Internet Programming 622 Study Hub

This example follows the guide's registration.html and process_registration.php idea, but it applies the later security and empty-field rules so the revision version is safer than the first teaching example. It demonstrates form handling only; it does not create an account or store a password.

registration.html: save this form beside process_registration.php. Each control name matches a key used by the handler below.

<!doctype html>
<html lang="en">
<head>
	<meta charset="utf-8">
	<meta name="viewport" content="width=device-width, initial-scale=1">
	<title>Widget Club Registration</title>
</head>
<body>
	<h1>Join the Widget Club</h1>
	<form action="process_registration.php" method="post">
		<p>
			<label for="firstName">First name</label>
			<input id="firstName" name="firstName" type="text" required>
		</p>
		<p>
			<label for="lastName">Last name</label>
			<input id="lastName" name="lastName" type="text" required>
		</p>
		<p>
			<label for="password1">Password</label>
			<input id="password1" name="password1" type="password" required>
		</p>
		<p>
			<label for="password2">Confirm password</label>
			<input id="password2" name="password2" type="password" required>
		</p>
		<fieldset>
			<legend>Gender</legend>
			<label><input name="gender" type="radio" value="female" required> Female</label>
			<label><input name="gender" type="radio" value="male"> Male</label>
			<label><input name="gender" type="radio" value="other"> Prefer to self-describe</label>
		</fieldset>
		<p>
			<label for="favoriteWidget">Favorite widget</label>
			<select id="favoriteWidget" name="favoriteWidget">
				<option value="">Choose one (optional)</option>
				<option value="clockwork bird">Clockwork bird</option>
				<option value="pocket telescope">Pocket telescope</option>
				<option value="self-stirring mug">Self-stirring mug</option>
			</select>
		</p>
		<p>
			<label><input name="newsletter" type="checkbox" value="yes"> Send me the newsletter</label>
		</p>
		<p>
			<label for="comments">Comments (optional)</label>
			<textarea id="comments" name="comments" rows="4" cols="40"></textarea>
		</p>
		<button type="submit">Send registration</button>
	</form>
</body>
</html>

process_registration.php: read the submitted values, check required fields, then escape text before displaying it.

<?php
// process_registration.php
// This script receives the Widget Club form through method="post".
// Every key below must match a form control's name attribute.

$requiredFields = ["firstName", "lastName", "password1", "password2", "gender"];
$missingFields = [];

foreach ($requiredFields as $fieldName) {
	// empty() catches fields that exist but contain an empty string.
	// It is useful for required text and password fields.
	if (empty($_POST[$fieldName])) {
		$missingFields[] = $fieldName;
	}
}

// The newsletter checkbox is optional, so it may not exist in $_POST.
// isset() avoids an undefined index notice when the box was not ticked.
$newsletter = isset($_POST["newsletter"]) ? "yes" : "no";

// Escape output before displaying submitted text in HTML.
$firstName = htmlspecialchars($_POST["firstName"] ?? "");
$lastName = htmlspecialchars($_POST["lastName"] ?? "");
$favoriteWidget = htmlspecialchars($_POST["favoriteWidget"] ?? "");
$comments = htmlspecialchars($_POST["comments"] ?? "");

if ($missingFields) {
	echo "<h1>Please complete the required fields</h1>";
	echo "<p>Missing: " . htmlspecialchars(implode(", ", $missingFields)) . "</p>";
	exit;
}

if ($_POST["password1"] !== $_POST["password2"]) {
	echo "<p>The passwords do not match. Please try again.</p>";
	exit;
}

echo "<h1>Thank You</h1>";
echo "<dl>";
echo "<dt>First name</dt><dd>$firstName</dd>";
echo "<dt>Last name</dt><dd>$lastName</dd>";
echo "<dt>Gender</dt><dd>" . htmlspecialchars($_POST["gender"]) . "</dd>";
echo "<dt>Favorite widget</dt><dd>$favoriteWidget</dd>";
echo "<dt>Newsletter</dt><dd>$newsletter</dd>";
echo "<dt>Comments</dt><dd>$comments</dd>";
echo "</dl>";

