Now it’s time to get down to the real task at hand - actually creating a working web-page using PHP. In this tutorial, I’ll show you how to create a simple web-page to demonstrate how to add a little bit of dynamic jazz to an otherwise static site.

Mixing PHP with HTML

I’m assuming, for this tutorial, and throughout the rest of the tutorials, that you have at least a basic knowledge of HTML - enough to be able to use simple tags such as <br/> (newline), <a>, <form> and so on. If not, why not check out any of the decent HTML tutorials around the web - Google for “HTML Tutorial”

HTML PHP is HTML

One thing to realise here is that an HTML page can function as both an HTML page and as a PHP page. Let me explain:

In the previous tutorial, we saw how a PHP file could be created by using the start and end tags, <?php and ?>. We also saw how these tags could start and stop as often as you wished. Within the context of a standard PHP file, this doesn’t make much sense. After all, what’s the point of stopping and starting the PHP code if we’re just going to be executing more of the same PHP?

The answer lies in the fact that, between those PHP tags, we can output HTML content. Take the following code snippet as an example. This is the full text from a PHP file

A sample PHP file

Run this, and we see the output

A sample PHP file
And here is the second line

Now, what’s going on here? You might well have guessed by now, the “echo” command is used to output data to the screen. But there’s no echo command on the first line, so how is this text appearing? And more importantly, you might ask, where’s the semicolon? I did say in an earlier tutorial that any PHP code without a semicolon at the end of each statement will fail. But the important thing to note here is that on line 1, before the <?php tag, that’s not PHP code

Huh? What?

PHP files can contain both static text and PHP code, the important thing to realise is that, whenever the code is between the <?php and ?> tags, it will be executed as PHP code

The next page will go into a little more detail

What is MySQL?

If you’re reading this tutorial, there’s a good chance you’ve already gained a reasonable familiarity with PHP programming, and can piece together a simple application with a few lines of code. If not, why not head on over to the PHP Tutorial section for a quick refresher course?

If you have attained a reasonable understanding of PHP, you’ll be aware of the great potential PHP has for building web-based applications and interactive websites to allow users to add content or contribute to discussions. This interactivity is a major component of many such sites, and the ability of these sites to store and manipulate user data plays a vital role in their success.

One of the most common technologies used on the internet to store large quantities of data for future retrieval and display is the database system MySQL. MySQL is an example of a database management system (DBMS) which, in laymans terms, means that it has the ability to store and retrieve large amounts of data for whatever use the user sees fit. In our case, for display in our dynamic websites and applications.

Data Storage for the Masses

Data storage is a hot topic on the internet today. If you’ve used Google’s GMail application for email, you’ll have seen that they currently offer roughly 7 Gigabytes of storage per person. That’s a lot of space! Other sites, such as Flickr for photography, and Facebook for social networking and chat also require a lot of storage space to allow their users to keep track of the vast amounts of information they upload.

You might be surprised to know, but the same technology that powers these sites, and keeps them running with millions and millions of hits is the very same technology I’m going to introduce you to here. Yep, that’s right - MySQL is capable enough to support multi-million user websites while at the same time being simple enough to pick up and learn the basics in a short timeframe. What’s more, it’s completely free! Thanks to the wonders of Open Source software, this powerful database tool is available for anyone to download and start using right away. Maybe one day when you become a top notch developer, you could contribute something back to this fantastic community of community-created software!

MySQL with PHP

PHP is a scripting language, used to generate web-pages and process information. MySQL is a data storage application, and is used to keep track of vast quantities of data. When you put the two together, you gain the power of PHP to display and alter the data stored within MySQL in whatever way you desire.

PHP and MySQL are two completely seperate applications. One can happily exist without the other, and it’s even possible to use other programming languages with MySQL (Perl, Java etc.), as well as other database systems with PHP (PostgreSql and others) but the combination of PHP with MySQL is one of the most widely used, and many of the most popular content management systems (such as Wordpress, Drupal and Joomla) cannot function without them.

The link between PHP and MySQL comes with the use of a database extension to allow PHP to access and modify the data held within the database through the use of special PHP function calls, such as mysql_query() to run a specific query on the database, and mysql_connect() to establish a connection to the database at runtime.

The proper usage of these functions, and more detail about other MySQL extension functions will be outlined in later sections in this tutorial.

Please note that all these tutorials assume that you’re using the combination of PHP with MySQL. You’ll still be able to get something out of it if you’re not using PHP, since the majority of the tutorial relies on only a few simple PHP functions, and these will usually have similar equivalents in whatever other language you’re using

Website design with PHP

It’s quite likely you’ve reached this page because you’re interested in learning how to build your first website with PHP, or modify your existing website to make use of PHP. It’s also quite likely, if you’re just starting out with PHP, or programming in general, that you won’t really know what PHP is exactly, or what it does.

PHP is one of the most widely used technologies for building websites. Alongside the database management system MySQL, it powers some of the most popular and heavily visited sites. The role of PHP in these websites is to construct the pages of text and images you see when you navigate these sites, and it can also be used for even more complex operations behind the scenes. PHP can dynamically construct pages based on user input, so that you don’t need to offer visitors static pages of text, but can instead provide them with information based on their specific requirements.

A user might, for example, select from a drop-down list of items in a shop, and be presented with a detailed description of the selected product, or fill in an email form to contact you directly about a service, bypassing the need to provide your email address on a public website.

If you’re already familiar with PHP, you may already have covered most of the topics in the first part of this tutorial. We will cover some of the fundamentals of programming, including for loops, if…else statements and more. Although some people may be well versed in the use of these programming methods, there may still be information of value. Near the end of each section I will look at each subject in more detail, and there may even be one or two nuggets of information which even the more experienced PHP developer will find useful!

This tutorial won’t aim to cover everything though, and doesn’t aim to replace the more comprehensive PHP references out there - including PHP’s own, extremely useful, online library available through php.net

What is PHP?

It is said that the acronym PHP is recursive, and stands for “PHP: Hypertext Preprocessor”, which would no doubt cause some headaches if you attempted to write it out in full. A more sensible explanation is that it stands for “Personal Home Page”, originally from a piece of software developed by Danish programmer Rasmus Lerdorf to maintain his own personal homepage.

These days, PHP is still used to maintain personal homepages. Also business pages, online directories, online shops… the list goes on. It is an extremely versatile language and, while its critics may say it lacks the langauge processing capabilities of Perl, say, or the complexities of C/C++, there’s no arguing that it is a very capable language for use in creating the underlying code and structure of a great number of websites

How PHP Works. Roughly

The basic idea behind PHP is outlined in the image above. PHP code is stored within PHP Files [1], which are then passed through a PHP Parser [2] that then generates the code necessary to display the webpage [3] you see when you visit a specific URL, like http://www.mywebsite.com/index.php

Arrays

There are times in programming where you need to keep track of many variables at once. Maybe the current time of day, the number of items in a package or the name of a certain product. These variables may all be very similar too though, you might, for example, need to keep track of the names of all employees in a company, or the number of items inside each of a large number of packages. Arrays can be used to keep track of these multiple values from within one variable.

Arrays are a special type of data structure in PHP. They are used to hold multiple values, in a way which allows the values held within to be re-arranged, searched or sorted. Values can also be removed or added easily. Arrays are especially useful when you’re dealing with lists of items, or collections of values that need to be sorted into ascending or descending order.

Creating and manipulating arrays

An array is initialised using the language construct array(), and is assigned to a PHP variable name, in exactly the same way as other scalar variables [reference scalar in previous tut]. Arrays can contain any number of values, each of which can be any of the PHP data types. Here is an example of a simple array

$array = array(1, "two", 3.0, "four");

This will initialise the variable $array as an array containing the values 1, “two”, 3.0 and “four”.

An array like this is known as a Non-associative array because the values are not associated with any specific keys but are instead just numbered numerically, like so…

An example of a simple non-associative array

Displaying Arrays

Once this array has been initialised, we can check the contents of the array in certain ways

echo $array;
print_r ($array);
var_dump($array);

This produces

Array
Array ( [0] => 1 [1] => two [2] => 3 [3] => four )
array(4) { [0]=> int(1) [1]=> string(3) "two" [2]=> float(3) [3]=> string(4) "four" }

Echo is not built to handle complex data structures like arrays. Instead we need to turn to our old friend print_r() - but even then, we’re not getting the full picture. Var_dump() produces the most information about our array, giving us the datatype held in each position of the array.

Associative arrays

Note the numbers in square brackets on lines 2 and 3 in the above example. These numbers correspond to the “keys” of each item in the array. Arrays work by assigning each item a “key-value pair” by which to reference each position in the array. In the above example, the keys are generated automatically, in sequence according to the order in which the values were entered. We can over-ride this behaviour though, and specify our own keys for each value

$array = array(4 => 1, 3 => "two", 2 => 3.0, 1 => "four");

Here, we’ve assigned the entries in the array to keys in descending numerical order.

Another example is an array containing a list of employee names, and their associated job titles

Now, you might be asking, what’s the use of this feature in real code? Well, this gives me a good opportunity to introduce a powerful feature of arrays - sorting.

Procedural programming has many advantages, mainly the ability to store frequently used code within functions, and to encompass complex algorithms within easy-to-remember function names.

In this tutorial, I’ll take things a step further, and introduce you to the concept of Classes and Objects in PHP. To put it simply, an Object in the context of programming languages is a data structure which can contain any number of variables and functions all held together under a Class name. This Class can then be created in the normal scope of the code and stored inside a new variable, and multiple copies of this same class can be created. This allows for an even greater level of code encapsulation, allowing more complexity to be accessed from simple commands.

I mentioned that procedural programming allows us to encapsulate code within functions to be re-used as required. Classes take that a step further, allowing us to encapsulate many functions within a class and to create multiple copies of each class.

Note that, when inside a class definition, functions are referred to as methods, and variables are referred to as members - even though we still use the keyword “function” to define methods.

Methods : “Functions defined inside Classes”

When defining a function within a class, we refer to it as a method, and this method then becomes available to all instances of a class. The following example shows the syntax used to define a class, and also create an instance of the class for use. We will then call the method defined within the class, using this newly created instance

Class MyClass {
   function myFunction(){
      echo "Hello world!";
   }
}
$myObject = new MyClass(); //create an instance of MyClass called $myObject
$myObject->myFunction();  //call the method, myFunction() using the instance

Lets take a step by step look at what’s happening here

Line 1 : New classes in PHP are defined by the use of the Class keyword, followed by a user defined name to label the class. Here, we’re calling our class MyClass. The body of the class is placed between a pair of braces. Class naming convention is the same as for standard variables and function names, and traditionally class names start with an uppercase letter
Lines 2-4 : Within the class, we can define a range of variables and functions. Here, we’re defining just one function, in this case, the function myFunction, which serves a single purpose - to print “Hello world!”
Line 6 : Here’s where the fun begins! After a class has been created, we can then assign instances of the class to variables. Here, we make use of the “new” keyword to create a new copy of the MyClass object. Note the parentheses after MyClass. These aren’t explicitly required here, but later on in the tutorial, I’ll show you how you can place values within these to add extra functionality to your class.
Line 7 : by the use of the -> operator we can call functions and access variables within the class object. Here, we are calling the myFunction function. This will produce the now-familiar output

Hello world!

Multiple instances of the same class can be created. This way, we can reuse the functionality of the class without needing to worry about redeclaring variables, or functions

$firstObject = new MyClass();
$secondObject = new MyClass();
$thirdObject = new MyClass();
$firstObject ->myFunction();
$secondObject ->myFunction();
$thirdObject ->myFunction();

Let’s take a step forwards now and add in some variables, or members into our functions. When defining variables within the body of a class, we refer to these variables as members. Here is an example of another class definition with a couple of members, $a and $b defined within its body.

Members : “Variables defined inside Classes”

Class MyClass {
  public $a = 5;
  public $b = 10;
 
  function showValues(){
    echo "a equals $this->a";
    echo " and b equals $this->b";
  }
}
$class = new MyClass;
$class->showValues();
echo "a plus b = ".($class->a + $class->b);

a equals 5 and b equals 10
a plus b = 15

Here, you’ll see much that is familiar from the previous example. We define a class using the “Class” keyword, and inside the class is a function, or method showValues(). But, we’ve got a couple of new things here that need some explaining!

Lines 2 and 3 : Here, you can see a couple of members $a and $b being defined, in much the same way as we’d define variables within the normal scope of a script, except when defining members inside a class, we must use the public keyword. There are exceptions to this rule though, and they will be explained shortly. Note that it is also acceptable to define members by using the keyword var e.g. var $a = 5; although this usage is a remnant from earlier versions of PHP and is only supported for compatibility reasons. It is better to use public
Lines 6 and 7 : Now that we have the variables $a and $b defined within the body of the class, we can use these values from within functions. Here, you’ll see another mysterious variable - $this. $this is a very special variable in PHP. When inside a class, or object, $this allows you to refer to the class from within itself. Notice how, when calling a class method from outwith the class definition we use the notation $class->functionName()? When we’re running code from inside the class itself, we can do the same thing, but instead of using the name of the class, we simply use $this. This way we can refer to the class object without needing to know the specific variable name the class has been assigned to.In this case, we’re working with the values of $a and $b from inside the method by referring to them with $this->a and $this->b
Line 12 : Here we are accessing the values of $a and $b directly. You can see from this example how it’s much cleaner, and compact to use methods from within the class to access variables in this way, since it allows for greater code portability. This code can be improved like so,

Class MyClass {
  public $a = 5;
  public $b = 10;
 
  function addValues(){
    return "a plus b = ".($this->a + $this->b);
  }
}
$class = new MyClass;
echo $class->addValues();

Confused? Yes, don’t worry, it can be a little overwhelming at first, but the thing to remember about Object Oriented Programming is that it uses lots of the same principles you’ve been using already, but with a little twist. It’s really about changing the way you think about coding, into a more packaged, compartmentalised view of things.

