Web Database Applications With Php And Mysql (2nd Edition) [Electronic resources] نسخه متنی

17.2 Customer Validation

Example 17-1
lists the
customer/validate.php
script. It is based on Example 10-4 and has the same structure with four
exceptions:

It validates a larger set of fields.

It manages the creation of digests from passwords and user account
allocation.

It uses the includes/validate.inc include file,
which contains general-purpose validation functions based on those in
Chapter 9. The file is discussed in Chapter 16.

If the validation succeeds and the member isn't
logged in, the user is authenticated and logged in using functions in
includes/authenticate.inc, which is discussed in
Chapter 20.

Example 17-1. The winestore customer validation script, customer/validate.php

<?php
require_once "DB.php";
require_once "../includes/winestore.inc";
require_once "../includes/validate.inc";
require_once "../includes/authenticate.inc";
set_error_handler("customHandler");
session_start( );
$connection = DB::connect($dsn, true);
if (DB::isError($connection))
trigger_error($connection->getMessage( ), E_USER_ERROR);
// Clear and register an error array - just in case!
$_SESSION["custErrors"] = array( );
// Set up a custFormVars array for the POST variables
$_SESSION["custFormVars"] = array( );
// Clean and load the POST variables
foreach($_POST as $varname => $value)
$_SESSION["custFormVars"]["{$varname}"] =
pearclean($_POST, $varname, 50, $connection);
// Validate the firstname
checkMandatory("firstname", "first name", "custErrors", "custFormVars");
// Validate the Surname
checkMandatory("surname", "surname", "custErrors", "custFormVars");
// Validate the Address
checkMandatory("address", "address", "custErrors", "custFormVars");
// Validate the Initial
if (!empty($_SESSION["custFormVars"]["initial"]) &&
!eregi("^[[:alpha:]]{1}$", $_SESSION["custFormVars"]["initial"]))
$_SESSION["custErrors"]["initial"] = 
"The initial field must be empty or one " .
"alphabetic character in length.";
// Validate the City
checkMandatory("city", "city", "custErrors", "custFormVars");
// Validate Zipcode
if (checkMandatory("zipcode", "Zip code", "custErrors", "custFormVars"))
checkZipcode("zipcode", "Zip code", "custErrors", "custFormVars");
// Phone is optional, but if it is entered it must have correct format
if (!empty($_SESSION["custFormVars"]["phone"]))
checkPhone("phone", "telephone", "custErrors", "custFormVars");
// Validate Date of Birth
if (checkMandatory("birth_date", "date of birth", "custErrors",
"custFormVars"))
checkDateAndAdult("birth_date", "date of birth", "custErrors",
"custFormVars");
// Only validate email if this is an INSERT
if (!isset($_SESSION["loginUsername"]))
{
if (checkMandatory("loginUsername", "email/username",
"custErrors", "custFormVars") &&
emailCheck("loginUsername", "email/username",
"custErrors", "custFormVars"))
{
// Check if the email address is already in use in
//  the winestore
$query = "SELECT * FROM users WHERE user_name =
'{$_SESSION["custFormVars"]["loginUsername"]}'";
$result = $connection->query($query);
if (DB::isError($result))
trigger_error($result->getMessage( ), E_USER_ERROR);
if ($result->numRows( ) == 1)
$_SESSION["custErrors"]["loginUsername"] =
"A customer already exists with this " .
"email address.";
}
// Validate password - between 6 and 8 characters
if (checkMandatory("loginPassword", "password",
"custErrors", "custFormVars"))
checkMinAndMaxLength("loginPassword", 6, 8, "password",
"custErrors", "custFormVars");
}
// Now the script has finished the validation,
// check if there were any errors
if (count($_SESSION["custErrors"]) > 0)
{
// There are errors.  Relocate back to the client form
header("Location: " . S_DETAILS);
exit;
}
// Is this an update?
if (isset($_SESSION["loginUsername"]))
{
// Check the user is properly logged in
sessionAuthenticate(S_DETAILS);
$cust_id = getCust_id($_SESSION["loginUsername"], $connection);
$query = "UPDATE customer SET
title_id =     {$_SESSION["custFormVars"]["title_id"]},
surname =     '{$_SESSION["custFormVars"]["surname"]}',
firstname =   '{$_SESSION["custFormVars"]["firstname"]}',
initial =     '{$_SESSION["custFormVars"]["initial"]}',
address =     '{$_SESSION["custFormVars"]["address"]}',
city =        '{$_SESSION["custFormVars"]["city"]}',
state =       '{$_SESSION["custFormVars"]["state"]}',
zipcode =     '{$_SESSION["custFormVars"]["zipcode"]}',
country_id =   {$_SESSION["custFormVars"]["country_id"]},
phone =       '{$_SESSION["custFormVars"]["phone"]}',
birth_date =  '{$_SESSION["custFormVars"]["birth_date"]}'
WHERE cust_id = {$cust_id}";
$result = $connection->query($query);
if (DB::isError($result))
trigger_error($result->getMessage( ), E_USER_ERROR);
}
else
{
// Lock to get the next available customer ID
$result = $connection->query("LOCK TABLES customer WRITE");
if (DB::isError($result))
trigger_error($result->getMessage( ), E_USER_ERROR);
// Find the max cust_id
$result = $connection->query("SELECT max(cust_id) FROM customer");
if (DB::isError($result))
trigger_error($result->getMessage( ), E_USER_ERROR);
$row = $result->fetchRow(DB_FETCHMODE_ASSOC);
// Work out the next available ID
$cust_id = $row["max(cust_id)"] + 1;
// Insert the new customer
$query = "INSERT INTO customer VALUES ({$cust_id},
'{$_SESSION["custFormVars"]["surname"]}',
'{$_SESSION["custFormVars"]["firstname"]}',
'{$_SESSION["custFormVars"]["initial"]}',
{$_SESSION["custFormVars"]["title_id"]},
'{$_SESSION["custFormVars"]["address"]}',
'{$_SESSION["custFormVars"]["city"]}',
'{$_SESSION["custFormVars"]["state"]}',
'{$_SESSION["custFormVars"]["zipcode"]}',
{$_SESSION["custFormVars"]["country_id"]},
'{$_SESSION["custFormVars"]["phone"]}',
'{$_SESSION["custFormVars"]["birth_date"]}')";
$result = $connection->query($query);
if (DB::isError($result))
trigger_error($result->getMessage( ), E_USER_ERROR);
// Unlock the customer table
$result = $connection->query("UNLOCK TABLES");
if (DB::isError($result))
trigger_error($result->getMessage( ), E_USER_ERROR);
// As this was an INSERT, we need to INSERT into the users table too
newUser($_SESSION["custFormVars"]["loginUsername"],
$_SESSION["custFormVars"]["loginPassword"],
$cust_id, $connection);
// Log the user into their new account
registerLogin($_SESSION["custFormVars"]["loginUsername"]);
}
// Clear the custFormVars so a future form is blank
unset($_SESSION["custFormVars"]);
unset($_SESSION["custErrors"]);
// Now show the customer receipt
header("Location: " . S_CUSTRECEIPT);
?>

