Web Systems Security
CY430
Lecture 5: Server Scripting
PHP
Part I
1
Client-side scripting
• Client-side scripting is executed on the client
computer, and usually runs as interpreted program
code within the browser.
• It can be used to make web pages more interactive ,
to determine which user-agent (browser) is running
on the client computer, or to validate form data
before it is sent to the server.
2
Server-Side scripting
• Server-side scripts are executed on a web server
• Server-side scripting can be used to process form
information submitted by a client, query or update a
server-side database, and dynamically generate web
pages that can be displayed in the user's browser.
3
Server scripting languages
There are a number of server-side scripting languages
• PHP (*.php, *.php3, *.php4, *.phtml)
• Python (*.py)
• R (*.rhtml)
• Ruby (*.rb, *.rbw)
• Java (*.jsp) via JavaServer Pages)
• ASP (*.asp)
• ASP.NET (*.aspx)
• ASP.NET MVC (*.cshtml)
• Go (*.go)
• Google Apps Script (*.gs)
• Perl via the CGI.pm module (*.cgi, *.ipl, *.pl)
4
PHP: Introduction
• PHP: is a server scripting language.
• PHP was created by Rasmus Lerdorf
• In 1995, Lerdorf released it as a package called the
“Personal Home Page Tools.”
• In 1997, PHP 3 was released after a substantial rewrite,
which resulted in a large increase in performance and led
to an explosion of PHP use.
• The current version is 8.2.6/ May 2023
• PHP is a widely-used, free, and efficient alternative to
competitors such as Microsoft's ASP.
5
PHP: Introduction
• PHP is an open-source technology.
• PHP is platform independent—implementations
exist for all major UNIX, Linux, Mac and Windows
operating systems.
• PHP also supports many databases, including
MySQL.
6
Embedding PHP
• PHP code is embedded directly into text-based
documents, such as HTML.
• The scripts are interpreted by the server before
being delivered to the client.
• PHP script file names end with .php.
7
Simple PHP Program
• PHP code is inserted between the delimiters <?php
and ?> and can be placed anywhere in HTML
document.
• All variables are preceded by a $ and are created
the first time they’re encountered by the PHP
interpreter.
• Variable names in PHP are case sensitive.
8
Simple PHP Program
• Forgetting to terminate a statement with a semicolon
(;) is a syntax error.
• All operations execute on the server before the HTML
document is sent to the client.
• You can see by viewing the source of a PHP document
that the code sent to the client does not contain any
PHP code.
9
Simple PHP Program
• Like JavaScript, PHP variables are loosely typed.
• They can contain different types of data (e.g.,
integers, doubles or strings) at different times.
$var = 5; // $var is an integer
$var = "hello"; // Now, $var is a string
$var = 10.5; // Now, $var is a float
10
Simple PHP Program
<html lang="en">
<?php
$name = ”Meznah"; // declaration and
initialization
?>
<head>
<meta charset = "utf-8">
<title>Simple PHP document</title>
</head>
<body>
<h1><?php print( "Welcome to PHP, $name!
Today is ".date("l jS \of F Y") ); ?></h1>
</body>
</html>
11
Simple PHP Program
12
When displaying the source
13
Data Types
Type Description
int, integer Whole numbers.
float, double Real numbers.
Text enclosed in either single (‘ ’) or double (" ")
string quotes.
bool, boolean true or false.
array Group of elements.
object Group of associated data and methods.
NULL No value.
14
Converting Between Data Types
Converting between different data types may be necessary when
performing arithmetic operations with variables.
1. Type conversions can be performed using function settype.
Function settype takes two arguments—the variable whose type is
to be changed and the variable’s new type.
2. Another option for conversion between types is casting.
does not change a variable’s content—it creates a temporary copy of
a variable’s value in memory.
15
settype() Function
• The settype() function converts a variable to a specific type.
• Syntax: settype(variable, type);
<?php
$a = "32"; // string
settype($a, "integer"); // $a is now integer
$b = 32; // integer
settype($b, "string"); // $b is now string
$c = true; // boolean
settype($c, "integer"); // $c is now integer
(1)
?>
16
settype() Function
<?php
$testString = "3.5 seconds";
settype( $testString, "double" );
print("as a double $testString </br>");
settype( $testString, "integer" );
print("as an integer $testString</br>");
settype( $testString, "string" );
print("as a string $testString</br>");
By using method
?> settype, changing
variable back to string
result in loss of data
17
Type Casting
• Type and value of a variable remain unchanged even after it
has been cast several times.
