The following article is an excerpt from PHP & MySQL: Novice to Ninja, 7th Edition, a hands-on guide to learning all the tools, principles, and techniques needed to build a professional web application. In this second tutorial in the series, you’ll learn the basics of PHP, including statements, variables, operators, comments, and control structures.
Now that you have your server up and running, it’s time to write your first PHP script. PHP is a server-side language. This concept may be a little difficult to grasp, especially if you’ve only ever designed websites using client-side languages like HTML, CSS, and JavaScript. A server-side language is similar to JavaScript in that it allows you to embed dynamically generated content into the HTML code of a web page, giving you greater control over what appears in the browser window than HTML alone can provide. The key difference between JavaScript and PHP is the stage at which the code is run. Client-side languages like JavaScript are read and executed by the web browser after downloading the web page (embedded programs and all) from the web server. In contrast, server-side languages like PHP are run by the web server, before the web page is sent to the browser. Whereas client-side languages give you control over how a page behaves once it’s displayed by the browser, server-side languages let you generate customized pages on the fly before they’re even sent to the browser. Once the web server has executed the PHP code embedded in a web page, the result takes the place of the PHP code in the page. All the browser sees is standard HTML code when it receives the page. That’s why PHP is called a “server-side language”: its work is done on the server. Note: in the early days of the Web — and when the first edition of this book was published! — JavaScript was a client-side scripting language used mainly in the browser. Then along came technologies like Ajax, which allowed JavaScript to communicate with the server. And more recently still, JavaScript has been used both in the browser and on the server to create database-driven apps. While these new uses for JavaScript offer exciting possibilities, there’s still very much a place for PHP — as this book sets out to demonstrate! PHP code is written in PHP tags. Like most HTML tags, PHP has a start tag and and end tag:
PHP supports both single quotes (
Here’s what an 
Here’s what it looks like in code:
Here’s what a 
While loops aren’t generally used for simple counters like this; it’s normally the job of the 
Let’s take a closer look at the code that made this possible. This is the most important line:
Note: you might notice that some browsers will automatically convert the 
If you view the source code of the page, you can confirm that the 
This is all well and good, but we’re still yet to achieve our goal of true user interaction, where the user can enter arbitrary information and have it processed by PHP. To continue with our example of a personalized welcome message, we’d like to invite the user to type their name and have it appear in the resulting page. To enable the user to type in a value, we’ll need to use an HTML form.
Note: I’ve added some CSS to the form (available in 
The form is functionally identical to the previous one. The only difference is that the URL of the page that’s loaded when the user clicks the GO button will be without a query string. On the one hand, this lets you include large values (or sensitive values such as passwords and credit card numbers) in the data that’s submitted by the form without them appearing in the query string. On the other hand, if the user bookmarks the page that results from the form’s submission, that bookmark will be useless, as it lacks the submitted values. This, incidentally, is the main reason why search engines use the query string to submit search terms. If you bookmark a search results page on Google, you can use that bookmark to perform the same search again later, because the search terms are contained in the URL.
Note: as a rule of thumb, you should only use
- Setting Up Your PHP Development Environment with Docker
- A Beginner’s Guide to PHP
- Introducing MySQL: A Beginner’s Guide
- Displaying Data from MySQL on the Web: an Introduction
Now that you have your server up and running, it’s time to write your first PHP script. PHP is a server-side language. This concept may be a little difficult to grasp, especially if you’ve only ever designed websites using client-side languages like HTML, CSS, and JavaScript. A server-side language is similar to JavaScript in that it allows you to embed dynamically generated content into the HTML code of a web page, giving you greater control over what appears in the browser window than HTML alone can provide. The key difference between JavaScript and PHP is the stage at which the code is run. Client-side languages like JavaScript are read and executed by the web browser after downloading the web page (embedded programs and all) from the web server. In contrast, server-side languages like PHP are run by the web server, before the web page is sent to the browser. Whereas client-side languages give you control over how a page behaves once it’s displayed by the browser, server-side languages let you generate customized pages on the fly before they’re even sent to the browser. Once the web server has executed the PHP code embedded in a web page, the result takes the place of the PHP code in the page. All the browser sees is standard HTML code when it receives the page. That’s why PHP is called a “server-side language”: its work is done on the server. Note: in the early days of the Web — and when the first edition of this book was published! — JavaScript was a client-side scripting language used mainly in the browser. Then along came technologies like Ajax, which allowed JavaScript to communicate with the server. And more recently still, JavaScript has been used both in the browser and on the server to create database-driven apps. While these new uses for JavaScript offer exciting possibilities, there’s still very much a place for PHP — as this book sets out to demonstrate! PHP code is written in PHP tags. Like most HTML tags, PHP has a start tag and and end tag:
<?php and ?> respectively. Anything inside these PHP tags is treated as PHP code and run on the server.