// Exam trap: the guide's first handler printed the submitted password.
// A secure revision answer should never display password values back to the user.
?>

This single-file example combines an HTML form with a PHP POST handler. It checks that the learner name is present and no longer than 40 characters, that the topic is one of the allowed choices, and that minutes is an integer from 5 to 180. Save it as study-log.php and run it through a PHP-enabled local server. The character-count check uses PHP's mbstring extension.

study-log.php: the handler runs before any HTML is sent, so validation and response output can be decided first.

<?php
// The allowed values are defined by the server, not trusted from the request.
$topics = ["HTML forms", "PHP validation", "Cookies and sessions"];
$form = ["learner" => "", "topic" => "", "minutes" => ""];
$errors = [];
$minutesValue = null;
$submitted = $_SERVER["REQUEST_METHOD"] === "POST";

if ($submitted) {
    // Ignore unexpected array input; normal form controls submit strings.
    foreach (["learner", "topic", "minutes"] as $field) {
        $value = $_POST[$field] ?? "";
        $form[$field] = is_string($value) ? trim($value) : "";
    }

    if ($form["learner"] === "") {
        $errors[] = "Your name is required.";
    } elseif (mb_strlen($form["learner"], "UTF-8") > 40) {
        $errors[] = "Your name must be 40 characters or fewer.";
    }

    if (!in_array($form["topic"], $topics, true)) {
        $errors[] = "Choose a valid study topic.";
    }

    $minutesValue = filter_var($form["minutes"], FILTER_VALIDATE_INT);
    if ($minutesValue === false || $minutesValue < 5 || $minutesValue > 180) {
        $errors[] = "Minutes must be a whole number from 5 through 180.";
    }
}

function escapeHtml(string $value): string {
    return htmlspecialchars($value, ENT_QUOTES | ENT_SUBSTITUTE, "UTF-8");
}
?>
<!doctype html>
<html lang="en">
<head>
    <meta charset="utf-8">
    <meta name="viewport" content="width=device-width, initial-scale=1">
    <title>Study Session Log</title>
</head>
<body>
    <h1>Log a study session</h1>

    <?php if ($submitted && $errors): ?>
        <div role="alert">
            <h2>Please correct these items</h2>
            <ul>
                <?php foreach ($errors as $error): ?>
                    <li><?= escapeHtml($error) ?></li>
                <?php endforeach; ?>
            </ul>
        </div>
    <?php elseif ($submitted): ?>
        <p role="status">
            <?= escapeHtml($form["learner"]) ?> studied
            <?= escapeHtml($form["topic"]) ?> for <?= $minutesValue ?> minutes.
        </p>
    <?php endif; ?>

    <form action="study-log.php" method="post">
        <p>
            <label for="learner">Your name</label>
            <input id="learner" name="learner" type="text" maxlength="40" required
                   value="<?= escapeHtml($form["learner"]) ?>">
        </p>
        <p>
            <label for="topic">Study topic</label>
            <select id="topic" name="topic" required>
                <option value="">Choose a topic</option>
                <?php foreach ($topics as $topic): ?>
                    <option value="<?= escapeHtml($topic) ?>"<?= $form["topic"] === $topic ? " selected" : "" ?>><?= escapeHtml($topic) ?></option>
                <?php endforeach; ?>
            </select>
        </p>
        <p>
            <label for="minutes">Minutes (5–180)</label>
            <input id="minutes" name="minutes" type="number" min="5" max="180" step="1" required
                   value="<?= escapeHtml($form["minutes"]) ?>">
        </p>
        <button type="submit">Save study session</button>
    </form>
</body>
</html>

• $_SERVER["REQUEST_METHOD"] selects the POST-processing path; the first page visit only displays the form.
• $_POST[$field] ?? "" handles absent controls. The is_string() guard also avoids warnings if a request submits an array instead of a normal text value.
• in_array(..., true) checks the submitted topic against the server-side allowlist using strict comparison.
• filter_var(..., FILTER_VALIDATE_INT) rejects non-integers; the following comparisons enforce the permitted range.
• HTML attributes and displayed text are escaped when output. Browser constraints such as required, maxlength, and min/max help users but do not replace server-side validation.

