Newbies forum FAQ + Bookmarked threads

[planetsim]

A Tutorial for the Newbies

1) "My variables are empty" OR "My script won't work"
"$somevar is blank"
"I copied this script & it won't work"
"I changed hosts/servers & now my script doesn't work"

In recent releases of PHP, the php.ini directive "register_globals" is set to "Off" by default; so the recommended/preferred method of coding variables has changed. Many tutorials and texts/books were written prior to this change, so "I copied this from a book, perfectly" may not have any effect on your situation. You now must call variables from the "SUPERGLOBAL" arrays. Use $_POST['var'] for a POSTED form; $_GET['var'] to obtain a value from a URL. Cookies are $_COOKIE['var'], Session variables are now $_SESSION['var'], etc.

EXAMPLE:
Script one: form.php---

echo "<form action=\"handle.php\" method=post>";
echo "What's your first name? <input type=text name=FName>";
echo "<br><input type=submit name=submit value=submit>"; 

Script two: handle.php---

echo $name; //THIS WON'T WORK!
echo $_POST['FName']; //This returns the value entered in Script One 

dalecosp

Remember that $_POST, $_GET, $_SERVER, $_FILES, $_REQUEST, etc., are only valid if your PHP version is > 4.0 --- otherwise use $HTTP_POST_VARS, $HTTP_GET_VARS, $HTTP_SERVER_VARS, $HTTP_POST_FILES, etc.

planetsim

Reference: http://www.php.net/variables.external

2) MAIL: "Can I send mail with PHP?"
"I want to mail a form..."

The basics of the mail tag:

mail(string to, string subject, string message, string additional_headers); 

Headers can be any of the following, (and some others):
MIME-Version: 1.0
Content-type: text/html; charset=iso-8859-1
From:
Cc:
Bcc:

EXAMPLE: A Form with Mailed Results

//The Form --- "form.html"

<form action="mail.php" method="post"> 
Email: <input type="text" name="frmail"> 
Message: <textarea name="msg"></textarea> 
Subject: <input type="text" name="subj"> 
<input type=submit name="submit" value="Send">
</form> 

//The mail script --- "mail.php"

$to = "you@isp.com"; 
$headers  = "MIME-Version: 1.0\r\n"; 
$headers .= "Content-type: text/html; charset=iso-8859-1\r\n"; 
$headers .= "From: ".$_POST['frmail']."\r\n"; 
$mail =  @mail($to,$_POST['subj'],$_POST['msg'],$headers); 

// The "@" sign before the mail() call suppresses printing of errors
// that may occur.  The test below will check for errors instead:

if(!$mail){ 
    echo "Email not sent! Please try later..."; 
}else{ 
    echo "Mail sent successfully!"; 
} 

Reference: http://www.php.net/manual/en/function.mail

planetsim

3) MYSQL/database:
"How do I..."
"Getting info from a database..."
"?Select * from ?, huh?"

Using MySQL and formatting its data

MySQL and PHP are pretty much a package deal; together with the Apache Server, they are often referred to as "AMP" - "Apache/Mysql/PHP". Yes, Tux lovers, if you run them on Linux, it's "LAMP" --- pretty !

MySQL is a Structured Query Language, much like MSSQL, and one of the best RDBMS' (Relational DataBase Management Systems). Before moving on check out PHP/MySQL functions at http://www.php.net/manual/en/ref.mysql.php

4 main functions are always used with MySQL and fetching data.

mysql_connect(); or mysql_pconnect(); //Connect to a MySQL database. 
        // mysql_pconnect() maintains a permanent connection to the db server; mysql_connect() doesn't. 

mysql_select_db('mydbase') // Selects a database named "mydbase" after connection is made. 

mysql_query() // Creates a query to select data from a table or tables. 

mysql_fetch_array(); or mysql_fetch_object(); // Both do exactly the same thing; extract data from a query.
        
// The difference is mysql_fetch_aray is done like this:

$var['index']

// and mysql_fetch_object is like this:

$var->index. 

To select more than one row of data you will require a loop. The most common loops are while() or foreach(). For this example, we use while();

Assume we have a table named "news" in a database "mysite". We need to extract all the rows from "news" and display them in an HTML table for each article. There are 4 fields (or "columns") in this db table: id, title, date, and message.

 $con = mysql_connect("localhost","usernamehere","passwordhere"); 
        // "localhost" is used if the db server is on the
        //same computer the web server is on....
$selectdb = mysql_select_db("mysite",$con); 
$query = mysql_query("SELECT * FROM news");      

// Creates an array of items with keys corresponding to table columns...
while($row = mysql_fetch_array($query)){

//Create the HTML table
echo "<table><tr><td>NewsID: ".$row[id]." Title:".$row[title].";
echo "</td></tr><tr><td>Date: ".$row[date]."<br />".$row[message]."</td></tr></table><br />"; 
} 

There you go... simple, isn't it? Though you can do it a differently with a foreach() statement. There are other functions, but these will take you a long way....
planetsim

4) Sessions and Cookies
Sessions and cookies are argued about all over the Board - which is better? Let's see why people are arguing.

Sessions: http://www.php.net/manual/en/ref.session.php
Before a session can exist it first must be started ( session_start(); ) and then the session registered ( session_register(); ). Although you can bypass the session_register by using the $_SESSION or $HTTP_SESSION_VARS superglobal arrays.

Here is a simple session code:

<?php 
if (!session_is_registered('count')) { 
    session_register('count'); 
    $count = 1; 
} 
else { 
    $count++; 
} 
?> 
Hello, Visitor!  You have seen this page <?php echo $count; ?> times....<p> 
To continue, <A HREF="nextpage.php?<?php echo strip_tags (SID)?>">click here</A>

This just counts how many times a visitor has visited that page. Sessions need to be registered but can also be unregistered using... session_unregister().

So, when to use sessions? Most of the time you should use a session in an admin or to keep track of a user on the site. Let's create a simple Session which stores a username, then gets validated on each page.

//HTML Form to log in...
 
<form action="login.php" method="post"> 
Username <input type="text" name="user"><br /> 
Password <input type="password" name="pass"><br /> 
<input type="submit" name="submit" value="login"></form> 

//end of form

//login.php 

#check if account exists 
$qstring="SELECT * FROM users WHERE username = '";
$qstring.=$_POST['user']."' AND password = '".$_POST['pass']."'"); 
$qry = mysql_query($qstring); 
$numrows = mysql_num_rows($qry); 
if($numrows < 1){   // If no return fr. database, the account doesn't exist....
}else{ 
    session_start(); // start the session...
    $_SESSION['user'] = $_POST['user']; // Registers the session user. If the POSTed username was "badman", 
                    // then $_SESSION['user']=="badman"
} 
//End of Validating 

//The Check log 
function checkLog(){ 
    global $_SESSION; 
    if(session_is_registered("user")){  
    #add code to validate the user in the db 
    }else{ 
        session_unregister("user"); // unregister the session
        header("location: index.php"); // send them to the "home page"....
    } 
} 

That example probably doesn't work; But you get the idea. What I haven't explained is that sessions only last as long as the browser is open, or until the session expires. About 5 minutes if browser inactive.

O.K. now... Cookies!!
Reference:http://www.php.net/manual/en/function.setcookie.php

Cookies are simpler than Sessions; Site Administration scripts shouldn't use them, but they're great for forums, etc.

Creating a Cookie

setcookie(); // Will create the Cookie 
$_COOKIE['somename']; //Will get the cookie name and validate it when necessary. 

O.K. --- the basics of setcookie();
setcookie ( name , value , expire , path , domain , secure);

name - name of the cookie.
value - value of the cookie. This value is stored on the clients computer; do not store sensitive information.
expire - time the cookie expires. This is a unix timestamp (number of seconds since the epoch) In other words, you'll most likely set this with the time() function plus the number of seconds before you want it to expire. Or you might use mktime().
path - The path on the server in which the cookie will be available on.
domain - The domain that the cookie is available
secure - Indicates that the cookie should only be transmitted over a secure HTTPS connection. When set to 1, the cookie will only be set if a secure connection exists. The default is 0.

