DEV Community: Mateusz Jasiński

Self-refreshing view counter in PHP and JS

Mateusz Jasiński — Sat, 13 Apr 2024 20:02:04 +0000

Hi there, long time no see huh

Have you ever written an admin panel for your website?

There is one interesting statistic I personally like looking at - view count

We're proud to see people enjoying themselves while using our product, aren't we?

Then, we ought to know how many people do we attract
Time to finish this intro what will we code today?

Project plan

First - We'll create a bit of backend.
We need

Database with table "views".
Script for database connection.
A script that passes views content as JSON.
Another function, that will update views table.

Then, time to hop into frontend with:

UI for the counter and admin-panel.
Javascript parsing data function executed in an interval.

Backend

Start your server and let's get to work!

I've created a simple database called view-counter. In it one table called views with one count field in it
There, add one row with value 0

We need a function for executing queries. As our code will send a bit of requests, such function will definitely be useful

function runQuery(string $query, array $params=[]){
    $db = new PDO("mysql:host=localhost;dbname=view-counter", "root", "");
    try{
        $stmt = $db->prepare($query);
        $stmt->execute($params);

        if(!$stmt->rowCount()){
            return ["No result"];
        }
        return $stmt->fetch(PDO::FETCH_ASSOC);

    }catch(PDOException $e){
        return "Error occured";
    }
}

Of course, replace strings passed in PDO constructor with your DSN and credentials
$params was set to be equal to [], as there's no need to use it every time - it's an optional argument

We'll need to access current view count 2 times - once to display and once to increment it

Let's write a quick function.

function getViews(){
    return runQuery("SELECT * FROM `views`")['count'];
}

Next step: Add pageVisited() - one to actually updates the counter

function pageVisited(){
    $currentVisits = getViews();
    $currentVisits++;
    runQuery("UPDATE `views` SET `count` = ?", [$currentVisits]);
}

We don't need to return anything.
I put all of these functions inside lib.php in scripts folder

<?php 

function runQuery(string $query, array $params=[]){
    $db = new PDO("mysql:host=localhost;dbname=view-counter", "root", "");
    try{
        $stmt = $db->prepare($query);
        $stmt->execute($params);

        if(!$stmt->rowCount()){
            return ["No result"];
        }
        return $stmt->fetch(PDO::FETCH_ASSOC);

    }catch(PDOException $e){
        return "Error occured";
    }
}

function getViews(){
    return runQuery("SELECT * FROM `views`")['count'];
}

function pageVisited(){
    $currentVisits = runQuery("SELECT * FROM `views`")['count'];
    $currentVisits++;
    runQuery("UPDATE `views` SET `count` = ?", [$currentVisits]);
}

In addition we need api.php.
Here, JSON will be returned for JavaScript to grab;

<?php

require "scripts/lib.php";
echo json_encode(getViews());

Backend, checked. Shall we jump to the front?

JS and HTML

We need 2 pages and 1 JS file

Pages:

page.php - Page where we count visits
admin-panel.php - To display the counter

JavaScript:

update-counter.js - Will update the counter on admin-panel.php

For page.php, we don't need anything big. Just remember to update the counter with each visit

<html>
<head>
    <meta charset="UTF-8">
    <title>Mysterious Page</title>
</head>
<body>
    <h1>This page is not totally tracked</h1>
</body>
</html>
<?php
    require "scripts/lib.php";
    pageVisited();
?>

It's time to shine with admin-panel.php

<html>
<head>
    <meta charset="UTF-8">
    <title>Admin page - check your views</title>
</head>
<body>
    <h1>Page was visited <span id = "count"></span> times</h1>

    <script src = "scripts/update-counter.js"></script>
</body>
</html>

We've written simple HTML, but fun is about to begin

In the scripts folder add update-counter.js

We need a function, that will grab data from api.php and replace the contents of cound span

I want it to be replaced every 5 seconds

const updateCounter = ()=>{

}
updateCounter()
setInterval(updateCounter, 5000)

Inside updateCounter, we need to make a request and update #counter

fetch(`http://localhost/view-count/api.php`, {method: "GET"})
.then(req => req.json())

As it's here, first we get data from api.php and treat it as JSON

Then

.then(req => {
    const counterElement = document.querySelector('#count');
    counterElement.innerHTML = req
})

Grab that data and replace counterElement with updated number

Overall, update-counter.js looks like this

const updateCounter = ()=>{

    fetch(`http://localhost/view-count/api.php`, {method: "GET"})
    .then(req => req.json())
    .then(req => {
        const counterElement = document.querySelector('#count');
        counterElement.innerHTML = req
    })
}
updateCounter()
setInterval(updateCounter, 5000)

In browser, at admin-panel.php we'll encounter.

Now head to page.php - when you come back, even without refreshing on admin-panel.php you'll see.

That's it! We made it

Conclusion

Thanks for reading this article.
Now in addition to login and inifinite scroll you have view counter in your arsenal ready to use everywhere you need

Hope you've enjoyed coding with me - check out 2 articles linked earlier and my whole PHP course.

Code for you to download is available here on my Github

That's it, see you next time.

Learn x86 Assembly with me

Mateusz Jasiński — Mon, 04 Mar 2024 18:58:47 +0000

What's up.

Based off of my posts, I think it might be kind of strange to see an article like this

But yeah, I've decided to learn assembly

Also - Correct me if I'm wrong somewhere here or oversimplified a term. I'd be more than happy to read such comments and get my knowledge and understanding to the higher level

Why Assembly and why x86?

Starting with the second part - that's what my processors architecture is.

I don't have ARM processor, yet someone would tell me.

Just buy used computer or VPS with such access

I could, of course - Yet I would not like to spend too much money right now

I believe, that with some curiosity and time to search, I can dig information for free - This will be the challenge itself

I like challenges - so why not?

And why assembly? Simple answer...

Reverse Engineering

Just got into it - so Assembly might be fairly useful there, as not always everything can be found with C# or even C de-compiler

Where I'll be learning from?

I've found 2 decent sources

tutorialspoint - in english, with nice segments and everything
This paper from Jagiellonian University - yet in polish, so my native language

But, that's it for the talking - let's learn something

What does assembly code consist of

If we look at assembly code - it consists of sections

Some basic ones are

.bss - In this section, we declare variables, that will be changed while execution
.data - it stores constants, like strings or ints
.text - contains the code itself. We need to also declare _start here

section.text
    global .start
_start:

_start tells the kernel, where should it look for the beginning of the code.

In there, we can find mnemonics - Assembly instructions

In one line, there can only be one mnemonic

So, this

MOV TOTAL, 48 ADD TOTAL, 10

Can never appear - so we need to write this in 2 separate lines

MOV TOTAL, 48 ; Move 48 to variable in memory called TOTAL
ADD TOTAL, 10

As you see, I've also added ; to the end - that's comment in assembly

That's it, not to much yet still I hope it will expand very soon

What will I learn now?

Probably start reading about registers and other parts such as variables or conditional instructions

Right now, I'd like to thank you for reading - Share you expirance in comments. Maybe we as community can learn a very valuable lessons from you.

Also, feel free to share your sources - where have you been learning assembly from and that's it

See you next time

PHP 0 to hero pt.16 - .htaccess and robots.txt files

Mateusz Jasiński — Tue, 27 Feb 2024 16:31:56 +0000

Welcome - Sadly or not, that's the last part of this series

We finally come to an end - today I won't be talking about PHP itself

You know, when we were writing a code, we've always had .php at the end. Like /login.php

But it can be better

We want it more appealing, like /login, don't we?
That's the perfect example of .htaccess file usefulness

Apart from that, I'll also explain usage and importance of robots.txt file - by the way talking about it's security issues

What will we learn today?

When can we use .htaccess
How to add SEO-friendly addresses to our website
Adding error pages
Basic robots.txt structures

No more talking - let's go

When can we use `.htaccess` files?

.htaccess is a config overwrite mechanism made for Apache HTTP server - and only for it

So, If you are using Nginx or Microsoft IIS - sorry to say, but you need to use native solutions.

Right now (I assume) we are working with Apache server so using .htaccess shouldn't be a problem for us

Also

Quick disclaimer

Using .htaccess files, even despite it's popularity, comes with some flaws.