Review request superglobals · Review output security · Review form validation

Use name="languages[]" so PHP receives an array. Accept only known options, then escape each value before HTML output.

<?php
$allowed = ["PHP", "JavaScript", "Python"];
$selected = [];
if ($_SERVER["REQUEST_METHOD"] === "POST") {
	$raw = $_POST["languages"] ?? [];
	if (!is_array($raw)) $raw = [];
	$selected = array_values(array_intersect($allowed, $raw));
	echo "<p>Selected: " . htmlspecialchars(implode(", ", $selected), ENT_QUOTES, "UTF-8") . "</p>";
}
?>
<form method="post">
	<label for="languages">Favourite languages</label>
	<select id="languages" name="languages[]" multiple size="3">
		<?php foreach ($allowed as $language): ?>
			<option value="<?= htmlspecialchars($language, ENT_QUOTES, "UTF-8") ?>"<?= in_array($language, $selected, true) ? " selected" : "" ?>><?= htmlspecialchars($language, ENT_QUOTES, "UTF-8") ?></option>
		<?php endforeach; ?>
	</select>
	<button type="submit">Submit</button>
</form>

This matches the review requirements: JPG/JPEG/PNG only, at most 2 MB, saved in uploads/, with an error if a check fails. The image content is checked as well as the filename extension. Save as upload.php and ensure the web server can write to the project folder.

<?php
$message = "";
$imageUrl = "";
if ($_SERVER["REQUEST_METHOD"] === "POST") {
	$file = $_FILES["photo"] ?? null;
	if (!$file || $file["error"] !== UPLOAD_ERR_OK) {
		$message = "Choose an image and try again.";
	} elseif ($file["size"] > 2 * 1024 * 1024) {
		$message = "The image must be 2 MB or smaller.";
	} else {
		$extension = strtolower(pathinfo($file["name"], PATHINFO_EXTENSION));
		$type = (new finfo(FILEINFO_MIME_TYPE))->file($file["tmp_name"]);
		$allowed = ["jpg" => "image/jpeg", "jpeg" => "image/jpeg", "png" => "image/png"];
		if (!isset($allowed[$extension]) || $allowed[$extension] !== $type || getimagesize($file["tmp_name"]) === false) {
			$message = "Only JPG, JPEG, and PNG images are allowed.";
		} else {
			$folder = __DIR__ . "/uploads";
			if (!is_dir($folder) && !mkdir($folder, 0755)) {
				$message = "Could not create the uploads folder.";
			} else {
				$name = bin2hex(random_bytes(16)) . "." . $extension;
				if (move_uploaded_file($file["tmp_name"], $folder . "/" . $name)) {
					$imageUrl = "uploads/" . $name;
				} else {
					$message = "Could not save the uploaded image.";
				}
			}
		}
	}
}
?>
<form method="post" enctype="multipart/form-data">
	<label for="photo">Image (JPG or PNG, up to 2 MB)</label>
	<input id="photo" name="photo" type="file" accept=".jpg,.jpeg,.png" required>
	<button type="submit">Upload</button>
</form>
<?php if ($message !== ""): ?><p><?= htmlspecialchars($message, ENT_QUOTES, "UTF-8") ?></p><?php endif; ?>
<?php if ($imageUrl !== ""): ?><img src="<?= htmlspecialchars($imageUrl, ENT_QUOTES, "UTF-8") ?>" alt="Uploaded image"><?php endif; ?>

The review requires a prepared statement, password hashing, and safe output. Assume a users table with username and password_hash columns, a working $conn MySQLi connection, and HTTPS. Save the hash at registration; never save the original password.