PHP code must be placed in a file with a .php extension. When someone connects to the server and asks it to load a file with a .php extension, the server then runs it as a PHP script. If you put PHP tags in a file with a .html or any extension other than .php, the web server won’t run any PHP code, and the PHP code will be sent directly to the browser — which doesn’t understand PHP code!
Let’s take a look at a PHP script.
Example: PHP-RandomNumber
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
<title>Random Number</title>
</head>
<body>
<p>Generating a random number between 1 and 10:
<?php
echo rand(1, 10);
?>
</p>
</body>
</html>
random.php in the public directory and navigate to https://v.je/random.php.
Most of this is plain HTML. Only the line between <?php and ?> is PHP code. <?php marks the start of an embedded PHP script and ?> marks its end. The web server is asked to interpret everything between these two delimiters and convert it to regular HTML code before it sends the web page to the requesting browser. If you right-click inside your browser and choose View Source (the label may be different depending on the browser you’re using) you can see that the browser is presented with something like this:
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
<title>Random Number</title>
</head>
<body>
<p>Generating a random number between 1 and 10:
5
</p>
</body>
</html>
- Security. In the example above, we placed a random number generated by the web server into the web page. If we had inserted the number using JavaScript, the number would be generated in the browser and someone could potentially amend the code to insert a specific number.
- No browser compatibility issues. PHP scripts are interpreted by the web server alone, so there’s no need to worry about whether the language features you’re using are supported by the visitor’s browser.
- Access to server-side resources. The code on the server can do anything; it’s not limited to the capabilities of the browser. The resulting HTML could be generated from a database or an Excel file, or it could be the result of a calculation, such as the total of the user’s shopping cart.
- Reduced load on the client. JavaScript can delay the display of a web page significantly (especially on mobile devices!), since the browser must download and then run the script before it can display the web page. With server-side code, this burden is passed to the web server, which you can make as beefy as your application requires (and your wallet can afford).
- Choice. When writing code that’s run in the browser, the browser has to understand how to run the code given to it. All modern browsers understand HTML, CSS and JavaScript. To write some code that’s run in the browser, you must use one of these languages. By running code on the server that generates HTML, you have a choice of many languages — one of which is PHP.
Basic Syntax and Statements
PHP syntax will be very familiar to anyone with an understanding of JavaScript, C, C++, C#, Objective-C, Java, Perl, or any other C-derived language. But if these languages are unfamiliar to you, or if you’re new to programming in general, there’s no need to worry. A PHP script consists of a series of commands, or statements. Each statement is an instruction that must be followed by the web server before it can proceed to the next instruction. PHP statements, like those in the aforementioned languages, are always terminated by a semicolon (;).
This is a typical PHP statement:
echo 'This is a <strong>test</strong>!';
echo statement, which is used to generate content (usually HTML code) to send to the browser. An echo statement simply takes the text it’s given and inserts it into the page’s HTML code at the position where the PHP script was located.
In this case, we’ve supplied a string of text to be output: This is a <strong>test</strong>!. Notice that the string of text contains HTML tags (<strong>and </strong>), which is perfectly acceptable.
So, if we take this statement and put it into a complete web page, here’s the resulting code.
Example: PHP-Echo
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
<title>Test page</title>
</head>
<body>
<p><?php echo 'This is a <strong>test</strong>!'; ?></p>
</body>
</html>
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
<title>Test page</title>
</head>
<body>
<p>This is a <strong>test</strong>!</p>
</body>
</html>
random.php example we looked at earlier contained a slightly more complex echo statement:
echo rand(1, 10);
This is a <strong>test</strong>! directly to the echo command:
echo 'This is a <strong>test</strong>!';
' as the start of the string and find the next ' and use that as the end of the string.