In the next section, we’re going to take a look at how we can control access to the members and methods contained within a class

I will go to the cinema if I have $15 or more to spend tonight

if($amount  >= 15){
  echo "I'm going to the cinema";
}

But, what would you do if you didn’t go to the cinema? There’s usually an alternative…

I will go to the cinema if I have $15 or more. Otherwise, I’ll just stay in and watch TV

This would be represented in PHP as

if($amount  >= 15){
  echo "I'm going to the cinema";
} else {
  echo "I'm a bit skint. I think I'll just stay in and watch Friends re-runs again";
}

The first line sets up the proposition, “What’s the value of $amount?” or, “How much money have I got?”. The curly brackets (or braces) are the containers for each of the outcomes (this is an important syntactical feature of PHP).

What we’re saying here is that the echo statement contained within the first pair of braces (line 2) will be executed if the value of $amount is greater than or equal to (>=) 15

The statement within the second set of braces (line 4) is executed when $amount is less than 15. The “else” operator tells PHP that we want one or the other - not both - dependant on the outcome of the “if” statement

True & False

PHP, much like any other language, uses the two boolean values TRUE and FALSE to represent the outcome of logical expressions. The result of a statement like “$amount >= 15″ will equal TRUE if the variable $amount holds a numerical value which is greater than, or equal to 15 and FALSE otherwise. Here are some other examples of boolean expressions

  5 > 3 //TRUE, 5 is greater than 3
  3 = 4 //TRUE, 4 is indeed greater than or equal to 4
  5 != 3 //TRUE, 5 is not equal to (!=) 3
  3 != 3 //FALSE, 3 is equal to 3 - the operand "!=" fails here
  5 == 5 //TRUE, 5 does indeed equal 5

These are fairly banal examples. I can’t imagine anyone would get excited about writing a program to prove that 5 equals 5!

Equality operator (==) & Assignment operator (=)

An important thing to note about the last example is the use of equality operator (==) This is not the same as the assignment operator (=) == is used to check if two values are equal, whereas = is used to assign a specific value to a variable. i.e.

$x = 5; // $x now equals 5
$x == 7;  /* 7 doesn't get assigned to $x
 instead, the whole expression equates to false
 since $x doesn't equal 7 */

We can see this more clearly by looking at the value of each expression as a whole using var_dump()

var_dump ($x = 5); /* int(5) */
var_dump ($x == 7);  /*  bool(false)  */

AND & OR

Sometimes you want to base the outcome of a situation on more than one variable, you wish to know, for example, that two certain conditions will be fulfilled before deciding on a choice of action. Expanding on our cinema example from earlier -

If I have $15 or more AND it is not raining, I’ll go to the cinema. Otherwise I’ll stay in and watch TV

becomes…

if($amount >= 15.00 && !$raining){
  echo "I really want to see the new Indiana Jones film";
} else {
  echo "It's too wet out, and the episode of Friends where they play 'Fireball' is on";
}

Here, we are using the operator “&&” to represent the expression “and” - similarly, we can use the operator “||” to represent “or”.

This statement is based on two things - firstly, the same condition as before - how much money have I got? Secondly, the condition “!$raining”. The exclamation mark before $raining is means that !$raining will equate to TRUE only if $raining equals FALSE. Confusing? Yes, it is a little bit to begin with, but dealing with logical expressions usually can be!

Think of it this way - it can be rewritten as

if($amount >= 15.00 && $raining == FALSE){

Which makes more sense. You may encounter quite a few situations like this in PHP, where things are written in a specific shorthand that somewhat obscures the meaning, but once you get the hang of it you find it quicker and simpler to use the shorthand version. Take the following code snippet…

Elseif

Sometimes it might be the case that there aren’t just two potential outcomes to a situation. Indeed, as with most scenarios in life, there are many more. Consider yet another modifcation to the above scenario.

I’m going to the cinema if it’s not raining, and I have $15 or more. If it is raining, I’ll stay in and watch TV. Otherwise, if it isn’t raining, but I have less than $15, I’ll go and visit my friends

Here, we have three unique outcomes - going to the cinema, staying in, or visiting friends. We can work this out with logic by introducing another choice in our if statement, as follows

if($amount >= 15.00 && !$raining){
  echo "Let's go to the cinema";
} elseif ($amount < 15.00 && !$raining){
  echo "I'm going to visit friends";
} else if($amount < 15.00 && $raining == TRUE) {
  echo "I think I'll just stay in tonight";
}

Notice though, in the final case, we’re doing checks for logical conditions that aren’t actually required, given that we can reason, through logical deduction, that if it’s raining, neither of the first cases will match, so the check for $raining == TRUE is redundant. Likewise, because we know that the value of $amount isn’t relevant either, we can safely ignore that too. A more compact way of writing the above code would be

if($amount >= 15.00 && !$raining){
  echo "Let's go to the cinema";
} elseif ($amount < 15.00 && !$raining){
  echo "I'm going to visit friends";
} else {
  echo "I think I'll just stay in tonight";
}

Usually, for the final condition in an if…elseif…else statement, we have already checked for all the relevant conditions we’re interested in, and this final “else” is simply the “default case”

Conditional Shorthand using ? and :

echo ($amount >=15 && !$raining)?"I'm going to the cinema":"I'm going to stay in";

Now what on earth is all that about? Well, it’s exactly the same expression as before - only written in an even more shorthand way. This time, we’re using the conditional operators ? and : to express our situation.

An interesting way to view this is to think of the ? in the statement above in exactly the same way as you would view it in a normal sentence. Let’s reword our thoughts about going to the movies…

Is it dry outside, and do I have more than $15? If so, then I’ll head out. If not, then I’ll stay in

We’re asking a question here - the same question in PHP form reads..

$amount >=15 && !$raining?/* if so */"I'm not going to the cinema":/* otherwise */"I am going to the cinema";

(I added in some extra wording in comments to make it clearer - that might not be fully accepted as valid PHP code though)

Here, we’re using the colon (:) to mean “Otherwise”, so the use of the ? and : operators basically amounts to

  (statement which equals either TRUE or FALSE)?Do this if it's true:Do this if it's false;

If you think about it, you can also imagine how you could place other conditional statements within the expressions to be evaluated in either case, to produce even more complex scenarios

Let’s expand again on our cinema example

I’m going to the cinema if it’s not raining, and I have $15 or more. Otherwise I’ll stay in and watch TV. But, if my friends call me up to go along, I’ll head anyway

if(($amount >= 15.00 && !$raining) || $friends_have_called == true){
  echo "Let's go to the cinema";
} else {
  echo "Nah, let's not bother";
}

Here, the conditional statement in line 1 has expanded to include an “or” (||) condition - either, it’s not raining and I have enough money, or, my friends have called. If my friends have called, it doesn’t matter about the first expression.

Note as well, that the first condition has been placed in brackets, instead of writing

if($amount >= 15.00 && !$raining || $friends_have_called == true){

Which is prone to misinterpretation (That could be saying “If I have more than $15, and it’s either not raining or my friends have called…”) There is a feature of programming called operator precedence which defines which operator is considered first, but when in doubt, always use brackets to make your statements clearer - it helps when other people look at your code too

Switch Statements

One other way of providing a conditional response to an expression is to use the switch() function. This function is especially useful when we expect one of a fixed number of outcomes to occur, and we wish to compare a specific variable to each, to find out which value has occured.

The switch() function also uses the keywords case, default and break, and the exact purpose of these can be seen in the example below.

$i = 2;
switch($i){
  case 2:
    echo "i is equal to 2";
    break;
  case 3:
    echo "i is three";
    break;
  case 1:
    echo "i is only one here";
    break;
  default:
    echo "i is neither 1, 2 or 3";
    break;
}

The above code will output

i is equal to 2

Here, we are using the case keyword to declare which of the outcomes 1, 2 or 3 we wish to deal with in each case. The switch statement itself is encased within a pair of braces (lines 2 & 15) and each case statement is simply defined by whatever code appears between the colon (:) and the break; statement.

The final case is named “default”, and this is the case which occurs when none of the previous cases is matched. The usage here is similar to the last sentence I wrote in the section above about “elseif” - the last default case is usually the one that requires no extra conditions to be matched.

This switch statement above is identical in functionality to the series of if statements:

$i = 2;
if($i==2){
  echo "i is equal to 2";
} elseif ($i==3) {
  echo "i is three";
} elseif ($i==1) {
  echo "i is only one here";
} else {
  echo "i is neither 1, 2 or 3";
}

But the switch statement is arguably more compact, and a bit simpler to code than the equivalent code using “if”

Footnote : An alternate syntax for If…else statements

if…else statements can also be written using the following syntax

Note that, in the second code example, there is no need for any braces round each of the results. All the code to be executed based on the logic expression is contained between each of the if:, elseif: and else: statements

Note as well, it’s vitally important to include the “endif;” statement, to replace the final closing brace.

Switch statements can also be written as

switch($i):
  case 1:
    echo "one";
    break;
  default:
    echo "not one";
    break;
endswitch;

And similar syntactical differences can be applied to while loops, for loops and foreach loops

This way of writing if statements can be useful, and slightly tidier, but is slightly more prone to errors, especially when nesting if statements, and can sometimes produce erratic results

Just as when defining variables, specific naming conventions must be adhered to. A function name can contain letters, numbers and underscores, and must not start with a number. They are also, like variables, case-sensitive. A (very simple) example:

function my_function(){
  echo "Hello world";
  $a = 5;
  echo "The value of $a is $a";
}
my_function();

Hello world
The value of $a is 5

Line 1 : The definition of the function. This declares that you, the programmer, have decided to create a function for use called “my_function”. The empty brackets () will be filled in later, but they are important and you cannot leave them out.
Lines 2-4 : Inside the braces you can place whatever code you desire
Line 6 : This is a function call and lets PHP know that we want to execute the function at this point. This differs from the function declaration in that we are not using the function keyword to create a function. This function call can occur anywhere within the code, as long as it occurs after the function has been declared

Introduction to Loops

Loops in PHP are very useful when you need to perform repetitions of the same code over and over again, or when you need to ensure that you iterate through all possible values of an array, for example. They come in a few different flavours, the most common being “for” loops and “while” loops. There are a few other more obscure ways to create loops, and I’ll cover them at the end, in the extended section.

The three types of loop I will cover in this section are For loops, While loops and Foreach loops

While loops

While loops are the simplest kind of loop in PHP. They’re pretty much just saying “Do something for a while until a certain condition is satisfied”. You could be saying Stay at work until this project is finished or Keep on running this marathon until you get to the end

The general syntax of a while loop is as follows

while(condition = true) {
  do something
}

A real-world code example of this might be

$miles_completed = 0;
$race_finished = false;
while($race_finished == false) {
  $miles_completed++;
  if($miles_completed >= 26){
    $race_finished = true;
  }
}

I’ll explain some of the symbols and operations going on here…

Lines 1 and 2 : we initialise the values of $miles_completed and $race_finished. The code wouldn’t work properly otherwise, as $race_completed has to be equal to FALSE initially to satisfy the while loop in line 3
Line 3 : The while loop will repeat as long as $race_finished is equal to false. A drawback of while loops is that they can loop indefinitely if you are not careful, and this will cause your application to crash - you can see how this would occur if we didn’t increment the value of $miles_completed or set $race_completed to be true. You’d be running that marathon for ever!
Line 4 : the expression $miles_completed++; is a way of saying $miles_completed = $miles_completed+1; This can also be rewritten as $miles_completed += 1;
Line 5 : we check the value of $miles_completed on every repetition of the loop. Once $miles_completed becomes greater than 10 (since we are incrementing the value every time round) then $rage_finished is set to TRUE, therefore breaking the condition that keeps the loop going

Another way of writing while loops is to invoke the “do” statement

$miles_completed = 0;
$race_finished = false;
do {
  $miles_completed++;
  if($miles_completed >= 26){
    $race_finished = true;
  }
} while($race_finished == false);

The only difference here is that the statement between do.. and ..while will always be executed at least once before the loop begins. So, for example, the code

$line = "Texty texty text text";
$a = 1;
do {
  echo $line;
} while($a == 2);

will output

Texty texty text text

even though the condition of the while loop (that a must equal 2) is false

For loops

For loops are probably the most common type of loop found in PHP, and indeed in most other kinds of programming language. They can be used to loop through a series of repetitions like a while loop, but with some advantages. It’s not so easy to create a for loop that will never end, since the code to define the “exit condition” as well as the code to increment the count for the loop are defined explicitly at the start

The syntax of for-loops is as follows

for(loop initialisation code; the loop "exit condition"; code to evaluate before each loop){
  //the code to execute on each loop goes in here
}

A more concrete example of the for loop, and the most commonly encountered style is

for($i = 0; $i

$i = 0 : This sets up the variable $i for the purpose of the loop. In this instance, we’re going to continually check the value of $i after every loop, and only exit when the second element evaluates to true…
$i < 100 : Since we initially set $i = 0, then this statement will initially evaluate to false. The loop will exit only after this condition becomes true, which is the task of the final element…
$i++ : This statement says that we want to increment the value of $i after every loop. After 100 loops, $i will be greater than 100, so the loop will exit successfully

This for loop will produce the output

i = 0
i = 1
i = 2
(... and so on)

Some other examples of for loops, using slightly different code

for($i = 50; $i>0; $i--) /* same as before, but decreasing $i */
for($i = 0; $i 0; $i=substr($i, 0 ,strlen($i)-1)){
    echo $i;   
}
// this prints out...
// Hello
// Hell
// Hel
// He
// H

Foreach loops

Foreach loops are a particularly useful feature of PHP when working with arrays as they allow us to iterate through all the values of an array in sequence. Foreach loops also allow us to access the keys of an array, which is a useful feature when working with associative arrays.