<?php
// During registration, after validating the submitted password:
$hash = password_hash($password, PASSWORD_DEFAULT);
$insert = mysqli_prepare($conn, "INSERT INTO users (username, password_hash) VALUES (?, ?)");
mysqli_stmt_bind_param($insert, "ss", $username, $hash);
mysqli_stmt_execute($insert);
mysqli_stmt_close($insert);

// During login, retrieve the stored hash with a parameterized query:
$username = trim($_POST["username"] ?? "");
$password = $_POST["password"] ?? "";
$query = mysqli_prepare($conn, "SELECT password_hash FROM users WHERE username = ?");
mysqli_stmt_bind_param($query, "s", $username);
mysqli_stmt_execute($query);
mysqli_stmt_bind_result($query, $storedHash);
$found = mysqli_stmt_fetch($query);
mysqli_stmt_close($query);
if ($found && password_verify($password, $storedHash)) {
	session_start();
	session_regenerate_id(true);
	$_SESSION["username"] = $username;
	echo "Welcome, " . htmlspecialchars($username, ENT_QUOTES, "UTF-8");
} else {
	echo "Invalid username or password.";
}

Check connection and statement errors in a real application. The form uses method="post" and password input type="password"; output escaping protects the greeting, while the prepared query protects SQL parameters.

The study guide’s preference flow uses a form page, a cookie-setting handler, and a demo page that reads the cookies. These files are self-contained and use only local PHP; the compact save_state.php version is included as a one-file alternative. Cookie headers are sent before page output, and the chosen values are checked against an allowlist.

colors.php · choose the preferences:

<!doctype html>
<html lang="en">
<head>
	<meta charset="utf-8">
	<meta name="viewport" content="width=device-width, initial-scale=1">
	<title>Set Your Preferences</title>
</head>
<body>
	<h1>Choose page colours</h1>
	<form action="prefs.php" method="post">
		<p>
			<label for="background">Background</label>
			<select id="background" name="background">
				<option value="white">White</option>
				<option value="black">Black</option>
				<option value="red">Red</option>
				<option value="blue">Blue</option>
			</select>
		</p>
		<p>
			<label for="foreground">Text colour</label>
			<select id="foreground" name="foreground">
				<option value="black">Black</option>
				<option value="white">White</option>
				<option value="red">Red</option>
				<option value="blue">Blue</option>
			</select>
		</p>
		<button type="submit">Save preferences</button>
	</form>
</body>
</html>

prefs.php · validate the selections, set both cookies, and confirm:

<?php
// prefs.php
$colors = [
	"black" => "#000000",
	"white" => "#ffffff",
	"red" => "#ff0000",
	"blue" => "#0000ff",
];

$backgroundName = $_POST["background"] ?? "";
$foregroundName = $_POST["foreground"] ?? "";

if (!is_string($backgroundName) || !is_string($foregroundName) || !array_key_exists($backgroundName, $colors) || !array_key_exists($foregroundName, $colors)) {
	http_response_code(400);
	exit("Choose a valid background and text colour.");
}

// The browser sends these cookie values back on a later request.
setcookie("bg", $backgroundName, time() + (60 * 60 * 24 * 7));
setcookie("fg", $foregroundName, time() + (60 * 60 * 24 * 7));
?>
<!doctype html>
<html lang="en">
<head><meta charset="utf-8"><title>Preferences Saved</title></head>
<body>
	<h1>Preferences saved</h1>
	<p>Background: <?= $backgroundName ?></p>
	<p>Text: <?= $foregroundName ?></p>
	<p><a href="prefs_demo.php">View the page with these preferences</a></p>
</body>
</html>

prefs_demo.php · read the cookies on the next request and apply the allowlisted colours:

