Security: Help a guy learn about Classes?

[ATS16805]

hello. this is probably poor etiquette, but i think i have a way that i might be able to learn something "big" here, if perhaps someone feels like coaching me through this.

hear me out...
i just worked out a way to do a query on my db, and sort one field alphabetically into tables (thanks to my favorite weedpacket script !!! woohoo! a first time success. 😃 [sorry] )
so, now that i have all of these names (a list of people) sorted neatly, i need to do the next step, which is to go back in and turn those nothing-but-raw-output names into URL's for the user to click on so they can view the Full listing for that person.
this might make more sense if you glance at the Weedpacket thing, so you can see what i'm up to-- understanding that i've done the following variation / addendum to WP's code:

// WP's
echo '<td>';
echo mysql_result($result,'value',$i);
echo '</td>'; 

//mine:

$r = mysql_fetch_array($result);
$l_name = $r['l_name'];

echo  '<td>';
echo $l_name;
echo '</td>';

the first thing that came to mind was to make a variable based on the $r[row_id] array of the looping MySQL output, and use that for a forthcoming query on the db in which i'll pull the record out by that row_id. basic stuff, right?

okay, so my brain is like a sieve, so i am constantly re-reading stuff that i already learned at one point or another-- plus, i'm still a beginner!
Googled how to pass the variable via URL (fastest thing i could think of) w/ $_GET[''] , and came upon this article about Security in which i learned about how it's almost always a BAD idea because of the potential for SQL injection.

okay-- that said, did more research, and found some stuff right here at PHPBuilder.com in the Articles about using Classes to work w/ multiple possibilities as performed on the same thing-- i guess the basic concept of Objects and Classes.

so, i'm thinking i want to try this...
My db has 8 fields (+ 1 for the id), and 3 are ENUM's and 1 is a SET.
what i have to do w/ these db queries is going to involve a lot of little IF statement logic-- on almost every field of course, to determine what to output about these people.

does this sound to you like the perfect place to use Classes?
my Table contains info about people / groups ( Artists / Art Ensembles to be precise).

i want to make an "Artist" class so that i can perform different queries on the database more easily. i realize that there are probably vast possible answers-- but, considering that i've never built my own Class before "where should i begin"?
Do you recommend a tutorial based on what i've told you about what i know, and what i need to know?

thanks!!!!

[frost110]

Classes are always a good idea. They work like a charm.

I am not ure about the best way for this. My mind is kind of tired right now but classes can be used in many ways for example:

<?php

class artist{
     // constructor
     function artist() {
           // instantiate DB here? Or pass DB class through parameters
    }

function getArtist($artistID) {
      // grab that certain artist
     validateOutput($restultArray);
     return $resultArray;
 } 

function getArtists($arrayAritstIDs) {
     // grab all artists with the id's provided
     validateOutput($resultsArrays);
     return $resultsArrays;
}

function validateOutput($arrayArists) {
       // Do validation of fields here

   }
}
?>

I do not know if that is what you were thinking but there it is. You can have an array of the artists class if you prefer which the class would look a ton different. Like this:

<?php


class artist {
     function artist() {
           //constructor stuff
      }

 function name($name="") {
       if ($name != "" && $this->canEdit) {
               $this->name = $name;
               $this->isDirty = true;
        } 

       return $this->name
 }

 function populateArtist($artistID) {
        $this->name = $result['name'];
 }

function saveArtist() {
      if ($this->isDirty) {
          //save new artist information
    }
 }

}

?>

Really the possibilities are endless. I hope this helps.

--FrosT

[bpat1434]

Let me ask you this (and hopefully this will help you answer your own question):
You have 3 queries, will each query have a different form?
Will each query have different if()else{} statements based upon what they're querying for?

If all 3 queries share the same basic structure, and then each query has its own set of if()else{} statements to execute, then I'd say a class would make sense.

