FEBRUARY 2003
VOLUME II - ISSUE 2
php|architect The Magazine For PHP Professionals
The Object Oriented Evolution of PHP5 A Look At The New OOP Model Using The Zend Engine 2.0 By Zeev Suraski
Creating A Customized Template-Engine Hacking the Smarty Template Engine
www.phparch.com
Enterprise Applications: PHP in a Multitier Environment Data Fingerprinting with Hash Functions in PHP Time Travel: Breadcrumbs and Session History with PHP
Plus:
Tips&Tricks, Book Reviews, Product Reviews and much more..
This copy is registered to: Liwei Cui
[email protected] The designers of PHP offer you the full spectrum of PHP solutions
Serve More. With Less. Zend Performance Suite Reliable Performance Management for PHP
Visit www.zend.com for evaluation version and ROI calculator
Technologies Ltd.
TABLE OF CONTENTS
php|architect Departments
Features 10
INDEX
4
by Peter James
EDITORIAL RANTS
18 5
Time Travel - Breadcrumbs and History with PHP
NEW STUFF
The Object Oriented Evolution of PHP by Zeev Suraski
6
REVIEWS
27
by Dave Palmer
Zend Encoder V.3.1.0
22
REVIEWS
32
LogiCreate
61
TIPS & TRICKS
BOOK REVIEWS
Creating a Customized Template-Engine by Andreas Demmer
38
by John Holmes
65
PHP in an N-Tiered World
Building a Turing Test with PHP and the GD Library by Marco Tabini
47
Using, Reusing and Extending Smarty by Tomica Jovanovic
67
exit(0); Hello, Mr. Gates?
55
Data Fingerprinting with Hash Functions in PHP by Leon Vismer
February 2003 · PHP Architect · www.phparch.com
3
EDITORIAL RANTS
EDITORIAL
L
ately, I’ve been measuring the progress of php|a in terms of “brilliant ideas”. After a careful analysis of our history up to this point, I have noticed that instead of following a smooth linear progression based on constant innovation, our ascension from the ashes of the publishing world seems to have resulted from short-lived but intense flashes of genius, which are then followed by long periods of cerebral inactivity. (A related study also showed that I have way too much time on my hands, but I was far too busy to notice or even care about that). For example, Arbi came up with the idea of calling our magazine “php|architect” after I had been brooding over names like “The PHP Gazette” and “The PHP Informer” for days. I can only be thankful for the completely random sequence of synaptic signals that made that brilliant idea come to life. Given the spontaneity of our collective genius, it would most definitely prove futile to even try to explain how we arrived at our most brilliant idea: to ask Brian Jones, who joined our editorial staff last month, to become our new Editor-in-Chief. I can only say that it was a moment of unparalleled brilliance. I’m sure that we burned a good number of those remaining brain cells which had not yet been fried by years of exposure to the radiation that our monitors happily produce to keep us warm, but it was worth it. This is, therefore, my last editorial as the Editor of php|a. I will still be the Publisher of this magazine and I will do my best to contribute my thoughts to our exit(0) column (whose name
was another flash of inspiration, if I may say so myself), but I will move on to some of the new initiatives that we have in store for you, and Brian will take over the entire editorial process of php|a. As my parting words from my editorial post, let me tell you about the Editor-in-Chief. The post of Editor-in-Chief is instrumental in defining the course and stature of a magazine, and I can only be happy that Brian has decided to accept our request to take this position with us (not to mention how happy I am that someone else will be doing it! But alas, poor foolish soul that he is, Brian will only read this once the magazine has already hit the virtual stands, and by then his fate will be sealed). Naturally, the person who can sport the title of Editor-in-Chief enjoys a great deal of power—a power that Brian promptly abused by asking me to rewrite this editorial, claiming that “my thoughts were too fragmented”. As if. That could ever. Happen. Let me now tell you about the Publisher. The post of Publisher affords great powers as well. That includes the power to edit and reject (did I say reject? I meant “evaluate”) the Editor-inChief’s monthly editorial. Regardless of whether his thoughts are fragmented or not. Ah, the bittersweet taste of revenge...