.htaccess slows down requests - It's server-side mechanism so It can't be cached in a browser. Every request requires "executing" .htaccess file(s)

99% of things we'll be doing in .htaccess can be done in default Apache config file - httpd.conf

If you have write access to it (like on VPS) - use it as much as you can. Your site will perform much better

Also, .htaccess is very vulnerable to syntax errors - one minor typo and you get error 500 all over your website

So to sum up - use .htaccess files only if you don't have access to httpd.conf (for example on shared hosting) and use only 1 at a time

With this said - let's go

SEO-friendly addresses

I think, while browsing the internet you've seen website with link like this http://domain.com/home - That's where .htaccess comes in handy

Using RewriteEngine we can create such addresses for pages

First - enable RewriteEngine

RewriteEngine on

Then, we can start adding our rules

RewriteRule home index.html
RewriteRule about-us aboutus.html
RewriteRule privacy-policy privacy-policy.html

To find some pattern - it looks like this

RewriteRule [new address] [file]

When creating them, pay attention to letter case - write everything in lowercase and use snake-case to separate words

Why?

Lowercase helps SEO - sometimes search engine might index My-page 2 times. As My-page and my-page which makes you loose your position in search results
snake-case (with dashes instead of spaces) - When Google sees my-page it replaces - with space, as it can't distinguish any other meaning for it. Then it matches typical Google searches

On the other hand - using _ suggests that there is a letter, but we don't know which one. So my_page could be read as myopage or myjpage and so on

Error Documents

From part 8 we know that sometimes websites don't work as we want - so we have 4xx and 5xx errors

Now, displaying typical 404 Apache page looks unprofessional - some websites have their own error pages, with matching theme and some funny images

We can do this in .htaccess as well - for example with 404 page

ErrorDocument 404 https://example.com/404.php

One question? Can't we just use relative path - /404.php

Not really - sometimes .htaccess reads / not as website's root directory (/var/www/html or C:/xampp/htdocs), but as filesystem's root directory (/ or C:/)

So, using domain and absolute path in general assures us, that no matter where 404 will happen, Apache will always find valid error document.

What is `robots.txt`?

Imagine this:

You've created a website. What to do now?

Why not publish it and get it indexed (visible) at Google (and other search engines)

But we don't really want to show our style sheets or account configuration panel in Google, do we?
That's the main purpose of robots.txt files

Google defines it as

[robots.txt] tells search engine crawlers which URLs the crawler can access on your site

I highly recommend you to get familiar with robots.txt docs from Google, before publishing the website

Now, let's say we don't want to index topsecretpage.php.
We need to specify:

To What crawlers this rule should be applied

User-Agent: *

* stands for all (just like in SQL)

Where crawlers can't or can enter

Disallow: /topsecretpage.php

Allow: /openpage.php

In robots.txt we also declare sitemap - XML file containing every sub-page on your website

Sitemap: https://www.example.com/sitemap.xml

Security issues

Don't use robots.txt to hide pages from everyone - this file is easily accessible.

For example - this is YouTube's robots.txt

And I didn't hack YT or anything - just went to https://www.youtube.com/robots.txt

So yeah, robots.txt is cool to hide style sheets or some files that require logging in - but don't put credential or employee-only files in there

Conclusion

As you seen, this was more of site administration article - but hey!
Every knowledge is valuable - especially if it resolves somewhere around our main interest

Thanks for reading - check out my blog and rest of this series

They all will get a re-write soon - so more valuable content and better summarized knowledge for you.

Little personal afterword

As that's the last part of this "chapter" - I'd like to say something
Thank you so much for every view, comment and like - Even though it wasn't much, still I'm glad that I could help someone.

Also, big thanks to everyone who took their time and reviewed this course - from Forum Pasja Informatyki and Reddit

I'll definitely post something like this again - when my work will reach satisfying level

I've learned a lot, I hope you had as well - and what more can I say.

Thanks for everything and see you while creating projects (and in some other articles)

Refactoring spaghetti code in PHP

Mateusz Jasiński — Fri, 23 Feb 2024 21:15:10 +0000

Have you ever looked at the code and thought, "What is this mess"?

After a while, you can even say such thing about your own "masterpieces"

But remember, code review is part of the journey and perfect way to become 10x developer

(Only true code quality measure)

Today, we'll learn some secrets of refactoring - so your next project will look as clear as a whistle

Read the whole article carefully - You can take some breaks but don't skip the paragraphs

Yet, no more intro - let's go

What will we be working on?

I think this is a perfect example of spaghetti code

    <?php
    // Main code
    $h = $_POST['h'];
    $i = $_POST['i'];
    $d = $i * $h;

    if ($d > 100) {
        echo "Total is greater than 100!";
    } else {
        echo "Total is less than or equal to 100!";
    }

    $j = array("Apple", "Banana", "Orange");

    if ($h > 0) {
        if ($i > 0) {
            if ($i < 10) {
                if ($h < 10) {
                    if ($d > 100) {
                        echo "Total is greater than 100!";
                    } else {
                        echo "Total is less than or equal to 100!";
                    }
                } else {
                    echo "Quantity is greater than or equal to 10!";
                }
            } else {
                echo "Price is greater than or equal to 10!";
            }
        } else {
            echo "Invalid price!";
        }
    } else {
        echo "Invalid quantity!";
    }

    if (is_array($j)) {
        if (count($j) > 0) {
            foreach ($j as $k) {
                echo $k . "<br>";
            }
        } else {
            echo "No items to print!";
        }
    } else {
        echo "Invalid items!";
    }
?>

Fair amount of mess I sense.

Overall - it's calculating total and quantity of a cart at some shopping website.

Now imagine, it's your first day at a new workplace, you are assigned fix something in this chaos.
And there are 1000 lines like this.

Your whole shift is over, but you didn't even got half of the meaning - and bug fix is a whole different story

So, how should we approach this?

Variable naming

Don't you dare to name variables a, b, c or so on
(...Unless it's i in for loop)

That's the first thing we have to fix - as far as I understood
$h represents quantity of products
$i -> price
$h -> total
$j -> items
$k -> item (in for-each loop)

    <?php
    // Main code
    $quantity = $_POST['h'];
    $price = $_POST['i'];

    $total = $price * $quantity;

    if ($total > 100) {
        echo "Total is greater than 100!";
    } else {
        echo "Total is less than or equal to 100!";
    }

    $items = array("Apple", "Banana", "Orange");

    if ($quantity > 0) {
        if ($price > 0) {
            if ($price < 10) {
                if ($quantity < 10) {
                    if ($total > 100) {
                        echo "Total is greater than 100!";
                    } else {
                        echo "Total is less than or equal to 100!";
                    }
                } else {
                    echo "Quantity is greater than or equal to 10!";
                }
            } else {
                echo "Price is greater than or equal to 10!";
            }
        } else {
            echo "Invalid price!";
        }
    } else {
        echo "Invalid quantity!";
    }

    if (is_array($items)) {
        if (count($items) > 0) {
            foreach ($items as $item) {
                echo $item . "<br>";
            }
        } else {
            echo "No items to print!";
        }
    } else {
        echo "Invalid items!";
    }

?>

Looks a little better, doesn't it

But the end is far away - we've got more work to do

Modularization

I don't think this listing is the only place in whole project, where we calculate total and display items from array

Put these into functions - so we can reuse them later

I'm starting with calculating total

function calculateTotal(int $price, int $quantity){
    $total = $price * $quantity;

    if ($total > 100) {
        return "Total is greater than 100!";
    } else {
        return "Total is less than or equal to 100!";
    }
}

Then, I can just write this over and over again

echo calculateTotal($price, $quantity);

I have also added types to be sure, that I won't pass I like pizza as price of cart

The same thing with listing items

function listItems(){
    $items = array("Apple", "Banana", "Orange");
    if (is_array($items)) {
        if (count($items) > 0) {
            foreach ($items as $item) {
                echo $item . "<br>";
            }
        } else {
            echo "No items to print!";
        }
    } else {
        echo "Invalid items!";
    }
}

But, when you think about it.
We'd probably have more arrays to list. Customers, orders, complains or employees, to name a few.

So, why not write one function to list every array that we want to

function listArrayItems(array $array){
    if (is_array($array)) {
        if (count($array) > 0) {
            foreach ($array as $item) {
                echo $item . "<br>";
            }
        } else {
            echo "No items to print!";
        }
    } else {
        echo "Invalid items!";
    }
}

Much better - now we can use it all around the code

listArrayItems($items)

So, is it the end? Not really

DRY and KISS

Are we doing a laundry? Will we put our computer into washing machine and then to leave in the sun?