Anything outside of quotes is treated as a series of commands to run. The following is not valid code:
echo This is a <strong>test</strong>!;
This, then the command is, followed by the command a, and so on. As none of these are valid commands in PHP, the above code would produce an error message. If you want to treat something as text, remember to put quotes around it!
In contrast, the following code will run a valid command — the built-in “function” rand — to generate a random number and then pass the result to the echo command:
echo rand(1, 10);
rand function will produce a random number, but different functions perform different tasks.
You can quickly identify if something is a function because it’s followed by parentheses. PHP has many built-in functions that let you do all sorts of things, such as sending email and working with information stored in various types of databases.
PHP won’t try to run anything that’s inside a string. The following code won’t process the rand function:
echo 'rand(1, 10)';
'rand(1, 10)' as a string, and will send the text rand(1, 10) to the browser, which probably isn’t what you’d want to do. It’s important to understand the difference between a string and code. PHP will see any text outside quotes as a series of commands it should follow. Anything inside quotes is a string and is data that PHP will work with.
PHP doesn’t try to understand strings. They can contain any characters in any order. But code (anything not inside quotes) — which is essentially a series of instructions — must follow a rigid structure for a computer to understand it.
Note: using a code editor with syntax highlighting makes it easy to quickly see if something is a string or code. Strings will be a different color from code that needs to be processed.
The image below shows simple code highlighting in the Visual Studio Code editor.
PHP supports both single quotes (') and double quotes (") to encase strings. For most purposes, they’re interchangeable. PHP developers tend to favor single quotes, because we deal with HTML code a lot, which tends to contain a lot of double quotes. For example:
echo '<a href="http://www.sitepoint.com">Click here</a>';
href= is not the end of the string by placing a \ before it (known as an escape character) and do the same with any double quotes we actually wanted to send to the browser as part of the HTML:
echo "<a href=\"http://www.sitepoint.com\">Click here</a>";
rand in our example earlier) followed by parentheses. The instruction rand(1, 10) tells PHP to run the function with the name rand. Running a function is also more commonly referred to as calling a function.
Most functions in PHP return a value when they’re called. Once the value is returned, PHP behaves as if you’d actually just typed that returned value in your code instead. In the echo rand(1, 10); example, our echo statement contains a call to the rand function, which returns a random number as a string of text. The echo statement then outputs the value that was returned by the function call.
Every function in PHP can have one or more arguments that allow you to make the function behave in a slightly different way. The rand function takes two arguments: a minimum and maximum random number. By changing the values that are passed to the function, you’re able to change the way it works. For example, if you wanted a random number between 1 and 50, you could use this code:
echo rand(1, 50);
(1, 50)) for two reasons. First, they indicate that rand is a function that you want to call. Second, they mark the beginning and end of a list of arguments — PHP statements that you wish to provide — in order to tell the function what you want it to do. In the case of the rand function, you need to provide a minimum and a maximum value. Those values are separated by a comma.
Later on, we’ll look at functions that take different kinds of arguments. We’ll also consider functions that take no arguments at all. These functions will still need the parentheses, even though nothing will be typed between them.
Variables, Operators, and Comments
Variables
Variables in PHP are identical to variables in most other programming languages. For the uninitiated, a variable can be thought of as a name given to an imaginary box into which any value may be placed. The following statement creates a variable called$testVariable (all variable names in PHP begin with a dollar sign) and assigns it a value of 3:
$testVariable = 3;
$testVariable. While the $testVariable variable used to contain a number, it would now contain a string of text:
$testVariable = 'Three';
echo command from earlier:
$testVariable = 3;
echo $testVariable;
$randomNumber = rand(1, 10);
echo $randomNumber;
Operators
The equals sign we used in the last two statements is called the assignment operator, as it’s used to assign values to variables. (There’s a different way to actually indicate “equals” in PHP, as we’ll see below.) Other operators may be used to perform various mathematical operations on values:$testVariable = 1 + 1; // assigns a value of 2
$testVariable = 1 - 1; // assigns a value of 0
$testVariable = 2 * 2; // assigns a value of 4
$testVariable = 2 / 2; // assigns a value of 1
+ is the addition operator, - is the subtraction operator, * is the multiplication operator and / is the division operator. These are all called arithmetic operators, because they perform arithmetic on numbers.
