• Using mysqlcp_param02.php and mysqltest.sql

  Updated files and Instructions will always be on our course website.

  What follows below is some of the old instructions, for the most part, you can ignore these, though some of the advice on filtering may be useful.

  So, for the most part DON'T: Do the following:

  1. Create the 3 tables in your own database, and get mysqlcp.php working on you account (20pts)
  2. Remove all of the functions from mysqlcp.php and put them in their own include files (30pts)
  3. Create form.php.inc file that generates the form (20pts)
  4. Modify my mysql connection/error class file called mydb3.php.inc and create a mydbtest.php(40pts)
     • NOTE: THIS IS NOT OPTIONAL, you must use the class as a class to connect to the db
     • class file should get username and password from outside the public_html directory
     • Should allow the passing of database names, queries and so on into and out of class.
     • Should be able to return values to database object created
     • make sure to use the mysqli functions and not the old mysql ones.
  5. Make a seperate "Cleaner Class" that uses the following as appropriate:
     • trim
     • substr, str_replace
     • strlen
     • preg_match, preg_replace
     • striptags (with any exceptions you feel appropriate
     • htmlentities for printing (unless you wish to ALLOW some tags)
     • Make a testclean.php to test this class out (60pts total)
  6. In addition to the "view auctions" and "add auctions" functions that will be moved to their own include files in step 2 above (and cleaned up to use the mydb3.php.inc class etc) you need to do the following:
     • Adding a User:
       Should store a md5 password in a table and do a password/username check) 30pts
     • Fixing the add auctions to put the username in from the login (via sessions?) and not from a pulldown list
     • Using sessions to make sure that "add auction" , "add user" and "insert auction" features only count if logged in
     • For both "insert auction" and "add user" make sure to use parameterized queries to insert the information
  7. All of this should now be accessible from mysqlcp_param.php (50pts)
• Print the date at the bottom of the page in the format Monday, January 23, 2005

This page last updated on: