I. PHP Database Queries

Useful Links

• MySQL Improved Extension Library for PHP
• SQL Injection
• Password Hashing

Preliminaries

To assign a password to the admin user on localhost, phpMyAdmin can be used:

1. From WAMPServer, activate phpMyAdmin
2. Select Privileges under the localhost column
3. Click the icon on the far right of the row with user root and host localhost
4. Find the Change password area, make sure that Password is selected and enter admin for both the Password: and Re-type: fields
5. Press the Go button

To be able to use phpMyAdmin, locate the file config.inc.php. On my computer, this file is located in C:\wamp\apps\phpmyadmin2.11.5

Locate the line with the comment // MySQL password and change the value in the corresponding assignment statement from a default of '' to 'admin'. phpMyAdmin should now work properly once again.

Examples

1. A simple example that prints the information from the country table in the residential database that we developed last week. File: query.php.
2. The example above is extended to perform error handling and to print the country information in a table. File: query2.php.
3. A user is asked to select a country from the country table. All people from the person table who reside in the desired country are displayed. Files: query3.php, query4.php, db.inc.
4. Assume a database named users has been created with a table named accounts. Each account contains a userName and password. The valid accounts are montana/helena, idaho/boise, southDakota/pierre, northDakota/bismarck, wyoming/cheyenne. Here is a simple login system: login.html and verify.php.

Security Issues

In a real application, we don't want the db.inc to be visible to the user. There are several possibilities:

• Configure Apache so that files with the .inc extension can not be retrieved.
• Store the .inc files outside the document tree of the Apache web server installation. Use the complete path in the require directive.

II. XHTML Forms

• form tag
• input tag: note the following types: text, textarea, password, reset, submit, radio, checkbox.
• select tag: for drop down menus.

Laboratory

Enhance example 4 above in an interesting and non-trivial way. If you are a Montana State student, demonstrate it during today's lab period. If you are a University of Leipzig student, either demonstrate it during today's lab period or e-mail it to Sebastian (loewe AT uni-leipzig.de) no later than the end of the day.