February 2003 · PHP Architect · www.phparch.com
php|architect Volume II - Issue 2 February, 2003 Publisher Marco Tabini
Editors Arbi Arzoumani Brian K. Jones Marco Tabini Graphics & Layout Arbi Arzoumani
Administration Emanuela Corso
Authors Andreas Demmer, Peter James, Tomica Jovanovic, Dave Palmer, Zeev Suraski, Marco Tabini, Leon Vismer
php|architect (ISSN 1705-1142) is published twelve times a year by Marco Tabini & Associates, Inc., P.O. Box. 3342, Markham, ON L3R 6G6, Canada. Although all possible care has been placed in assuring the accuracy of the contents of this magazine, including all associated source code, listings and figures, the publisher assumes no responsibilities with regards of use of the information contained herein or in all associated material.
Contact Information: General mailbox: Editorial: Subscriptions: Sales & advertising: Technical support:
[email protected] [email protected] [email protected] [email protected] [email protected] Copyright © 2002-2003 Marco Tabini & Associates, Inc. — All Rights Reserved
4
NEW STUFF
NEW STUFF
ionCube Launches New Encoder
British PHP software company ionCube Ltd. released version 2.0 of their standalone Encoder product last month. The new encoder providers additional features compared to its predecessors, such as the possibility of creating text headers that are appended to the encoded files. This could be useful, for example, for creating copyright and ownership notices, as well as instructions and how-to guides at the beginning of each file. The Encoder sells for $349.00 US. For more information, you can visit the ionCube website at : http://www.ioncube.com/encoder TechMeridian Releases XAVIOUR CMS
TechMeridian, a new PHP development company based in the United States, has released a product called XAVIOUR Web Application Platform. According to TechMeridian, XAVIOUR represents a combination of the features normally found in content management and templating systems. It promotes reusability of the code and provides a flexible framework that can easily be extended by writing code directly into the templates, if necessary. XAVIOUR is entirely based on PHP and PostgreSQL, thus providing a platform that can easily be taken to an enterprise-level of stability and performance. The software product costs $199.00 US for a single-domain license. More information can be found on the TechMeridian website at : http://www.techmeridian.com/xaviour
users of the OpenWeb product free of charge. A new full subscription can be purchased for $60 US from the OpenOSX website at : http://openosx.com/openweb/ 2003 PHP Conference in Montréal
This just hot off the press—The Québec PHP Association announced that they will be holding a PHP conference in Montréal, Canada, on March 20th and 21st. The conference will attract a who’s who of the PHP community, from PHP creator Rasmus Lerdorf to Zend-engine co-creator (and php|a author) Zeev Suraski. The conference will include sessions in both French and English, and it is sure to attract visitors from the Americas as well as from Europe. The php|a team will be with a booth and to cover the event. http://phpconf.phpquebec.com/ php|a
We Dare You To Be A Professional. Subscribe to php|a Today and Win a book from Wrox Press
OpenOSX Updates OpenWeb With PHP 4.3.0
MacIntosh open-source software provider OpenOSX have updated their OpenWeb CD product to include the latest version of PHP. OpenWeb is a CD compilation of open-source software for the MacIntosh market designed to provide publishing and development tools to Web developers and webmasters. Besides technologies like Apache, PHP and MySQL, it also includes a shopping card, a content management system and a graphical management interface. The new 2.5.1 update is available to registered
February 2003 · PHP Architect · www.phparch.com
php|architect The Magazine For PHP Professionals
5
REVIEWS
REVIEWS
Reviewed For You
Zend Encoder
V.3.1.0
By Marco Tabini
T