[ATS16805]

hey (to both respondants),
my profuse apologies that i have been unable to view this w/ any examining regard since i became unexpectedly preoccupied in the meantime...
i look forward to taking a GOOD look at it asap.

thanks so much for your replies!!!!! i haven't proceeded w/ that project yet, so i will definitely be in here soon as i get back to it! just fyi
🙂

[thread_PHP]

hi for example u can create the class properties like this. and usage of functions like the following way where i put bold for editcategoryall.php page where i am calling the properties class and its methods

<?php



class Properties
{

VAR $asro=array();
VAR $asri=array();
VAR $fri=array();


function openDB()
{
	mysql_connect("localhost","root","") or die("Sorry Unable to connect".mysql_error());
}
function selDB($dbnam="tb1")
{
	mysql_select_db($dbnam);
}



function closeDB()
{
	mysql_close();
}

		function setPosindex()
		{

			$qry1 = sprintf ("select * from supermenu where langid=2 and supar=0 order by posindex");

			$res1 = mysql_query($qry1);

			$i = 1;

		   if (mysql_affected_rows() > 0)
			 while ($row1 = mysql_fetch_array($res1,MYSQL_BOTH))
			  {
				$lid = $row1['menuid'];

				$qryupd1 = sprintf("update supermenu set posindex='%s' where menuid='%s'",$i,$lid);
			//	 print $qryupd1." <br>";		
								mysql_query($qryupd1);
						$i = $i+1;		
				$qry3 = sprintf("select * from supermenu where langid=2 and supar='%s' order by posindex",$lid);
				$res3 = mysql_query($qry3);

				if (mysql_affected_rows() > 0)
					while($row3 = mysql_fetch_array($res3,MYSQL_BOTH))
					{
						$qryupd2 = sprintf("update supermenu set posindex='%s' where menuid='%s'",$i,$row3['menuid']);
						// print $qryupd2." <br>";	
								mysql_query($qryupd2);
						$i = $i+1;		
						$qry5 = sprintf("select * from supermenu where langid=2 and supar='%s' order by posindex",$row3['menuid']);
						$res5 = mysql_query($qry5);

						if (mysql_affected_rows() > 0)
							while($row5 = mysql_fetch_array($res5,MYSQL_BOTH))
							{
								$qryupd3 = sprintf("update supermenu set posindex='%s' where menuid='%s'",$i,$row5['menuid']);
								// print $qryupd3." <br>";	
										mysql_query($qryupd3);
								$i = $i+1;		
								$qry7 = sprintf("select * from supermenu where langid=2 and supar='%s' order by posindex",$row5['menuid']);
								$res7 = mysql_query($qry7);

								if (mysql_affected_rows() > 0)
									while($row7 = mysql_fetch_array($res7,MYSQL_BOTH))
									{
										$qryupd4 = sprintf("update supermenu set posindex='%s' where menuid='%s'",$i,$row7['menuid']);
										// print $qryupd4." <br>";	
												mysql_query($qryupd4);
										$i = $i+1;		
									}
							}
					}


			  }	

		}	





		function updateGallerys()
		{
			$qryselect=sprintf("select menuid,prodqry from supergalleryqry");
		 	$rsselect=mysql_query($qryselect);
		 	while($rowselect=mysql_fetch_array($rsselect,MYSQL_BOTH))
		 	 {
		 	 	$menuidgal=$rowselect[0];
		 	 	$prodqry=$rowselect[1];
		 	 	$qrydelete2=sprintf("delete from supergalleryqryimgs where menuid='%s'",$menuidgal);
 	  			mysql_query($qrydelete2);
	 	  		$rsselect1=mysql_query($prodqry);
			 	while($rowselect1=mysql_fetch_array($rsselect1,MYSQL_BOTH))
			 	{
			 		$newcatid=$rowselect1['prodid'];
			 	 	$insgalleryqry=sprintf("insert into supergalleryqryimgs(menuid,catid) values('%s','%s')",$menuidgal,$newcatid);
					mysql_query($insgalleryqry);
			 	}
		 	 }
		}


	function showoptionswithdb($id)
		{
				global $languageid,$dbaddnewimg,$dbaddnewatt,$dbdelatt,$dbsearchsame,$dbemptyprod,$indetailsrch,$fields,$dbsearchall;