An example of the foreach syntax is

/* three people, and their respective scores in a test*/
$scores = array("jeff" => 74, "bill" => 88, "john" => 63);
foreach($scores as $value){
  echo $value;
}

The “as” keyword is used to assign each value in the array to a temporary variable for use within the loop. Inside the loop, operations can be carried out on each value in turn. The above code will output

74
88
63

If we wish to perform operations on keys as well as values, we can make a slight adjustment to the syntax

$scores = array("jeff" => 74, "bill" => 88, "john" => 63);
foreach($scores as $key => $value){
  echo "$key, $value";
}

The operator => is used to let PHP know that we want to assign a temporary variable to each key in the array as well as each value. In the case of an indexed array, where we haven’t explicitly defined the keys, each key will simply be an incremental numerical value - 0, 1, 2 etc.

jeff, 74
bill, 88
john, 63

When performing operations on an array, it’s often useful to be able to modify the contents of the array in some way. Here, we might want to replace each score with a “pass” or “fail” depending on whether the score is above the pass mark (let’s say 70 in this case)

We can make use of the “pass by reference” functionality of PHP to state that the temporary variable $value shouldn’t be assigned the actual value of each array element, but instead should point directly to that array element, like so

$scores = array("jeff" => 74, "bill" => 88, "john" => 63);
foreach($scores as &$value){
  if($value >= 70)
    $value = "pass";
  else
    $value = "fail";
}
unset($value);
print_r($scores);

This will give us

Array (
  [jeff] => pass
  [bill] => pass
  [john] => fail
)

Notice in line 8 of the above code, we use the statement unset($value). This is because, after iterating through an array passed by reference in this way, references to the final element of the array, and to $value still remain, so it’s good practice to destroy them via the use of the unset() function.

(The files used in this tutorial are available to download here)

Pagination

Sometimes when working with a MySQL powered website in PHP, we’ll come across situations where we have multiple records that we wish to display to the visitor. If there are many tens, hundreds or more of these results, we might not want them all shown on the one page as this would increase the loading time, and make the list harder to navigate.

To solve this problem, we introduce the concept of pagination in MySQL, which makes use of the handy LIMIT keyword and information passed by GET from the URL query string

Using LIMIT to specify a range of records in MySQL

For this example, we’re going to use a table of records containing popular boys and girls names beginning with “S” along with their general meaning. Because this table contains a lot of entries, I’m not going to display it all here, but the accompanying SQL file contains all the information you need to import the table into your MySQL database. Once you’ve done that, you can then proceed with the tutorial to learn how to split this data into pages and display the pages to your visitors along with a handy navigation bar.

download the full table in SQL here

Let’s perform our first query on this data to retrieve the first 30 records in the list. This is the main query we will be using to build our pagination application shortly

SELECT * FROM name_meanings LIMIT 0, 30 ORDER BY id ASC

If you run this SQL query, you’ll see the results returned are limited to only 30 and, more importantly, only the first 30. The LIMIT keyword takes, as arguments, two values - first, the record to start counting from and second, the number of records to return. So here, we could from record 0 and return 30 records. To return our second “page” of results, we would use

SELECT * FROM name_meanings LIMIT 30, 30 ORDER BY id ASC

Which then returns another 30 records, but this time returns the rows starting from record 30. We’re also using the ORDER BY keyword here, just to ensure that the results are ordered correctly. At the end of the tutorial, we’ll see how we can use the ORDER BY feature to add even more functionality to our site!

This is the fundamental principle behind creating a pagination system. We’ll now look to see how we can specify which page we want to view, and give the visitor control over this variable.

Passing the Current Page Number via the Query String

to actually determine which page to show at any given time, we’re going to build a little PHP script. This script will do a couple of things. Firstly, it’ll display whatever records we’re interested in, in a nicely formatted table and secondly, it will retrieve the current page we wish to view via the $_GET variable. (The $_GET array always contains any variables passed in the query string, e.g. if the URL is index.php?my_var=123, then the value of $_GET['my_var'] will be 123)

Let’s take a look at this code. This file is also available in the tutorial zip archive downloadable from here

 
Name Meanings
 
<html>
<html>
<head>
<title>Name Meanings</title>
<style>
html {font-family:tahoma,verdana,arial,sans serif;}
body {font-size:62.5%;}
table tr th{
    font-size:0.8em;
    background-color:#ddb;    
    padding:0.2em 0.6em 0.2em 0.6em;
}
table tr td{
    font-size:0.8em;
    background-color:#eec;
    margin:0.3em;
    padding:0.3em;
}
</style>
</head>
<body>
<?php
//we always start out by connecting to our database
//using a handy external file, db_connect.php
include("db_connect.php");
//fetch our page number from the query string
//the URL should look something like
//name_meanings.php?page=4
$page = $_GET['page'];
//define how many records we want to show per page
$records_per_page = 15;
if(!filter_var($page, VALIDATE_INT, 1))
  $page=1;   
echo "<h3>Showing results for page $page</h3>";
//calculate the offset value to start counting from
//in the MySQL query. To do this, we multiply the page
//number, minus one, by the number of records we want
//to show per page
//e.g. for page 1 - Our starting record will be (1-1)*30
$offset = ($page-1) * $records_per_page;
$result = mysql_query("SELECT * FROM name_meanings ORDER BY id ASC LIMIT $offset, $records_per_page");
echo "<table><tr><th>Name</th><th>Name Meaning</th></tr>";
if($row = mysql_fetch_array($result)){
  do{
    echo "<tr><td>{$row["name"]}</td><td>{$row["meaning"]}</td></tr>";
  } while($row = mysql_fetch_array($result));  
}
echo "</table>";
?>
</body>
</html>

This code will display on screen, a simple list of names and, depending on the query string appended to the URL, will start from a different point in the list, like so

Different query strings produce different tables

You can see how the URL name_meanings.php produces a different table to name_meanings.php?page=3

Constructing the Page Navigation Links using PHP

Now that we’ve created a system to allow us to display any page of results, we need to hand control to this over to the user. To do this, we can create a series of hyperlinks, all pointing back to the current page, but with a different value appended to the URL. The following code, appended to the end of the previous code, before the </body> and </html> tags, will achieve this

echo "<p>Navigation</p>";
$count_result = mysql_query("SELECT COUNT(*) FROM name_meanings");
$count_row = mysql_fetch_array($count_result);
//fetch the total number of rows in the table
$count = $count_row["COUNT(*)"];
//we will use this information to build our navigation list
for($i=1; $i<=$count/$records_per_page; $i++){
  echo "<a href='name_meanings.php?page=$i'>$i</a>";
  //output a little symbol (|) to seperate the links
  //but not for the last link
  if($i!=$records_per_page)
    echo " | ";
}

Reload your name_meanings.php file, and you should see a list of 16 links underneath the table, you can click on any of these to go to any of the pages.

How about if we add next and previous links to make navigation even easier? And also make the current page link inactive, so we can’t click on the same page link that we’re already viewing No problem! Make the following adjustment to the above code

echo "<p>Navigation</p>";
$count_result = mysql_query("SELECT COUNT(*) FROM name_meanings");
$count_row = mysql_fetch_array($count_result);
//fetch the total number of rows in the table
$count = $count_row["COUNT(*)"];
//we will use this information to build our navigation list
echo (($page>1)?"<a href='name_meanings.php?page=".($page-1)."'>prev</a>":"prev")." | ";
for($i=1; $i<=($count/$records_per_page)+1; $i++){
  if($i!=$page)
    echo "<a href='name_meanings.php?page=$i'>$i</a>";
  else
    echo $i;
  //output a little symbol (|) to seperate the links
  //but not for the last link
  if($i<$count/$records_per_page)
    echo " | ";
}
echo " | ".(($page<$count/$records_per_page)?"<a href='name_meanings.php?page=".($page+1)."'>next</a>":"next");

Resulting in…

Behold! The power of navigation!

See how we’ve made it so that the next and prev links are inactive if we’re on the last and first pages respectively? We can do this by performing some checks on the current values of $page and $count/$records_per_page (which gives us the maximum page number)

Note here that $count/$records_per_page actually gives us a value of 16.6, which we can still work with, but for a more accurate count of the full number of pages, you’d use floor($count/$records_per_page) to get 16

Keeping track of the Query String variables and Adding New Ones

What if you already have an application you want to add pagination to, which makes use of query strings? Consider the following example and imagine that the query string variable section=code is actually important, and we mustn’t lose it when changing page

name_meanings.php?section=code&page=5

If we just stuck with the code above, our navigation links would direct us to the following pages

name_meanings.php?page=1
name_meanings.php?page=2
...etc

Which is not good! We’ve lost our original query string variable, and so whatever purpose it served has now been lost and the page may display wrongly. However, using some simple PHP code, we can create a function that will automatically generate a valid link for us, complete with whatever variable we choose to append to it. The function is as follows (we’ll name it build_url() )

function build_url($filename, $key, $value){
  $values = array();
  $query_str = array();
  //get the query string arguments and store them in
  //the $values array
  parse_str($_SERVER['QUERY_STRING'], $values);
  //loop through the $values array and add the appropriate 
  //keys to the query string
  foreach($values as $k=>$v){
    //IF, though, a key in the existing query string matches the same key
    //we're trying to add, ignore it, since we'll add it manually in a moment
    //This prevents having multiples of the same keys
    if($k!=$key){
      $query_str[] = "{$k}={$v}";
    }
  }
  //add in our new key and value
  $query_str[] = "{$key}={$value}";
  //reconstruct the full URL using the implode() function to piece together all
  //the query string values in the $query_string array, joining them together with "&"  
  return "$filename?".implode("&", $query_str);
}

And we’ll rewrite some of our code to use this function to generate our links

echo (($page>1)?"<a href='".build_url("name_meanings.php", "page", $page-1)."'>prev</a>":"prev")." | ";
for($i=1; $i<=($count/$records_per_page)+1; $i++){
  if($i!=$page)
    echo "<a href='".build_url("name_meanings.php", "page", $i)."'>$i</a>";
  else
    echo $i;
  //output a little symbol (|) to seperate the links
  //but not for the last link
  if($i<$count/$records_per_page)
    echo " | ";
}
echo " | ".(($page<$count/$records_per_page)?"<a href='".build_url("name_meanings.php", "page", $page+1)."'>next</a>":"next");

Using this function, we can now enter a URL like

name_meanings.php?section=code&page=5

and our page links will still be valid.

Creating a “Sort By” option with ORDER

Now that we’ve introduced a function to keep our URLs intact, this opens up an interesting new possibility, we can now add more than one search parameter to our table, to allow us to further refine our results. Let’s add a couple of options, first a direction option to choose whether we want the table in ascending or descending order, and another option sort by to state whether we want to sort by “name” or by “meaning”. Add the following code, near the end of the file…

echo "Table Order";
echo "direction : ";
echo $dir=="ASC"?"Ascending":"Ascending";
echo " | ";
echo $dir=="DESC"?"Descending":"Descending";
echo "";
echo "sort by : ";
echo $sort=="name"?"Name":"Name";
echo " | ";
echo $sort=="meaning"?"Meaning":"Meaning";

This will create the appropriate links to jump to the necessary page URL. We’re looking to have URLs along the lines of

name_meanings.php?page=5&sort=name&dir=asc

We also need to add code earlier in the file to deal with these new variables. Near the top of the file, before the main SQL query

//get the direction we'd like to sort our results in. Defaults to ASC
$dir = strtoupper($_GET['dir']);
if($dir!="ASC" && $dir!="DESC")
  $dir = "ASC";
 
//get the database value to sort by. Defaults to "name"
$sort = $_GET['sort'];
if($sort!="name" && $sort!="meaning")
  $sort = "name";

And make the following changes to the SQL query itself

$result = mysql_query("SELECT * FROM name_meanings ORDER BY $sort $dir LIMIT $offset, $records_per_page");

You should now be able to load up the page, and see your new navigation links working fully! Try changing the sort order of the table - note that, when sorting by “meaning”, the blank entries will show up first.

Now we have even more control!

Conclusion

You should now have a simple knowledge of the basics of pagination for PHP and MySQL. As you’ve progressed through this tutorial, you may have noticed some shortfalls in the script, and areas for improvement. One of the things I haven’t mentioned, but which you may well want to try and implement yourself, is a way to get round the problem that the pagelinks themselves could get pretty numerous!. Try and find some interesting way of displaying the links so that you perhaps see them like this

prev | 1 | 2 ... 8 | 9 | 10 .... 20 | 21 | next

If you get really stuck, email me and I might let you know the solution

The files used in this tutorial are available to download here.

The functionality of PHP in terms of image manipulation ranges from very simple resizing of images through to more complex effects and functions using image libraries such as ImageMagick

In this tutorial, I’ll take you through some of the more common uses for PHP when manipulating images, and then introduce you to some of the cooler aspects of this powerful little tool, which could help you to really add a bit of jazz and sparkle to your website!

Let’s start with something simple. We’ll take a particular image, how about, let’s say, an image of a cute puppy and then run some functions on it to determine a few facts about it.

getimagesize()

We’ll start here by determining the image type (is it a jpeg, gif, png?), dimensions (height and width) and a few other things by using the getimagesize() function. Note that for this example, the image we’re using - puppy.jpg - must be in the same directory as the PHP script we’re calling this function from

$info = getimagesize("puppy.jpg");
print_r ($info);

The function returns an array containing all of the relevant information, so the above code will produce

Array (
  [0] => 491 //width
  [1] => 367 //height
  [2] => 2 //this number is a constant representing the image type
  [3] => width="491" height="367"
  [bits] => 8  //number of bits-per-pixel in the image
  [channels] => 3 // 3 = RGB, 4 = CMYK
  [mime] => image/jpeg //determines the filetype
)

From this we can tell the image is 491 by 367 pixels in size, with an 8-bit colour depth, and 3 colour channels. We also have the filetype, stored as the “mime” value of the array - “image/jpeg”.