<?php
$data = "98.6 degrees";
print("<p>Using type casting instead:
as a double:“. (double) $data ."</p>") ;
print( "<p >After casting: $data is a " . gettype( $data ).
"</p>" );
Casting keeps the variable’s
?> type and value unchanged
18
Global and Local Variables
<?php
$x = 5;
$y = 10;
function myTest() {
//The global keyword is used to access a global variable
from within a function.
global $x, $y;
$y = $x + $y;
}
myTest();
echo $y; // outputs 15
?>
19
PHP Operators
Operator Name Example Result
Sum of $x and
+ Addition $x + $y $y
Difference of $x
- Subtraction $x - $y and $y
Product of $x
* Multiplication $x * $y and $y
Quotient of $x
/ Division $x / $y and $y
Remainder of $x
% Modulus $x % $y divided by $y
Result of raising
** Exponentiation $x ** $y $x to the $y'th
power 20
PHP Comparison Operators
Operator Name Example Result
Returns true if $x is
== Equal $x == $y equal to $y
Returns true if $x is
=== Identical $x === $y equal to $y, and they
are of the same type
Returns true if $x is
!= Not equal $x != $y
not equal to $y
Returns true if $x is
<> Not equal $x <> $y
not equal to $y
Returns true if $x is
not equal to $y, or
!== Not identical $x !== $y
they are not of the
same type
Returns true if $x is
> Greater than $x > $y
greater than $y
21
PHP Comparison Operators
Operator Name Example Result
Returns true if $x is less
< Less than $x < $y
than $y
Returns true if $x is
>= Greater than or equal to $x >= $y greater than or equal to
$y
Returns true if $x is less
<= Less than or equal to $x <= $y
than or equal to $y
Returns an integer less
than, equal to, or greater
<=> Spaceship $x <=> $y than zero, depending on if
$x is less than, equal to, or
greater than $y.
22
String Concatenation
• The concatenation operator (.) combines multiple
strings in the same print statement.
$data=2.5;
print( "<p>Using type casting instead:</p>
<p>as a double: ". (double) $data .” </p> " .
"<p>as an integer: ". (integer) $data ."</p>");
• All data that’s enclosed in the parentheses and
terminated by a semicolon is printed to the HTML
document.
23
Initializing and Manipulating Arrays
• Array names, like other variables, begin with the $
symbol.
• Unlike other programming languages, if a value is
assigned to an array element of an array that does not
exist, then the array is created.
$first[ 0 ] = "zero";
$first[ 1 ] = "one";
$first[ 2 ] = "two";
24
Initializing and Manipulating Arrays
• The for statement prints each element’s value.
• Function count returns the total number of elements in
the array.
name of the array
for ( $i = 0; $i < count( $first ); ++$i )
print( "<p>Element $i is $first[$i] </p>" );
Element 0 is zero
Element 1 is one
Element 2 is two
• The escape sign is the backslash (\)
• Try with print( "<p>Element \$i is $first[$i]</p>"
); Element $i is zero
Element $i is one
Element $i is two 25
Initializing and Manipulating Arrays
• A second method of initializing arrays using the function
array ()
$second = array( "zero", "one", 2, "three" );
for ( $i = 0; $i < count( $second ); ++$i )
print( "<p>Element $i is $second[$i]</p>");
Element 0 is zero
Element 1 is one
Element 2 is 2
Element 3 is three
26
String Comparisons
The strcmp() function compares two strings.
Syntax: strcmp(string1,string2)
• Return Value:
– 0 if the two strings are equal
– <0 if string1 is less than string2
– >0 if string1 is greater than string2
• Example:
– bus alphabetically precedes car
print(strcmp("bus", "car"));
– comparison alphabetically precedes compassion
• Relational operators (==, !=, <, <=, > and >=) can also be
used to compare strings.
27
28
String Comparisons
$fruits = array( "apple", "orange", "banana" );
for ( $i = 0; $i < count( $fruits ); ++$i )
{ if(strcmp( $fruits[ $i ], "banana" ) < 0 )
print( "<p>" . $fruits[$i] . " is less than
banana " );
//OR you can use < operator
if ( $fruits[ $i ] < "apple" )
print( "and less than apple!</p>" ); }
29
Book Chapter/ References:
Learning PHP, MySQL & JavaScript: With jQuery, CSS &
HTML5 (Learning PHP, MYSQL, Javascript, CSS & HTML5)
chapters 3, 4 and 5 p. 35-125
30