No, no, no - don't do that to your electronics

DRY is an acronym - stands for Don't repeat yourself

In our case - we have those two snippets

$total = $price * $quantity;

if ($total > 100) {
    echo "Total is greater than 100!";
} else {
    echo "Total is less than or equal to 100!";
}

And

if ($quantity > 0) {
        if ($price > 0) {
            if ($price < 10) {
                if ($quantity < 10) {
                    if ($total > 100) {
                        echo "Total is greater than 100!";
                    } else {
                        echo "Total is less than or equal to 100!";
                    }
                } else {
                    echo "Quantity is greater than or equal to 10!";
                }
            } else {
                echo "Price is greater than or equal to 10!";
            }
        } else {
            echo "Invalid price!";
        }
    } else {
        echo "Invalid quantity!";
    }

The second one is just expanded with quantity check - but does it have to be combined?

That's what KISS rule is about

KISS means Keep it simple stupid (I don't think that "stupid" here was meant to insult anyone)

We can split this in two separate parts - no need to make a big pile out of it

So, let's focus on second snippet - we'll divide it into 2 elements

Check total
Check quantity

We don't really need to write total calculation, as we have already done this - in calculateTotal function

Focus on quantity checking

function checkQuantity(int $price, int $quantity){
    if ($quantity > 0) {
        if ($quantity < 10) {
            echo calculateTotal($price, $quantity);
        } else {
            echo "Quantity is greater than or equal to 10!";
        }    
    }else {
        echo "Invalid quantity!";
    }

}

As in our spaghetti - quantity was only present when we calculated total, so we can call previously coded function

Let's look at our code now

<?php

function calculateTotal(int $price, int $quantity){
    $total = $price * $quantity;

    if ($total > 100) {
        return "Total is greater than 100!";
    } else {
        return "Total is less than or equal to 100!";
    }
}

function checkQuantity(int $price, int $quantity){
    if ($quantity > 0) {
        if ($quantity < 10) {
            echo calculateTotal($price, $quantity);
        } else {
            echo "Quantity is greater than or equal to 10!";
        }    
    }else {
        echo "Invalid quantity!";
    }

}

function listArrayItems(array $array){
    if (is_array($array)) {
        if (count($array) > 0) {
            foreach ($array as $item) {
                echo $item . "<br>";
            }
        } else {
            echo "No items to print!";
        }
    } else {
        echo "Invalid items!";
    }
}

$quantity = $_POST['h'];
$price = $_POST['i'];

echo calculateTotal($price, $quantity);

checkQuantity($price, $quantity);

Significantly better than before, isn't it? But there are 2 more things to do

If-else maze

Code looks fine, but we can make it even cleaner.

Have a look at checkQuantity()

function checkQuantity(int $price, int $quantity){
    if ($quantity > 0) {
        if ($quantity < 10) {
            echo calculateTotal($price, $quantity);
        } else {
            echo "Quantity is greater than or equal to 10!";
        }    
    }else {
        echo "Invalid quantity!";
    }

}

We can re-write it by changing if-else's conditions - I call it negative statements

So, instead of checking if $quantity is greater than 0, we check if it's less than 0 and finish this function when condition is met

Like this

function checkQuantity(int $price, int $quantity){
    if ($quantity <= 0) {
        echo "Invalid quantity!";
        return 0;
    }

    if ($quantity < 10) {
        echo calculateTotal($price, $quantity);
    } else {
        echo "Quantity is greater than or equal to 10!";
    }    

}

Much finer - now focus on listArrayItems()

function listArrayItems(array $array){
    if (is_array($array)) {
        if (count($array) > 0) {
            foreach ($array as $item) {
                echo $item . "<br>";
            }
        } else {
            echo "No items to print!";
        }
    } else {
        echo "Invalid items!";
    }
}

We also see here nested statements - quick fix?

function listArrayItems(array $array){
    if (!is_array($array)) {
        echo "Invalid items!";
        return 0;
    }

    if (count($array) < 0) {
        echo "No items to print!";
    }

    foreach ($array as $item) {
        echo $item . "<br>";
    }
}

Much better now - what does our code look like?

<?php

function calculateTotal(int $price, int $quantity){
    $total = $price * $quantity;

    if ($total > 100) {
        return "Total is greater than 100!";
    } else {
        return "Total is less than or equal to 100!";
    }
}

function checkQuantity(int $price, int $quantity){
    if ($quantity <= 0) {
        echo "Invalid quantity!";
        return 0;
    }

    if ($quantity < 10) {
        echo calculateTotal($price, $quantity);
    } else {
        echo "Quantity is greater than or equal to 10!";
    }    

}

function listArrayItems(array $array){
    if (!is_array($array)) {
        echo "Invalid items!";
        return 0;
    }

    if (count($array) < 0) {
        echo "No items to print!";
    }

    foreach ($array as $item) {
        echo $item . "<br>";
    }
}

$quantity = $_POST['h'];
$price = $_POST['i'];

echo calculateTotal($price, $quantity);

checkQuantity($price, $quantity);

Amazing! There's no comparison between refactored code and dirty one.
That's the codebase you'd wish to work with

We can theoretically end here, but I have one extra stage for you.

Additional step: Modularization pt.2

What if we want to use listArrayItems() in some random file - but we don't need whole cart handling

We can always move those functions to another file - and then include in everywhere needed

I've created one called cartModules.php with all functions inside

<?php 

function calculateTotal(int $price, int $quantity){
    $total = $price * $quantity;

    if ($total > 100) {
        return "Total is greater than 100!";
    } else {
        return "Total is less than or equal to 100!";
    }
}

function checkQuantity(int $price, int $quantity){
    if ($quantity <= 0) {
        echo "Invalid quantity!";
        return 0;
    }

    if ($quantity < 10) {
        echo calculateTotal($price, $quantity);
    } else {
        echo "Quantity is greater than or equal to 10!";
    }    

}

function listArrayItems(array $array){
    if (!is_array($array)) {
        echo "Invalid items!";
        return 0;
    }

    if (count($array) < 0) {
        echo "No items to print!";
    }

    foreach ($array as $item) {
        echo $item . "<br>";
    }
}

And then, included it

<?php

require "cartFunctions.php";

$quantity = $_POST['h'];
$price = $_POST['i'];

echo calculateTotal($price, $quantity);

checkQuantity($price, $quantity);

Now I can finally say - That's it

TL:DR - best practices in bullet points

Give meaningful names to your variables
Split code into functions, classes or namespaces
DRY
KISS
Avoid nesting if-else statements - one layer of depth is enough. Two can slide, but three or more requires immediate code review
Split your functions into reusable modules - and give them meaningful names too

Conclusion

Just got the idea, so I wrote this article - hope you enjoyed it and learned something

These are the basics - but with practice comes experience, so congrats. You have made the first step to make your scripts better

But maybe, you are a pro in code review? Do you think there is something missing? Share your intriguing stories and personal practices in comments.

By the way check out my blog. I'm going to continue my PHP course there and create some awesome projects + there will be articles not published on dev.to

Also, check out this same article there

Code will be available on Github both clean, and messy

Again, I hope you've enjoyed it. Share your feedback, stories or ideas in comments and see you next time

PHP 0 to hero pt.15 - OOP coding

Mateusz Jasiński — Thu, 22 Feb 2024 21:22:10 +0000

Hi there! Welcome back to another exciting part of our PHP journey. Today, we're delving into the captivating world of object-oriented programming (OOP). If you've just stumbled upon this article and OOP is a bit of a mystery to you, fear not! Check out the previous part where I provided a comprehensive explanation of how OOP works.

Now, let's focus on today's grand adventure, where we'll cover:

Declaring classes and naming conventions
Properties and methods with encapsulation
How to declare constructors
Inheritance

As an illustrative example, we'll create a class for handling database connections in PHP. So, buckle up, and let's get started!

Classes

To create a class, we use the class keyword:

class ClassName {

}

Ever wondered why a class name starts with a capital letter? It's the StudlyCaps convention, and it's the PSR naming convention for classes. So, remember, class names always start with a capital letter.

Now, let's dive into the details.

Properties and Methods

I've covered these concepts theoretically in the previous part, so if you missed it, take a moment to catch up.