Note: each of the arithmetic lines above ends with a “comment” after the semicolon. Comments enable you to describe what your code is doing. They insert explanatory text into your code — text that the PHP interpreter will ignore.
Single-line comments begin with //. A single-line comment can be on its own line or, as in the example above, it can be placed at the end of a line of code.
If you want a comment to span several lines, start it with /*, and end it with */. The PHP interpreter will ignore everything between these two delimiters. I’ll be using comments throughout the rest of this book to help explain some of the code I present.
One operator that sticks strings of text together is called the string concatenation operator:
$testVariable = 'Hi ' . 'there!'; // Assigns a value of 'Hi there!'
$var1 = 'PHP'; // assigns a value of 'PHP' to $var1
$var2 = 5; // assigns a value of 5 to $var2
$var3 = $var2 + 1; // assigns a value of 6 to $var3
$var2 = $var1; // assigns a value of 'PHP' to $var2
$var4 = rand(1, 12); // assigns a value to $var4 using the rand() function
echo $var1; // outputs 'PHP'
echo $var2; // outputs 'PHP'
echo $var3; // outputs '6'
echo $var4; // outputs the random number generated above
echo $var1 . ' rules!'; // outputs 'PHP rules!'
echo '$var1 rules!'; // outputs '$var1 rules!'
echo "$var1 rules!" // outputs 'PHP rules!'
echo $var1 . ' rules!';).
Control Structures
The examples of PHP code we’ve seen so far have been either one-statement scripts that output a string of text to the web page, or a series of statements that were to be executed one after the other in order. If you’ve ever written programs in other languages (such as JavaScript, Objective-C, Ruby, or Python), you already know that practical programs are rarely so simple. PHP, just like any other programming language, provides facilities that enable you to affect the flow of control. That is, the language contains special statements that you can use to deviate from the one-after-another execution order that has dominated our examples so far. Such statements are called control structures. Don’t understand? Don’t worry! A few examples will illustrate it perfectly.If Statements
The most basic, and most often used, control structure is theif statement. The flow of a program through an if statement can be visualized as shown below.
Here’s what an if statement looks like in PHP code:
if (condition) {
⋮ conditional code to be executed if condition is true
}
rand() function we used earlier, setting the minimum and maximum from 1 to 6:
$roll = rand(1, 6);
echo 'You rolled a ' . $roll;
if statement.
Example: PHP-DiceRoll
$roll = rand(1, 6);
echo 'You rolled a ' . $roll;
if ($roll == 6) {
echo 'You win!';
}
== used in the condition above is the equals operator, which is used to compare two values to see whether they’re equal. This is quite different from using a single =, which is used for assignment, and can’t be used for comparison.
The if statement uses braces ({ and }) to surround the code you want to run only when the condition is met. You can place as many lines of code as you like between the braces; the code will only be run when the condition is met. Any code placed after the closing brace (}) will be run all the time:
$roll = rand(1, 6);
echo 'You rolled a ' . $roll;
if ($roll == 6) {
echo 'You win!'; // This line will only be printed if you roll a 6
}
echo 'Thanks for playing'; // This line will always be printed
==). A common mistake among beginner PHP programmers is to type a condition like this with a single equals sign:
if ($roll = 6) // Missing equals sign!=) instead of the equals operator (==). Consequently, instead of comparing the value of $roll to the number 6, it will actually set the value of $roll to 6. Oops!
To make matters worse, the if statement will use this assignment operation as a condition, which it will consider to be true, so the conditional code within the if statement will always be executed, regardless of what the original value of $roll happened to be.
If you save this as diceroll.php and run the code, you’ll see the random number being generated. If you run it until you win, you’ll see this in the browser:
You rolled a 6You win!Thanks for playing
$roll = rand(1, 6);
echo '<p>You rolled a ' . $roll . '</p>';
if ($roll == 6) {
echo '<p>You win!</p>';
}
echo '<p>Thanks for playing</p>';
You rolled a 6
You win!