<?php
// prefs_demo.php
$colors = [
	"black" => "#000000",
	"white" => "#ffffff",
	"red" => "#ff0000",
	"blue" => "#0000ff",
];

$backgroundName = $_COOKIE["bg"] ?? "white";
$foregroundName = $_COOKIE["fg"] ?? "black";
if (!is_string($backgroundName) || !array_key_exists($backgroundName, $colors)) $backgroundName = "white";
if (!is_string($foregroundName) || !array_key_exists($foregroundName, $colors)) $foregroundName = "black";
?>
<!doctype html>
<html lang="en">
<head>
	<meta charset="utf-8">
	<meta name="viewport" content="width=device-width, initial-scale=1">
	<title>Widget Club Store</title>
</head>
<body style="background-color: <?= $colors[$backgroundName] ?>; color: <?= $colors[$foregroundName] ?>">
	<h1>Welcome to the Widget Club store</h1>
	<p>Your colour preferences came from cookies returned by the browser.</p>
	<p><a href="colors.php">Change preferences</a></p>
</body>
</html>

save_state.php · optional one-file version: this alternative combines the form and preference handling in one page.

<?php
// save_state.php
$validColours = ["gray", "white", "black", "blue", "green"];
$backgroundName = $_COOKIE["bgcolor"] ?? "gray";

if ($_SERVER["REQUEST_METHOD"] === "POST") {
	$postedColour = $_POST["bgcolor"] ?? "";
	if (in_array($postedColour, $validColours, true)) {
		$backgroundName = $postedColour;
		setcookie("bgcolor", $backgroundName, time() + (60 * 60 * 24 * 7));
	}
}
if (!in_array($backgroundName, $validColours, true)) $backgroundName = "gray";
?>
<!doctype html>
<html lang="en">
<head><meta charset="utf-8"><title>Save It</title></head>
<body style="background-color: <?= $backgroundName ?>">
	<form action="save_state.php" method="post">
		<label for="bgcolor">Background colour</label>
		<select id="bgcolor" name="bgcolor">
			<?php foreach ($validColours as $colour): ?>
				<option value="<?= $colour ?>" <?= $colour === $backgroundName ? "selected" : "" ?>><?= ucfirst($colour) ?></option>
			<?php endforeach; ?>
		</select>
		<button type="submit">Save preference</button>
	</form>
</body>
</html>

This combines the guide's practical tasks for example.txt and the hit-counter example using count.dat. Notice how the script checks existence before reading and closes each file handle after use.

<?php
// file_status_and_counter.php
// Demonstrates file_exists(), filesize(), filemtime(), fopen(), fread(), fwrite(), and fclose().

$exampleFile = "example.txt";

if (file_exists($exampleFile)) {
	echo "<p>File size: " . filesize($exampleFile) . " bytes</p>";
	echo "<p>Last modified: " . date("Y-m-d H:i:s", filemtime($exampleFile)) . "</p>";
} else {
	// file_put_contents() creates or overwrites the whole file in one call.
	file_put_contents($exampleFile, "Hello, this is a new file!");
	echo "<p>example.txt was created.</p>";
}

$counterFile = "counter.txt";

if (!file_exists($counterFile)) {
	// Create the counter file with an initial zero.
	file_put_contents($counterFile, "0", LOCK_EX);
}

$handle = fopen($counterFile, "r");
if (!$handle) {
	die("Cannot read the counter file.");
}

// Read up to 20 characters and cast the result to an integer.
$counter = (int) fread($handle, 20);
fclose($handle);

$counter++;

$handle = fopen($counterFile, "w");
if (!$handle) {
	die("Cannot open the counter file for writing.");
}

// Opening with "w" erases old content, then writes the new visit count.
fwrite($handle, (string) $counter);
fclose($handle);

echo "<p>You are visitor #$counter.</p>";
?>

This completes the file review tasks alongside the metadata, counter, directory, and CSV examples above. The first script creates data.txt, reads it line by line, appends a sentence, and reports a missing file clearly.