				//$dbsearchall="";

	            print " <table border=0 cellpadding=0 cellspacing=0 width='100%' style=\"border:1px solid #D4A017\" >";
	        	 print " <tr  bgcolor='#DC9F00' height=24 onClick=\"EC('Eaddresses$id',this);\" style=\"cursor:pointer\">";
	         	 print "  <td style=\"padding-left:10px\"><font class='BB' color='White'><u>Options</u></font>";
	         	 print "  <img name=imgopt src='images/opt_arrow_down.gif' border=0 align='absmiddle' hspace='1'> </td>";
	       		 print "  </tr>";
	        	 print " <tr id='Eaddresses$id' style=\"display:none\";  bgcolor='#F7E7BD' >";
	         	 print "  <td colspan=2 style=\"padding:9 10 14 10\"><table border=0 cellpadding=0 cellspacing=0 width='100%'>";

	              print " <tr> <td nowrap style=\"padding-right:5px;\"><input type=submit class=buttonbg  name=Submit value='$dbaddnewimg'  >";
	              print "&nbsp;<input type=submit class=buttonbg  name=Submit value='$dbaddnewatt'  >";
	              print " &nbsp;<input type=submit class=buttonbg  name=Submit value='$dbdelatt'  >";
	              print "</td></tr>";

	              print " <tr> <td>";
	              print "<form action='duplicatefilenames.php' name=frmsamevalue>";
							 print "<div  align=left>";
						    print "<br><li>$dbsearchsame  <select name=txtattname class=textbox >";
						    for($i=0;$i<mysql_num_fields($fields);$i++)
					  		{

					  			if($i == 0 or $i == 1 or $i == 10)
					  			{
					  			}
					  			else 
					  			{
					  				$fieldname=mysql_field_name($fields,$i);
						  			$qrytext=sprintf("select trim(columnText) from supercol where languageid='%s'  and columnName='%s'",$languageid,$fieldname); //To Get the text to be displayed in this page.
//							  			print $qrytext." hellooooo<br>";
										$restext=mysql_query($qrytext);
										if(mysql_affected_rows() > 0)
										{
											$rowtext=mysql_fetch_row($restext);
											$dbcoldesc=$rowtext[0];
										}
										else 
										{
											$dbcoldesc=$fieldname;
										}
						  				print "<option value='$fieldname'>$dbcoldesc</option>";
						  			}
						  		}
							    print "</select>";
							    print "<input type=submit  name=Submit  value='Go' class=buttonbg>&nbsp;&nbsp;&nbsp;&nbsp;||&nbsp;&nbsp;&nbsp;&nbsp;<a href='emptyallprod.php' ><font color=black>$dbemptyprod</font></a>&nbsp;&nbsp;&nbsp;&nbsp;||&nbsp;&nbsp;&nbsp;&nbsp;<a href='searchproductqrytotal.php' ><font color=black>$indetailsrch</font></a> &nbsp;&nbsp;&nbsp;&nbsp;||&nbsp;&nbsp;&nbsp;&nbsp; <a href='searchproductqryallatt.php' ><font color=black>$dbsearchall</font></a>";
							//     print "</form>";
					 print "</td></tr>";	
		              print " <tr> <td>&nbsp;</td></tr>";


	            print "  </table></td>";
	       print "   </tr>";
	      print "  </table>";

		}


}
?>

//CALLing the above properties class in editcategoryall.php like the following way
<?php 
session_start();

require_once("library1/properties.php");
require_once("library1/configure.php");	//for the rights constans.

$catid=$_REQUEST['catid'];

$uid= $_SESSION['loguid'];
if($uid=='')
{
	$_SESSION['loguid']="Guest";

$uid=  $_SESSION['loguid'];
}
$languageid=$_SESSION['languageid'];
if( $languageid=='')
{

$_SESSION['languageid']=2;
$languageid= $_SESSION['languageid'];
}



[B]$ob=new Properties;
$ob->openDB();
$ob->selDB();[/B]
       ?> 
        <?php
     [B]   $ob-> closeDB();[/B]  ?>     

[ATS16805]

THANK you all for being so willing to help and offering your generous input for me on this topic!! i'm really excited about this-- it feels like one of those Golden Chalice moments-- like i'm ready to go up against a Boss in DOOM or something...hehe.. and i've got some bad-#ss weapons at my side. 😉
exciting! definitely the feeling/ moments that drive me at this new world (new to me) of programming.

bpat1434 wrote:

Let me ask you this ... If all 3 queries share the same basic structure, and then each query has its own set of if()else{} statements to execute, then I'd say a class would make sense.

hi, bpat!
yes, i believe the answer is invariably "Yes" for all of the queries...