Thanks for playing
else statement. The else statement must follow an if, and will be run if the condition isn’t met.
Example: PHP-DiceRoll-Else
$roll = rand(1, 6);
echo '<p>You rolled a ' . $roll . '</p>';
if ($roll == 6) {
echo '<p>You win!</p>';
}
else {
echo '<p>Sorry, you didn\'t win. Better luck next time!</p>';
}
echo '<p>Thanks for playing</p>';
didn't contains a single quote, it needs to be “escaped”. By preceding the single quote with a backslash (\), it tells PHP not to treat the ' in didn't as the end of the string.
With an else statement, one (and only one!) of the two blocks of code is guaranteed to run. Either the code in the if block will run if the condition is met, or the code in the else block will run if it isn’t.
Conditions can be more complex than a single check for equality. An if statement can contain more than one condition. For example, imagine if the game were adjusted so that both 5 and 6 were winning numbers. The if statement could be changed to the following.
Example: PHP-DiceRoll-Or
if ($roll == 6 || $roll == 5) {
echo '<p>You win!</p>';
}
else {
echo '<p>Sorry, you didn\'t win. Better luck next time!</p>';
}
||) means “or”. The condition above is now met if either condition is met. This can be read as “If you roll a 6 or you roll a 5”.
However, this can be expressed in an even better way. if statements aren’t limited to using the equals (==) operator. They can also utilize the mathematical greater than (>) and less than (<) operators. The if statement above could also be done with a single expression.
Example: PHP-DiceRoll-Greater
if ($roll > 4) {
echo '<p>You win!</p>';
}
else {
echo '<p>Sorry, you didn\'t win. Better luck next time!</p>';
}
$roll > 4 will be met if the value stored in the $roll variable is greater than 4, allowing us to have 5 and 6 as winning numbers with a single condition. If we wanted 4, 5 and 6 as winning numbers, the condition could be changed to $roll > 3.
Like the “or” expression (||), there’s an “and” expression that’s only met when both conditions are met. We could expand the game to include two dice and require players to roll two sixes to win.
Example: PHP-DiceRoll-TwoDice
$roll1 = rand(1, 6);
$roll2 = rand(1, 6);
echo '<p>You rolled a ' . $roll1 . ' and a ' . $roll2 . '</p>';
if ($roll1 == 6 && $roll2 == 6) {
echo '<p>You win!</p>';
}
else {
echo '<p>Sorry, you didn\'t win. Better luck next time!</p>';
}
echo '<p>Thanks for playing</p>';
$roll1 == 6 && $roll2 == 6 will only be met if $roll1 == 6 is true and $roll2 == 6. This means that the player has to roll a 6 on both dice to win the game. If we changed the and (&&) to an or (||) — that is, if ($roll1 == 6 || $roll2 == 6) — the player would win if they rolled a 6 on either dice.
We’ll look at more complicated conditions as the need arises. For the time being, a general familiarity with if … else statements is sufficient.
Note: PHP also allows the use of or in place of || and and in place of &&. For example:
if ($roll == 6 or $roll == 5) { … }or and || work that can lead to unexpected behavior. Generally speaking, avoid the “spelled out” operators. Sticking to the double pipe (||) and double ampersand (&&) will help prevent a number of confusing bugs.
Loops
Another type of control structure that’s very useful is a “loop”. Loops allow you to repeat the same lines of code over and over. Two important kind of loops arefor loops and while loops. Let’s look at how they work.
For Loops
Thefor loop is used when you know up front how many times you need to run the same code. The image below shows the flow of a for loop.
Here’s what it looks like in code:
for (declare counter; condition; increment counter) {
⋮ statement(s) to execute repeatedly as long as condition is true
}
declare counter statement is executed once at the start of the loop. The condition statement is checked each time through the loop before the statements in the body are executed. The increment counter statement is executed each time through the loop after the statements in the body.