<?php
$path = __DIR__ . "/data.txt";
if (!file_exists($path) && file_put_contents($path, "Initial data\n") === false) {
	die("Cannot create data.txt.");
}
$reader = fopen($path, "r");
if ($reader === false) die("Cannot open data.txt for reading.");
while (($line = fgets($reader)) !== false) {
	echo htmlspecialchars($line, ENT_QUOTES, "UTF-8") . "<br>";
}
fclose($reader);
if (file_put_contents($path, "This is new data added.\n", FILE_APPEND | LOCK_EX) === false) {
	die("Cannot append to data.txt.");
}
$missing = @fopen(__DIR__ . "/nonexistent.txt", "r");
if ($missing === false) echo "The requested file could not be opened.";
else fclose($missing);

For the binary task, use rb/wb, count bytes with strlen(), and never echo raw binary into an HTML page. Supply a small sample.png file first.

<?php
$source = fopen(__DIR__ . "/sample.png", "rb");
if ($source === false) die("Cannot read sample.png.");
$bytes = stream_get_contents($source);
fclose($source);
if ($bytes === false) die("Cannot read binary data.");
echo "Read " . strlen($bytes) . " bytes.";
$target = fopen(__DIR__ . "/sample-copy.png", "wb");
if ($target === false) die("Cannot create the copy.");
$written = fwrite($target, $bytes);
fclose($target);
if ($written !== strlen($bytes)) die("The binary copy was incomplete.");

This complete SQL script follows the guide's mydatabase and fruit example. It shows the exam sequence: create the database, select it, create a table, insert rows, read rows, update one row, delete one row, and verify the result.

-- Run these statements at the mysql > prompt after logging in with:
-- mysql -u root -p

CREATE DATABASE mydatabase;
USE mydatabase;

-- The id column is the primary key.
-- AUTO_INCREMENT lets MySQL generate id values automatically.
CREATE TABLE fruit (
	id SMALLINT UNSIGNED NOT NULL AUTO_INCREMENT,
	name VARCHAR(30) NOT NULL,
	color VARCHAR(30) NOT NULL,
	PRIMARY KEY (id),
	KEY (name)
);

-- Because id is AUTO_INCREMENT, only name and color are supplied.
INSERT INTO fruit (name, color) VALUES ('banana', 'yellow');
INSERT INTO fruit (name, color) VALUES ('tangerine', 'orange');
INSERT INTO fruit (name, color) VALUES ('plum', 'purple');

-- SELECT * retrieves every column from every row.
SELECT * FROM fruit;

-- Selecting named columns is clearer when you do not need the whole row.
SELECT name, color FROM fruit;

-- WHERE filters the rows returned by the query.
SELECT * FROM fruit WHERE name = 'banana';
SELECT * FROM fruit WHERE id >= 2;

-- Exam trap: always use WHERE when only one row should change.
UPDATE fruit
SET name = 'grapefruit', color = 'yellow'
WHERE id = 2;

-- DELETE removes rows but leaves the table structure in place.
DELETE FROM fruit WHERE id = 2;

-- DROP TABLE removes the whole table and all its data permanently.
-- DROP TABLE fruit;

This example cleans up the addendum's first test.php idea. Save it inside your XAMPP project folder, start Apache, then open it through localhost.

<?php
// htdocs/Demo/test.php
// The file extension must be .php so Apache sends the page through PHP.

$studentName = "Derek";
$today = date("Y-m-d");
?>
<!DOCTYPE html>
<html lang="en">
<head>
	<meta charset="UTF-8">
	<title>PHP Test Page</title>
</head>
<body>
	<h1>My Name is <?= htmlspecialchars($studentName) ?></h1>
	<p>This page was processed by PHP on <?= htmlspecialchars($today) ?>.</p>
	<p>If you can see today's date, Apache and PHP are working through XAMPP.</p>
</body>
</html>