Example:[/i]

setcookie ("TestCookie", $value,time()+3600, "/~rasmus/", ".example.com", 1); 

This one only works on a secure connection. It will be saved in /~rasmus/.
The Cookie will only work the domain "example.com".

setcookie ("TestCookie", $value,time()+3600);  /* expire in 1 hour */ 

Will Work anywhere as long as it's on the same domain, e.g. "phpbuilder.com".

Seeing the Cookies Value:

if(empty($_COOKIE['cookie'])){ 
    $var = "phpbuilder"; 
    setcookie("cookie",$var,time()+60*60); #lasts 1 hr 
}else{ 
echo $_COOKIE['cookie']; #Prints "phpbuilder"
} 

That's it, really. Like I said, not as complex as Sessions, but you can see why cookies shouldn't be used for things like Site Admin.

[planetsim]

Continued

5) Security
This isnt just PHP Related. For any person developing Server Side Web Applications should follow simple steps to stop people bypassing into areas they shouldnt be etc.

PHP - Make sure the register_globals = off. This will mean that you'll need $_POST etc.
The reason for this. Imagine you have an include include($page); in a querystring. What would happen if the user created a file on another server, and made it copy Database data, Passwords etc on your server by simply doing this index.php?page=http://website.com/deadlyscript.php
By using $_GET or $HTTP_GET_VARS, you limit only to querystrings.
Then by validating the data by using either a switch statement or if/else statement to make sure the data that is being entered from the querystring is correct.

Forms are a big problem. People can put clever yet annoying Javascript Functions in your script simply by entering in the Javascript code into a form.
You should always make sure you use strip_tags(); and use the htmlentities etc. Before using any information from a form. Some simple things like bin which gets inserted into your database can be fatal.

Never use cookies as a way to access your Site Admin, use sessions, this will make sure you always have to login via a form, before accessing the admin.
With Admins and accounts, make sure passwords are encrypted by using md5();. When needing to check the password just use md5() to see if its exact.

If you ever have forms that require Javascript to validate. Make sure you have some sort of php function that checks the same material that the Javascript is validating. Reason for this is Javascript could be off, Javascript isnt always accurate.

Just following these simple steps can stop many fatal errors occuring, and keep your Web Site Secure.

If anyone else has things they think should be added to the list, please go right ahead.

[planetsim]

Arrays

http://php.net/manual/en/ref.array

I tend to think of arrays as a variable with lots of information tied to it.

This is because i tend to use arrays when theres lot of information for one thing eg. using mysql_fetch_array to extract data from a query.

An example of an Array

$names = array('paul','david','phil','andrew','sandra','sarah');
///$names in an array with 6 indexes.

echo "<table>";

//Getting the data into information
foreach($names as $key => $value){
   echo "<tr><td>Name: ".$value."</td></tr>";
}
echo "</table>"; 

From that it should create a table. With 6rows.

two-dimensional Arrays
These are arrays, that have sub arrays in them..

$fruits = array (
    "fruits"  => array ("a"=>"orange", "b"=>"banana", "c"=>"apple"),
    "numbers" => array (1, 2, 3, 4, 5, 6),
    "holes"   => array ("first", 5 => "second", "third")
); 

As you can see there are 3sub arrays in the array $fruits.

When to use two-dimensional arrays?
I liked an example when i first learnt arrays, was a person, and we had got all his details. Eg, Name, Age, Location.
From there we can make sub arrays
name => array("Firstname","Surname");
age => "40";
location array("Address" => "7 Goodwill Ln",
"PostCode" => "2234";
);
Thats just an example.

$person = array("Name" => array("Andrew","Gibson"),
                          "Address" => array("Street" => "7 Goodwill Ln","PostCode" => "2234", "State" => "QLD", "Country" => "Australia"),
"Age" => "40"
);
//Getting the information from an array wont be as easier as previous version

foreach($person as $key => $value){
if(!is_array($value)){
echo $key ." ". $value."<br />";
}else{
foreach($value as $key2 => $val){
echo $key2. " ".$val."<br>";
}
} 

Probably wouldnt work as i didnt test it, but basically that would be an easy way to extract data from two-dimensional arrays.

There is still more to arrays than that, but that is a start.