For the sake of readability, when creating a class, it's common practice to first declare properties and then methods. The first method declared should be the constructor, and the last should be the destructor.

Now, let's start creating our DB connection class. Create a file called db-class.php and declare the class DatabaseHandler:

class DatabaseHandler {
}

Properties

Now, let's declare the properties. We need DSN, database user, and database password:

private $db_dsn;
private $db_user;
private $db_pass;
protected $db_conn;

Since we don't need to access these data from outside of this class, we've made them private. $db_conn is protected, as it might be useful later.

Our class now looks like this:

class DatabaseHandler {
    private $db_dsn;
    private $db_user;
    private $db_pass;
    protected $db_conn;
}

Methods

Why create a database handler if it can't handle database connections? Let's fix that. We'll start with a constructor. To declare it, we create a function called __construct:

public function __construct($dsn, $username, $password) {

}

Now, let's add some content to our constructor:

public function __construct($dsn, $username, $password) {
    $this->db_dsn = $dsn;
    $this->db_user = $username;
    $this->db_pass = $password;
    $this->db_conn = new PDO($dsn, $username, $password);
}

That's what the constructor is for – initializing the class. And what's this mysterious $this? It's a reference to the current object.

Now, with the help of this, this, this, and this article, I challenge you to write a method that executes SQL queries and returns their results as associative arrays. In the next article, I'll share my solution with comments on how it works.

That's it! Our class is ready:

class DatabaseHandler {
    private $db_dsn;
    private $db_user;
    private $db_pass;
    protected $db_conn;

    public function __construct($dsn, $username, $password) {
        $this->db_dsn = $dsn;
        $this->db_user = $username;
        $this->db_pass = $password;
        $this->db_conn = new PDO($dsn, $username, $password);
    }

    // Place for your method
}

Inheritance

Now, let's shift our focus to inheritance. In the example below, we'll use the same analogy as last time, but let's focus on the code rather than theory:

<?php

class Person {
    public $name;
    protected $age;
    private $phone;

    public function talk() {
        // Do stuff here
    }

    protected function walk() {
        // Do stuff here
    }

    private function swim() {
        // Do stuff here
    }
}

class Tom extends Person {
    // Tom class extends Person class
    // Tom inherits all public and protected members from Person

    // So class Tom will have these properties and methods:
    // public $name;
    // protected $age;
    // public function talk(){}
    // protected function walk(){}

    // But it will not inherit the private members
    // This is what object inheritance means
}

Notice this line:

class Tom extends Person

To create a child class, we use the extends keyword. The recipe for a child class is:

class ChildName extends ParentName

And there you have it! The world of PHP OOP is full of exciting possibilities. Dive in and experiment

Conclusion

To be fair, I thought I won't finish this article on time - but there it is!

Check out my blog and other articles there
See you next time

PHP 0 to hero pt.14 - OOP Introduction

Mateusz Jasiński — Thu, 15 Feb 2024 15:00:00 +0000

Welcome again - we'll be starting a totally new topic now

This article is purely theoretical - I want to familiarize you with OOP and it's basic principles

So, what will we learn today?

What is OOP
Basic concepts - like class, object, method, attribute etc.
Encapsulation
Inheritance

Sound complicated? It will be fine, don't worry

So - let's go

What is OOP?

OOP stands for Object Oriented Programming - that's a really common principle in modern coding
It's base is a concept of an object - data structure containing both variables and functions?

Do you remember connecting to the database? That's where we created objects - and then we used it's functions
These functions are called methods - remember that term, as I'll use it often
Variables stored inside objects are called attributes

But how can we create object? Using classes
Class is a recipe for an object. It contains everything. attributes, constants, methods.

class someClass {
    // all of the content here
}

There are 2 really special methods constructor and destructor

Constructor is a method, executed while creating an object. So calling like this:

$db = new PDO([...]);

Invokes a constructor - we can do whatever we want to with this method. I use it to assign values to attributes and log information about it.

But destructor is the opposite of constructor (like name says). - It is executed, when object is destroyed. So mostly in the end.
In lower-level languages such as C++ destructors where used to deallocate memory and just cleaning in general. Luckily working with addresses is not our job in PHP - so we can use it for logging purpose or just don't use it at all

Encapsulation

Here, I'll use another analogy. Let's treat class as a mafia family.

They have some assets, like cars, houses, stocks etc. But they don't want some of them, to be known for others.

That's why they hide them. Set up fake bank accounts, transfer money, hide cars in garages all around the world and so on.

And that's what encapsulation is all about - we make assets (attributes or methods in our case) visible only for specified group. So friend classes, everyone or no one.

We have 3 basic clauses

public - Make it available for everyone. Other classes, other instances external code etc.
private - Hide it, it's visible only inside your class. We don't want to share it.
protected - only inheriting classes can access this (So in our analogy - children of mafia boss)

We add it before declaration of method/attribute inside class

public $var;

private function privateFunction(){ /* more code here */}

But, I've told something about inheritance - what is it?

Inheritance

I wont' be explaining too much here, as I found (in my opinion) the best explanation for this concept in comments of PHP docs

So thank you Mohammad Istanbouly for this piece of explanation

<?php

class Person
{
    public $name;
    protected $age;
    private $phone;

    public function talk(){
        //Do stuff here
    }

    protected function walk(){
        //Do stuff here
    }

    private function swim(){
        //Do stuff here
    }
}

class Tom extends Person
{
    /*Since Tom class extends Person class this means 
        that class Tom is a child class and class person is 
        the parent class and child class will inherit all public 
        and protected members(properties and methods) from
        the parent class*/

     /*So class Tom will have these properties and methods*/

     //public $name;
     //protected $age;
     //public function talk(){}
     //protected function walk(){}

     //but it will not inherit the private members 
     //this is all what Object inheritance means
}

Conclusion

I hope this article explained a lot about OOP - I have shown you some code and we'll focus on writing next week.

Share your feedback in the comments, check out my blog and this article about hashing and see you soon

Why is hashing passwords important?

Mateusz Jasiński — Thu, 08 Feb 2024 22:25:41 +0000

Passwords accompany us on regular basis.

You know, every day we have to use them. If not them, some of substitutes ex. physical keys like Yubikey.

Even though code security is frequently mentioned - we still hear about recent breaches/hacks and new vulnerabilities are disclosed on weekly (if not daily) basis.

Most of web breaches work pretty simple - some endpoint was not sanitizing passed data properly, it lead to some code execution and then attacker somehow read whole database and it's now for sale on the dark web for $1000.

But, what failed? How did the attacker extract data? Can we protect ourselves?

Today, we will talk about securing passwords itself - and there is one really useful technique

I'll tell you how it works,

What is hashing?

Hashing is a form of converting data. Then, we end up with fixed-size output corresponding to passed data.

It's a mathematical term, but crucial in IT security.

The vital part of hashing is it's irreversibility - Data once hashed, can't be deciphered unless we use more black-hat techniques (cracking for example)

If we want to hash hello using SHA-256 algorithm it, we end up with something like this

2CF24DBA5FB0A30E26E83B2AC5B9E29E1B161E5C1FA7425E73043362938B9824

And even if we added another thousand random letters - result would also be ideally 64 characters long.

last important thing - salt

Salting passwords

Just like you salt your meals to make them tastier - you salt your passwords but to be more secure

What is a salt? It's a random chunk of bytes added to the string, before hashing - so cracking it is harder

I assume that you know that passwords strength is based off on their length and randomness. It's definitely easier to guess

hello

Than

Kj8%'!kn)-~Yv*b4hello

And that string - Kj8%'!kn)-~Yv*b4 - is a salt

We should always add those type of strings to passwords - yet here are some general rules to follow

Salt has to be random - Always
- Don't reuse salts for multiple users
- Don't use usernames as salts
- Don't set one salt for every password
To generate it use cryptographically secure generator - so the salt can't be guessed easily.

Now, why do we need it?

Why do we need hashes?

Time to answer that question - Why should you use hashing?

I'll sum this up in bullet points

It adds another layer of security - Now, even if attacker gains access to the database, they need to spend time (and resources) to crack those hashes. Which might make a hack unprofitable
Prevents from privacy violation - Let's be real, most of people reuse passwords.
We are humans too and might have some personal affairs, better or worse. If an employee can have access to someone's password, they can (and maybe will) try it somewhere (like facebook or instagram). And if the password is reused - you know what might happen next.

