form-handle-test-sanitize
testing forms; sanitizing html

We've been talking about input forms (html elements), and then php scripts to process a submitted form:

The URL that handles the submitted form is the one given in the form tag as the submit attribute:

  <!-- inside form.php (or, form.html) -->
  <form submit='submit.php' action="post">
    Login: <input type='text' name='userid' />
    <br />
    Remember me?: <input type='checkbox' name='remember' value='yep' />
    …
  </form>

Use the $_POST (or, $_GET) array to look up values; for indices (keys), use the name attribute that you gave the input-element back in the html.

  <!-- inside submit.php -->
  <?php
     echo "Hey there ", $_POST['userid'];
     if (array_has_index('remember',$_POST)) {
       echo "How could I ever forget?";
        // $_POST['remember'] = 'yep'
       }
  ?>

Note that checkboxes which weren't checked, etc., don't have any entries in $_POST (even though you might wish it had an entry with value “false” or something).
If you gave several input-elements the same name attribute, and the name ends in “[]”, then in $_POST look it up without the “[]”, and you'll get an array of all the values (with numeric indices/keys).
Use http post when the URL-request ;
Use http get when the URL-request .
php detail: When a php program contains anything not inside “<?php … >”, those lines are simply .

testing a form-handler

Video: easily testing a form-handler (18m38s)

Our functions have test cases, and this helps gives us confidence before we ever deploy to the web. But what about form-handlers? The result from form-handler is a long page that includes various bits from the form. It's too tedious to make this a check/expect sort of test, since the details of the html part of the output aren't relevant (and might change). Moreover, generating the page requires the POST data, that were entered by hand back in the form. But we would like to be able to check that the form-handler without going through the web, and also eyeball-check the result on certain inputs w/o having to continually re-type the inputs and call up the form.

Solution: Make a php program which simply initializes $_POST, and then require's the form-handler. Recall the sample form from last lecture (and recall what happens when it submits). Then, inspect:

formB-handle-test-1_php.txt source; results.
formB-handle-test-2_php.txt source (alternate init syntax); results.
formB-handle-test-0_php.txt source (degenerate sample); results.
formB-handle-test-3_php.txt source; results.

Awesome sauce: We can run these handler-tests locally, or over the web. The former is useful when the latter isn't showing up as expected.

Although we use these to manually test our handler, they are not unit tests (they're not automated). Admittedly, the filename topic-handle-sample-input-N.php might be better a more descriptive name than just topic-handle-test-N.php, but we'll concede to a shorter, more convenient name.

Sanitizing input

Video: sanitizing html 1: htmlspecialchars (25m18s)

When creating a page which includes something typed in by the user (from a previous text-input), we must be careful. What characters could the user type that our browser would not interpret as data, but instead as part of the html page's structure? (Here's our sample form.)

We have three levels of html to think about:

(Web 0): What the browser renders
...tough to seek hi<b>hahaha.
(Web I): The desired html, to have it render the above
...tough to seek hi<b>hahaha.
(Web II): The code which prints the desired html:
echo "...tough to seek ", htmlspecialchars($_POST['quest']), "\n";

Here is an improved form which sanitizes its input before printing. Much better! However, there is still a minor issue: consider a multi-line message: How does it render? We realize that for the browser to render a newline, its html-source must contain “<br/>”, and so our code-to-print-that-html must look for any newlines in the user's input, and replace that character with the br tag. Here's a fully-working, sanitizing form.

Video: sanitizing html 2: nl2br (6m59s)
Optional but good to know: Video: magic-quotes; array_map (24m01s)

Some functions to consider:

htmlspecialchars
nl2br
Note that to prevent errors, some php servers used to enable “magic quotes”: When setting up the $_POST array, they will guard against malicious/accidental breaches by adding a slash in front of any quote-characters. This default-server-behavior has been deprecated and may be discontinued eventually (though php.radford.edu still uses them as of 2015-Sep-28).

A poor solution is to always call stripslashes on all input. A better solution — one that won't have to change if the server's behavior changes — is to check whether or not the server is configured to auto-add slashes, via get_magic_quotes_gpc, and only call stripslashes in that case. You could do this every time you access $_POST, but perhaps it's better just to do it once and for all at the beginning of your handler:
if (get_magic_quotes_gpc()) { $_POST = array_map( 'stripslashes', $_POST ); }
Note: array_map is a handy function which takes in an array, and the (name of) a function, and applies that function to every element of the array. Sure we could write a loop to do this ourselves, but array_map often saves us that work — in effect, array_map is a specialized looping construct.
The one drawback of using this line is that if $_POST contains an entire array as one of its values, stripslashes won't go recur down into the strings that (sub)array holds. (In fact, it will give an error, if applied to an array instead of a string). So I have written a version of stripslashes which works recursively (and, doesn't inadvertently convert numbers and booleans to strings, like stripslashes does!):
// If server is adding magic-quotes (deprecated), then remove them now: require('stripslashes_deep.php'); if (get_magic_quotes_gpc()) { $_POST = stripslashes_deep($_POST); }
You may use the code from stripslashes_deep.php and stripslashes_deep-test.php.