Another way we can retrieve the type of image used is to make use of PHP’s image_type_to_extension() function which will take, as its argument, the value of the array in index “2″ - in this case a value of 2, which represents the filetype of the image. So, for this value we get

echo image_type_to_extension(2);

which outputs

.jpeg

So, now we have this information, what else can we do with the file? We could try resizing the image, and saving a new copy of it. But first, let’s just try reading in the file data and see what happens

header("Content-Type: image/jpeg");
$image = @imagecreatefromjpeg("puppy.jpg");
imagejpeg($image);
imagedestroy($image);

And behold, a picture of a cute puppy!

Line 1 : This header value tells the browser to interpret the following data as Jpeg image data
Line 2 : Read the image data from the file, puppy.jpg using imagecreatefromjpeg(). The @ symbol simply supresses any errors that might occur. This creates a GD Resource $image, which can then be manipulated as required, or sent as output to the browser. Function like this one are part of PHP’s GD2 Library of image manipulation functions. Each function works on, or loads/saves an object representing image data called a GD Resource.
Line 3 : imagejpeg() is the function that outputs the image data to the browser
Line 4 : After we have output the image data, destroy the image resource with imagedestroy()

So that’s how we read in and print out simple jpeg data. Similar functions also exist for PNG and GIF filetypes - namely imagecreatefromgif(), imagegif() and imagecreatefrompng(), imagepng()

Resizing and Rotation

What else can we do with the image once we’ve loaded it into memory with imagecreatefromjpeg()? Let’s try resizing the image. Here we will make use of the imagecreatetruecolor() function to create a blank GD resource to copy the resized image into, and the imagecopyresampled() function to perform the copying.

The arguments for imagecopyresampled() are as follows

bool imagecopyresampled  ( resource $dst_image, resource $src_image, int $dst_x, int $dst_y, int $src_x, int $src_y, int $dst_w, int $dst_h, int $src_w, int $src_h )

Which might need a little explanation: The first two are relatively straightforward, $dst_image is the GD resource to copy to, and $src_image is the GD resource to copy from. After these two arguments are 8 parameters that specify (x, y) co-ordinates on both the source and destination images, and width and height values for the source and destination images also.

These points and widths are used to calculate which area of the source image is to be copied based on the top-left (x, y) co-ordinates and the source width and height, and the new width and height of the destination image, as well as the top-left co-ordinate values for the new image to start at

When we call imagecreatetruecolor() we must also specify a width and height for this destination image.

header("Content-Type: image/jpeg");
$image = @imagecreatefromjpeg("puppy.jpg");
$size = getimagesize("puppy.jpg");
$percent = 150/100;
$image_dest = @imagecreatetruecolor($size[0]*$percent, $size[1]*$percent);
imagecopyresampled($image_dest, $image, 0, 0, 0, 0, $size[0]*$percent, $size[1]*$percent, $size[0], $size[1]);
imagejpeg($image_dest);

This will output an image 150% the width and height of the original. You can control the size of the image by changing the value of $percent. With some experimentation you can also try changing the ratio of the width and height to distort the image, and change the values within imagecopyresampled() to change the portion of the image that is resized.

Why not try image rotation by replacing the imagejpeg($image_dest); function call to the following

// 0x000000 is the background colour to use for the blank
// space left after the rotation calculation
$rotate = imagerotate($image_dest, 45.0, 0x000000);
imagejpeg($rotate);

Cute puppy has been rotated 45 degrees. Poor thing

Saving the Image To Disk

Once you’ve manipulated the image enough, you may then want to save it to disk. A common usage for such a function is the use of generated thumbnail images for image upload sites. The idea being that a user would upload an image to a forum, or an image hosting site, and they would be given the option of either linking to the full-size image, or to a small thumbnail of the image.

Such functionality is easy to achieve with the GD2 library, we simply modiy to the code from earlier by adding a new parameter to imagejpeg. This simply saves the GD resource to a file on the disk, as specified by the name given.

$image = @imagecreatefromjpeg("puppy.jpg");
$size = getimagesize("puppy.jpg");
// let's save a 33% thumbnail
$percent = 33/100;
$image_dest = @imagecreatetruecolor($size[0]*$percent, $size[1]*$percent);
imagecopyresampled($image_dest, $image, 0, 0, 0, 0, $size[0]*$percent, $size[1]*$percent, $size[0], $size[1]);
// modify this final line to add an extra parameter to imagejpeg
imagejpeg($image_dest, "puppy_thumb.jpg");

New, smaller thumbnail puppy

This then results in a new file on the disk, smaller in size and dimensions than the original called “puppy_thumb.jpg”. The original file is not overwritten or modified during this action. We have also removed the header() function call from the first line, since we will no longer be writing the image data to the browser window.

Saving a PHP file

A PHP file is basically a text file containing all the required PHP code to run a specific program. PHP code can be written with the use of a simple text editor, like Windows Notepad, or the more useful Crimson Editor. All you need to do is type in the required PHP code and save the file with the extension .php

You can create a PHP file yourself by creating a blank text file and simply renaming it with the extension .php. You need absolutely nothing else for this to work as a valid PHP file. Although, as I’m sure you’ll realise, a blank file won’t do anything much of use! First of all, we need to enter some valid PHP code into this file

(Important: Don’t use a program such as Microsoft Word, Frontpage or other more complex word processors to create your PHP file. Although the page might look free of formatting when you save the file, there will be other hidden formatting elements within the file itself that will prevent any PHP code from running.)

This is an example of some PHP code

This code is the exact same code that will work as a PHP file on a server, and we’ll take a look shortly at how you can create your very own simple PHP file to run as a basic web-page sample. First though, we need to know where to locate our PHP files.

The location of the PHP file on disk

An important thing for us at this point is to know where to save this .php file for it to be recognised as a valid web-page file. Any PHP documents must be placed within the document root of a website server. In simple terms, this means that on your computer, or on the remote computer that you’ve got set up as a website host, are a number of folders and directories. One of these directories will be set up as the document root, and is usually named c:local if you’re using your own Windows machine to run the code, or something like /htdocs or /html_root if you’re running on a remote server.

The document root is the base directory from which all the website data is served from. Any sub-directories within this main root directory will show up as sub-folders when you type in the URL

e.g. if you have a folder “mysite” within the c:local folder, you’ll be able to access the URL http://localhost/mysite to see the contents of this folder. Any PHP files within this folder can be accessed by adding the PHP filename to the end. e.g. http://localhost/mysite/myphpfile.php

Similarly with a remote host, a folder like htdocs/mysite will be accessible from http://www.mywebsite.com/mysite and any relevant PHP files in the mysite folder will be at http://www.mywebsite.com/mysite/myphpfile.php and so on

Index.php

PHP files can be named anything you want, according to the filename rules of the operating system you’re using (For example, Windows filenames can’t contain certain characters) - you can have “myphpfile.php”, “biscuits.php”, “cheese_on_toast.php”. But a useful name for a PHP file is index.php

The reason behind naming a php file index.php is that the file “index.php” will always be loaded first when visiting a URL that doesn’t specify a filename e.g. http://www.mywebsite.com - in this case, that URL will automatically look for a file named http://www.mywebsite.com/index.php. This is an extremely useful way of defining a main page, or home page for your site.

In the next section, we’ll make a start on generating our first PHP file, and seeing the results in a browser window.

Adding your first few lines of code

After saving a blank PHP file in your chosen location, point your browser to the URL where your file is located, according to the directory structure and the location you saved the file in. E.g. using the address http://localhost/myphp/myphp.php if you saved the file in c:localmyphpmyphp.php or http://www.mywebsite.com/mysite/file.php if you saved the file file.php on a remote server in the folder mysite).

After entering this URL, you should see a blank screen appear. This is because we’ve not added anything to the file yet!

Return to your text editor, and add the following lines to the file

Type it out exactly as it’s written above. I’ll explain the symbols used here in just a moment, but return to the web browser now, and reload the page. You’ll see the following output

Hello world

If you see the above text, then everything is going well! You should now have your first working PHP application. If you don’t see the text above appear on the screen, go back and check the file again. You must enter the code exactly as it appears above. Now, I shall explain what’s going on here

The <?php and ?> tags are the PHP delimeters. They are used to declare where the PHP code starts, and where it ends. This will be of more importance in the next tutorial which deals with the combination of HTML code and PHP. For now, all you need to know is that these symbols are vital to the execution of the code. It is also acceptable to start and stop these PHP delimiters as often as you like. So, for example, the following code is perfectly valid

Note that you can also use the symbolds <? and ?> to express the beginning and end of the code, but the use of <?php and ?> is much more widely accepted as the standard, due to the way most servers interpret the code.

On the second line, you will see a commonly used PHP command, “echo”, which we’ll look at again later. For now, the important thing to note is the semicolon used at the end of the line. It is absolutely vital, in PHP, to terminate any expression or command with this semicolon, otherwise the code will fail.

If you’re coming from an ASP background (another language similar to PHP, not as widely used but still very popular) you can enable PHP to recognise ASP style tags, like so

Using Comments in PHP

Comments are an excellent way to document your code. They allow for a way to place handy notes and thoughts for yourself alongside your code so that you can pick up where you left off when you return to either add new features or debug the script. Comments also provide an effective way for other developers to understand your thoughts and motivations when working on your code.

Comments can be written in one of three ways as the following examples demonstrate

Comments may seem a bit counterintuitive at first. If you’re not used to programming, you might wonder what the point is of adding all that extra work if it does nothing useful. In time though, and with experience of larger projects, you’ll find that all those little thoughts and statements become invaluable when you return to debug code days, weeks, months or years later.

When developing a PHP project, whether it’s a simple website or a much larger web application, it’s always a good idea to take into account the potential appearance of errors in your PHP code. An error occurs whenever PHP tries to execute an instruction which either results in an impossible outcome, or otherwise prevents the script from executing in the manner intended by the programmer.

Errors range from simple fatal errors, where program execution is halted at the point of the fault - usually a syntax error or a call to a function that doesn’t exist - to more complex errors where the cause of the problem isn’t immediately clear, and an indepth review of the code must be carried out to pinpoint the flaw.

Undefined Variables (and other little glitches)

Dealing with errors in a meaningful and graceful manner is a major consideration when developing PHP code. The default behaviour of PHP when encountering an error is to output a very simple line of text, with very basic formatting. It’s really quite ugly, and not the sort of thing you want your visitors to be seeing:

echo ($hello_world);

Here, we are trying to access a variable $hello_world which has not been defined. The resulting output will be a screen with the following text

Notice: Undefined variable: hello_world in C:localmyphp.php on line 5

Note: You might not see this appear on screen right away. PHP sometimes is not fully set up to display all errors as they happen. To change PHP’s default behaviour, add the following lines before the echo statement above

error_reporting(E_ALL|E_STRICT);
ini_set("display_errors", TRUE);

Line 1 tells PHP to report all errors (including “strict” errors, which aren’t included as part of the E_ALL argument). Line 2 sets a PHP configuration variable which instructs PHP to always display errors. This value is also hidden away in the php.ini configuration file, but that’s not always accessible, so this way of setting it is perfectly valid.

One way to get around this error message cropping up in the first place is to make sure you’ve properly defined the variable before you use it. And if you’re uncertain whether or not the variable is defined, you can always place checks before calling it, like so

//the isset function checks if a given variable is defined or not
if(isset($hello_world){
  echo $hello_world;
} else {
  echo "The variable 'hello world' couldn't be located";
}

But that’s not terribly practical when you have to do the same checks for every variable, and the error message displayed still makes it all too clear to the visiting public that something’s gone wrong.

In the next section, we will look at ways of handling these error messages in a much more efficient manner

x + 5 = 7;
from this we can deduce that x = 2

In PHP it works in a similar fashion, except we usually know the value of x, and simply assign it a specific value, such as x = 5. We can then use that value to perform calculations using other symbols and numbers. For example

$x = 5  //x now equals 5
$y = $x + 10  /* y now equals 5 + 10 */

These symbols in PHP are known as variables and require you to follow a specific syntax to use them properly. Once you understand the principles behind them, you’ll begin to see how they form a major component of any PHP application, and can be used to store many things other than just numbers. Let us begin though, by guiding you through a few simple examples of the use of variables.

A simple introduction

A very simple example of the use of a variable in PHP is to hold just one number, e.g.

$x = 5;

All variables in PHP start with a dollar sign, followed by a string of numbers, letters (both lower-case and capitals) and underscores. Variables are also case sensitive, meaning that $Variable is not equal to $variable. The only other requirement of variable naming is that the first digit cannot be a number. These are examples of valid variable names

$variable_name = 5; //valid - integer
$VariableName = 25.5; //valid - floating point
$variable3 = 155; //valid
$_variable_number_four = "value"; //valid - string
$_x = "five"; //valid

These are not valid variable names

$1st_variable = 5; //invalid
$Variable.name = 25; //invalid, cannot have dots in names

Variables are assigned values through the use of the equals sign (=) operator. Once a variable has been assigned to a value, that variable symbol can be used in place of the value anywhere in the code. The value of the variable can also be changed at any point during the execution of the code. The same value can also be assigned to multiple variables at the same time, like so

$a = $b = $c = 5;
echo "$a, $b, $c";

This produces the output

5, 5, 5

Flexible Types

The “type” of a variable is defined by the value you’ve assigned to it. PHP supports a wide range of types, including strings, integers and floats.