[laserlight]

More on security:

Use is_numeric() to help validate data that is expected to be numeric.
It is also possible to treat the data as a string and use regex to check that all characters are valid.

Use htmlspecialchars() or htmlentities() when writing output that you arent certain of.
This takes care of insertion of html or malicious clientside scripting.
Use strip_tags() if you dont want any of these tags at all.

Remember to escape strings entered into databases.
You might want to use addslashes() if the data is not already escaped.
However, different database systems may require other ways to escape characters that could potentially allow SQL injection.

Storing md5() hashes as passwords doesnt necessarily add more security, but it does make it more difficult to obtain the user's original password if this password is intercepted.

Cookies are an acceptable means of authentication if you dont need much security, but be warned: they can be spoofed easily.
Using sessions can be better, but again these methods arent foolproof.
If you need something stronger, you'll have to use encryption, SSL, https etc

[jimson]

maybe we can see this in newbie code

echo '<table border="1" cellpadding="1" cellspacing="1">'; 
echo '     <tr>'; 
echo '          <td>'; 
echo                $my_variable_value; 
echo '          </td>'; 
echo '     </tr>'; 
echo '</table>'; 

for oldbie code

echo '<table border="1" cellpadding="1" cellspacing="1">'. 
               '<tr>'. 
                     '<td>'.$my_variable_value.'</td>'. 
               '</tr>'. 
     '</table>'; 

now the code looks prettier.

[planetsim]

Dont believe it.. forgot to acknowledge the real begginers..
Ok

For those with no idea in PHP.. Heres the basics

PHP means PHP Hypertext Processor.. Before that it was more well known as Personal Home Page.. thus the PHP..

Before we can go on and just create php we need a webserver.
The best solution would be Apache i suggest people download the 1.3.x version. As its the most stable.

There are a couple of ways to download it..

As a MSI. Get this if your Windows,
Zip - Dont sugget anyone reading this thread to get it.

I assume most of you are Windows Users, so download the MSI version of it.. Approx 2-3mb

Installation isnt hard. But you can goto http://robouk.mchost.com/tuts/tutori...torial=server1 and learn how to install it..

remember to test if it installed correctly by going to. http://localhost once you have started the apache server.

From there you'll need to install PHP once again you can goto the site i suggested it has how you install it, the tutorial is quite old yet shouldnt be any different in installation.

If you dont want the tutorial.. goto http://php.net and download the PHP Installer. exe file about 900kb if i remember correctly.

Follow the prompts. When you get to which server you want to install.. Select apache, you should recieve an error saying something like, Couldnt get to requested server or something a long those lines.

That will mean you'll have to do this in the httpd.conf file.. Located in the Apache/Conf Directory.

Open the file up and add this anywhere in it.

ScriptAlias /php/ "c:/php/"
AddType application/x-httpd-php .php
Action application/x-httpd-php "/php/php.exe"

Change the c: to which ever drive you installed PHP on.
This just allows PHP to be parsed by the server, as a CGI Binary.

You can install MySQL as well. But lets not get too far ahead of ourselves.

Restart the Apache Server

And create a .php file in the webroot directory. most likely htdocs.

<?php
phpinfo();
?>

Save it.. as index.php
and goto http://localhost/index.php

If you see the PHP File with the information about your PHP Settings, you have successfully installed PHP. Otherwise.. try again.

Some PHP Basics

<?php
$name = "planetsim";
echo $name; //Displays planetsim
?>

<?php
$name = "planetsim";
if($name == "planetsim"){ 
echo "Hi ".$name.", how are you today?";
}else{
echo "Who are you?";
}

[planetsim]

Planning your site

Before coding, designing graphics and creating your database/flat file system. You should plan your site.

Many of you more experinced programmers if your reading would know what its like when not planning a site, and in the middle of creating it, you want more features in it, eventually you keep adding them, and you have no idea when your project will finish, because as your adding your new features, your fixing code that wont work with the original design.

Ok so why Plan?
If you read the paragraph above you'd see what kinda mess you could become of not planning. Planning is a crucial step in creating your website.

So what do i plan?
Before we start planning. Brainstorm ideas, you should have some idea on what the site is about and title.

