Tutorial-building Dynamic Websites

Still i admire your spirit - keep it up man - dont worry u will not get tired in Jesus name (Amen).

Hi webdezzi just asking you could send the complete tutorial on designing dynamic website using PHP/MySQL please jeturn16@yahoo.com

Thanks Yusufu,

those are combined ideas from different source on the net.


and sorry students, i have been using cafes lately as my ISP has been having problems activating my internet (Starcomms).

and i will appreciate it if Questions are posted on this thread so that other Pros here can help with it.
Thanks for the calls sha!

Just concluded another project yesterday, meaning more time to spend on this tutorials.

to cheeck the user, we need to run a query that looks more like this.

SELECT username, password FROM settings WHERE settings_name='login' (let break the query to explain something)

with that "WHERE settings_name='login'" above, we have used the settings name to single out the row we want.
remember that there cant be 2 succh rows, WHY? because we have set the column named "settings_name" to unique when creating the table
that way, if we accidental enter something that already exist in that column, there will be an error, mysql will not accept it from us.

(lets conclude our query) AND username=what_the_user_submitted AND password=pass_user_submitted

How do we know what the user submitted.
let us code it

NOTE: it is common practice to write sql reserved words in caps, that way, it is easier to read, lower cases will do just fine, sql is case INsensitive

Lets complete the explanation begging for answers (thats if u were following)

if(isset($_POST['username']) && isset($_POST['password']) && $_POST['username']!="" && $_POST['password']!="" )

the double && is used when you need to continue a check using "and", we also have || which means "or" .
like we have above

if posted username is set AND posted password is set AND posted username is not equal to nothing AND posted password is not equal to nothing


then run the block

"if" is one interesting construct, life will be difficult living without it.

let say you have the task of accepting student data from a website and saving the data into different location based on their sexes, then based on their sexes, save it the second time based on their age group (say young and old)

notice the else, am sure you understand what it does.

if(userSex is male)
   {
    //run code that will check age group
   if(ageGroup=young)
      {
       //run code that will save data into young male category
      }
   elseif(ageGroup=old)
      {
       //run code that will save data into old male category
      }   
   
   }



elseif(userSex is female)
   {
    //run code that will check age group
   if(ageGroup=young)
      {
       //run code that will save data into young female category
      }
   elseif(ageGroup=old)
      {
       //run code that will save data into old female category
      }   
   

   }

You can see above that we have blocks of codes embedded in blocks of codes.
there are many ways you can come up with solutions to that task, thats just to illustrate the usefulness of "if"

there is another construct similar to if-else which is switch-case
that, you will have to read up from your php manual or pray that we need it ahead.

Now, let me expose you to these guys,
$_POST, $_GET,  $_COOKIE, $_SERVER, $_FILES, $_ENV, $_REQUEST, $_SESSION

those guys are Arrays which exist throughout your entire script and you can access them at anytime.
They can be empty at times though,  they always exist

for instance, say someone submits a form like we did using the POST method as in

<form id="login_form" name="login_form" method="post" action="index.php">

automatically, the server saves the values in the ASSOCIATIVE $_POST array
that way you can check the array and get which of the data you want.

to access the exact data you want from the array, you just have use the name of the field

<input name="username" type="text" id="username" />

like in that HTML, the name is username

so to access what the user submitted as username, it's just a matter of $_POST['username']
if you still dont get this, think of (arrays of submitted data) as (fleet of cars)
if you need a camry, you will just take the key to the camry, then you have your camry

note that the key is NOT the camry, it only gives access to the camry.
same way $_POST['username'] is just a key (infact, in php, the "username" inside the $_POST[ ] will be called an array key) enabling us to access it's corresponding value.

yes they are following, I just hope they will post questions here so that others can learn while.


And worth the note: We will be having a seminar on the 5th of March in Osun State (I chose my root first  )
If you live very close to Osun state and you dig my tutorials, You can reserve a space. Call me on 08029037890.

For my state, I decided it will be N5,000 per participant.

Other states will follow and will range from N15, 000 to N20,000.
Its going to be 100% practical as we  will be building a website for a fictitious school in osun state.

I noo lie
www.2advanced.com
Na  FIREEEEEE

I stubled on this site becos I'm in search of creative and talented web developers in house for my company.

But sadly I can't find any. When would we have local web developers just like 2advanced. They are not the best, but look at the concept.

am out

Great job webdezzi. . . . .  u d'on do more than well sef!

Abeg, is there any other way of creating tables with mySQL. . . . . .  the interface is quite bamboozling!

DHTML, lol just trying to teach the little i know. Not really for the money. we did it last week i guess it was d location. Crowd wasn't as i thought it wud be, but compared to some seminars i've been to. We thank God.



@Ruddie, You mean you find phpmyadmin interface bamboozling and not mysql interface.

mysql is the database server running more like a background process. Phpmyadmin only helps to make that background process visible so u can manage it.
take mysql as the internet and phpmyadmin as your web browser

the internet is there, but may be difficult or complex if you have to use DOS to browse the web. so your browser makes it simpler.

about your question, Yes, you can create tables by typing the queries dirrectly in the sql window, infact, you can do anything mysql permits right inside phpmyadmin.
you can even manage mysql using the ugly command window

I had no idea we had so many outstanding developers in Nigeria, this is amazing stuff guys!

Based on your expert web design abilities, kindly take a look at www.chukslist.com and let me know how good a job you think my techs did, 

~Thx

I am a graphic designer, i like to know how to design and launch my own website. I hope am not too late to the class. Emmakchinedu@yahoo.com

Pleas am having problem previewing my asp.net page in dreamweaver 8. any help pls.

Next we need to write a script that will compare the submitted username and password against what we already have in the database.
remember we already have the username and password stored in the database, so we just check against it.


Since the only way to communicate to the database is through sql queries, we will need to build our query and with the help of php, we will push our queries to mysql and wait for mysql to give us result.

since it is possible to get database entries from mysql using the "SELECT" statement. i.e select * from database.table,

so we will cleverly use this same SELECT statement to get what we want. How? watch.

SELECT * FROM settings WHERE first= 'userSubmittedUsername' AND second= 'userSubmittedPassword' AND settings_name='login'

Please note that i have tweaked the settings table to fit my needs, you can decide to come up with your table name as admins instead of settings. thats fine

u can also decide to do away with the settings_name column, thats also fine. Infact you can name your table columns username and password instead of first and second as i named mine.
just make sure your query reflects what you have.

The query above will definitely send us a result if the database returns any result.
and the database will return a result only if the conditions (WHERE first= 'userSubmittedUsername' AND second= 'userSubmittedPassword' AND settings_name='login') is true On any row.
else, it returns nothing.
all we then need to do is check if the database returned something or not. If it does, then the user credentials are correct and we give him access to the admin pages.
so lets go ahead with the php code to handle this

now let break down some complicated stuffs in the above snippet.

the include helps retrieve a file elsewhere and makes it's content available to the script above, including variables and functions.
that way, we are able to manage parts of the code, like for instance we can change the database setting in the included file and it affect all the site pages.

the is one inefficiency i will first like to deal with.
that is  mysql_select_db('tut99',$conn);

we have inserted the database name "tut99" directly in this page, lets say we changed our database name in the future, then this approach means we must be ready to start opening all our files and start changing the database name. I think it is better to have it defined in our include file then use a variable here instead.

the next line is riddled with both errors and sql injection vulnerabilities

$result = mysql_query("SELECT * FROM settings WHERE first= '$_POST['username']' AND second= '$_POST['password']' AND settings_name='login'");

first we handle the errors.
In php, we can concatenate _{(join 2 things together to form one)} with dot (.)
e.g
$thirdThing="this is the third thing";
echo "This is the first thing"."this is the second thing".$thirdThing;
notice how we joined them

We joined 2 strings with dots, then joined a variable to it also ote that variables need no double quotes
so lets correct this

$result = mysql_query("SELECT * FROM settings WHERE first= '$_POST['username']' AND second= '$_POST['password']' AND settings_name='login'");

to

$result = mysql_query("SELECT * FROM settings WHERE first= ".$_POST['username']." AND second= ".$_POST['password']." AND settings_name='login'") or die("error occured!");

security wise, this line can still be exploited like we have below, this is the expected sql query

SELECT * FROM settings WHERE first= 'admin' AND second= 'pass' AND settings_name='login'

what if the user supplied something like admin as username and ' or 1=1/* as password,
the we have something like this

SELECT * FROM settings WHERE first= 'admin' AND second= '' or 1=1/*' AND settings_name='login'
/* will comment out everything at the back of the query and will return true cos 1 will always be equal to 1
and boom, the user logs in as admin.

another thing will like to add to it for newbies is
DO NOT USE "or die(mysql_error())", use or die(redirect())

redirect() can be a custom function like this

function redirect(){header('Location: '.$_SERVER['PHP_SELF']); exit();}

This is because mysql_error() helps attackers with useful info while plotting their attacks

to correct the above, it is good practice to run your user submitted data through any of the available security functions available in PHP
example is mysql_real_escape_string()

something like this
$_POST['username']=mysql_real_escape_string($_POST['username']);
we have now updated the array element
We will reserve security issue till we finish the whole application, you will know why very soon
the rest of the code is clear enough, next i will post a working updated version of the software

@ webdezzi,

If you have a  manual / e-book for this PHP/MySQL-website design issue, please send to me. . . . .  <ruudsoftware@yahoo.co.uk>

or kindly point me to where i can get 1, please!

@ webdezzi,

Thanks man. . . .  sorted that bit out, wasn't much wrong there - about your advice, think i'll stick to your workflow, thanks again!