1. Copyright 2009 Justin C. Klein Keane PHP Code Auditing Session 1 – PHP Foundations Justin C. Klein Keane jukeane@sas.upenn.edu

2. Copyright 2009 Justin C. Klein Keane Overview Purpose of these sessions Gage PHP competency Assignments Length of the course

3. Copyright 2009 Justin C. Klein Keane What is PHP? Dynamic scripting language  Written in C Served by a web server (Apache) CLI Current version is PHP 5 http://php.net

4. Copyright 2009 Justin C. Klein Keane Commercial Support Zend (http://www.zend.com)  Produces Zend Studio IDE  Also produces debuggers, enterprise servers, etc.  Founded by some of the chief PHP developers

5. Copyright 2009 Justin C. Klein Keane Developing PHP Access to a web server that supports PHP Eclipse using PHP Development Tools (PDT)  Bundle from http://www.eclipse.org/pdt Nice to have Remote System Exporer (RSE) installed as well  http://www.eclipse.org/dsdp/tm/ Best source of documentation is http://php.net

6. Copyright 2009 Justin C. Klein Keane PHP Basics PHP is plain text When a URL is requested Apache parses the text file and interprets any PHP  Apache must be able to read the file  Apache interprets the file every time.php is the common extension but any is possible

7. Copyright 2009 Justin C. Klein Keane Structure of PHP PHP is delimited with: <?php ?> Any material between the delimiters is interpreted Text outside of the delimiters is treated as static

8. Copyright 2009 Justin C. Klein Keane Simple 'Hello world' <?php echo “Hello world”; ?>

9. Copyright 2009 Justin C. Klein Keane Web friendly 'Hello world' <?php echo “Hello world”; ?>

10. Copyright 2009 Justin C. Klein Keane Apache renders as: Hello world

11. Copyright 2009 Justin C. Klein Keane PHP Syntax - Comments // One line comment /* Multiline comment */ # Acceptable but discouraged one line comment

12. Copyright 2009 Justin C. Klein Keane PHP Syntax Basics - Variables Variables are denoted with the $ sign Variables names must be alphanumeric or undersign PHP variables are case sensitive

13. Copyright 2009 Justin C. Klein Keane PHP Variables Variables are not statically typed Integers can become floats can become strings Variable types include:  Boolean  Integer  Float  String  Array  Object  Resource  NULL

14. Copyright 2009 Justin C. Klein Keane Operators Arithmetic operators  +, -, *, /, % String operators . Assignment operators  =,.=, +=, -=, *=, /=

15. Copyright 2009 Justin C. Klein Keane Operators (cont.) Comparison operators  ==, ===, !=, <>, !==,, = Increment, decrement operators  ++, -- (pre and post) Logical operators  !, &&, ||, and, or, xor

16. Copyright 2009 Justin C. Klein Keane Strings Strings are delimited by quotes  Different behavior depending on single or double quote Example strings:  $a = 'foo';  $b = “$a bar”;  $c = $a. $b

17. Copyright 2009 Justin C. Klein Keane Arrays $array = array(); $array = ('one', 'two', 'three'); $array[0] = 'new one'; $assoc_array = ('one'=>'uno', 'two'=>'dos'); $assoc_array['one'] = 'uno nuevo';

18. Copyright 2009 Justin C. Klein Keane Control Structures If Else Elseif and else if

19. Copyright 2009 Justin C. Klein Keane If Else Statement if ($a < $b) { print “$a is less than $b”; } else { print “$b is less than $a”; } Can you spot the logic flaw above?

20. Copyright 2009 Justin C. Klein Keane If Else Statement (alt) if ($a < $b) echo “$a is less than $b”; else if ($a == $b) echo “$a is equal to $b”; else echo “$b is less than $a”;

21. Copyright 2009 Justin C. Klein Keane Ternary Statement $result = ($a < $b) ? 'a is less' : 'a is not less';

22. Copyright 2009 Justin C. Klein Keane While loops $a = 1; while ($a < 10) { echo $a. “ ”; $a++; }

23. Copyright 2009 Justin C. Klein Keane Do While Loops $a = 0; do { echo $a; $a++; } while ($a < 10);

24. Copyright 2009 Justin C. Klein Keane For loop for ($a=0; $a<10; $a++) { echo $a. “ ”; }

25. Copyright 2009 Justin C. Klein Keane Break Control for ($a=0; $a<10; $a++) { if ($a == 5) break; echo $a; }

26. Copyright 2009 Justin C. Klein Keane Continue (skip) for ($a=0; $a<10; $a++) { if ($a==5) continue; print $a; }

27. Copyright 2009 Justin C. Klein Keane Switch switch ($a) { case 0: echo 'a is zero'; break; case 1: echo 'a is one'; break; default: echo 'a is something else'; }

28. Copyright 2009 Justin C. Klein Keane Functions function foo() { return “bar”; } echo foo();

29. Copyright 2009 Justin C. Klein Keane Functions (cont.) function foo($a='bar') { $a.= “ something”; return $a; } $retval = foo('foo');

30. Copyright 2009 Justin C. Klein Keane Classes class Foo { $name; __construct($name) { $this->name = $name; } $myvar = new Foo('foobar'); echo $myvar->name;

31. Copyright 2009 Justin C. Klein Keane Classes (cont.) class Foo { $var = 'bar'; function getVar() { $var = 'inner_var'; return $var; } $a = new Foo(); $b = $a->getVar();

32. Copyright 2009 Justin C. Klein Keane Building PHP with Includes <?php include('inc/foo.php'); require('inc/bar.php'); $a = new Foo(); echo $a->somevar; ?>

33. Copyright 2009 Justin C. Klein Keane Some Useful Built-in Functions for Debugging die(“message”); echo “ ”; print_r($variable); echo phpinfo();

34. Copyright 2009 Justin C. Klein Keane For Next Time 1) Install Eclipse PDT 2) Install the RSE extensions 3) Download the VMWare image for development 4) Connect to the VMWare image web root at: /var/www/html 5) Create a new default page with your name and the PHP configuration information