he simplicity and immediateness of a scripting language like PHP is a double-edged sword. On the one hand, everyone has direct access to the source code; no need to compile for separate platforms and distribute separate versions of your application. On the other... everyone has direct access to the source code, which makes the protection of intellectual property really difficult. Let’s face facts, it would be difficult for a software market to exist without some form of code protection. After all, PHP consultants and software developers are selling their knowledge, which, for better or for worse, is somewhat embedded into the source code they produce. The demand for code protection has resulted in several products which have been developed to make it possible to limit the functionality of a PHP script (or a series of scripts) so as to facilitate a commercial licensing scheme. The Zend Encoder, produced by Zend Technologies (yep, the same folks who wrote the Zend Engine on which PHP is based) is a rather complete system that makes it possible to transform a PHP source file into an “intermediate” representation of itself—that is, a preinterpreted set of bytecode instructions that the PHP interpreter would be able to execute but that are quite meaningless to a human being. The resulting file is further mangled to make reverse-engineering almost impossible. In addition, it is possible to require that a
February 2003 · PHP Architect · www.phparch.com
The Cost: $960.00 - $2,880.00 (US) (or less through special small business pricing) Requirements: -Supported PHP versions: 4.0.5 up through 4.3.0. -Supported operating systems: -Linux glibc 2.1 / 2.2 (e.g. RedHat 6.x/7.x/8.x, Debian 4.2, SuSE 6.4, Mandrake 8.1, and others) -Windows® 98 / NT 4.0 / 2000 / XP. -Solaris Sparc 2.6 /2.7 /2.8 (Non-GUI version). -Supported Web Servers for deployment: -Apache 1.3.x, IIS 4 / 5 -Zeus (using FastCGI) or any Web server that supports CGI -The Graphical User Interface is supported under Windows and Linux only. Product Page: Zend Encoder Home Page: Zend Technologies (http://www.zend.com) Company Background: Zend Technologies provides web developers and enterprises using PHP, integrated software solutions for developing, protecting and scaling their PHP applications providing a foundation that allows companies to efficiently and effectively develop PHP based web applications. Zend's founders are the designers of PHP 3, PHP 4 and Zend Engine 1.0; on which all PHP sites and applications are run. They are also currently leading the design and development of PHP 5 and the Zend Engine 2.0.
6
REVIEWS
Zend Encoder V.3.1.0
script only run if a special “license file” is present and provided by the end-user, thus making it possible to limit the execution of a script to a specific timeframe (limited trial), or to specific IPs, and so on. Installation Zend installation systems are, in my experience, among the best ones available to the PHP community. As in most cases, the Encoder is a Java-based application that will run on pretty much any platform—the Zend website allows you to download a version for Windows, Linux or Solaris. On Linux, the platform I tested it on, the application is set up through a very straightforward process that even connects to the Zend website and downloads the appropriate license code automatically. A free 14-day trial of the Encoder is available, its only limitation being that your encoded files will only work for three days, regardless of what settings you choose when converting them.
The User Interface Once installed, the Encoder launched flawlessly—no ifs, ands or buts about it. It features a neat graphical user interface (shown in Figure 1) that makes using the software for the encoding of large numbers of files easy and convenient. As you can see, the interface is based on the concept of a “project”—this way, you can encode entire directories of PHP scripts at the click of a mouse. In fact, I tried to encode the entire php|a website, and the entire operation took only a few seconds. The original files were not overwritten (if they were, I’d lose our source code!), but copied over to a destination folder of our choosing. The program even skipped over our CVS folders automatically! The Encoder supports several options designed to enrich the value of encoded files. For example, it’s possible to prepend a clear-text header to the file that allows you to insert installation or usage comments, or even plain PHP code that is executed if the server is not set up properly to accept encoded files. In addition,
Figure 1
February 2003 · PHP Architect · www.phparch.com
7
REVIEWS the Encoder also applies several optimizations to the code while encoding it (although I did not find much in the way of improvement to our scripts’ performance... I guess we just write good code!), and it is possible to require that each encoded script only work with other encoded scripts. This last feature can be very important if, for example, your include files contain your custom license authentication mechanism and you don’t want them to be replaced with dummy versions that circumvent your scheme.