The presence of the session variable
$_SESSION["loginUsername"] indicates whether or
not the user is logged in. The script adds a new customer to the
customer table and a row to the
users table if the user isn't
logged in, because the user must be applying for membership
(otherwise, she's updating details of her
membership). We don't use MySQL's
auto_increment feature to obtain the next
available cust_id, but instead use locking to
figure out the maximum value and reserve the next value for this
customer. We've avoided
auto_increment because it's
proprietary and you'd have to change it if you
migrated the winestore to a different database server. We could have
used an auxiliary table to manage the key fields (as discussed in
Chapter 8), but we decided to keep things
simple.

If the user is logged in, the member must be updating her details. In
this case, before updating the row, the external function calls
getCust_id( ) to get the customer
cust_id associated with the
$_SESSION["loginUsername"] session variable. The
function is defined in the winestore.inc file
discussed in Chapter 16.

If validation fails in Example 17-1, the script
redirects the browser to the
customer/details.php script shown in Example 17-2. Any validation error messages are recorded in
the array $_SESSION["custErrors"] and this array
is used to display the messages interleaved with the customer form
widgets. The values that are passed from the form in the
$_POST superglobal are themselves stored in the
$_SESSION["custFormVars"] array
so that they can be returned to the form for redisplay. This process
of using session arrays to store intermediate data is discussed in
Chapter 10.

If validation and the database write succeed, the session variables
are emptied and the script redirects to the
customer/receipt.php script shown in Example 17-3. Also, if it's a new user
that's been created, they're logged
in using the registerLogin( ) function
that's discussed in Chapter 20.