Creating Databases One-way encryption. Passwords. Security issues. Data normalization. Integrity and Robustness. Homework: Finalize teams & projects. Making unique posting on encryption, passwords, security, normalization.

Passwords How can your security with respect to passwords be compromised?

Password advice Do what they force us (the faculty) to do at Purchase –change passwords often Don't put on paper that you leave around. Use different passwords. Monitor your bank, credit card, etc. ???

Password protection Over-the-shoulder: –use password type for input fields. –Use post and not get [use https connection. Needs cooperation of server.] Use one-way hash algorithm ???

Secure Hash Algorithm-256 Takes input and produces a digest (256 bits long) One-way: very difficult to decrypt it. Can be done on the server or on the client. –I will demonstrate on the client. Test is done digest vs digest. Protects against some inside jobs: someone may know the digest, but won't know the plain text to produce the digest.

Start of password system meyer/research/register.htmlhttp://socialsoftware.purchase.edu/jeanine. meyer/research/register.html –probably never have this as part of a production application.

outline of register.html Register function encode() { …. }..

register.html User name Password Confirm password

function encode() { var pw1 = document.f.pw.value; if ((document.f.un.value.length<1) ||(pw1.length<1)) { alert("Need to enter User Name and Password. Please try again."); return false; } else if (pw1 == document.f.cpw.value) { document.f.pw.value = SHA256(pw1); document.f.cpw.value = ""; alert("document.f.pw.value now is "+document.f.pw.value); return true; } else { alert("passwords do not match. Please try again."); return false; }

Note After submitting the form, the encode function does [some] client side validation. It returns true if appropriate to continue to the action script It returns false if appropriate to return the form for the user to try again. Notice that the second password field is cleared if the two are the same Notice that the first password field is altered.

completereg.php Add song to database <?php require("opendbo.php"); $tname = "finders"; $finder = addslashes($_POST["un"]); $epw = $_POST["pw"]; $query = "INSERT INTO $tname values ('0','$finder','$epw')"; $result = mysqli_query($link,$query); if ($result) { print("The finder was successfully added. \n"); } else { print ("The finder was NOT successfully added. \n");} ?>

Remember computer systems are made up of –hardware –software –[networks] –people –procedures

Registration system Assign people passwords –Admin. does the registration just shown Provide way for users to change passwords Tradeoff: –randomly generated versus –one the player can remember

Change password scripts changepassword.html –show out of order, body first completechangepassword.php

User name Current password Password Confirm password Your browser does not recognize canvas

start of changepassword.html Change password

function encode() { var ctx= document.getElementById("canvas").getContext("2d"); ctx.clearRect(0,0,600,600); var pw1 = document.f.oldpw.value; var npw = document.f.newpw.value; if ((document.f.un.value.length<1) ||(pw1.length<1)) { alert("Need to enter User Name and Password. Please try again."); return false; } else if (npw == document.f.cpw.value) { document.f.oldpw.value = SHA256(pw1); document.f.newpw.value = SHA256(npw); document.f.cpw.value = document.f.newpw.value; return true; } else { drawroundedarrowbox(ctx,10,30,40,300,80,"Passwords do not match.",30,"black","pink"); return false; } }

completechangepw.php Complete change finder password <?php require("opendbo.php"); $tname = "finders"; $finder = $_POST["un"]; $epw1 = $_POST["oldpw"]; $epw2 = $_POST["newpw"]; $query = "UPDATE $tname SET epw = '$epw2' WHERE username = '$finder' AND epw = '$epw1'"; $result = mysqli_query($link, $query); if ($result) { print("The password was changed. \n"); } else { print ("The password was NOT successfully changed. \n"); } ?>

addsite scripts meyer/research/addsite.htmlhttp://socialsoftware.purchase.edu/jeanine. meyer/research/addsite.html addsite.html –show body first addsite.php –tries to make addition and –presents new form for adding another site or going to one of the display scripts goes into and out of php

Site: Date: Site description: URL: Category: Username: Password: Save on this computer next time you invoke addsite?

addsite.html retrieves information from local Storage does the encoding: client side then server side handling Start of the file: Add website info, login

retrieveinfo function function retrieveinfo() { var savedun; var savedpw; try { savedun = localStorage.getItem("researchun"); savedpw = localStorage.getItem("researchpw"); if (savedun) { document.f.un.value = savedun; document.f.pw.value = savedpw; document.getElementById("greeting").innerHTML="We lcome Back."; document.f.saveok.value = "Yes"; } } catch(e) {} }

encode function function encode() { var pw1 = document.f.pw.value; if (document.f.saveok.value!="No") { try { localStorage.setItem("researchun",document.f.un.value); localStorage.setItem("researchpw",pw1); } catch(e) { alert("error on local storage "+e); } } else { //no saving, remove anything saved try { localStorage.removeItem("researchun"); localStorage.removeItem("researchpw"); } catch(e) { //alert("error on local storage "+e); } } if ((document.f.un.value.length<1) ||(pw1.length<1)) { alert("Need to enter User Name and Password. Please try again."); return false; } else { document.f.pw.value = SHA256(pw1); return true; } }

start of addsite.php Complete adding site to research table <?php require("opendbo.php"); $tname = "sitesfinders"; $stitle=addslashes($_POST["stitle"]); $sdate=$_POST["sdate"]; $sdesc=addslashes($_POST["sdesc"]); $surl=$_POST["surl"]; $scat = addslashes($_POST["scat"]); $un =$_POST['un']; $epw = $_POST['pw'];

$query = "SELECT * FROM finders WHERE username='$un' AND epw='$epw'"; $result = mysqli_query($link, $query); if ($row=mysqli_fetch_array($result)) { $fid = $row['finderid']; $query = "INSERT INTO $tname values ('0','$stitle','$sdate','$surl','$sdesc','$scat','$fid')"; $result = mysqli_query($link, $query); if ($result) { print("The site was successfully added. \n"); ?>

Add [another] web site? Site: Date: Site description: URL: Category:

<?php print ("Username: <input name='un' type=' ' value='"); print ($un."' />"); print ("Password: "); ?>

Show all websites or Show sites for a category <?php } else { print ("The site was NOT successfully added. \n"); } else { print ("Problem with username and/or password and/or data."); } ?>

What is normalization? Data analysis is a process that prepares a data model for implementation as a simple, non- redundant, flexible, and adaptable database. The specific technique is called normalization. Normalization is a data analysis technique that organizes data attributes such that they are grouped to form non-redundant, stable, flexible, and adaptive entities.

Goals of normalization Have well-defined tables—at most one value for each field Store each item of information exactly one place so if/when it changes, only have to change one place Don't store items that can be calculated so making changes is simplified.

Process of defining database May start with the desired end products (sometimes called artifacts) –Reports –Forms May be from original, possibly even non- automated version of application May be from combination of application. Goal is to produce single database that serves multiple uses.

Normalization process First step is to do what is necessary to get each entity into 1 st normal form: –An entity is in first normal form (1NF) if there are no attributes that can have more than one value for a single instance of the entity. Any attributes that can have multiple values actually describe a separate entity, possibly an entity and relationship. –Common situation is so-called multiple values, such as distinct items in an order (distinct beneficiaries, game- machines) –Action is to create new entity

Modifying model to 1 st NF Many items (titles) Associative entity: Use combination of keys for new (concatenated) key

Moving to 2 nd NF If you do not have any concatenated keys, no work is needed. Model is already in 2 nd NF. If you do have any concatenated (combination) keys, you need to examine these entities. –An entity is in second normal form (2NF) if it is already in 1NF and if the values of all nonprimary key attributes are dependent on the full primary key—not just part of it. Any nonkey attributes that are dependent on only part of the primary key should be moved to any entity where that partial key is actually the full key. This may require creating a new entity and relationship on the model.

Moving to 2 nd NF Some attributes relate to the product itself, not the fact that the product is part of this order. Remove these attributes.

Moving to 3 rd NF Make sure that all non-primary attributes depend just on the key, not, for example, on another attribute. –An entity is in third normal form (3NF) if it is already in 2NF and if the values of its nonprimary key attributes are not dependent on any other non-primary key attributes. Any nonkey attributes that are dependent on other nonkey attributes must be moved or deleted. Again, new entities and relationships may have to be added to the data model. –Typical example is something that can be calculated.

Example of move to 3 rd NF

Normalization …. is a process. It is [somewhat] mechanical. There is chance that your model may be in 1 st, 2 nd, or even 3 rd without action or much action on your part, but it is good to go through the process. Note: Some may argue for certain redundancies, for example, storing a calculated value. Why or why not?

Normalization decreases chances of needing to change information in more than one place. Happened to you?

Where should (persistent) data go? localStorage (cookie) on client computer Database (s) Flat file on server –File with its own encoding XML file on server Decisions based on more than technical factors….

Fields of table Set up using php (or phpMyAdmin) in a certain order, set names, data types Two variations for INSERT –“INSERT INTO questions VALUES (‘0’,’$qtext’,’$atext’,$val)” Must use order used in creation step –“INSERT into questions (text,value,answer) VALUES (‘$qtext’, $val,’$atext’)”

Number of records After any SELECT, can query the number of records. $query = "SELECT * FROM tablename"; $result = mysqli_query($link,$query); $num_rows = mysqli_num_rows($result); echo $num_rows;

Homework Make unique posting on security, password, encryption, normalization. –READ the reference and comment on it!!! Work on enhancement projects.