We as creators don't want to be responsible any for these - so hash your passwords. That's how we can prevent those situations from happening

Hashing algorithms

Bold of you to assume, that there is only one algorithm - There are THOUSANDS of them. Some are less, some more secure.

According to OWASP the best password hash is Argon2id

Why? As it provides a great defense against both GPU-based (so, to simplify guessing) and side-channel (exploiting flaws in algorithm implementation) attacks

But it can't be applied everywhere - so we need to look for something else

Then OWASP suggests scrypt as backup option - Comparing to Argon2id

These configuration settings provide an equal level of defense [in comparison with Argon2id]. The only difference is a trade off between CPU and RAM usage.

There are also 2 other ones to remember

bcrypt - is meant to be utilized, when we interact with legacy systems. It has it's flaws, such as limiting input to 72 bytes so if possible, use either Argon2id or scrypt

Legacy hashing algorithms

Of course, except for the ones mentioned - there are older algorithms such as md5 or sha-1.
But they shouldn't be used - NEVER

With modern technology we can pretty easily brute-force them.

Every algorithm will one day become outdated - stay alerted and read about new hashes, so your data will always be secure

Conclusion

As developers, we should treat security seriously. Don't overlook it, as simple breach can tear apart company's reputation and make you pay enormous fines

I hope this article was useful, share your feedback down below
Check out other articles such as

And just follow my blog in general. If you want me to write about something, share it. I'll gladly publish a post, especially for you

Stay safe and well informed.
See you next time

PHP 0 to hero pt.13 - functions, include and require - PHP modules

Mateusz Jasiński — Thu, 08 Feb 2024 15:00:00 +0000

Welcome - It's 13th part of this course

Today, we will get to something chill and easy - so we can rest a little after previous 4 parts of - I need to admit this - intensive work

We'll focus on creating clean code and dividing it into modules

So, what will we talk about today?

What are functions and how to declare them
How to get code from another file
Advise on splitting code into modules
include vs require - what's the difference
Why do we sometimes add _once to both include and require

With this said - let's board and start this amazing journey

Functions

Let's say, we are writing a game and sometimes our character dies - so we need to code the death of it

Will we create a piece of code and then copy it around? Hell no, that's a violation of DRY principle ("Don't repeat yourself")

And if we wanted to change something? And there'd be 5000 of those death moments - have mercy for yourself

That's why we have functions - right now we will only create one piece of code and put it in a function.

Then, when we need it - just call the function

protagnist_death();

How do we declare them?

Declarating functions

We declare them in blocks - using function keyword

Let's say we we need to validate a password - is it at least 8 characters, doesn't it contain username etc.

So - start with the function.

function validatePassword($password){

}

As you see, we specify that this is a function
Then declarate it's name
And open brackets for arguments

Basically it's good practice to pass every required variable as an argument - so we operate only on them or also on variables declarated inside the function

Here we only have one but we can always add more

function validatePassword($password, $minLength, $username)

and so on, you add arguments after the commas (,) - as much as you want (and need)

Finish our function - let's do the second variant

function validatePassword($password, $minLength, $username){
    if(!is_numeric($minLength))
        return "Length must be a number";

    if(strlen($password) < $minLength)
        return "Password is too short";

    if(strpos($password, $username) !== false)
        return "Password can't contain username";

    return "Password correct";
}

As you see, I hadn't wrote curly brackets in if statements - that's just a shorter form of it.

If you write one line, you don't have to create a big block - just indicate that return is meant to execute after condition is met and that's it

And what's that return? It's basically what will remain after the execution (If you understand that concept from maths - it's like y)

So, let's now write a program that will use this function

$username_g = "test1";
$password_g = "tes12345";
$length = 8;

echo validatePassword($password_g, $length, $username_g);

// Password correct

As you see, we call a function and pass our arguments - it then returns us the result

So, with that declarated variables - the interpreter will see this

$username_g = "test1";
$password_g = "tes12345";
$length = 8;

echo "Password correct";

And that's exactly what we have written in last return case

You can test this code with multiple data, but let's now jump to another thing

Including files in PHP code

We have a lot of files, that connect to the database - but we always need to pass there credentials. And what if they change?

We'll have to get through all of the files and change there data? This sound horrifying

That's why, we create a file called config.php where we store all database info

<?php
$db_dsn = "OUR DSN";
$db_user = "root";
$db_pass = "";

Now we can add it, but how? With function called require or another one called include

So, we connect to the database

<?php
require "config.php";
$db = new PDO($db_dsn, $db_user, $db_pass);
// [...] Some code

We can also use include

<?php
include "config.php";
$db = new PDO($db_dsn, $db_user, $db_pass);
// [...] Some code

And the interpreter, sees this

<?php
$db_dsn = "OUR DSN";
$db_user = "root";
$db_pass = "";

$db = new PDO($db_dsn, $db_user, $db_pass);
// [...] Some code

Useful, isn't it?

But, is there any real difference between include and require? Yes, there is

`include` vs `require`

There is one very big difference between them - error reporting

Let's say, we want to include file called header.php

There is one problem - that file does not exist.
So, when we run include like this

include "header.php";

It will just throw a warning (E_WARNING) and that's it - script continues like nothing happened

But, if we use require instead

require "header.php";

Our script will crash and throw a fatal error (E_COMPILE_ERROR).

So, when we have some crucial mechanisms - use require
If site will work fine without it, or could just display an error - use include

Now, the last thing about those statements

What does appending `_once` do?

require and include are not the only options. We can append _once - and get require_once and include_once

They are used exactly the same and have the same differences - but how they differ from require and include?

If you happen to have some code, that might include the same file twice, using *_once variant will include it only once

So, if we included something twice - like here

require_once "config.php";
// [...] Some code [...]
require_once "config.php"

The interpreter would only see

$db_dsn = "OUR DSN";
$db_user = "root";
$db_pass = "";

// [...] Some code [...]

Without redeclarating variables in the code

Which one is the best?

Right now, If you write clean code, it doesn't matter which one you use.

Personally - I mostly utilize require_once. But that's more of a habit.

So, choice is yours!

Conclusion

Another part finished - hope you liked it

By the way if you have some ideas for articles, share them in comments. I'll try to write about all of them.

That's it - check out other articles and my blog in general

See you next time

PHP 0 to hero pt.11 - Integrating SQL with PHP (SQL pt.3)

Mateusz Jasiński — Thu, 01 Feb 2024 15:00:00 +0000

Hi and hello

Welcome in part 11 of this course - Today we will test our knowledge from 2 previous parts and add something new.
What would it be? We'll be writing login script but in 2 ways. More about later

So, what will we learn today?

How to use mysqli both in procedural and object-oriented way
How to use some other database managements systems
What is PDO - why and how to use it
What's SQL injection and how to defend our app against it
What are prepared statements and how they are superior to other methods

Kind a lot of it - and we will write the same functionality 2 times

So prepare yourself for a bit of reading
I'd divide this into 2 articles - both will be here and on my blog and I'll try to publish them at the same time

Login mechanism

Before we start writing - we should have some plan. How will our code even work?

I have some ideas - here they are

First - save both username and password to variables and sanitize them
Then execute a query that checks if passed username is in our table
- If there is no user like that, redirect to the login page with message Invalid username or password
- If there is a user - continue a script
Using password_verify function check if passwords match
- If yes, set isLoged session variable to true and redirect to the secret page
- If not, redirect to the login page with message Invalid username or password

Why do we display the same messages? Purely for security reasons
That's how we hide from attacker contents of our database - even though username is valid potential hacker won't see it, as both messages are the same

So, it's high time to start coding

Form template

I won't be spending here too much time - this will be simple form with 2 inputs and a button

<?php session_start(); ?>
<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>Log in</title>
</head>
<body>
    <h1>Log in</h1>
    <form action="login.php" method = "POST">
        <input type="text" name = "username" placeholder="username"><br/><br/>
        <input type="password" name="password" placeholder="password"><br/><br/>
        <button type="submit">Log in</button>
        <?php 
            if(isset($_SESSION['error'])){
                echo $_SESSION['error'];
                unset($_SESSION['error']);
            }
        ?>
    </form>

</body>
</html>

I've also added php code for displaying eventual errors - it works like this:

Check if $_SESSION['error'] is set
Display it
Unset it - So it won't be here after refreshing the page

I'll skip styling - you can do it yourself and let's now focus on actual login - but first

Ways of connecting to database from PHP

So, there is no one way?