$string = "This is a string";
$integer = 5; //an integer value;
$float = 4.55; //a "floating point" value

PHP doesn’t explicitly require that you maintain the same type for a certain variable though. If you tried to assign a string value to a variable which previously contained an integer, you’ll encounter no problems. Similarly with any other types, floating point variables can hold integers or strings and so on.

time() or, the Unix Timestamp

One of the simplest date/time functions in PHP is time(). This simple function takes no arguments, and simply returns a numeric value equal to the number of seconds since the “Unix Epoch”, declared as January 1st 1970 at midnight (GMT) - just an arbitrary date chosen to base timing calculations on when working with dates and times. This gives a start time upon which we can base our time calculations

$time = time();
echo $time; //gives us something like 1219075172

PHP’s date() function

This timestamp can then be used as input to the date() function to format it for improved readability. The date() function takes, as its arguments, a string to define how we wish the formatted time to appear and secondly, a Unix timestamp just like the one returned by time(). It is also possible to use date() without specifying a timestamp and it will use the current time as its source.

echo date("F j, Y, g:i a", 1219075172); //produces "August 18, 2008, 4:59 pm"

The string used in the date() function can contain a number of single letters which are then substituted for their human readable counterparts according to the value of the timestamp. In our case, the following substitutions are made

F: The full textual representation of the month, August in this case
j: The day of the month, without leading zeros, e.g. 4, 18, 22
Y: The full year, e.g. 2008
g: The current hour, in 12-hour format
i: The current number of minutes
a: Either am, or pm, depending on the time

A full list of all the codes, and their textual counterparts can be seen on PHP.net’s date() page here. Extra text can be added to the formatted string as required, but remember to escape any characters which date() will interpret as formatting text.

Make time with mktime()

An alternative to the time() function is mktime(). This function is useful when we wish to use a date/time which is not the current time. mktime() takes as its arguments numerical values representing, in this order - hours, minutes, seconds, months, days, years - and a final value to declare whether daylight savings time is to be taken into account.

$date = mktime(10, 15, 0, 12, 12, 1980); //produces 345464100
echo date("F j, Y, g:i a", $date); //produces "December 12, 1980, 10:15 am"

Verifying a Valid UsernameVerifying Valid DatesValidating IP AddressesMatching Phone Numbers, Postcodes, Social Security numbers etcValidating Email AddressesVerifying Credit Card NumbersReplacing Static Links with Hyperlinks in HTMLRemoving Swearing and Profanity from blogs and forumsStripping out Bad Attributes and Javascript from HTML codeBBCode - Custom Formatting DefinitionsConclusion

Regular expression are one of the most powerful features of PHP. They’re also one of the most confusing and bewlidering if you’re not familiar with their syntax. They can be used for a wide range of purposes, from validating user names to grabbing data from a website. In this article, I’ll take you through 10 regular expression functions which I have found extremely useful in the past and which can play an important role in any modern website or application.

Verifying a Valid Username

^Back to top

Sometimes we need to impose rules on a website about what sort of names a user can choose. For our own needs, and for readability, it’s often useful to state rules which force users to choose names containing only letters, numbers or underscores.

The following regular expression function checks a given username string based on the following rules

A username must start with a lower-case or upper-case letter
A username can contain only letters, numbers or underscores
A username must be between 8 and 24 characters
A username cannot end in an underscore

function valid_name($username){
    return preg_match("#^[a-z][da-z_]{6,22}[a-zd]$#i", $username);
}

$usernames = array(
  "RoughGuide98", "_invalidUsername", "%423f@''#",  "25UserName",
  "I_am_valid_user",  "I am not a valid user", "tooshort",
  "ThisUserNameIsTooLongAndWontBeAccepted", "ThisIsTheRightSize"
  );
 
foreach ($usernames as $name){
    if(valid_name($name))
        echo "$name - Ok";
    else
        echo "$name - Unsuitable!";  
}
 
/* This produces...
RoughGuide98 - Ok
_invalidUsername - Unsuitable!
%423f@''# - Unsuitable!
25UserName - Unsuitable!
I_am_valid_user - Ok
I am not a valid user - Unsuitable!
short - Unsuitable!
ThisUserNameIsTooLongAndWontBeAccepted - Unsuitable!
ThisIsTheRightSize - Ok */

Verifying Valid Dates

^Back to top

This regular expression function will check if a date provided is valid in the DD-MM-YYYY format and can successfully check for an incorrect date value for specific months. It will also deal successfully with February 29th on leap years. It can accept the characters “/”, “-” and “.” as date seperators.

function check_date($date){
    $seperator = "[/-.]";
    return preg_match("#^(((0?[1-9]|1d|2[0-8]){$seperator}(0?[1-9]|1[012])|(29|30){$seperator}(0?[13456789]|1[012])|31{$seperator}(0?[13578]|1[02])){$seperator}(19|[2-9]d)d{2}|29{$seperator}0?2{$seperator}((19|[2-9]d)(0[48]|[2468][048]|[13579][26])|(([2468][048]|[3579][26])00)))$#", $date)==1?true:false;
}

Here’s the function in action

check_date("30.9.2005"); //valid
check_date("32.9.2005"); //invalid
check_date("29.1.2005"); //valid
check_date("29.2.2005"); //invalid

Validating IP Addresses

^Back to top

This regular expression function will check if a given IP address is within the valid range, specifically between 0.0.0.0 and 255.255.255.255

function valid_ip($ip_address){
    $val_0_to_255 = "(25[012345]|2[01234]d|[01]?dd?)";
    $pattern = "#^($val_0_to_255.$val_0_to_255.$val_0_to_255.$val_0_to_255)$#";
    return preg_match($pattern, $ip_address, $matches);
}

This regular expression is relatively simple. It uses the regular expression to find a number between 0 and 255 and repeats it 4 times, seperated by dots. Here’s the function in use

valid_ip("0.0.0.255"); //valid
valid_ip("0.0.0.256"); //invalid

Matching Phone Numbers, Postcodes, Social Security numbers etc

^Back to top

All of these are fairly similar, so are lumped into the same category here. I’ve left out “Credit Card Numbers” since they can require a little extra consideration, and I’ve given them their own section later on. But for now, let’s look at how we can use pattern matching to check some of the most common number sequences we use in our daily lives.

Let’s look first at matching a valid US telephone number

US phone numbers are of the format 000 000 0000, a group of three numbers, followed by another three then a final four. We can write this in regular expression format as follows

$reg = "#^d{3}sd{3}sd{4}$#";

This will match any phone number in the above format, like 351 234 5555. But we run into problems if we’re using a different notation, like (123)-555-5555. No worries though, the following alterations will allow us to use all sorts of variations like this

$reg = "#^(?d{3})?[s.-]?d{3}[s.-]?d{4}$#";

Let’s try this now

function matchUSPhone($number) {
  $reg = "#^(?d{3})?[s.-]?d{3}[s.-]?d{4}$#";
  return preg_match($reg, $number);
}
 
if(matchUSPhone("(123)-555-5555"))
  echo "This matches";
//indeed, this does match

Here’s some other useful functions you can use

//Match a UK format phone number
function matchUKPhoneNumber($number){
  //UK Phone numbers are 10 or 11 digits long, and have a 3, 4, 5 or 6 digit area code
  $s = "(([ -.])*)?";
  $result = preg_match("#^(((?d{3})?$sd{7,8})|((?d{4})?$sd{6,7})|((?d{5})?$sd{5,6})|((?d{6})?$sd{4,5}))$#", $number);
  return $result;
}
 
//Match a US social security number
function matchUSSocialSecurity($ss_num){
  return preg_match("#d{3}-d{2}-d{4}#", $ss_num);
}
 
//This regular expression matches a UK National Insurance number  
function matchUKNationalInsurance($ni){
  $digits_1_and_2 = "[ABCEGHJKLMNOPRSTWXYZ][ABCEGHJKLMNPRSTWXYZ]";  
  $the_rest = "d{6}[A-D]?";
  $reg = "#^".$digits_1_and_2.$the_rest."$#";
  return preg_match($reg, $ni);
}

Validating Email Addresses

^Back to top

Checking that an email address is valid is a fairly tricky thing. You have to make sure the domain name is correct, and that the first part of the email contains valid characters. Using regular expressions though, something like this becomes fairly trivial. Here’s a simple example to match a very basic email address

$reg = "#(.*)@(.*).com#";

This is pretty useless though, since it will only match email addresses ending in “.com”. A more concrete example is as follows

function checkEmail($email){
    $reg = "#^(((([a-zd][.-+_]?)*)[a-z0-9])+)@(((([a-zd][.-_]?){0,62})[a-zd])+).([a-zd]{2,6})$#i";
    return preg_match($reg, $email);   
}

And a couple of examples

checkEmail("robin@roughguidetophp.com"); //valid
checkEmail("not-an-email@address"); //invalid

Note that this function won’t determine whether a given email address actually exists and is valid. To achieve that, you’d need to implement more checks. One possibility is to use the PHP function checkdnsrr() to check that the domain name is valid, although that only exists on Unix installations of PHP. On Windows you’d need to write your own custom function.

You would then still need to check that the mailbox itself exists, which could be achieved by sending out a confirmation email to the user, and if they receive it, and click on the link contained within, then you’ll know it’s a valid address.

Verifying Credit Card Numbers

^Back to top

When developing e-commerce applications, it becomes necessary to process credit card details, and make sure they’re accurate. A simple check you can perform is to see if the credit card number a customer provides fits the card number definitions laid out by the card issuers. For example, a Visa card number starts with a 4, and can contain 16 or 13 digits.

The following regular expression function will check to see if a card number conforms to the appropriate rules. This function checks for some of the most common card types. An additional second parameter can be entered to use a Luhn algorithm check1 which is a method used by card issuers to generate valid card numbers, as opposed to random strings of digits. Read more about the Luhn algorithm at Wikipedia, if you’re interested

check_cc() will return false if the card number isn’t valid and if it is valid, will return a string containing the type of card matched.

function validatecard($cardnumber) {
    $cardnumber=preg_replace("/D|s/", "", $cardnumber);  # strip any non-digits
    $cardlength=strlen($cardnumber);
    $parity=$cardlength % 2;
    $sum=0;
    for ($i=0; $i9) $digit=$digit-9;
      $sum=$sum+$digit;
    }
    $valid=($sum%10==0);
    return $valid;
}
 
 
function check_cc($cc, $extra_check = false){
    $cards = array(
        "visa" => "(4d{12}(?:d{3})?)",
        "amex" => "(3[47]d{13})",
        "jcb" => "(35[2-8][89]ddd{10})",
        "maestro" => "((?:5020|5038|6304|6579|6761)d{12}(?:dd)?)",
        "solo" => "((?:6334|6767)d{12}(?:dd)?d?)",
        "mastercard" => "(5[1-5]d{14})",
        "switch" => "(?:(?:(?:4903|4905|4911|4936|6333|6759)d{12})|(?:(?:564182|633110)d{10})(dd)?d?)",
    );
    $names = array("Visa", "American Express", "JCB", "Maestro", "Solo", "Mastercard", "Switch");
    $matches = array();
    $pattern = "#^(?:".implode("|", $cards).")$#";
    $result = preg_match($pattern, str_replace(" ", "", $cc), $matches);
    if($extra_check && $result > 0){
        $result = (validatecard($cc))?1:0;
    }
    return ($result>0)?$names[sizeof($matches)-2]:false;
}

And here’s a sample of the function in action

$cards = array(
    "4111 1111 1111 1111",
    "4111 1111 1111 1",
    "4111 1111 1111 111",
    "3400 0000 0000 009",
    "3500 0000 0000 009",
    "5500 1545 0000 0004",
    "5940 0000 0000 0004"
);
 
foreach($cards as $c){
    $check = check_cc($c, true);
    if($check!==false)
        echo $c." - ".$check;
    else
        echo "$c - Not a match";
    echo "";
}
 
/*
This gives us
4111 1111 1111 1111 - Visa
4111 1111 1111 1 - Visa
4111 1111 1111 111 - Not a match
3400 0000 0000 009 - American Express
3500 0000 0000 009 - Not a match
5500 1545 0000 0004 - Mastercard
5940 0000 0000 0004 - Not a match
 
Using the Luhn algorithm, we can also check further to 
see if any of these numbers actually represents a valid card
check_cc("5500 1545 0000 0004", true); //matches
check_cc("5500 1585 0000 0004", true); //doesn't match
 
*/

Replacing Static Links with Hyperlinks in HTML

^Back to top

A useful feature on most forums is the ability to type in a website address, like http://www.google.com, for example, and have that address automatically linked, via a HTML hyperlink, like so - http://www.google.com. The following regular expression function will automatically replace any website addresses with the appropriate HTML code to produce an active link

function replace_urls($string){
    $host = "([a-zd][-a-zd]*[a-zd].)+[a-z][-a-zd]*[a-z]";
    $port = "(:d{1,})?";
    $path = "(/[^?#"s]+)?";
    $query = "(?[^#"s]+)?";
    return preg_replace("#((ht|f)tps?://{$host}{$port}{$path}{$query})#i", "$1", $string);
}

Here, the four different components of the average URL - host (e.g. www.google.com), port (e.g. www.website.com:8080), path (e.g. www.website.com/mysite/file.php) and the query string (e.g. www.website.com/index.php?var=1&var2=100) - are combined to generate the final regular expression pattern.