To count to ten using a for loop, you can use the following code:
for ($count = 1; $count <= 10; $count++) {
echo $count . ' ';
}
$count = 1;. You’re already familiar with this code. It’s creating a variable called$countand setting the value to1.$count <= 10;. This is the condition. It can be read as “keep looping while$countis less than or equal to 10”.$count++. This says “add 1 to the counter each time”. It’s identical to$count = $count + 1.echo $count . ' ';. This prints the value of the counter followed by a space.
<= operator. This acts similarly to the less than operator (<), but evaluates to true if the number being compared is less than or equal to the second. Other available operators include >= (greater than or equal) and != (not equal).
All three parts of the for loop are combined to produce the complete loop. Although, at first glance, the code seems a little more difficult to read, putting all the code that deals with controlling the loop in the same place actually makes it easier to understand once you’re used to the syntax. Many of the examples in this book will use for loops, so you’ll have plenty of opportunities to practice reading them.
You can change each part of the for loop to have different results. For example, let’s look at how to add 3 each time you can change the for loop by amending the last part.
The final part of the loop, $count++, says add 1 to the value of $count, and it’s a short way of writing $count = $count + 1.
By changing $count++ to $count = $count + 3, the for loop can be used to count in threes.
Example: PHP-For
for ($count = 1; $count <= 10; $count = $count + 3) {
echo $count . ' ';
}
1 4 7 10
for loops can be combined with other statements — such as if statements — to perform specific tasks on each iteration. For example, rather than refreshing the page on our dice game each time, we might want to roll the dice ten times and print the results.
Example: PHP-DiceRoll-ManyDice
for ($count = 1; $count <= 10; $count++) {
$roll = rand(1, 6);
echo '<p>You rolled a ' . $roll . '</p>';
if ($roll == 6) {
echo '<p>You win!</p>';
}
else {
echo '<p>Sorry, you didn\'t win. Better luck next time!</p>';
}
}
echo '<p>Thanks for playing</p>';
$roll = rand(1, 6);
echo '<p>You rolled a ' . $roll . '</p>';
if ($roll == 6) {
echo '<p>You win!</p>';
}
else {
echo '<p>Sorry, you didn\'t win. Better luck next time!</p>';
}
$roll = rand(1, 6);
echo '<p>You rolled a ' . $roll . '</p>';
if ($roll == 6) {
echo '<p>You win!</p>';
}
else {
echo '<p>Sorry, you didn\'t win. Better luck next time!</p>';
}
$roll = rand(1, 6);
echo '<p>You rolled a ' . $roll . '</p>';
if ($roll == 6) {
echo '<p>You win!</p>';
}
else {
echo '<p>Sorry, you didn\'t win. Better luck next time!</p>';
}
// and so on …
5 as a winning number, you’d need to update the condition in ten different places. Using a loop, you can change the code in one place and it will affect each iteration of the loop. If you ever find yourself copy/pasting code, there’s always a better way of achieving what you’re trying to do.
Note: given your new knowledge of loops, you should be able to start coding for yourself. Can you complete these challenges?
- Challenge 1: print all the odd numbers from 21 to 99.
- Challenge 2: print the nine times table up to 12 x 9 (
9 18 27… etc.) without using the multiplication operator (*) or anifstatement. - Challenge 3: print the nine times table in this format:
This time, you’ll need to use the multiplication operator!1x9 = 9 2x9 = 18 … etc.
While Loops
Another often-used PHP control structure is thewhile loop. Where the if … else statement allows us to choose whether or not to execute a set of statements depending on some condition, the while loop allows us to use a condition to determine how many times we’ll execute a set of statements repeatedly.
The following image shows how a while loop operates.
Here’s what a while loop looks like in code:
while (condition) {
⋮ statement(s) to execute repeatedly as long as condition is true
}
while loop works very similarly to an if statement. The difference arises when the condition is true and the statement(s) are executed. Instead of continuing the execution with the statement that follows the closing brace (}), the condition is checked again. If the condition is still true, the statement(s) are executed a second time, and a third, and will continue to be executed as long as the condition remains true. The first time the condition evaluates false (whether it’s the first time it’s checked, or the hundredth), the execution jumps immediately to the statement that follows the while loop, after the closing brace.
You can use a while loop to create a counter that has a similar result to a for loop.