perhaps it will be best for me to just be more specific-- i wanted to avoid specifying exactly what i have here because i wanted to avoid being told "the answer"-- instead just the "classes syntax" and usage, so i can really dig in and learn while working on this-- (heck, i'm sure it's going to take a lot of cross referencing, regradless of what i'm told here), but that might just be making stuff too difficult for me to transmit to you what i've got going on here-- i think i'm just being silly...

so-- here's what i'm doing. this will appear on a web site where teachers, principals, school board, etc visit to search for artists to accomodate their needs.

this query will involve only one table, which has these fields:

• art_id = primary

• ensemble = enum

• f_name = varchar

• l_name = varchar

• grade_levels = set('0', '1', '2', '3', '4', '5', '6', '7', '8', '9', '10', '11', '12', '13', '14', '15') // 0- 6 is Elementary, 7-9 is Middle School, 10-12 is HighSchool, and i planned for "special ed" and other unexpected stuff, hence up to 15

• art_form = varchar

• state_registered =enum

• resident_artist = enum

• comments = tinytext

these fields tell us if this is a person or an ensemble (if ensemble = '1', that name goes into l_name, if ensemble = '0' then f_name and l_name are used), what are their respective instructional grade-levels, what is their art-form (painting, theatre, photography, lit, music, etc), are they registered for state funding, and finally-- are they available for a "residency" (stay for several days/weeks) vs one day visit/ performance.

let me give some example queries-- as if i were a school-board member:
1) search terms: Middle School, Photography, State Funded

2) search: Sally Smith

3) sort-by-row: show all state_registered, sort alphabetically (alpha optional!)

see what i've got now? so, you can see the vast amount of if { } elseif {} statements, etc.
i realize that some of you have already shown me possible solutions in your own code-- but i wanted to be clear on what i'm working with here.
thanks again! i'm still working on another part of this project, but i want to dabble w/ this asap, so-- no rush on responding to this-- but of course i'm looking forward to reading it!
thanks so much!!!!!
🙂

[ATS16805]

(was afraid i was running out of room)
here's what i get so far from my understanding-- tell me if i'm on the right track, please
my Artist class will have all of the characteristics listed in the table, right?

class Artist {
    var $ensemble;
    var $f_name;
    var $l_name;
    var $g_l;
    var $art_form;
    var $reg;
    var $res;
}

but it's the function part where i'm kinda lost...
would this make sense? i might want functions such as

• Alphabetize

• show ensebles

• show high school

• show resident artists only

• etc

and then i could do something like Alphabetize the "show ensembles" function?
does this look like i even need classes for this, or no? am i going to be able to use that method here? am i getting it at all, or does it seem like i'm missing the point?

thanks!

[bpat1434]

Honestly, what you're askign to do can all be done for you in your query. If you build your query right, you can alphabatize (ORDER BY), show specific elements (SELECT table.ensembles....) and then, in your if/else statements, decide what to show.

One way of doing that may be writing all the information into different <div> tags. And when the user clicks a link, a small JS function "unhides" the visibility of that new div. I had a site that did this, worked extremely well. It was a links page, but if they only wanted county results, they'd click "County" or whatever and that div would show!! It's neat. It's really easy with JS and CSS.

ShowHide.js

function ShowHide(id)
{
	var res = expMenu(id);
}

function expMenu(id)
{
	var itm = null;
	if (document.getElementById)
	{
		itm = document.getElementById(id);
	}
	else if (document.all)
	{
		itm = document.all[id];
	}
	else if (document.layers)
	{
		itm = document.layers[id];
	}
	if (!itm)
	{
		// do nothing
	}
	else if (itm.style)
	{
		if (itm.style.display == "none")
		{
			itm.style.display = "";
			return 1;
		}
		else
		{
			itm.style.display = "none";
			return 2;
		}
	}
	else
	{
		itm.visibility = "show";
		return 1;
	}
}

It's an option....

[ATS16805]

cool! that's a great trick to know!!

but, what about that $_GET['artistvar'] issue i was talking about eariler... or is that not going to be a concern now?

i mean-- i still have to create a hyperlink... know what i mean? hmm... maybe i just need to think on it a bit...
the idea is that i want to show a table of the results, and have those names clickable-- all viewable at once at first, and all already hyperlinks. know what i mean? i have 'em here but they aren't hyperlinks yet... it's just a raw output for now