An example of this in action

$string = "Visit http://www.google.com for all your searching requirements! And here are some pictures of cheese - http://images.google.co.uk/images?q=cheese";
echo replace_urls($string);
 
/*
This produces...
Visit http://www.google.com for all your searching requirements!
And here are some pictures of cheese - http://images.google.co.uk/images?q=cheese
*/

Removing Swearing and Profanity from blogs and forums

^Back to top

Sometimes it’s useful to be able to protect the youngsters and more fragile minded members of our communities from having to see rude words on their computer screens by filtering out any words deemed to be unsuitable from any comments posted by site members.

The following regular expression function makes use of the preg_replace_callback() function in PHP to perform a function call “stars” on every matched instance for the words in the $swears array, replacing each letter except the first with star symbols.

This function can be used after retrieving data from a database, to filter out any unsuitable content. You can also use this function to filter out any other keywords, perhaps to prevent users from advertising your competitor’s products on your forum, for example.

function deswear($string){
 
    function prep_regexp_array(&$item){
        $item = "#$item#i";
    }
 
    function stars($matches){
        return substr($matches[0], 0, 1).str_repeat("*", strlen($matches[0])-1);
    }    
 
    $swears = array("darn", "heck", "blast", "shoot");
    array_walk($swears, "prep_regexp_array");
    return preg_replace_callback($swears, "stars", $string);
}

And an example of this in action

$string = "Aw, darn, HECK, Blast and ShOoT!";
echo deswear($string);
//Aw, d***, H***, B**** and S****!

Stripping out Bad Attributes and Javascript from HTML code

^Back to top

When working with a forum or blog where user comments are welcomed, it’s often necessary to maintain strict control over exactly what a user can post on the site. The simplest method is just to strip out all unwanted content using the PHP function strip_tags(). This function also has an optional argument to let you leave certain tags in place though, like <b> or <u> if you wish to allow users the ability to specify custom formatting

A problem with this, though, is that strip_tags() will not remove whatever is inside the <b> or <u> tags if you leave them in place. For example, the following code will not get stripped out using strip_tags()

This is <b style='font-size:100px' onMouseOver='alert("Hello")'>malicious text!</b>

This will trigger a javascript alert window whenever you move your mouse over the bold text and also - because of the “style” attribute - make the text 100 pixels tall. Not what you want to be seeing on your message board!

The following function will not only strip out any unwanted tags from your HTML code, but will also clean up whatever attributes are inside those tags, preventing people from messing up your page

function cleanTags($source, $tags = null)
{
    function clean($matched)
    {
          $attribs = "javascript:|onclick|ondblclick|onmousedown|onmouseup|onmouseover|".
                     "onmousemove|onmouseout|onkeypress|onkeydown|onkeyup|".
                     "onload|class|id|src|style";
          $quot = ""|'|`";
          $stripAttrib = "' ($attribs)s*=s*($quot)(.*?)(2)'i";
          $clean = stripslashes($matched[0]);
          $clean = preg_replace($stripAttrib, '', $clean);
          return $clean;
    }      
 
    $allowedTags='';
    $clean = strip_tags($source, $allowedTags);
    $clean = preg_replace_callback('##', "clean", $source);
    return $source;
}

Here’s the function in action

$string = "This is malicious text!";
 
echo $string;
echo cleanTags($string);
//gives us...
//  This is malicious text!

BBCode - Custom Formatting Definitions

^Back to top

A more comprehensive approach to the previous problem of disallowing certain tags in HTML user input is to completely strip out all tags, except for your own custom-defined ones.

Instead of declaring your tags using pointed brackets (< and >) you can create custom tags, most commonly with square brackets ([ and ]). This is known as BBCode (Bulletin Board Code). It is a simple way of defining custom formatting rules for forums and gives more control to the board owner over what users can and cannot do. Any range of tags can be defined, the most common of which are [b] for bold, [for underline and [to place a link.

Here is a simple implementation of some basic BBCode rules

function BBcode($string) {
 
    //get rid of all HTML tags
    $string = strip_tags($string);
 
    $patterns = array(
        "bold" => "#[b](.*?)[/b]#is",
        "italics" => "#[i](.*?)[/i]#is",
        "underline" => "#[u](.*?)[/u]#is",
        "link_title" => "#[url=(.*?)](.*?)[/url]#i",
        "link_basic" => "#[url](.*?)[/url]#i",
        "color" => "#[color=(red|green|blue|yellow)](.*?)[/color]#is"
    );
 
    $replacements = array(
        "bold" => "$1",
        "italics" => "$1",
        "underline" => "$1",
        "link_title" => "$2",
        "link_basic" => "$1",
        "color" => "$2"
    );
 
    return preg_replace($patterns, $replacements, $string);
 
}

This regular expression function searches through a given string for any instances of matching text within square brackets, followed by a matching closing pair of brackets with the same text inside. So, for example, the text “[b]this is bold[/b]” would be matched by the first expression in the array. Note how we’re specifying that the contents of each pair of brackets musn’t be a greedy search - denoted by the ? after the * symbol. Otherwise, a string like “[b]this is bold[/b] and [b]this is also bold[/b]” would return a match for everything within the first [b] and the last [/b], not what we require.

Here it is in action

echo BBcode("[b]this is[/b] me being [b]bold[/b], and [url=http://www.google.com]here's a link[/url] and another - [url]http://www.google.com[/url]");
//this is me being bold, and here's a link and another - http://www.google.com
 
echo BBcode("Here's some [color=red]Red Text![/color]");
//Here's some Red Text!

Conclusion

^Back to top

So, there you go. Hopefully you’ve gained some useful knowledge from this article. At the very least, you should now have an understanding of the power of regular expressions and be able to see how they can fit in with your website applications to provide extra functionality.

These expressions and functions can also be translated into other programming languages fairly easily, like Javascript or Perl (Perl’s regular expression handling is actually far superior to PHP’s, and I’d recommend checking it out just to get a grasp of regular expression handling in its purest form). The expressions themselves will need very little altered when being used elsewhere, although the PHP functions used will most likely have different counterparts.

Try messing around with the expressions to obtain different results, and feel free to use any code in this article in your own programs.

Thanks to www.planzero.org ↩

(Download all the files used in this tutorial here)

Visitor Tracking and Analysis

When running a website, whether it’s a small personal homepage, or a large site for a company, it’s useful to be able to know who is visiting your site, and what they’re up to while they’re there. If you use PHP and MySQL to build your site, then it becomes a simple task to retrieve some information about your visitors and write it into the database, to be viewed at a later date.

Using this information, you can develop strategies to improve your website, and learn about your visitor’s browsing trends. You might even be able to tailor specific pages for a visitor’s purpose based on what search terms they used to find that page.

Store and view useful information about all your visitors

In this tutorial, I’ll take you through the steps required to build and install a very simple visitor tracking tool on your website, so you can start analysing your visitors behaviours.

The files you’ll need

During this tutorial we’ll need to create 5 files. If you’d rather just get straight to the point and try installing this application yourself, you can download all the files used in this article here

ip_report.php - To access and view visitor statistics
ip_tracker.php - The plugin module which will update the database with the relevant values
three test pages - To let you see the tool in action!
session_end.php - An optional file, used during testing to manually reset a session

We’ll also need to create a new MySQL table, visitor_tracking, the code for that is included in the zip file, as well as in the area below.

Considerations before we start

Let’s consider first, what we might want to achieve using a tool like this. Basically, we want to be able to access information about our visitors. But what information? And in what format?

We’re going to be storing our visitor data in a MySQL database. We’re also going to put measures in place to ensure that we don’t confuse unique visits with page hits. unique visit is when one single person visits your website and when that happens, we want only one record in the database. But, we also want to see the individual page hits which show how many individual pages each person has viewed. We can use this information to see how long a particular person stayed on the site.

Along with this visit data, we’re going to store some other information about the user being tracked. Thanks to the PHP array $_SERVER, we can get hold of a wide range of useful stats and information about the person. Here is a sample of some of the information we can retrieve about people arriving at our site.

Referring page - Accessed through the $_SERVER['HTTP_REFERER'] variable. You can use this to see if people have come from a search engine, and this variable will also contain the search terms they used to find you. Very useful for marketing and analysis
IP Address - A handy value to label your visitor records with. This is available through $_SERVER['REMOTE_ADDR']
The current page address - To see which pages our visitors are accessing, we can retrieve the filename for the current page through $_SERVER['SCRIPT_NAME']. We can also grab the query string with $_SERVER['QUERY_STRING']

A selection of other values is available through the $_SERVER array too, but for now, we’re just going to store and record two values using this array - the current page location, and the IP address of the visitor

Note : IP Addresses can sometimes change, even while a user is browsing a page, so we can’t rely on these to track them. Instead, we’re going to rely on the session a user generates while they visit the site. This is unique and unchanging for each individual user, so we can make use of this fact to track them across multiple pages on our site.

MySQL code

Run this query in your MySQL management tool to generate the table we’re going to be using for this application. This is just a simple example of a visitor tracking tool, and doesn’t contain many fields, but you can add in as many new fields as you like, and it’s possible to track extra visitor data such as the type of browser they’re using, their location and more!

DROP TABLE IF EXISTS `visitor_tracking`;
CREATE TABLE IF NOT EXISTS `visitor_tracking` (
  `entry_id` int(11) NOT NULL AUTO_INCREMENT,
  `visitor_id` int(11) DEFAULT NULL,
  `ip_address` varchar(15) NOT NULL,
  `page_name` text,
  `query_string` text,
  `timestamp` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
  PRIMARY KEY  (`entry_id`),
  KEY `visitor_id` (`visitor_id`,`timestamp`)
) ENGINE=InnoDB  DEFAULT CHARSET=latin1;

ip_tracker.php

First we’re going to create the file that will do the visitor tracking for us. This file will be include()’d at the top of each of the pages we wish to track. We’ll also be tracking by query string, so this will work if your site only uses one file (e.g. index.php) and generates pages based on the value of an id (e.g. index.php?page_id=52)

To start off, we need to set up our database connection and also grab some values from the server about our current visitor, so we can save these to the database later

//define our "maximum idle period" to be 30 minutes
$mins = 30;
//set the time limit before a session expires
ini_set ("session.gc_maxlifetime", $mins * 60);
session_start();
$ip_address = $_SERVER["REMOTE_ADDR"];
$page_name = $_SERVER["SCRIPT_NAME"];
$query_string = $_SERVER["QUERY_STRING"];
$current_page = $page_name."?".$query_string;
//connect to the database using your database settings
include("db_connect.php");

Let’s explain a few things here

$mins = 30 - We need to define a “timeout” limit for our visitor tracking tool. If a visitor clicks on a new page within, say, 29 minutes, then that’ll be counted as part of the same visit. If, however, they go away for an hour or so and come back, we might want to treat that as a new visit. Increase this value if you want to let visitors stay away from the site longer and still count them in the same visit
session_start(); - Start up the session. Very important that you don’t include any HTML whitespace or other characters before this function call
$ip_address = … etc. - Grab some useful values from the server including the current visitor’s IP address, the name of the page we’re on and anything that’s in the query string. The current page is generated by joining these last two together
include(”db_connect.php”); - Just include whatever code you need in a seperate file to connect to the database. In my case, the code is

//change these values to whatever your own database server requires
$link = mysql_connect('localhost', 'root', 'pass'); //Connects to the database at "localhost"
if(!$link) {
    //halt execution if cannot connect
    die("Cannot connect to the database!");
}
mysql_select_db('test', $link); //Assuming you have a database named "test" set up

Next, we’re going to consider two different scenarios - first, if the visitor is returning to the site after already having viewed a page. We’re going to set a value in the $_SESSION array to remember this person, so…

if(isset($_SESSION["tracking"])){
    //update the visitor log in the database, based on the current visitor
    //id held in $_SESSION["visitor_id"]
    $visitor_id = $_SESSION["visitor_id"];
    if($_SESSION["current_page"] != $current_page)
    {
        $sql = "INSERT INTO visitor_tracking
            (ip_address, page_name, query_string, visitor_id)
            VALUES ('$ip_address', '$page_name', '$query_string', '$visitor_id')";
        if(!mysql_query($sql)){
            echo "Failed to update visitor log";
        }
        $_SESSION["current_page"] = $current_page;
    }
}

In this first conditional branch, we’re checking to see if the session variable “tracking” has been set. If so, then this means that we’re already tracking this visitor and so must insert a new entry into the database based on their visitor ID. We’ll see in just a moment how we generate this visitor ID and also set the appropriate session variables. As long as the session is valid (if the user has been idle for less than 30 minutes), then these values will exist, otherwise they’ll be deleted and we can count this as a new visit, which is dealt with in the second condition of the IF statement.

line 16 - We check that the current page doesn’t match the last page the user viewed. We don’t want to track multiple reloads of the same page
lines 18-20 - The SQL statement to add a new entry to the visitors table. Note how $visitor_id will always be set to the same value, the value held in “visitor_id” in the $_SESSION variable. This is so we can track the same visitor across multiple page views. All entries for a specific “visit” by a specific user will have the same visitor ID.