Example: PHP-WhileCount
$count = 1;
while ($count <= 10) {
echo $count . ' ';
++$count;
}
for loop, and you’ll notice a lot of the same statements in different places. This code may look a bit frightening, I know, but let me talk you through it line by line:
$count = 1;. The first line creates a variable called$countand assigns it a value of1.while ($count <= 10). The second line is the start of awhileloop, the condition being that the value of$countis less than or equal (<=) to 10.{. The opening brace marks the beginning of the block of conditional code for thewhileloop. This conditional code is often called the body of the loop, and is executed over and over again, as long as the condition holds true.echo $count . ' ';. This line simply outputs the value of$count, followed by a space.++$count;. The fourth line adds1to the value of$count.++$countis a shortcut for$count = $count + 1.$count++will also work here! The position of the++can be important, but in this case it doesn’t matter. If the++is before the variable name, the counter is incremented before the value is read. When$countis zero, the codeecho ++$count;will print1, whereasecho $count++;will print0. Be careful when using++, as putting it in the wrong place can cause bugs.}. The closing brace marks the end of thewhileloop’s body.
$count is 1, so the condition is definitely true. The value of $count (1) is output, and $count is given a new value of 2. The condition is still true the second time it’s checked, so the value (2) is output and a new value (3) is assigned. This process continues, outputting the values 3, 4, 5, 6, 7, 8, 9, and 10. Finally, $count is given a value of 11, and the condition is found to be false, which ends the loop.
The net result of the code is shown in the following image.
While loops aren’t generally used for simple counters like this; it’s normally the job of the for loop. Although you can create a counter with a while loop, usually they’re used to keep running code until something happens. For example, we might want to keep rolling the dice until we get a 6. There’s no way to know how many dice rolls will be needed when we write the code: it could take one roll or hundreds to get a six. So you can place the dice roll in a while loop.
Example: PHP-DiceRoll-While
$roll = 0;
while ($roll != 6) {
$roll = rand(1, 6);
echo '<p>You rolled a ' . $roll . '</p>';
if ($roll == 6) {
echo '<p>You win!</p>';
}
else {
echo '<p>Sorry, you didn\'t win, better luck next time!</p>';
}
}
$roll != 6. In order for the while loop to be run the first time, the $roll variable must be set to a value for the initial comparison. That’s the purpose of the $roll = 0; line above the while loop. By setting the value to zero initially, when the while loop runs the first time, the condition $roll != 6 is met, because $roll is equal to zero, not 6, and the loop will start. If the $roll variable isn’t created prior to starting the loop, you’ll get an error, because the $roll variable hasn’t been set to anything before it’s used.
There’s a variant of the while loop called do … while, which is useful in these kinds of cases. It allows you to run some code without a condition and then run it again if the code isn’t set. This takes the following structure:
do {
statement(s) to execute and then repeat if the condition is true
}
while (condition);
do {
$roll = rand(1, 6);
echo '<p>You rolled a ' . $roll . '</p>';
if ($roll == 6) {
echo '<p>You win!</p>';
}
else {
echo '<p>Sorry, you didn\'t win, better luck next time!</p>';
}
}
while ($roll != 6);
while statement is run, the $roll variable has been given a value, so you don’t need to give it an initial value of zero to force the loop to run the first time.
Note: PHP doesn’t mind how you format your code, and whitespace is ignored. You could write the previous example like this:
do {
$roll = rand(
1,
6);
echo '<p>You rolled a ' . $roll . '</p>';
if (
$roll == 6
)
{
echo '<p>You win!</p>';
}
else
{
echo '<p>Sorry, you didn\'t win, better luck next time!</p>';
}
}
while ($roll != 6);Arrays
An array is a special kind of variable that contains multiple values. If you think of a variable as a box that contains a value, an array can be thought of as a box with compartments where each compartment is able to store an individual value. To create an array in PHP, use square brackets ([ and ]) containing the values you want to store, separated by commas:
$myArray = ['one', 2, '3'];
array keyword. The following code is equivalent to the square bracket notation above:
$myArray = array('one', 2, 3);if statements and while loops.
This code creates an array called $myArray that contains three values: 'one', 2, and '3'. Just like an ordinary variable, each space in an array can contain any type of value. In this case, the first and third spaces contain strings, while the second contains a number.