Zend Encoder V.3.1.0 Figure 2
Licensing Capabilities Perhaps one of the most interesting features of the Encoder is its ability to encode a project and control the functionality that an end-user has access to by issuing a special license file. This can be very useful if you plan to offer specialized “trial” versions of your application that the end-user can play with, build upon as needed and then upgrade to a “full” version by just installing a single file. Licensing is only available if support for it is activated when a script is encoded. The licensing screen (Figure 2) offers a wide variety of options, including the ability to limit the execution of the scripts using constraints such as time or IP or even a hardware ID that is generated by a small Zend application distributed together with the Encoder. Distributing the Code Once encrypted, a project can be redistributed by simply transferring the files to another system. Depending on the settings, you may also need to distribute a license file. In order to execute your script on a target system, your customers will need to install a copy of the Zend Optimizer together with their installation of PHP. This is not normally a big problem, as the Optimizer is a freely available product whose installation only require a small change in the php.ini file. However, if the application is being hosted by a third party, it might be difficult to convince them to install this software. Advanced Capabilities And Documentation In addition to the GUI, the Encoder also features the necessary tools for encoding scripts and generating license files on-the-fly through a command-line executable. This can be helpful if your goal is to hand out February 2003 · PHP Architect · www.phparch.com
licenses in an automated fashion directly from a website. There is no online help for the Encoder, but the installation includes a well-thought-out manual in PDF format that provides plenty of information on using the Encoder, both programmatically and from the GUI. Unfortunately, neither the installation program nor the GUI application itself offers any hints that the documentation itself exists, and this may discourage the less-than-zealous user. Bottom Line The Zend Encoder is not a cheap product, although you can actually get it very inexpensively through the Zend Small Business Program that we illustrated in last month’s issue of php|a ($295.00 US will grant you a license to the Encoder, the Zend Studio IDE and the Zend Performance Suite). However, it is also a very well-thought-out product that offers ease-of-use and consistency—something you don’t always find in the world of PHP. If you’re looking for a way to protect your products and want the maximum flexibility possible, then I recommend you check this product out. If your business qualifies for the Small Business Program (visit http://www.zend.com/store/products/zendsmallbiz.php for more information). I think you will find that the entire package offers tremendous value at a very reasonable price. php|a
8
FEATURES
FEATURES
Time Travel Breadcrumbs and History with PHP By Peter James
With all of the things to consider when designing and laying out your site, you can quickly become lost and overwhelmed. Usability, accessibility and localization usually require attention before a single line of code is written. While I can’t possibly hope to cover all of these topics meaningfully in a single article, what I can do is give you some code to implement one very important (and often overlooked) tool to increase your site’s usability: Breadcrumbs.
Introduction The great philosopher and novelist George Santayana once told us: “Those who cannot remember the past are condemned to repeat it.” The past has always been a vital part of the present. Like a map, it tells us where we’ve been and gives us important information with which to make decisions about the future. If you’re asking yourself what all of this has to do with PHP, let me show you. Information is critical. If you are reading this magazine, your business probably revolves around information, and you probably recognize the value of that information to the people who want it. The fact is, regardless of what your business is, every time someone visits your site you have the opportunity to capture useful information about them. That information can be used to significantly enhance their experience on your site, and there are many levels of detail to be had. For instance, you could request that users register and log in to your site, which usually has required the provision of at least some personal information on behalf of the end user. You could use this to contact your customers with promotions or newsletters, or target their demographic (age, gender, location) with advertising. While the gleaning of this personal data requires action from the user (ie, voluntary registra-
February 2003 · PHP Architect · www.phparch.com