No, there is no one way. We have at least 3

Via procedural interface of DBMS
Via object-oriented interface of DBMS
Using PDO

Using DBMS's interface

What do all of those geeky-sounding terms even it mean?

Procedural means using functions
Object-oriented means using objects
Right now, I won't be diving into details of OOP (Object-oriented programming) - this will be later

Right now, let's simplify object to this definition

Object - data structure containing both functions and variables

Let's see the comparison - here with MySQL

That's how the procedural version looks like

$mysqli = mysqli_connect("example.com", "user", "password", "database");

$result = mysqli_query($mysqli, "SELECT `username` FROM `users`");
$row = mysqli_fetch_assoc($result);
echo $row['users'];

As you see - first we call a function called mysqli_connect and save it's result to $mysqli variable. It creates connection between our code and database
Then with mysqli_query we execute our query and save it's results to $result
After all we use mysqli_fetch_assoc to fetch one row of data from $result and assign it to $row

See how in mysqli_query we have to pass $mysqli as parameter to the function

Now let's see the same thing - but this time object-oriented

$mysqli = new mysqli("example.com", "user", "password", "database");

$result = $mysqli->query("SELECT `username` FROM `users`");
$row = $result->fetch_assoc();
echo $row['users'];

It's doing absolutely the same thing

Creates mysqli object inside $mysqli
Runs query using function from the object - then saves result to $result
Fetches data from $result to the $row array

But look, how while executing query it doesn't take $mysqli as parameter - why is that?
Because while creating $mysqli object it "saves" data inside it, so when function is called it can take that data from the object itself - no need to pass additional parameters

-> calls a functions from inside the object - basic syntax looks like this

$object->function(params);

Both forms are valid - use whichever one you prefer
I find object-oriented way better than procedural, so I'll write in this style

With this said - let's write our login script

Writing login script

So, before we even start with writing Database connection - we have to do 2 more things

Check if we got the request
Save values from $_POST to variables
Validate and sanitize them

You should be familiar with those, at this point - If not, check out parts 7 and 8 and then come back here

Also, start a session - if you know nothing about them check out part 5 of this course

<?php
session_start();
if(empty($_POST['username'])){
    $_SESSION['error'] = "No username specified";
    header("Location: index.php");
    die();
}

if(empty($_POST['password'])){
    $_SESSION['error'] = "No password specified";
    header("Location: index.php");
    die();
}


$username_s = htmlentities($_POST['username'], ENT_QUOTES, "UTF-8");
$password_s = htmlentities($_POST['password'], ENT_QUOTES, "UTF-8");

Also empty() function returns true if passed variable is empty - and we don't want empty username or password do we?

With this said - let's start with database connection

$db = new mysqli("localhost", "root", "", "firstproject");

As we see, creating new mysqli object takes 4 arguments

Host - where is your database located (URL/Address)
Username - database username. If you installed MySQL and PHPMyAdmin manually, these credentials will differ - so you need to put your valid ones
Pasword - password for database user - in XAMPP root has no password
Database name - here it's firstproject because that's how we named our table 2 parts ago

Is everything working? If not, just show the error, and terminate execution

if($db->connect_errno != 0){
    $_SESSION['error'] =  "Error in database connection";
    header("Location: index.php");
    die();
}

(Personally, I love this name of the last function. It ideally pictures what it does - terminate further code execution)

First, let's maybe check the if username even exists - so let's write the query

$sql = "SELECT * FROM `users` WHERE `username` = ?";

Why do we have that ? there? Because we will be using prepared statements. And it indicates, where to place passed values

That's the safest and the best way of executing SQL queries in PHP
It secures our code from possible attacks such as SQLi. But what's that?

What is SQL Injection (SQLi)

To make it as short as possible - SQL injection that allows user to change SQL queries and in consequence gain access to vulnerable data (Like personal identifiable information - PII or passwords)

It occurs when PHP treats user-passed data as valid SQL. So when?

Let's say an attacker tries to compromise our website, so instead of normal username sends ' OR 1=1-- and password consists of some random characters

Then, if we added it to query like this

$sql = "SELECT * FROM `users` WHERE `username` ='".$username."'";

We end up with this query

SELECT * FROM `users` WHERE `username` ='' OR 1=1 --'

It always returns true, so we will gain access to the first account in database - and that's often admin account

With properly implemented authentication this should not happen, but this is very dangerous vulnerability, especially in places that return data to the users (like showing tasks on our website)

That's it from cybersec point of view - if you want to learn more, check out this module from Portswigger and let's come back to writing

Prepared statements - executing query

First - create a statement

$stmt = $db->prepare($sql);

Then, pass the username and execute the query

$stmt->bind_param("s", $username_s);
$stmt->execute();

using bind_param() function we substitute that question mark with value from $username_s

First parameter is a string of types - here I passed s, as we have only one parameter with type string. But there are also numerical types

i - int
d - double

Example from the docs shows it perfectly


$stmt = $mysqli->prepare("INSERT INTO CountryLanguage VALUES (?, ?, ?, ?)");
$stmt->bind_param('sssd', $code, $language, $official, $percent);

$code = 'DEU';
$language = 'Bavarian';
$official = "F";
$percent = 11.2;

$stmt->execute();

We have to check if we got something and get results of that query

$result = $stmt->get_result();
if($result->num_rows < 1){
    $_SESSION['error'] =  "invalid username or password ";
    header("Location: index.php");
    die();
}
$row = $result->fetch_assoc();

num_rows is a variable inside $result that stores integer representing how much rows were returned

Now in $row we have beautiful associative array with id, username and password

Validation

Now we need only to validate if the password matches the hash

if(!password_verify($password_s, $row['password'])){
    $_SESSION['error'] =  "invalid username or password ";
    header("Location: index.php");
    die();
}

If it does - close the connection, set isLoged variable and redirect to the secret page

$db->close();
$_SESSION['isLoged'] = true;
header("Location: secret.php");

With this variable we'll ensure, that only authenticated users will have access to secret page

Create secret.php and inside it check if isLoged is set

<?php 
session_start(); 
if(!isset($_SESSION['isLoged'])){
    header("Location: index.php");
}
?>

Then, I created a simple HTML webpage

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>Document</title>
</head>
<body>
    Welcome - you have successfully logged in
</body>
</html>

And that's it - you've created a login script.

Conclusion

That's the first half of this article - As I said before, I decided to split it into 2 parts, because

One part would be too long
This would be too much new knowledge for one article

Second half will be posted soon - both here and on my blog
I hope you enjoyed this article, and learned something new

Code from this part is available on my github and

By the way, If you want to have earlier access to my new articles, follow my blog

That's it - check out my other articles too and see you in next ones

PHP 0 to hero pt.12 - Using PDO (SQL pt.4 )

Mateusz Jasiński — Thu, 01 Feb 2024 15:00:00 +0000

Welcome again - today we continue our journey with using SQL databases in PHP

Today I'll show you pre-installed extension to PHP called PDO

It's (in my opinion) better way to connect to the database
So what will we learn today?

What is PDO
Why should you use it
A little bit about exceptions and their handling

And as I said in the previous part - we'll create the login script again - but today with PDO.

So, with this said - let's go!

What is PDO and why should you use it

To make it short and clear.
It's an interface for accessing databases in PHP. Unlike mysqli or pg, that are meant to be used with specific DBMS, PDO works with every more popular one.

So, no matter if we use MySQL, PostgreSQL or Oracle - the code is exactly the same in every single one.
That's the biggest benefit - we don't have to re-write the entire codebase just to migrate from ex. MySQL to PostgreSQL. We just change a few settings and we are good to go

Another thing are the exceptions - with native interfaces we have to detect that something it wrong and then throw excepition
But PDO does it on it's own - our role is to catch, and handle it

But, what are those exceptions?

