, 41–42

LOAD DATA INFILE, 315

prepared statements, 279–280

require(), 132–134

applying templates to web pages, 134–139

semicolons, 16

switch, 44–45

static keyword, 185

status of variables, testing, 40–41

stopping scripts, 50, 520–522

storage engines, 316–317

ARCHIVE, 316

CSV, 316

InnoDB, 316

foreign keys, 319

transactions, 318–319

MEMORY, 316

MERGE, 316

MyISAM, 316

stored procedures, 320–327

control structures, 323–327

declare handlers, 325

cursors, 323, 325

example of, 320–323

local variables, 323

storing

dates and times, Unix timestamps, 426–427

orders, 54

passwords, 300, 369

in RDBMSs, 74

records, 62

session ID, 477–478

str_replace() function, 107, 118–119

strategies for handling security, 341–343

balancing with usability, 342

monitoring, 342–343

starting with the right mindset, 342

strcasecmp() function, 115

strchr() function, 117

strcmp() function, 115

strftime() function, 429–431

string operators, 29

string type columns, 244–246

strings. See also regular expressions

changing case of, 111–112

checking length of, 115–116

comparing, 115

concatenating, 22

creating from classes, 194

evaluating, 519–520

filtering for output, 105–107, 347–348

to browser, 105–106

to email, 106–107

finding within strings, 116–117

formatting

conversion specification, 109

for printing, 109–111

heredoc syntax, 23

interpolation, 22

joining, 113

multibyte string functions, 440

ordering, 115

regular expressions, anchoring to beginning or end of, 123

splitting

explode() function, 112–113

with regular expressions, 129–130

with strtok() function, 113–114

with substr() function, 114

substrings

find-and-replace operations, 118–119

finding position of, 117–118

replacing with string functions, 116

trimming, 104

stristr() function, 117

strlen() function, 115–116

strnatcmp() function, 115

strpos() function, 117–118

strstr() function, 116–117

strtok() function, 113–114

strtolower() function, 112

strtoupper() function, 112

structure

of classes, 162–163

of functions, 144–145

strval() function, 41

subclasses, 161–162

inheritance, 168–169

submit event, 504

subnamespaces, 197

subqueries, 262–263

correlated subqueries, 264

operators, 263

row subqueries, 264

as temporary table, 264

substr() function, 114

substr_replace() function, 118–119

substrings

find-and-replace operations, 118–119

finding position of, 117–118

finding with regular expressions, 128–129

replacing

with regular expressions, 129

with string functions, 116

subtraction operator, 28

Subversion, 537

success key, 507

superclasses, 161–162

superglobal arrays, 20, 27

support for images in PHP, setting up, 449–450

switch statement, 44–45

syntax

heredoc, 23

jQuery selectors, 496–497

semicolons, 16

SHOW command, 303–304

syntax errors, 543–544

system() function, 399

T

table types

ARCHIVE, 316

CSV, 316

InnoDB, 316

foreign keys, 319

transactions, 318–319

MEMORY, 316

MERGE, 316

MyISAM, 316

selecting, 316

tables, 210, 218

aliases, 257–258

altering after creation, 265–268

columns, 235–237

CHAR type, 235

VARCHAR type, 235–236

creating, 232–234

displaying, 302

dropping, 268

grant tables, 292–293

columns_priv table, 296–298

connection verification, 298

db table, 295–296

procs_priv table, 296–298

request verification, 298

tables_priv table, 296–298

user table, 293–295

joining

full joins, 254–255

left joins, 256–257

linking tables, 218

optimizing, 310

records

deleting, 268

updating, 265

relationships, 213

retrieving data

criteria, specifying, 251–253

from multiple tables, 251–253

rows, inserting into SQL database, 248–250

simple tables, 218

subqueries as temporary table, 264

triggers, 327–329

viewing, 237–238

tables_priv table, 296–298

tags

JavaScript, <script> 494–495

PHP, 16

short style, 16

XML style, 16

templates, applying to web pages, 134–139

temporarily modifying runtime environment, 524–525

terminating scripts, 520–522

ternary operator, 34

testing

code, 541–542

PHP support, 610

variable status, 40–41

text

applying to buttons, 461–464

bounding box, 462–463

descenders, 463

positioning on buttons, 464

regular expressions

anchoring to beginning or end of string, 123

assertions, 126–127

backreferences, 126

branching, 123

character class, 121–122

character sets, 120–121

counted subexpressions, 123

delimiters, 120

escape sequences, 125–126

meta characters, 124–125

repetition, 122

in Smart Form Mail application, 127–128

special characters, matching, 123–124

strings, splitting, 129–130

substrings, finding, 128–129

writing on buttons, 464–465

threats to web application security

access to sensitive data, 331–333

actors, 339–340

compromised server, 338

denial of service, 335–337

malicious code injection, 337

modification of data, 334

repudiation, 338–339

three-dimensional arrays, 84–85

throw keyword, 200

time, microseconds, 435

timestamps, formatting, 429–431

timezones, 423–424

top-down approach to security, 343

totals, calculating on order forms, 36–37

tracking file upload progress, 387–388

traits, 174–176

transactions, 317–319

using InnoDB, 318–319

translation files, 445–447

trigger_error() function, 556

triggering your own errors, 556

triggers, 327–329

trim() function, 104

trimming strings, 104

troubleshooting. See also error handling; exception handling