Get ideas on:
What you want in the site
How you want data to be displayed
What language you want to use.
How long each step should take (Not really important but can give you some sort of timeframe of the project)
What things require a database

Planning
After brainstorming you should now plan your ideas.
First id plan your database design or flatfile system. Which ever method you'll be using.

When designing, make sure you do it on paper, so you know if your gonna have relationships between tables. (This is a must it can make those queries a lot easier)

After designing the database its graphics time. Im not graphic designer, but a good way of creating your main design is to create the page and how its gonna look, then cut it up(I use Photoshop) not sure on what other people have but most have the feature of cutting the image.

Once you have graphics, design the site in html. This way you have the Graphics and HTML done, its only the php. Most newbies love having html code with there php code, eventually most grow out of it (yay).

Then its all php code the rest of the way.

Now once you have planned your site, dont add features until the project is finished. This way you can go back on the plan and add it. Check if theres relationshipts / extra tables needed and/or graphics needed.

Then you can code it.

The smart programmers do this, its why they can finish that project fast and things work smoothly. You can see when a programmer isnt smart its when they have errors, 6times out of 10 its when a programmer has added a new feature.

GoodLuck with using this idea.

[planetsim]

echo 'asdasd';
echo 'asdadasd';
if($as == "asas"){
echo "noooooooo";
}else{
echo "yipee";
}

This isnt really help in coding, but help when people get into trouble

Instead of just copying your code into the textbox, put [php ]then copy
Without the space of course
then when you finish

[/php ] again without the space.

This doesnt just make it easier for myself to read, but im sure anyone who helps someone will appreciate it.

The [php ][/php ] tags will highlight code.. Much like further up on the post..

echo 'asdasd';
echo 'asdadasd';
if($as == "asas"){
echo "noooooooo";
}else{
echo "yipee";
} 

[Weedpacket]

I'd just worry about this example regarding sessions:

function checkLog(){
    global $_SESSION;
    if(session_is_registered("user")){
        #Validate the user in the db
    }else{
        #Unregister the session
        session_unregister("user");
        header("location: index.php");
    }
} 

Since $_SESSION is always available, it doesn't need to be declared global.

Also, as the manual strongly notes, it's not a good idea to go mixing $_SESSION with session_register(), session_is_registered() and session_unregister();. They don't do anything that can't be done with the $_SESSION array:

function checkLog(){
    if(isset($_SESSION['user'])){
        #Validate the user in the db
    }else{
        #Unregister the session
        $_SESSION['user']=null;
        header("location: index.php");
    }
} 

Actually, since PHP 4.3, I think unset($_SESSION['user']) will work - in PHP4.1 and 4.2 it wouldn't 'cos of a PHP bug.

[planetsim]

heh, i probably should have fixed that one up, didnt realise that until 2days ago, when browsing the manual.

[dalecosp]

The 2nd comment I made (in the first section) says "THIS WILL RETURN THE VALUE". It should say "PRINT" instead of "RETURN". AFAIK, echo() will only return boolean(?) T/F.

Also, there are at least 3 lines in the code examples that should be broken up for easier reading; the worst offender is in the "Let's assume I have a database called news" example.

Hey, Planetsim; I spent some time putting together the version with bold titles and attributions; if you get some time can you edit the post and insert that version instead?

Please don't think I'm being an*l here --- jus' figured if people are going to read it, might as well be the best it can....

[planetsim]

yea ill fix it up.. do you have the link.. i remember you asking before, just forgot about getting it done.

[planetsim]

Updated the Newbie Thread. Up top. Pretty nice work there dalecosp you did a lot of work..

[planetsim]

Gonna right another tut on

when to use if/elseif/else structure and the switch statement so keep a look out.

[Weedpacket]

Anothing bit about sessions for Windows users:

Warning: session_start(): open(/tmp\sess_30a5cf085c97b8062247eb482e99715b, O_RDWR) failed: No such file or directory (2) in C:\program files\Apache2\htdocs\whatever\foo.php on line 2

If you're using Windows, you have to specify the temporary directory in php.ini - "session.save_path" if I recall. "/tmp" is the default for Un*x systems.