Now we’re going to look at the other conditional branch - when a user visits the page for the first time

else {
    //set a session variable so we know that this visitor is being tracked
    $_SESSION["tracking"] = true;
    //insert a new row into the database for this person
    $sql = "INSERT INTO visitor_tracking
        (ip_address, page_name, query_string)
        VALUES ('$ip_address', '$page_name', '$query_string')";
    if(!mysql_query($sql)){
        echo "Failed to add new visitor into tracking log";
    } else {
        //find the next available visitor_id for the database
        //to assign to this person
        $entry_id = mysql_insert_id();
        $lowest_sql = mysql_query("SELECT MAX(visitor_id) as next FROM visitor_tracking");
        $lowest_row = mysql_fetch_array($lowest_sql);
        $lowest = $lowest_row["next"];
        if(!isset($lowest))
            $lowest = 1;
        else
            $lowest++;
        //update the visitor entry with the new visitor id
        mysql_query("UPDATE visitor_tracking SET visitor_id = '$lowest'
            WHERE entry_id = '$entry_id'");
        //place the current visitor_id into the session so we can use it on
        //subsequent visits to track this person
        $_SESSION["visitor_id"] = $lowest;
        //save the current page to session so we don't track if someone just refreshes the page
        $_SESSION["current_page"] = $current_page;
    }
}

ip_report.php

Now we’ll look at the file where we generate the report data. In the “head” of the file (before we add any HTML data) we’ll add in some PHP preprocessing, code that runs before we need to produce any output

<?php
include("db_connect.php");
//retrieve the appropriate visitor data
$view = $_GET["view"];
//set a default value for $view
if($view!="all" && $view!="record")
  $view = "all";
if($view == "all")
{
    //show all recent visitors
    $sql = "SELECT visitor_id, GROUP_CONCAT(DISTINCT ip_address) as ip_address_list,
        COUNT(DISTINCT ip_address) as ip_total, COUNT(visitor_id) as page_count,
        MIN(timestamp) as start_time, MAX(timestamp) as end_time FROM
        visitor_tracking GROUP BY visitor_id";
    $result = mysql_query($sql);
    if($result==false){
        $view = "error";
        $error = "Could not retrieve values";
    }
} else {
    //show pages for a specific visitor
    $visitor_id = $_GET['id'];
    //rung $visitor_id through filter_var to check it's not an invalid
    //value, or a hack attempt
    if(!filter_var($visitor_id, FILTER_VALIDATE_INT, 0)){
        $error = "Invalid ID specified";
        $view = "error";
    } else {
        $sql = "SELECT timestamp, page_name, query_string, ip_address
            FROM visitor_tracking WHERE visitor_id = '$visitor_id'";
        $result = mysql_query($sql);
    }
}
function display_date($time){
    return date("F j, Y, g:i a", $time);
}
 
?>

Some important things to notice here -

lines 11-14 - The SQL code used when we’re viewing the main page which details all the visitors that have arrived at the site, along with a few bits of information about them. Note the use of the MySQL function GROUP_CONCAT. This is an especially useful function, since it allows us to return a list of all the IP addresses (DISTINCT addresses in this case, since we don’t need duplicates) as a single string, seperated by commas.

See also how we use COUNT(visitor_id) to get a total page count for that specific visitor. And thanks to the GROUP BY keyword, we can return exactly one record per visitor, which makes processing and displaying the results much simpler
lines 29 & 30 - This is the SQL code we use when we’re displaying a specific user’s visit details. This is a simpler query, since we just need a list of all the pages they viewed, and the time they viewed them at.
lines 34-36 - A simple function used to format the date and time later on in the file

We’ll then generate the body of the page itself, including any HTML output necessary

<html>
<head>
<title>IP Tracker Report Page</title>
<style>
html {font-family:tahoma,verdana,arial,sans serif;}
body {font-size:62.5%;}
table tr th{
    font-size:0.8em;
    background-color:#ddb;
    padding:0.2em 0.6em 0.2em 0.6em;
}
table tr td{
    font-size:0.8em;
    background-color:#eec;
    margin:0.3em;
    padding:0.3em;
}
</style>
</head>
<body>
<h1>IP Tracker Report</h1>
<?php if($view=="all") {
    //display all of the results grouped by visitor
    if($row = mysql_fetch_array($result)){
    ?>
    <table>
      <tbody>
      <tr>
      <th>Id</th>
      <th>IP Address(es)</th>
      <th>Entry Time</th>
      <th>Exit Time</th>
      <th>Duration</th>
      <th>Pages visited</th>
      <th>Actions</th>
      </tr>
    <?php
      do{
        if($row["ip_total"] > 1)
            $ip_list = "Multiple addresses";
        else
            $ip_list = $row["ip_address_list"];
        $start_time = strtotime($row["start_time"]);
        $end_time = strtotime($row["end_time"]);
        $start = display_date($start_time);
        $end = display_date($end_time);
        $duration = $end_time - $start_time;
        if($duration >= 60) {
            $duration = number_format($duration/60, 1)." minutes";
        }
        else {
            $duration = $duration." seconds";
        }
        echo "<tr>";
        echo "<td>{$row["visitor_id"]}</td>";
        echo "<td>$ip_list</td>";
        echo "<td>$start</td>";
        echo "<td>$end</td>";
        echo "<td>$duration</td>";
        echo "<td>{$row["page_count"]}</td>";
        echo "<td><a href='ip_report.php?view=record&
id={$row["visitor_id"]}'>view</a></td>";
        echo "</tr>";
      } while ($row = mysql_fetch_array($result));
    ?>
      </tbody>
    </table>
    <?php } else { ?>
      <h3>No records in the table yet</h3>
    <?php } ?>
<?php } elseif($view=="record"){ ?>
  <h3>Showing records for Visitor <?php echo $visitor_id; ?></h3>
  <p><a href="ip_report.php">back</a></p>
  <?php
    //show all pages for a single visitor
    if($row = mysql_fetch_array($result)){
    ?>
    <table>
      <tbody>
      <tr>
      <th>Page viewed</th>
      <th>Query string</th>
      <th>Time of view</th>
      </tr>
    <?php
      do{
        if($row["ip_total"] > 1)
            $ip_list = "More than 1";
        else
            $ip_list = $row["ip_address_list"];
        $time = display_date(strtotime($row["timestamp"]));
        echo "<tr>";
        echo "<td>{$row["page_name"]}</td>";
        echo "<td>{$row["query_string"]}</td>";
        echo "<td>$time</td>";
        echo "</tr>";
      } while ($row = mysql_fetch_array($result));
    ?>
      </tbody>
    </table>
    <?php } else { ?>
      <h3>No records for this visitor</h3>
    <?php
    }
} elseif($view=="error") { ?>
    <h3>There was an error</h3>
    <?php echo $error;
}
?>
 
</body>
</html>

Have a look through the code above. You should be able to see variables being used that were set in the preceding PHP code, to control which page we view (whether it’s a page of all the available visitors, or a detailed view of one visitor’s session)

Test Files

I’ve also created three test files in the zip package, to let you see how the file ip_tracker.php above should be used. You just need to add an include() call to the file to add it to each page, and then the tracking functionality should be present on all pages where the file is added.

e.g.

 
Page 1
This page is now being tracked with IP Tracker!

To test the application, simply visit the test pages on your server and see how the report page at ip_report.php changes as you go. If you’re running the script on a local machine, you’ll probably see your IP show up as 127.0.0.1. From anywhere else, if the script is hosted online, you should see something different

To reset the session and see how the output changes when you start a new “visit”, open up session_end.php in your browser (included in the zip package), and this will destroy the current session, essentially making you a new visitor when you revisit the test pages.

session_end.php

Download all the files used in this tutorial here

An important note about performance

User tracking can be a very database intensive process, especially on busy sites, so don’t use this script on any sites where performance is important. This application serves only as a demonstration of the potential for PHP to perform visitor tracking and many improvements would need to be made before it could be used on data-heavy sites, but feel free to use the code on your own site, and modify or improve it as you feel necessary. Let me know if it’s been of any use to you!

Cleaning up User Input for MySQLDealing With Invalid User DataCase 1 - Invalid HTML TagsSolution 1 : Stripping out HTML tags before inserting via MySQLCase 2 : Using apostrophes and quotation marks in commentsSolution 2 : Escaping quotation characters with mysql_real_escape_string()Case 3 : Preventing SQL injection attacksSolution 3 : Prepare Your Inputs

Cleaning up User Input for MySQL

^Back to top

One of the things you’re going to encounter when using MySQL with PHP sooner, rather than later, is the issues that arise when you start accepting user input in the form of comments or blog posts. Up until now in this tutorial, we’ve just been using data that we’ve defined ourselves. We’ve been able to control what goes into our database tables.

When dealing with the general public though, we can’t assume anything about the data they submit into our database. In fact, we have to assume the worst, since the worst is what might break our website. Let’s look at a simple example first of all

Dealing With Invalid User Data

^Back to top

Let’s assume that we’re working on creating a brand new website containing useful information about microwave ovens. On this website, we want users to be able to leave comments and discussion points about their experiences with microwave ovens, and general chat with other members. In this tutorial, we’re not interested in the general workings of such a site, instead we’re going to look closely at what happens when users submit a wide range of “faulty” discussion posts, and what we can do about them

Imagine that this is the general layout of our comment posting area

<h2>Robin says...</h2>
Hi everyone, I love microwave ovens
<h2>Bill says...</h2>
I, too, love microwave ovens

This is a pretty straightforward layout, with simple headings displaying the name of each poster, and their comment underneath.

The actual process that’s occuring on our fictitious site is

A user is invited to post a comment using an HTML submission form
This data is sent to our server, where we process a MySQL command along the lines of “INSERT INTO comments (user_name, user_comment) VALUES (’Robin’, ‘Hi everyone, I love microwave ovens’)“
We then display this data on the website, using commands like “SELECT user_name, user_comment FROM comments“

Now, this might all seem perfectly harmless, but in stages 2 and 3 there is a lot of room for error, and with a simple implementation like we have above, many opportunities for people to - willlingly or unwillingly - cause more than a little havoc on our website

Case 1 - Invalid HTML Tags

^Back to top

In our example above, the user Robin was submitting the comment “Hi everyone, I love microwave ovens”. Now, let’s change that. Consider now that Robin is trying to post the comment “Hi everyone <h2>HELLO!</h2></p></p></p><h1>HEELLLOOO!</h1>”. See all those random HTML tags within the comment? This comment will have no problem being accepted into our MySQL query like so

$user_name = $_POST['user_name'];
//user_name = "Robin";
$user_comment = $_POST['user_comment'];
//user_comment = Hi everyone HELLOHEELLLOOO!
mysql_query("INSERT INTO comments (user_name, user_comment) VALUES ($user_name, $user_comment");

Our big problem comes in step 3, when we try and display this as HTML. It’s going to totally mess up our page layout. By allowing our users to submit anything they like, they then have free reign to mess up our page in whatever way they see fit. Fortunately, PHP comes to the rescue and gives us a relatively simple solution to our problem

Solution 1 : Stripping out HTML tags before inserting via MySQL

^Back to top

Using a handy PHP function, we can automatically strip whatever tags we don’t want to allow into our database. The function strip_tags() takes as its arguments, a string and an optional list of allowed tags, and returns a string containing only the characters we want to let in to our database. Consider that we only want to allow the tags <b>, <i> and <u>, for some simple formatting (usually we disallow things like <a> to prevent people from spamming links)

$bad_text = "We're not going to allow heading textsbut we will allow bold";
$good_text = strip_tags($bad_text, "");
echo $good_text;

If you run this script, and then look at the source of the output (”View -> Source” in most browsers - this is because the tags will be displayed as text, rather than HTML) you will see

We're not going to allow heading textsbut we will allow bold

Now, we could run this function on our input data before accepting it into our INSERT query, to ensure that no bad data gets placed inside the SQL code to mess up our formatting

//user_name = "Robin";
$user_name = strip_tags($_POST['user_name']);
//user_comment = Hi everyone HELLOHEELLLOOO!
$user_comment = strip_tags($_POST['user_comment'], "");
//user_comment now contains no unwanted HTML tags
mysql_query("INSERT INTO comments (user_name, user_comment) VALUES ($user_name, $user_comment");

Case 2 : Using apostrophes and quotation marks in comments

^Back to top

You might have noticed that when defining your MySQL query code, you have to pay special attention to the quotation marks used within PHP function calls. For example, in the example

$address = "'Maple House', 41 Avenue Drive, Islington";
mysql_query("INSERT INTO employees (address) VALUES ('$address'));

We are trying to insert the address ‘Maple House’, 41 Avenue Drive, Islington, but see how we’re specifying a house name, and have decided to wrap that in single quotation marks? This will conflict with the syntax of the MySQL function call, since we are already wrapping the whole string in single quotation marks and the INSERT procedure will fail. A solution might be to wrap the address in double quotation marks, but that doesn’t solve the problem, since the whole string could potentially also be wrapped in double quotes. And what about apostrophes? They always use the single quotation mark.

Solution 2 : Escaping quotation characters with mysql_real_escape_string()

^Back to top

A good solution to this is to use escaping, so that we can use special characters such as double and single quotation marks within our MySQL queries. Imagine we wanted to insert the address “Maple House”, 36 Baker’s Street, Islington. This address contains both single and double quotation marks so we need to be careful. Here is an example of using quote escaping to make our data safe for input

$address = $_POST["address"]
//$_POST["address"] is "Maple House", 36 Baker's Street, Islington;
$safe_address = mysql_real_escape_string($address);
mysql_query("INSERT INTO employees (address) VALUES ('$safe_address')");
//this is equivalent to INSERT INTO employees (address) VALUES ('"Maple House", 36 Baker's Street, Islington')

Here, the PHP function mysql_real_escape_string() will add slashes to all characters that need escaping for entry into a MySQL command, such as single quotes (’), double quotes (”) and other slashes ()

Note: There is a PHP directive, magic_quotes_gpc, which automatically adds slashes to $_GET and $_POST data whenever it is turned on. This is something to consider when dealing with MySQL data input, and you can check the status of this directive by use of get_magic_quotes_gpc()

Note, also: You must have a MySQL connection already set up, using the mysql_connect() function in order for mysql_real_escape_string() to work. Otherwise it’ll just return an error.

Case 3 : Preventing SQL injection attacks

^Back to top

One particularly nasty form of attack that can be carried out on your site is the SQL injection attack. In basic terms, this is when a user attempts to send unfiltered data into your database queries to take control of the database and run whatever queries they wish. They could retrieve sensitive data from your database, or even delete every single record on your site.