Quick intro to exceptions

This won't be long - for more info and deeper understanding I encourage you to check out this article purely about them

Exceptions are built-in mechanism that allows us to perfectly deal with every possible error, that might occur

For example it we write a calculator and somehow value passed as divisor is equal to 0, instead of dividing and crashing the whole website - code just throws an exception and another block handles it in the way we want to

// Let's say somewhere before we declarated variable called $divider

try{
    $dividedValue = $val/$divider;
    // Rest of the code...
}catch(DivisionByZeroError $e){
    echo "Warning. Division by zero - execution terminated";
    die();
}

// OR
try{
    if($divider == 0){
        throw new DivisionByZeroError();
    }
    // Rest of the code...
}catch(DivisionByZeroError $e){
    echo "Warning. Division by zero - execution terminated";
    die();
}

This snippets do exactly what we talked about

Again - to learn more, check out linked article and now let's write our login script in PDO

Writing login script

The only thing that is different is DB connection - we can copy the rest

Copy index.php, secret.php and this from login.php

<?php
session_start();

if(empty($_POST['username'])){
    $_SESSION['error'] = "No username specified";
    header("Location: index.php");
    die();
}

if(empty($_POST['password'])){
    $_SESSION['error'] = "No password specified";
    header("Location: index.php");
    die();
}

$username_s = htmlentities($_POST['username'], ENT_QUOTES, "UTF-8");
$password_s = htmlentities($_POST['password'], ENT_QUOTES, "UTF-8");

try{
   // rest of the code
}catch(PDOException $e){
    $_SESSION['error'] =  "Server error - ".$e;
    header("Location: index.php");
}

I've also added try-catch block for eventual errors and exceptions
Right now, we want message displayed. On typical (production) server it should never happen - for security reasons

We'll write rest of the code in place of comment - so inside try block

With this said let's start coding

Creating DB connection

First - create DB connection. But today with PDO

$db = new PDO("mysql:host=localhost;dbname=firstproject", "root", "");

You see, instead of 4 it takes only 3 arguments - but the first one looks strange - let's analyze it

This is DSN (Data source name) - that's a fancy name for a data structure (here string) that contains info necessary for PDO to connect to database
(To be more specific, it's needed for ODBC driver - the actual API for DB connection, which is used by PDO)

So let's see what contains this string -mysql:host=localhost;dbname=firstproject
I'll divide it into 3 parts

mysql: - indicated used DBMS
host=localhost; - Where is database located
dbname=firstproject - database name

There are more of those declarations - you can check them here

These are the only necessary ones for us - I hadn't specify port. We don't need it, as XAMPP (and your manual installation) uses default one - 3306 if you want to know

Right now, we don't need to check errno inside PDO, as if something goes wrong - PDO will automatically throw an exception
Comfy, isn't it

Executing query

First - write the query (or copy it - as it's the same one)

$sql = "SELECT * FROM `users` WHERE `username` = ?";

We use prepared statements again - so let's write it

Start with preparing the query

    $stmt = $db->prepare($sql);

Then let's execute it

    $stmt->execute([$username_s]);

But hold on a second - don't we have to bind the parameters?

Actually, we do - but not like before. Let's have a look at previously called function

As you see, we pass as it's parameter $username_s - so we do bind that parameters, but in execute(), not with bindParam()

And why it's in square brackets? Because, execute() only takes one parameter - and it's an array of arguments

Wrapping $username_s in square brackets we create an array with only one element - username

But if our query required more parameters - we can add something to it, like this:

$query->execute([$arg1, $arg2, $arg3]);

(that's just example - not our code element)

Of course, there is a function in PDO such as bindParam, and we can do regular binding

In this case - I'd look like this

$stmt->bindParam(1, $username_s, PDO::PARAM_STR);

First parameter means to which ? should this be bind
Second is actual value
And third - type of an argument, but using PDO constants. You can check their list here

Obtaining results

So now, we have something left

Check if we got something returned by query
Check if passwords match

First - we should get the results

    $results = $stmt->fetch(PDO::FETCH_ASSOC);

This function (fetch) will get us 1 resuls from the query in a format specified as an argument

And an argument is another PDO constant - here I've chosen associative array. But it can be

PDO::FETCH_NUM - an array indexed with numbers, not column names
PDO::FETCH_OBJ - and object with variables inside, named correspondingly to column names
PDO::FETCH_ASSOC - an associative array.

Now, let's check if we even got something

    if(!$results){
        $_SESSION['error'] =  "invalid username or password ";
        header("Location: index.php");
        die();
    }

We do we negate an array? It's not an expression.

Yeah, in some way it it.
Every value - no matter what type - has it's boolean value.
For 0 and empty - it's false
For not 0 - it's true

So when we negate the array - interpreter "thinks" something like this

So, we need to get boolean value of $results - 0 for empty, 1 for not empty. Then, I negate it. So when $results' value is 0 - if statement is true.

With this checked - let's look at the password

    if(!password_verify($password_s, $results['password'])){
        $_SESSION['error'] =  "invalid username or password ";
        header("Location: index.php");
        die();
    }

I think you saw it - I just copied the previous one changing $row to $result

With this checked - we can redirect user to the secret page

$_SESSION['isLoged'] = true;
header("Location: secret.php");

Does it work? - It works

And that's it - we finished this script

Conclusion

Thanks for reading - I hope you enjoyed it.
To be fair, I thought this article will be published somewhere on Sunday/Monday but I managed to finish it on time - so you see both of those at the same time

Whole code is available on my Github - today I also included the dump from database we created a while ago

You can import it using import functionality in PHPMyAdmin

And that's it - share your feedback in the comments. Also remember to regularly check my blog so you have access to my articles earlier. And not only to programming-based ones

See you in next articles

PHP 0 to hero pt.10 - SQL basics

Mateusz Jasiński — Thu, 25 Jan 2024 15:00:00 +0000

When we have SQL database ready - let's start learning language itself

SQL, as I said, stands for Structured Query Language

It looks a bit like a sentence in English

Now, we need to learn actual syntax and how to send those syntax

So, what do we do today?

What is query and how to execute them in phpMyAdmin
Different query types and their syntax

Let's go

Running queries

Before everything - what is query?

Query is a "sentence" in SQL, that tells database to interact (Get, edit, delete) with records.

You will see a lot of examples of them today

But, how do we execute that query in phpMyAdmin?

When we select table there is a little box above records:

When we click Edit or Edit inline we can run our own queries on the table

When we know, how to execute that query - let's learn some basic ones

Queries

Don't get shocked - it's a best and very common practice to write SQL keywords in uppercase (with caps lock)

So, when we write query

values defined by us, like table/column names - lowercase
SQL keywords (stuff built-in language) - uppercase

When we choose the table, this one query is executed.

SELECT * FROM `users`;

What is it?

`SELECT`

SELECT allows us to get every row that meets specific conditions

For example: we want to select value from table users from columns named id and username where email value equals test@test.com
Then, we'd write query like this

SELECT `id`, `username` FROM `users` WHERE `email` = "test@test.com"

Remember - conditions can be stacked using AND keyword

SELECT `id`, `username` FROM `users` WHERE `email` = "test@test.com" AND `password` = "Some hashed Password"

You can place as many AND as you want

So, formula for SELECT query looks like this

SELECT [Columns] FROM [table] WHERE [conditions]

If we want to select values from every column for each record we use * symbol

SELECT * FROM `users` WHERE `email` = "test@test.com"

That's pretty much it - we'll get used to it when we'll be actually working with SQL

`INSERT`

Let's say we want to add some record to the table - that's what INSERT is for

So, to add a new user to our users table, just run

INSERT INTO `users` VALUES(NULL, "user1", "$2y$10$7uKWbeYe7X/oZyQT/fxxfOp8ichcShxejqSXAOSYbMFiNCwkpe70.")

Last value is bcrypt hash of test123 string

Try it - click Edit or Edit inline (eventually SQL in top nav) and paste that query

After execution, we should see one record

Why is first value NULL? That's why we set up Auto increment for this column - now when we pass null it replaces it with numerical value of previous record and adds 1

So, if we run this query couple of times - then we get ids equal to 2, 3, 4 and so on

Here is the formula for INSERT query

INSERT INTO [table] VALUES([Values separated by comma])

Where number of values passed has to match number of columns

`DELETE` query

Our user doesn't really like his new task - he want to get rid of it

That's where DELETE comes in handy.

With this task - let's see a quick example

DELETE FROM `tasks` WHERE `task_id` = 1

1 here is just an example - in reality it would be value passed by PHP

Whole "recipe" for this query looks like this

DELETE FROM [table] WHERE [conditions]

`UPDATE` query

But if a user made a typo in it's title? Will we get whole contents of that record, then delete it and insert new?

