Find papers

ITM 251

Web Programming II

TU BITM · Semester 4 · BITM curriculum and programme regulation

Requirement
required
Credits
3
Study Guide
7 units available

Chapter notes

Authoritative study guide across 7 syllabus units

Open a unit to read its study notes.

Unit 1: Introduction· 10 LHs· ~12 marks

Suggest correction

Part 1: Core Concepts (2 Marks)

  • PHP (Hypertext Preprocessor): An open-source, server-side, interpreted scripting language designed primarily for web development, executed on web servers (Apache, Nginx) before HTML output is sent to the client.
  • PHP Superglobals: Predefined global arrays accessible from any scope without global $var: $_GET, $_POST, $_SERVER, $_COOKIE, $_SESSION, $_FILES, $_REQUEST, $_ENV.
  • include vs require:
    • include: If the specified file is missing, generates a Warning (E_WARNING) and continues execution.
    • require: If missing, generates a fatal error (E_COMPILE_ERROR) and halts program execution immediately.

Part 2: Structural Frameworks (10 Marks)

Client-Server PHP Execution Lifecycle

  1. [Client Web Browser] -- 1. HTTP GET request (index.php)
  2. [Web Server (Apache/Nginx)] 2. Dispatches to PHP Engine v [PHP Interpreter Engine] 3. Executes DB Queries (MySQL) 4. Renders pure HTML v [Client Web Browser] <-- 5. Returns pure HTML stream ------- [Web Server]

Part 3: Distinction Tables

Basis of Comparison Client-Side Scripting (JS) Server-Side Scripting (PHP)
Execution Environment Client browser engine (V8, SpiderMonkey). Web server PHP runtime engine.
Source Code Visibility Fully visible to user via “View Page Source”. Source code stays confidential; user receives only output HTML.
Database Access Cannot directly access internal DB ports. Full native direct database access (MySQL/PDO).

Part 4: Worked Problems & Exam Traps

Form Processing with Superglobal $_POST

  1. <?php
    • if ($_SERVER[“REQUEST_METHOD”] == “POST”) {
    • username=htmlspecialchars(trim(username = htmlspecialchars(trim(_POST[‘username’]));
    • email=filtervar(trim(email = filter_var(trim(_POST[‘email’]), FILTER_SANITIZE_EMAIL);
    • if (empty(username)∣∣empty(username) || empty(email)) {
  2. echo “<p style=‘color:red;’>All fields are required!</p>”;
    • } else {
  3. echo "<p>Welcome, " . username."!Registeredemail:".username . "! Registered email: " .email . “</p>”;
    • }
    • }
    • ?>
    • <form method=“POST” action=“<?php echo htmlspecialchars($_SERVER[“PHP_SELF”]);?>”>
  4. Name: <input type=“text” name=“username”><br>
  5. Email: <input type=“email” name=“email”><br>
    • <input type=“submit” value=“Submit”>
    • </form>

Printing $_SERVER["PHP_SELF"] without htmlspecialchars() exposes the webpage to Cross-Site Scripting (XSS) via URL tampering.