Here is an example of a simple attempt at an SQL injection attack. Consider this simple MySQL code

$user = $_POST['username'];
$password = $_POST['password'];
$result = "SELECT * FROM users WHERE name = '$user' AND password = '$password'";
if($row = fetch_mysql_array($result)) {
  //user is authenticated
}

This is a simple example of a (very) basic login script, which simply retrieves the username and a password from the $_POST variable (submitted via an HTML form) and checks to see if this user exists in this database along with this password (note that in a real database, the password should be encrypted, but we’re just using an unencrypted password for our example)

The flaw in our plan lies in the fact that we are using the variables as-they-are, directly inserted into the SQL string. You might not immediately see the flaw in this plan, but consider if we have the following input for the script

$user = "Robin";
$password = "x' OR 'a'='a";

This strange looking example for the variable $password is actually a devious attempt to fool your MySQL code into thinking that a valid attempt has been made to access an area of the site reserved only for authorised users, by making it seem like a valid password has been entered for the user Robin. Let’s see what happens when this value is entered into our SQL string

SELECT * FROM users WHERE name = 'Robin' AND password = 'x' OR 'a'='a'

Here, the condition “password = ‘x’ OR ‘a’=’a’” will always evaluate to true since we are checking that ‘a’ equals ‘a’, which it does. It does not matter if we get the correct value for “password”

Solution 3 : Prepare Your Inputs

^Back to top

The best defence against SQL injection attacks is vigilance and to maintain a set of personal coding rules whenever you’re creating MySQL queries. Never allow a situation like the one above to occur, where users have direct access to the values introduced into MySQL code.

Always validate your user defined inputs before accepting them into any SQL strings, and put whatever checks you feel are necessary in place to prevent malicious types from messing up your carefully crafted website.

A simple solution to the above injection example would be to use the mysql_real_escape_string() PHP function to ensure that, whatever input the user provides, it is always checked and treated for such attempts. The following example will prevent any SQL injection attack from taking place

$user = "Robin";
$password = "x' OR 'a'='a";
$result = "SELECT * FROM users WHERE name = '".mysql_real_escape_string($user)."' AND
  password = '".mysql_real_escape_string($password)."'";
if($row = fetch_mysql_array($result)) {
  //user is authenticated
}

This will attempt to run the MySQL query

SELECT * FROM users WHERE name = 'Robin' AND password = 'x' OR 'a'='a'

Which is perfectly valid, and will try and match the user Robin with the literal password “x’ OR ‘a’=’a” because of the presence of the escaping slashes, and this will fail. Unless that is, of course, the correct password!

MySQL and Data Storage

MySQL stores data in a tabular format, which makes it easy to visualise the information and print it out in a way that you or I can easily understand. Like all tables, it uses horizontal rows to store individual records, and vertical columns to assign labels to certain attributes about each record. For example, a table of DVD releases might have a “release date”, “film title”, “director” and so on.

In this tutorial we won’t be doing anything too technical. Instead, we’ll be focusing on learning about how MySQL represents the data you give it to store, and the limitations and potential benefits each storage type brings.

Some Sample Data and Column Types

To start off, let’s create a sample set of data for us to work with in our example, to give you a good idea of the various concepts I’ll introduce shortly:

Here you can see a table containing a whole load of information about a fictitious delivery firm. We’re storing the customer name, their address, the date their delivery is/was due, some comments about their delivery and a number which states the number of previous orders this customer has placed.

Each of these columns can be assigned a specific type based on the format of the data we’ll be storing in them. Let’s take a look at each one in turn and see the datatypes we could assign to each column

Name - Our customer names won’t be too long, and we won’t be storing anything other than text here, so we can define the “Name” column to be of type VARCHAR. Now, VARCHAR has a useful extra property where we can define the length of the data to be stored within the column. In this case, we could define it as VARCHAR(64) to specify that our customer names will be no more than 64 characters in length. VARCHAR fields are limited to only 255 characters in length though, so for lengthier entries, we may need to use something different…
Address - Our customer addresses could potentially be quite long, and perhaps exceed the 255 character limit imposed by VARCHAR. For our address field, we could use the TEXT datatype. TEXT can hold up to 65,536 characters (64KB) of data, which is plenty for our requirements here, and will allow us to have adequate length addresses, if necessary. Note that we can also have MEDIUMTEXT and LONGTEXT datatypes which can hold 16,777,216 (16MB) and roughly 4 billion (4GB!) characters respectively. You’ll most likely have no need for these unless you’re looking to have much longer columns than our address field. We may have use of the MEDIUMTEXT column for our comments field though…
Delivery Date - Here, we’re going to make use of MySQL’s DATE type to store our date. MySQL stores dates in a format suitable for calcuations and operations so that if required, we can do all sorts of useful things with this information. If we wish to retrieve the DATE information, MySQL will provide it to us in the format YYYY-MM-DD (where YYYY = year, MM = month and DD = day). If we also need to know the specific date and time for a record, we can make use of DATETIME which allows us to retrieve data in the format YYYY-MM-DD HH:MM:SS (HH = hours, MM = minutes, SS = seconds). In a later tutorial, we’ll look at how we can use MySQL’s date and time functions to manipulate records of this type
Parcel Received? - Here we’re going to make use of a simple data type called BOOLEAN which means the value can either be TRUE (1) or FALSE (0). Note that here we can also use a datatype TINYINT(1) which is simply saying that this value can be either a 1 or a 0
Delivery Comments - In this field, we might want to make use of the MEDIUMTEXT type, just incase we wish to store a large amount of data relating to a customer’s order. If you know that you won’t be storing much data in a column, it’s wise to use just the TEXT type, or even just VARCHAR so that you can identify which fields will hold the most data.Note that the actual choice of datatype has no real impact on space requirements or efficiency, as MySQL simply uses the amount of storage space necessary to fit in whatever data you place in TEXT, MEDIUMTEXT or LONGTEXT
Previous Orders - Here, we are just storing a numerical value, and for this we could assign a simple INT datatype, representing “integer”. Note that you might see the definition INT(11) or similar. The number in the brackets has no real bearing on the performance of the table and it doesn’t limit the size of number you can store in the INT field, although be aware that INT types have a minimum possible value of -2147483648 to 2147483647 (and if you choose to have the field unsigned i.e. with no negative values that changes to 0 to 4294967295)For our “previous orders” column this is quite the overkill though, so a simple TINYINT (-128 to 127 or 0 to 255 unsigned) or SMALLINT (-32768 to 32767 or 0 to 65535 unsigned) will do. It’s hard to forsee any customer having more than 255 previous orders, but sometimes it’s good to err on the side of caution, just incase - If this event ever did occur, the database table would become inaccurate

We can also have MEDIUMINT which gives us potential numbers into the billions and BIGINT for when billions just won’t do, and we need to move into the realm of quintillions (going all the way up to a mind boggling 18,446,744,073,709,551,615) MEDIUMINT is useful for defining unique IDs for tables (MySQL can handle tables with billions of rows each)

What are the limits of MySQL?

Some common questions when working with MySQL relate to finding out how much data MySQL might be able to handle. You may be concerned that your website or application will simply use too much data for use with MySQL or that the number of users on your site might cause performance to drop significantly. After all, every call to MySQL uses up some processor time, and the more people using it at once, the more you have to consider the speed of the operation.

Well, have no worries, because these questions have been asked many times before, with more than satisfying answers. As mentioned above, MySQL can easily handle tables with billions of rows and you can have tens of thousands of tables per database. Each of these tables can contain thousands of columns each. The first main hurdle most people encounter when using MySQL databases is the amount of disk space the table takes up, especially when using a remote web host, and that’s relatively easy to increase.

(It’s very unlikely you’ll ever reach the true limits of what MySQL can achieve, not until you’re put in charge of a web-forum with visitor numbers in the millions and post-counts in the billions!)

The MySQL Representation of this Table

Now that we’ve covered the main datatypes, I’m going to show you what this table looks like in MySQL code format. You don’t need to understand what all this does at the moment, but take a look at the syntax to see how the datatypes I’ve outlined above fit into the general scheme of things when working inside MySQL.

DROP TABLE IF EXISTS `addresses`;
CREATE TABLE IF NOT EXISTS `addresses` (
  `name` varchar(64) NOT NULL,
  `address` text NOT NULL,
  `delivery_date` date NOT NULL,
  `parcel_received` tinyint(1) NOT NULL,
  `delivery_comments` mediumtext NOT NULL,
  `previous_orders` smallint(6) NOT NULL
) ENGINE=InnoDB DEFAULT CHARSET=latin1;
 
INSERT INTO `addresses` (`name`, `address`, `delivery_date`, `parcel_received`
 , `delivery_comments`, `previous_orders`) VALUES
('Alan Smith', '12 Arlington Road', '2008-08-12', 1, 'Customer was very happy with service', 5),
('Kevin Wilson', '55 Kentucky Drive', '2008-08-16', 0, 'Customer wants detailed receipt', 0),
('Jim Jeffries', '165 Main Street', '2008-08-17', 0, 'No comments', 1);

The code above will create a table within a MySQL database and then insert all of the values in the table above, named “addresses” here. Later on, I’ll explain all the processes going on in more detail, but for now just familiarise yourself with the idea of tables, rows and columns in MySQL and try to visualise in your mind how all this information can be represented both as data and as text displayed on a screen.

In the next tutorial we’re going to move on to see how we can perform queries on similar sets of data to ask questions of the database, and get back some useful answers.

Now that we’ve got a simple understanding of how to perform SELECT, INSERT and UPDATE MySQL queries (and if not, have a quick review from the last couple of tutorials) we can now work on building ourselves a very simple PHP application to accept user data and save it into our database. This information will then be displayed to anyone visiting the site. We’ll also take a quick look at how we can generate a script to authenticate administrative users based on a username and password combination and allow those admin users to delete unwanted comments from the database.

A simple comment system using PHP and MySQL

The first thing we’ll need to do is generate the HTML form that we’ll use to accept the user data, and include a couple of important settings which will let us access this information later, once the user has submitted the form.

First, here’s the code you’ll need to use to generate the HTML form. Save this file somewhere in your PHP directory, with the name mysql_form.php

 
A simple PHP/MySQL form
<h2>Please enter your name and a comment</h2>
<form action="form_submit.php" method="post">
Name :
<input size="32" type="text" name="username" /><br>
Comment : <textarea cols="40" rows="5" name="comment"></textarea><br>
<input type="submit" value="Send comment" />
</form>

Here, we’re using the <form> tag to generate a set of text-entry boxes where a user can enter their details, to be sent to the server for processing. We have specified that we wish the data to be sent using the POST delivery method. This simply means that the data will be sent within the request to the server, rather than attached to the query string, as would be the case if we were using the GET method.

Next, we need to create another file which will receive the request from the user, and process the data accordingly. We have specified that this file will be called form_submit.php. Create this file, and within it add the following code

Before we go any further here, I’ll need to give you two things. Firstly, the contents of the file db_connect.php. What I’ve done here is simply place the mysql_connect() function within the file db_connect.php to save us having to type out the database connection code twice, as we’ll be adding that into our initial HTML file, mysql_form.php, in just a moment. Here is the connection file as it is set up on my computer (you may need to change the values to suit your installation of PHP)

Secondly, you’ll need the structure for the “comments” table. This should be created in the same database as is defined in the connection file above

DROP TABLE IF EXISTS `comments`;
CREATE TABLE IF NOT EXISTS `comments` (
  `id` int(11) NOT NULL AUTO_INCREMENT,
  `name` varchar(64) NOT NULL,
  `comment` text NOT NULL,
  PRIMARY KEY  (`id`)
) ENGINE=InnoDB DEFAULT CHARSET=latin1 AUTO_INCREMENT=1 ;

Notice how I’ve defined three columns, the first being an “id” column thay is also declared as a PRIMARY KEY, as well as having the AUTO_INCREMENT attribute set. This is very common practice in MySQL tables, and means we don’t need to concern ourselves with having comments with duplicate names, for example. These unique IDs also give us an easy way to refer to specific comments by number when administrating them at a future date, or deleting comments we don’t wish to keep.

Test Run

Try out the code I’ve included above. You should be able to see an HTML form and, when you submit that form, you should see a page saying “The comment was added successfully”. If not, then something has gone wrong and you should go back and recheck your code.

Checking for invalid data

One thing you might notice is if you try and submit the form without adding a name or a comment, then the MySQL query will still complete without a problem, and you’ll be left with a blank entry in the database. One way to get around this is to modify our code to check for such a situation and, if no data has been entered, prompt the user to go back and try again. The following change to form_submit.php will add this behaviour

If you try again, you’ll now see that the form will not accept blank data.

There’s a great deal more to consider when accepting user input into your database, and we’re going to look at that in further detail in the next section. For now though, we’ll continue with our example, and provide our visitors with some feedback on the comments posted so far

Modifying the HTML file to display the user comments

With a little bit of modification, we can adjust the file we created earlier, mysql_form.php to display all the comments submitted so far

A simple PHP/MySQL form
Please enter your name and a comment
 
Name :
 
Comment : 
 
 
Here are the comments submitted so far
 

In our extended example, we’re making use of the ORDER BY and LIMIT keywords to show only the 10 latest comments, in order from newest to oldest.

If you try out the code above, you should see the same form on the page mysql_form.php, and underneath, a list of all the comments you’ve added. If you try adding a new one, and then return to this page, you should see it appear at the top of the list.

On the next page, we’re going to expand on our example, and see how it’s possible to add in some administration priveleges to a select group of people using the power of PHP and MySQL

]]> http://www.roughguidetophp.com/creating-a-simple-comments-and-login-system-using-mysql-and-php/feed/