That's additional 3 queries. Multiplied by 1 million users it gives us 3 million queries - too much

That's why we have UPDATE

UPDATE `tasks` SET `title` = "Something new" WHERE `task_id` = 1

It will set title to Something new in record with task_id equal to 1 from tasks table

And basic syntax looks like this

UPDATE [table] SET [updated values] WHERE [conditions]

Dangers in `UPDATE` and `DELETE`

While working with DELETE and UPDATE we need to be sure, that WHERE conditions are valid - otherwise we might wake up with whole table looking identical or with no table at all

Unless we are specifically sure, that we want to update every record in table or delete whole content of the table, don't forget WHERE clause

Order of results

So, we have a bunch of posts but if we want to show them - it will display the oldest ones first (as that's the order in database)

Do we have to reverse that table in PHP itself? No - just use ORDER BY

For example with tasks

SELECT * FROM `tasks` WHERE `creator` = "johnny" ORDER BY `task_id` DESC

DESC will order the results alphabetically reversed (So here, from the greatest to lowest id)

And just ORDER BY (or ORDER BY [column] ASC) will return results in alphabetical order

`LIKE` keyword

SQL LIKE keyword allows us to search for specific pattern in column

So, I'll give an example

Let's say we create a shop and we have a database of cities

We want to see every city that starts with the letter L

So - we write this query

SELECT * FROM `Cities` WHERE `name` LIKE `L%`

From SQL to english

select all the columns from records from Cities table where name begins with L

% is so-called wildcard and it means any number of characters or even no at all

There is also one more useful wildcard - _
It represents a single character

So if in DB we'd have these 2 values

Lon
Lo

With %, both of those meet condition
But is we use _ - only the second one will get returned

Conclusion

That's pretty much it - I hope you have learnt something, as I'll require that knowledge in the next part

I thought, this part will have a delay (as I was working on something) but luckily it was short so it got posted in time

What I was working on? On my own blog

So yeah, most of the articles will get posted there - especially non-coding ones

If you want to have access to this course earlier - check my blog, as I'll post those articles as soon as I finish writing them

Also, check out my other articles and another parts of this course - and see you in the next ones

PHP 0 to hero pt.9 - setting up SQL (SQL pt. 1)

Mateusz Jasiński — Thu, 18 Jan 2024 15:00:00 +0000

What's up - welcome in another part of this course

Today, we start very important topic - using databases in PHP

This part is an introduction - there will be 2 other parts about strictly coding

So, what do we do today?

We will

Learn something about PHPMyAdmin and MySQL
Create our first database
Familiarize ourselves with terms like primary key, row, column, SQL, DBMS
Data types in SQL-based databases

So, let's get started

What will we use today

This time, we will utilize another software - DBMS

What is it? It stands for Database Management System
There, my choice is MySQL - we have it installed with XAMPP
(To be fair, it's MariaDB)

But remember - that's not the only one

We have plenty of those. There are differences in writing SQL code then - also PHP syntax might be different

Some of the most popular are

Another thing is software - We have utility built in XAMPP (and installed in linux) called phpmyadmin

This allows us to work with database graphically, rather than via queries

And, what is a query? That's a structure, that tells database to perform some action - like select some data or update them

We write them in language called SQL - structured query language

Let's see what it really looks like

Launching PHPMyAdmin

First thing - enable MySQL service in XAMPP (Or start mysql-server and mysql-client in linux)

Then, when this and Apache is working - we can access phpmyadmin

Go to http://localhost/phpmyadmin

At first - it looks like this

(Here I've got some databases from my previous projects - you should have it empty)

We'll familiarize ourselves with some of these - right now click new inside sidenav - you should be redirected to page like this

Creating database

Let's create a database called firstProject - choose whichever encoding suites your language from ones starting with utf8 and ending with ci

As I am polish, I've chosen utf8_polish_ci

After inputting everything - it looks like this

Now, next page

Database designing

We will create simple to-do app - so we need 2 tables

users - It will have 3 rows (right now)
- user_id - Numerical user id (It will be our primary key)
- username - self-explanatory
- password - user's password - I think also self explanatory
tasks - All tasks will be stored here. It will consist of 5 rows
- task_id - Primary key for this table
- task_title - self-explanatory
- description - description for user about specific task
- creator - Task owner. It will be user_id of whoever created this task
- timestamp - when was task created

What's a primary key?

Primary key - It's a column in the table (most of the time numerical), that's unique to all records (rows) - like here id.
It is used to distinguish rows in table

Creating tables

First, let's create users

Add name and number of columns - here 3

Then we end up here

Let's start with Name

After inputting names that we agreed to, we should have something like this

Next part - type

This indicates what type of data will be stored there

We have a bunch of them, like DECIMAL, BOOLEAN

So, what types will we have?
user_id - will be INT
username - will be TEXT
password - as well TEXT

Now, we have this - one last thing

We were talking about primary key - have we specified it? No

So, let's do it

There is a column called index - in row with user_id click on it, and choose PRIMARY

On pop-up - just click go and don't bother

Right beside it - we have suspicious checkbox labeled as A_I

Is it to fill it with data generated by AI? Not really

A_I stands for AUTO INCREMENT - we know the verb "to increment"

So, this option means that when we pass an empty value here (NULL) it will automatically replace it with incremented value of previous row

So, if we added a new row here it would automatically set user_id value to 1

If we added next row, it would fill it with 2. And so on

If you hadn't realized it yet - we have to check it

After all - it looks like this

Click Save button below and boom - we should be redirected to page called structure

Looks like it's fine - let's create the second one

Click New in database drop-down menu on navbar

Up here

Add table name. We have only 4 colums, but we need 5

Click Go button beside table name - it will add a new column

Now - fill it

As you see, I allowed myself to skip explaining everything - you should know, how it works and what some of those mean

One thing I want to tell you about is DATETIME type

It allows us to store dates in standardized MySQL format - YYYY-MM-DD hh:mm:ss

Here, those letters stand for one digit of
Y - year
M - month
D - day
h - hour
m - minute
s - second

Click Save and job is done

We have successfully created a database in PHPMyAdmin

Conclusion

As you see, today we have written no code - but don't worry.
Next parts will have more of coding

Check out other parts of this series - wait for next ones and see you in next articles

DEV Community: Mateusz Jasiński

Self-refreshing view counter in PHP and JS

Project plan

Backend

JS and HTML

Conclusion

Learn x86 Assembly with me

Why Assembly and why x86?

Where I'll be learning from?

What does assembly code consist of

What will I learn now?

PHP 0 to hero pt.16 - .htaccess and robots.txt files

When can we use .htaccess files?

Quick disclaimer

SEO-friendly addresses

Error Documents

What is robots.txt?

Security issues

Conclusion

Little personal afterword

Refactoring spaghetti code in PHP

What will we be working on?

Variable naming

Modularization

DRY and KISS

If-else maze

Additional step: Modularization pt.2

TL:DR - best practices in bullet points

Conclusion

PHP 0 to hero pt.15 - OOP coding

Classes

Properties and Methods

Properties

Methods

Inheritance

Conclusion

PHP 0 to hero pt.14 - OOP Introduction

What is OOP?

Encapsulation

Inheritance

Conclusion

Why is hashing passwords important?

What is hashing?

Salting passwords

Why do we need hashes?

Hashing algorithms

Legacy hashing algorithms

Conclusion

PHP 0 to hero pt.13 - functions, include and require - PHP modules

Functions

Declarating functions

Including files in PHP code

include vs require

What does appending _once do?

Which one is the best?

Conclusion

PHP 0 to hero pt.11 - Integrating SQL with PHP (SQL pt.3)

Login mechanism

Form template

Ways of connecting to database from PHP

Using DBMS's interface

Writing login script

What is SQL Injection (SQLi)

Prepared statements - executing query

Validation

Conclusion

PHP 0 to hero pt.12 - Using PDO (SQL pt.4 )

What is PDO and why should you use it

Quick intro to exceptions

Writing login script

Creating DB connection

Executing query

Obtaining results

Conclusion

PHP 0 to hero pt.10 - SQL basics

Running queries

Queries

SELECT

INSERT

DELETE query

When can we use `.htaccess` files?

What is `robots.txt`?

`include` vs `require`

What does appending `_once` do?

`SELECT`

`INSERT`

`DELETE` query

`UPDATE` query

Dangers in `UPDATE` and `DELETE`

`LIKE` keyword