Web Database Applications with PHP, and MySQL [Paperback]

Web Database Applications shows Web developers how to build rich Web database applications using two leading open-source technologies, PHP and MySQL. The authors also assume use of the Apache Web server, which is by far the most common PHP scenario. Both PHP and MySQL are introduced from scratch, although this is a fast-paced book best suited to at least intermediate developers.

After a brief discussion of Web database applications, the authors offer a rapid tour of PHP essentials, including loops, expressions, functions and common mistakes. Next comes a quick-start guide to MySQL, focusing mainly on the SQL language itself. The following chapters tackle connecting to MySQL and other databases, implementing user-driven queries and enabling writing as well as reading data. There is a useful chapter on data validation, both on the client and the server and excellent coverage of another crucial subject: security and authentication. This looks at the fundamentals of HTTP authentication and examines security features in both Apache and PHP, identifying weaknesses and explaining pros and cons. The closing chapters form a detailed case study, an online wine store, with complete code available for download. It embraces user management, a shopping cart, searching, ordering and delivery, covering many key topics in the process. At the back of the book are appendices on a range of issues, including installation, Web protocols, database modelling and session management.

Web Database Applications is tightly-focused, packing in lots of solid technical information without wasting words. It does not pretend to cover all the potential uses of PHP, and the screen shots will not win prizes for design, but it's a great handbook for building robust, secure database applications with these popular technologies. --Tim Anderson

"A first class reference and highly recommended instructional guide."

"As symbolized by the duck-billed platypus on the cover it is a book that will help you to survive in a rapidly changing world. Submerge yourself in proven technology and emerge unscathed once the dots have fallen out by the wayside. Recommended for its excellent examples which will save you thousands in case you need to develop a similar application." Information Security Bulletin, July 2002 "The book manages to deliver on two levels at once - the concepts, planning and design process as well as implementation. It's also surprisingly well written, and manages not to be too smug or patronizing." - Nick Veitch, LinuxFormat, October 2002

"....If you don't need computer concepts and language hand-holding but want to do a database-driven web application right, this book is well worth the price."

"....Recommended for its excellent examples which will save you thousands in case you need to develop a similar application."

"A useful book that offers a lot of varied information in one place for updating your skills...."

"O'Reilly books are often seen as the missing manuals and training courses for the open source world, and this book is no exception to this rule.

This new edition has been redesigned around the rich offerings of PEAR. Several of these, including the Template package and the database-independent query API, are fully integrated into examples and thoroughly described in the text. In addition, through a complex sample application--Hugh and Dave's Wine Store--all the important techniques of dynamic content are introduced. Good design is emphasized, such as dividing logic from presentation. The book introduces PHP 5 and MySQL 4.1 features, while providing techniques that can be used on older versions of the software that are still in widespread use. --This text refers to an alternate Paperback edition.

Chapter 8 – Sessions

A fundamental characteristic of the Web is the stateless interaction between browsers and web servers. As discussed in Chapter 1, HTTP is a stateless protocol. Each HTTP request a browser sends to a web server is independent of any other request. The stateless nature of HTTP allows users to browse the Web by following hypertext links and visiting pages in any order. HTTP also allows applications to distribute or even replicate content across multiple servers to balance the load generated by a high number of requests. These features are possible because of the stateless nature of HTTP.

This stateless nature suits applications that allow users to browse or search collections of documents. However, applications that require complex user interaction can't be implemented as a series of unrelated, stateless web pages. An often-cited example is a shopping cart in which items are added to the cart while searching or browsing a catalog. The state of the shopping cart--the selected items--needs to be stored somewhere. When the user requests the order page, the items for that user need to be displayed.

Stateful web database applications can be built using sessions, and session management is the topic of this chapter. In this chapter we:

Discuss how sessions are managed in the stateless environment of the Web and introduce the three characteristics of server-side session management

Introduce cookies for storing state

Show how to use and configure the PHP session management library

Use PHP session management to improve the client entry <form> in the winestore case study

Provide a brief list of reasons for using, or avoiding, session management over the Web

The focus of this chapter is on the session management provided by PHP. However, other techniques to keep state are briefly discussed, including the use of cookies.

Building Applications That Keep State
Applications sometimes need to use the result of one request when processing another. For example, a request that adds an item to a shopping cart needs to be remembered when the request is made to create the order. In other words, the state of the application needs to be stored between HTTP requests. There are two ways to achieve this: variables that hold the state can be stored in the browser and included with each request or variables can be stored on the server.

Most of this chapter is devoted to the second alternative, where the middle tier stores and manages the application state using sessions. However, in this section we briefly discuss solutions that store state in the client tier. One technique described in this section is the use of cookies. While cookies can store state in the client tier, they are also used in middle-tier session management, as described later in this chapter.

Managing State in the Client Tier
Data sent with the GET or POST methods can include the application state with each HTTP request. An illustration of this approach can be seen in the previous and next browsing features developed in Chapter 5. In this example, there are two pieces, or states, that need to be considered when a page is browsed: the query parameters the user provided and which page should be displayed.

The solution developed in Chapter 5 encodes the query and an offset as an embedded link.

This solution allows navigation through large search result sets. Similar solutions are used in the URLs generated to jump between the results pages of web search engines such as Google or Altavista. Cookies can be used for the same purpose.

Encoding the variables that hold state with each HTTP request increases the amount of data that has to be transmitted over the Web, and when data is encoded using the GET method, applications can generate long URLs. While HTTP doesn't restrict the length of URLs, some older browsers and proxy servers do enforce limits.

When state variables are encoded as part of the URL, or even when they are included as cookies, it is possible for the user to change the values that are sent with the request.

Changing the offset in a results page is harmless, but changing the item price of a bottle of wine is more serious. As discussed in Chapters 6 and 7, an application can't rely on data that is sent from the browser.

Cookies
Cookies are often used to store application state in a web browser. As with data sent with the GET or POST methods, cookies are sent with HTTP requests made by a browser. A cookie is a named piece of information that is stored in a web browser. A browser can create a cookie using JavaScript, but a cookie is usually sent from the web server to the client in the Set-Cookie header field as part of an HTTP response.