tion), other types of information can be gathered passively and silently. A prime example of the type of data which can be collected behind the scenes is ‘patterns of use’ information. This can provide invaluable insight into how your site is being used, allowing you to make decisions about the layout of your site. This could influence link
Information is critical. If you are reading this magazine, your business probably revolves around information, and you probably recognize the value of that information to the people who want it. REQUIREMENTS PHP Version: 4.0 and Above O/S: Any Additional Software: N/A
10
FEATURES placement, advertisement placement and numerous other factors. As an aside, one popular tool that can aid in the discovery and inspection of this data is phpOpenTracker. Another silently collected class of data, which will be our primary focus in this article, is the history of the current session. This is the most easily handled type of information. We can get it as they navigate, use it while we have them on the site, and then discard it when their session ends. Unlike many other types of desirable user data, it doesn’t require a database or the associated design; it is very transient. Interestingly enough, if stored across sessions, the history provides patterns of use data, which we mention briefly above. Among many other things, this information can be used to provide enhanced navigation options, called ‘breadcrumbs’, which is the subject of this article. First, I’ll first explain what breadcrumbs are, and then I’ll examine in detail the ways in which breadcrumbs can be used, giving you plenty of usable code along the way. A note about the coding style used in my examples In all of my examples involving sessions, I will use the $_SESSION[] array, rather than the associated globals. Aside from being what I consider to be a cleaner approach, this will reduce the chance for the introduction of errors by, for example, missing a session_register() call. I also do not assume in these examples that you will have register_globals enabled in your php.ini file. This will ensure maximum compatibility with different systems and PHP implementations. Of Bread and Crumbs ‘...and Hansel comforted his little sister and said: “Just wait, Gretel, until the moon rises, and then we shall see the crumbs of bread which I have strewn about, they will show us our way home again.’ - Hansel and Gretel - Brothers Grimm, et al Earning their name from the above-quoted famous tale, breadcrumbs are a navigation tool that helps the user find their context, and quickly navigate back to anywhere in that context. Breadcrumbs can be used to expose the structure of the site to the user, allowing them to learn the location of items. Usually found near the top of a web page under the title banner, breadcrumbs can be created using any server-side or client-side language. An example breadcrumb is shown in Figure A, and a nice, live example of breadcrumbs can be found at Google’s web directory at http://directory.google.com/ February 2003 · PHP Architect · www.phparch.com
Time Travel - Breadcrumbs and History with PHP
Figure A Home > Life > Plants > Flowers > Daisy
Usability expert Keith Instone tells us that there are generally two different types of breadcrumbs: location and path. Location breadcrumbs are useful on hierarchical sites, and represent a straight line from home (or the root) to your current location. This is similar to a file path in the Windows Explorer location bar, or the output of the pwd command in Unix, and is what we saw in Figure A. Path breadcrumbs are much less structured, and show the actual path you took to your current location, as in Figure B. Hence, if you jump in from a search engine, you’ll see a breadcrumb with only one crumb. Clicking a link on that page will take you to another page on that site, where you will then see two crumbs, and so forth. This can be used on non-hierarchical sites to supplement with a visual what’s under the browser’s back button. Figure B Store > Tables > Wines > Tables > Liquers > Edit
Is that clear? Location breadcrumbs are like a ‘You are here’ marker on a map, and path breadcrumbs are like a highlighted route on a map. Location breadcrumbs are more focused on where you are in the scheme of things, whereas a path breadcrumb is more concerned about the way you came. As an aside, it may be that if you used a search engine and looked for “daisy”, you might come across the page in Figure A directly. Strangely, you may still see the full location breadcrumb, even though you didn’t navigate through those points. This is because pages on sites that implement location breadcrumbs typically know their way home. This can work in a couple of different ways, which I’ll discuss a little later. Because they are the most common form, this article will focus on the location breadcrumb concept, although I will relate back to path breadcrumbs when appropriate. In fact, the second example that we will cover will actually be a hybrid that looks like a location breadcrumb, but the processing underneath is closely related to that of the path breadcrumb method. From this point on, unless otherwise noted, when I talk about breadcrumbs I’ll be referring to location breadcrumbs. More About Breadcrumbs Breadcrumbs usually will appear like a directory struc-