with EXPLAIN command, 308–309

file upload, 389

opening files, 58–61

SSL, 610–612

TrueType fonts, 457

try blocks, 199

two-dimensional arrays, 82–84

twofold approach to security, 343

two-table joins, 254–255

type casting, 25

type codes for conversion specification, 110–111

type hinting, 185–186

type operator, 35

type strength, 25

U

uasort() function, 89

ucfirst() function, 112

ucwords() function, 112

uksort() function, 89

umask() function, 394

unary operator, 28–29

undefined functions, calling, 142–143

UNIX

Apache, installing, 600–602

MySQL, installing, 602–605

PHP, installing, 605–609

Unix Epoch, 426

Unix timestamps, 426–427

converting date and time to, 426

UNIX_TIMESTAMP() function, 432–433

unlink() function, 70

unserialize() function, 521

unsetting session variables, 479

update anomalies, 215

UPDATE command (SQL), 265

updating

privileges, 299

records, 265

software, 354–355

uploading files, 379–389, 420

HTML form, 381–382

php.ini settings, 380–381

tracking upload progress, 387–388

troubleshooting, 389

writing the file handling script, 382–387

upload.php, 382–387

urlencode() function, 407

usability, balancing with security, 342

use command, 232

user interface for chat application, building, 504–507

user personalization, 561

user table, 293–295

user-defined exceptions, 202–204

user-defined functions, 144

parameters, 147

user-defined sorts, 88–89

users

authentication, identifying visitors, 365–366

MySQL, 225–232

creating, 224, 225–227

principle of least privilege, 225

privileges, 227–230, 300–301

privileges (MySQL), 291–299

web access, 231–232

usort() function, 88–89

V

val() method, 498

validating dates with checkdate() function, 428–429

values, 211

atomic column values, 216–217

basic values, filtering, 346–347

null values, 217–218

VARCHAR type columns, 235–236

variable functions, 146

variable handling functions, 39–40

variable variables, 25–26

variables, 23

accessing, 20–22

arrays, 75–76

accessing contents, 77–78

converting to scalar variables, 99–100

initializing, 79

loading from files, 92–96

multidimensional arrays, 75

navigating, 96–97

numerically indexed arrays, 76–77

reordering, 90–91

reversing, 92

sorting, 85–87

three-dimensional arrays, 84–85

two-dimensional arrays, 82–84

assigning values to, 24

assignment operators, 20

and constants, 26

data types, 24–25

scalar values, 26

type casting, 25

type strength, 25

debugging, 551–553

environment variables, 401–402

handles, 161

identifiers, 23–24

interpolation, 22

local variables, 323

scope, 27, 148–150

serializing, 521

session variables, 476, 479

registering, 478–479

unsetting, 479

status, testing, 40–41

version control, 536–537

viewing tables, 237–238

vieworders.php script, 65–66

visibility, controlling, 169–170

visitors, identifying, 365–366

vprintf() function, 111

vsprintf() function, 111

W

web access, configuring for MySQL users, 231–232

web application development

applying to software engineering, 530

chat application

chat server, building, 504–507

user interface, building, 510–517

internationalized software, 437–438

jQuery, 494–495

large projects

breaking up code, 535–536

choosing a development environment, 537–538

coding standards, 532

commenting your code, 534

defining naming conventions, 532–534

directory structure, 536

documenting, 538

function libraries, 536

indenting code, 534–535

optimizing code, 540–541

planning, 530–531

prototyping, 538–539

separating logic from content, 539–540

testing code, 541–542

version control, 536–537

writing maintainable code, 532

localization, 437–438

character sets, 438–440

locales, 438

operating system, securing, 361–362

reusing code, 531–532

security

code, securing, 343–352

database servers, securing, 357–359

disaster planning, 362–364

executing commands, 353–354

file system considerations, 352

network security, 360–361

strategies for handling, 341–343

web servers, 354–357

threats

access to sensitive data, 331–333

compromised server, 338

denial of service, 335–337

loss of data, 334–335

malicious code injection, 337

modification of data, 334

repudiation, 338–339

web database architecture, 218–220, 272

web pages

internationalization

language selector page, 442–444

locale-specific headers, 441–442

localizing, 440–445

protecting, 371

templates, applying with require() statement, 134–139

web servers, 218–219

Apache HTTP Server

.htaccess files, 374–377

configuring, 356

Nginx, 614

security, 354–357

browsing php.ini file, 355–356

shared hosting of web applications, 356–357

updating software, 354–355

websites

Bill Gates Wealth Clock, 407

consuming date from other sites, 404–408

cookies, 476, 477

session ID, storing, 477–478

setting from PHP, 476–477

session control, 475

visitors, identifying, 365–366

WHERE clause (SELECT command), 252–253

comparison operators, 252–253

while loops, 47–48

whitespace, 17

Windows operating system, installation packages, 612–613

writing

code for classes, 177–184

accessor functions, 178

attributes, 177

metatags, 177

operations, 181

file upload script, 382–387

to files, 55, 61

as cause for runtime errors, 546–547

text on buttons, 464–465

X

XML, AJAX, 493–494

XML style PHP tags, 16

XOR operator, 32–33

Y-Z

yield keyword, 192–193