Quick q: suppose a user types:

  hi
<3

in a textarea whose name is msg. What is

$_POST['msg']
nl2br($_POST['msg'])
htmlspecialchars($_POST['msg'])
nl2br(htmlspecialchars($_POST['msg']))
htmlspecialchars(nl2br($_POST['msg']))

We have seen arrays, and mentioned that if they have all-numeric indices (keys) then we can process them with a for loop or a while loop, using the same syntax that Java and Javascript happen to use.

Then we saw that if an array has keys which aren't all numeric, we can use a foreach loop to process them:

  $myData = array( 'hi' => 'hallo', 'good day' => 'guten Tag', 'see you later' => 'auf wiedersehen' );

  foreach ($mydata as $german) {
    echo $german, "\n";
    }

  foreach ($mydata as $english => $german) {
    echo "You say '$english', I say '$german'.\n";
    }

The foreach loop is of course one way to process each element of the $_POST array (if you didn't want code specific/different for each input form).

directory-processing

Look at the documentation for scandir.
Since it returns an array of filenames, it's a natural match to use with other functions that want an array of strings: For example, echo htmlLines( scandir( '/ibarland/Tmp' ) );

`array_map`

Suppose we wanted an English list of hyperlinks, separated by commas, with the word "and" before the last item. This decomposes into two orthogonal parts:

make a comma-separated list, from an array of words,
convert each word to a URL

And you just wrote a function for making an English list, and you called that. The array you pass in must be an array of URLs.

To create the array, hopefully you also used your function hyperlink, written from hw02. (If you wrote the same long HTML a tag over and over, that's a sign that a function would be better.) So you might have a loop:

  $URLsAsText = array( "http://d20srd.org", "http://www.radford.edu", "http://google.com" );

  $URLsAsHTML = array();
  foreach ($URLsAsText AS $url) {
     $URLsAsHTML[] = hyperlink($url);
     }

  echo "It should appeal to users of ", commaSeparatedList( $URLsAsHTML ), "."

Any other repeated stuff? Hmm, the “http:” prefix was kinda annoying, but writing a loop for that seems definite overkill.
(Design Question: Should hyperlink be prepending a http:? How does this limit what it can do? Does it violate the principle of least surprise?)

It's kinda annoying to keep writing loops that make a new array of updated values. Most of the loop is very rote — the only part that differs is the particular rule to transform the individual element to the new element. (In the example above, the answer is “the function hyperlink”.)

There is a handy function, array_map: You pass it an array of data, and you pass it the rule (function) on how to transform each individual datum, and it gives you back the entire transformed array. So our loop above gets turned in to:

  $URLsAsText = array( "http://d20srd.org", "http://www.radford.edu", "http://google.com" );
  $URLsAsHTML = array_map( "hyperlink", $URLsAsText );
  echo "It should appeal to users of ", commaSeparatedList( $URLsAsHTML ), ".";

or we could even get rid of the intermediate variable, if we don't want to save the result ¹:

  $URLsAsText = array( "http://d20srd.org", "http://www.radford.edu", "http://google.com" );
  echo "It should appeal to users of ", 
       commaSeparatedList( array_map( "hyperlink", $URLsAsText ) ),
       ".";

Finally, note that we can also handle the “prepend “http://” to each item” issue. We could make a separate function and pass that to array_map, or we could use an anonymous function:

  $URLsAsText = array_map( function ($domain) { return "http://" . $domain; }²,
                           array( "d20srd.org", "www.radford.edu", "google.com" ) );

video from distance lecture (breeze), 2017-feb-14 (1h23m), REVIEWING this info

¹ Heck, if you don't even want to name the original array, you could inline that. This is arguably in-lining too much, but that can be an issue of taste (and requires taking care with indentation):

  echo "It should appeal to users of ", 
       commaSeparatedList( array_map( "hyperlink",
                                      array( "http://d20srd.org",
                                             "http://www.radford.edu",
                                             "http://google.com" ) ) ),
       ".";

↩

² This is a function that we declare in the middle of the line; note it doesn't even have a name. We don't call this function ourselves: we are giving the function to array_map, and they'll use the function as they see fit — in this case, calling the function on every element of the array we're also handing them. In truth, the implementation of array_map is potentially very simple:

function arraymap( $arr, $func ) {
  $result = array();
  foreach ($arr AS $k => $v) {
    $result[$k] = $func($v);    // call the function we were handed, and store the answer in our array $result.
    }
  return $result;
  }

. ↩

home—lects—hws
D2L—breeze (snow day)

©2017, Ian Barland, Radford University
Last modified 2017.Feb.21 (Tue) Please mail any suggestions
(incl. typos, broken links)
to ibarlandradford.edu

form-handle-test-sanitize testing forms; sanitizing html

testing a form-handler

Sanitizing input

directory-processing

array_map

form-handle-test-sanitize
testing forms; sanitizing html

`array_map`