11
FEATURES
Time Travel - Breadcrumbs and History with PHP
ture, which is appropriate since they work best when you have a highly hierarchical site layout. A user can quickly navigate to any previous level by clicking one of the links in the breadcrumb. For instance, if a user clicked on the Plants link in Figure A, she would likely see a page listing the different types of plants, such as flowers, trees, and grasses. The breadcrumb found on that page might look like Figure C. Figure C Home > Life > Plants
Breadcrumb separators can be anything, including images, but are commonly one of a number of semiintuitive characters, as shown in Figure D. Figure D Home Home Home Home
> | : /
Movies > Animated Plays | Comedies Cooking : Fish Monsters / Sully
The links, such as Home and Monsters above, are links that contain just enough informtion to get you back to that place in your session history. Depending on your intention, and the layout of the site, this information can be very different, ranging from a plain script name through to a full blown URL. (or even a Javascript function call). HarveysHTMLHaven.com Let’s set the stage. Harvey is an aspiring business leader, and his final project while studying for his MBA required a business idea that related to IT. Harvey thought about it (no pun intended), and decided that as a part of his business he could resell web code and graphics. All he had to do was browse the web for an hour or two, and he’d have enough code and images to start up his business, HarveysHTMLHaven.com. Harvey ended up using a highly hierarchical physical structure for his site. Directories named images and code resided in his site’s home directory. Inside of the images directory were four more directories named buttons, clipart, icons and photos. Inside each of these were, potentially, gif, jpg and png. The code directory had a similarly nested structure. For brevity, we’ll focus only on the images tree. A user could follow links down any of these paths, and Harvey was concerned that the user would lose their bearings and become frustrated. He wanted to maintain some sort of map back to home at all times. Breadcrumbs to the rescue! This is the easiest form of breadcrumb to implement, because it is a more or less static structure. Sure, Harvey may add images to his February 2003 · PHP Architect · www.phparch.com
individual library pages, but the category layout is mostly static. Let’s write some code. In Figure F, you’ll see a simple class that I created to show how easy it is to deploy this form of breadcrumb. Let’s examine this code. I needn’t have used a class here, but it provides nice encapsulation. The class’s job is to build breadcrumbs from the script’s URL, and return the finished product. There are two member variables: $_separator, which contains the character used to delimit the links in the breadcrumb, and $_label_map, which is a list of labels to use for directory names. This code works off of the directories in the script’s URL, and the label map allows us to give these directory levels descriptive labels, rather than output the raw directory names. The class also contains a basic constructor, as well as a couple of gratuitous setter functions. The main functionality, though, comes from get_output(), which actually produces the breadcrumb. Let’s look at how. It first gets the script’s path from the $PHP_SELF server variable. If this class was instantiated from the script running at http://www.example.com/foo/bar/index.php an example of what we’d get from this variable is /foo/bar/index.php. The method then gets the highest directory in the path, also the current directory, which in this case would be bar. Then it explodes the path and puts all of the pieces into the $dirs variable. It now loops over all of the entries in $dirs. $base keeps a running concatenation of the directories already processed and is the basis for all links in the breadcrumb. As each directory is processed, the loop searches for an entry in the $label_map and, if one is found, outputs a breadcrumb using the current $base value, and the label from the map. Once all of the directories are processed, the $crumbs are joined together using $separator, and Figure G
12
FEATURES
Time Travel - Breadcrumbs and History with PHP
returned to the caller. Figure G contains the code to use this class for Harvey’s site. Harvey simply includes this file at the point in his page where he wants the breadcrumb to appear, and he’s in business. The code is very simple. A label map is defined, and the SimpleBreadcrumb class is instantiated using it.
Harvey is happy with the default separator, so he doesn’t pass any in. Finally, he gets the output, and prints it. This is a pretty simple class, but it provides very powerful functionality for a simple directory-oriented site such as Harvey’s. Although we know that this is a very simple example,
Figure F 1
February 2003 · PHP Architect · www.phparch.com
13
FEATURES let’s mention a couple of its limitations. First, it is dependent on a directory structure, which makes it very fragile. This class simply doesn’t work if your site is not laid out by directory, since that’s where the breadcrumbs come from. Second, it doesn’t actually maintain any history. Although the URL in a site structured by directory can generally be interpreted as the history (if your site is navigated linearly) the breadcrumbs are still built directly from it without any regard for querystring variables, or the path actually taken. This severely limits how flexible this class is. Let’s leave Harvey to his questionable business ideas, and move on to a more complex situation involving (almost) everyone’s favorite relative.
Time Travel - Breadcrumbs and History with PHP
State and History
Granny Smith had a dream of being an online kingpin. After some thought, she decided that the best way to begin her dynasty was to open an e-store, and wait for the riches to flood in. She even started buying pants with extra-big pockets, so she’d have room for all the money she was going to make. Her store, GrannysGiftGaggle.com is an emporium of goodies, from health food to hinges. If you can buy it, you can buy it at Granny’s. She has hundreds of categories and thousands of sub-categories. Let’s examine the structure a little further. All activity on GrannysGiftGaggle.com comes through specialized points of access, or controller scripts, and as I mentioned earlier, there is no really structured physical underlay for Granny’s site. She mostly relies on the data passed in on the querystring to get the current state, which determines what to show. Since the querystring will determine the current page, it might be educational for us to follow a simple set of transactions on Granny’s site, and see how people navigate around in Figure H.
State can be defined as a “unique snapshot that is quantified by values for a set of variables, characterizing the web site for a period of time, and is different from other states.” This is rather like your checkbook. Right now, if it is balanced, you have a certain set of possessions, and a certain amount of money left. Your checkbook, and life, is in a particular state. Writing a check will transition you to another state (hopefully not a broke one). In order to get the information we need for the state, we must first ask the question: What identifies it? The answer to that question depends on the way you’ve put your site together, and may end up being a very complicated question to answer. Harvey used his directory names to identify state, which was very simple. Granny doesn’t really have that luxury, so she will need to perform a little more magic. While Granny doesn’t have a physically hierarchical system, we can see from the above transaction that she does have a home directory, which appears to contain a products directory and an estore directory. This allows us to use Harvey’s system for part of the breadcrumb generation. The rest of the breadcrumb will need to be created from the incoming querystrings. Granny’s breadcrumbs will be a little different, not only in method, but also in construction. Granny’s breadcrumbs will aggregate themselves based on the user’s history, rather than building fresh on each page, like Harvey’s. The reason for this is that Harvey had all of the states built into each request (because of the URL), whereas Granny doesn’t. The subcategory page request contains no direct information about what page it came from. The user’s history is just a stored collection of past states. As an example, the user’s session history, after selecting the football category on Granny’s site, would contain the following states.
Disclaimer: This is obviously not intended to be a tutorial on how to write a shopping cart application, and is only a very rough example, for demonstration purposes, of how an application like this might work.
1. Home – no variables, no directories 2. Product Categories – no variables, products directory 3. Football Sub-Categories – category=football variable , products directory
Now that we’ve got the view from 50,000 feet on how Granny’s site works, we can move on to what we need to make breadcrumbs work. You may have seen some information in the links above that might be useful for generating breadcrumbs. This information will provide what breadcrumbs require: state.
This is starting to look suspiciously like a breadcrumb! Let’s see the code to “make it so, Number One”. It’s listed in Figure I. It’s ironic that this is the ComplexBreadcrumb class, when the code is almost simpler than the SimpleBreadcrumb class that we discussed earlier. Regardless, I’ll walk through this code. Again, I really didn’t need to use a class here, but there it is. The purpose of the class is to store state history in the
GrannysGiftGaggle.com
February 2003 · PHP Architect · www.phparch.com
14
FEATURES
Time Travel - Breadcrumbs and History with PHP
user’s session and allow retrieval of state in breadcrumb form. It has two member variables, $_separator, and $_current_state. $_separator again contains the character used to delimit the breadcrumb’s links, while $_current_state contains the label of the current state. This label is used as a crude lookup later. The class also contains a very basic constructor, which can optionally initialize the breadcrumb separator at instantiation. A setter function is also provided for this purpose. The meat of the class is contained in the get_output() method. This method first checks to see if a state has been registered for the current page. If not, it returns an empty string. If get_output() did detect a current state, it makes a non-linked breadcrumb entry for it, and then proceeds to process the parents of that state. For each parent, the state variables are URL-encoded and links are produced.
Once all of the parents have been processed, the array of $crumbs is reversed because we built it rightto-left, but want to display it left-to-right. Finally, the completed breadcrumb string is returned. Figure J shows a usage example of the ComplexBreadcrumb class. This file could be either included or embedded in the code that handles the case where category is set, as in http://grannysgiftgaggle.com/products/?category=football. This usage code instantiates our new class, and just to be different, changes the output separator to a forward slash. Since this is specific to the category state, it gets the category from the $_GET array, and sets the state accordingly. Finally, it gets the output and displays it. I have no doubt that using a little ingenuity specific to the situation, it would be possible to generalize this usage code and use it as a common include file, similar to Harvey’s.
Figure H 1
http://grannysgiftgaggle.com/
First the user navigates to the main page, where they are presented with, among other things, a link to the products section.
2
http://grannysgiftgaggle.com/products/
When the user navigates to the products section, they are presented with a number of product categories
3
http://grannysgiftgaggle.com/products/?category=football
Once a category is selected, a list of subcategories will appear.
4
http://grannysgiftgaggle.com/products/?subcategory=footballs
After they select a category, a list of products appears.
5
http://grannysgiftgaggle.com/products/?product_id=A1234
Once a product is chosen, the user may browse through any amount of relevant information about it, including the description, testimonials, specifications and supporting material.
6
https://grannysgiftgaggle.com/estor Once the user is happy with the product, they may e/?cart=add&prod_id=A1234 choose to add it to the cart.
7
https://grannysgiftgaggle.com/estor If no other products are wanted, the next logical e/?cart=checkout step is to check out.
8
https://grannysgiftgaggle.com/estor The checkout is multi-stage. First they must enter e/?cart=checkout&subpage=shipping their shipping address, and pick the delivery method.
9
https://grannysgiftgaggle.com/estor e/?cart=checkout&subpage=billing
Second, they enter their billing information.
10
https://grannysgiftgaggle.com/estor e/?cart=checkout&subpage=confirm
Then they confirm the order.
11
https://grannysgiftgaggle.com/estor e/?cart=checkout&subpage=receipt
And lastly, they get the receipt
February 2003 · PHP Architect · www.phparch.com
15
FEATURES
Time Travel - Breadcrumbs and History with PHP Figure I
1 " method=post> 62 Congratulations! You're either human or a really smart machine!
February 2003 · PHP Architect · www.phparch.com
42
FEATURES
Building a Turing Test with PHP and the GD Library
On To The Code
Improving The Test
Listing 2 shows an implementation of our Turing Test. As you can see, aside from the GenerateImage() function, there is little new here. The AdministerTest() function is used to generate the form that requests the user to validate the combination. The script calls this function directly whenever it is not invoked through a POST operation, which would indicate that the user is actually submitting information. Otherwise, the CheckResults() function is called, and the user’s input is matched against the MD5 hash of the original combination.
As it is, the test is not really foolproof. The use of just six digits and a well-known hashing algorithm, in fact, makes it relatively easy to write a bot that can bruteforce hack the combination. For example, take a look at the script in Listing 3, which loads up the HTML produced by Listing 2 and simply cycles through all the possible 6-digit combinations between 100,000 and 999,999 until it has found the one whose MD5 hash matches the value passed along by the script. As you can see for Figure 2, even on a relatively low-end machine like mine (I use a Celeron-based computer),
Listing 3 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54