To access a value stored in an array, you need to know its index. Typically, arrays use numbers as indices to point to the values they contain, starting with zero. That is, the first value (or element) of an array has index 0, the second has index 1, the third has index 2, and so on. Therefore, the index of the nth element of an array is n–1. Once you know the index of the value you’re interested in, you can retrieve that value by placing that index in square brackets after the array variable name:
echo $myArray[0]; // outputs 'one'
echo $myArray[1]; // outputs '2'
echo $myArray[2]; // outputs '3'
$myArray[1] = 'two'; // assign a new value
$myArray[3] = 'four'; // create a new element
$myArray[] = 'five';
echo $myArray[4]; // outputs 'five'
if statements.
Example: PHP-DiceRoll-English-If
$roll = rand(1, 6);
if ($roll == 1) {
$english = 'one';
}
else if ($roll == 2) {
$english = 'two';
}
else if ($roll == 3) {
$english = 'three';
}
else if ($roll == 4) {
$english = 'four';
}
else if ($roll == 5) {
$english = 'five';
}
else if ($roll == 6) {
$english = 'six';
}
echo '<p>You rolled a ' . $english . '</p>';
if ($roll == 6) {
echo '<p>You win!</p>';
}
else {
echo '<p>Sorry, you didn\'t win. Better luck next time!</p>';
}*
if statement for each possible dice roll. Instead, you can use an array to store each roll value:
$english = [
1 => 'one',
2 => 'two',
3 => 'three',
4 => 'four',
5 => 'five',
6 => 'six'
];
=> notation (known as a double arrow operator) allows you to define both the keys and the values when creating the array. This is equivalent to the following:
$english = [];
$english[1] = 'one';
$english[2] = 'two';
$english[3] = 'three';
$english[4] = 'four';
$english[5] = 'five';
$english[6] = 'six';
echo $english[3]; // Prints "three"
echo $english[5]; // Prints "five"
3 can be replaced with a variable that contains that value. This is also possible with array keys. For example:
$var1 = 3;
$var2 = 5;
echo $english[$var1]; // Prints "three"
echo $english[$var2]; // Prints "five"
$roll variable.
Example: PHP-DiceRoll-English-Array
$english = [
1 => 'one',
2 => 'two',
3 => 'three',
4 => 'four',
5 => 'five',
6 => 'six'
];
$roll = rand(1, 6);
echo '<p>You rolled a ' . $english[$roll] . '</p>';
if ($roll == 6) {
echo '<p>You win!</p>';
}
else {
echo '<p>Sorry, you didn\'t win, better luck next time!</p>';
}
if statements. There are two big advantages here.
Firstly, if you wanted to represent a ten-sided dice, it’s a lot easier to add to the array than add an extra if statement for each number.
Secondly, the array is reusable. For the version with two dice, you can just reuse the $english array rather than repeating all the if statements for each dice roll.
Example: PHP-DiceRoll-English-If-TwoDice
$roll1 = rand(1, 6);
$roll2 = rand(1, 6);
if ($roll1 == 1) {
$english = 'one';
}
else if ($roll1 == 2) {
$english = 'two';
}
else if ($roll1 == 3) {
$english = 'three';
}
else if ($roll1 == 4) {
$english = 'four';
}
else if ($roll1 == 5) {
$english = 'five';
}
else if ($roll1 == 6) {
$english = 'six';
}
if ($roll2 == 1) {
$englishRoll2 = 'one';
}
else if ($roll2 == 2) {
$englishRoll2 = 'two';
}
else if ($roll2 == 3) {
$englishRoll2 = 'three';
}
else if ($roll2 == 4) {
$englishRoll2 = 'four';
}
else if ($roll2 == 5) {
$englishRoll2 = 'five';
}
else if ($roll2 == 6) {
$englishRoll2 = 'six';
}
echo '<p>You rolled a ' . $english . ' and a ' . $englishRoll2 . '</p>';
$english = [
1 => 'one',
2 => 'two',
3 => 'three',
4 => 'four',
5 => 'five',
6 => 'six'
];
$roll1 = rand(1, 6);
$roll2 = rand(1, 6);
echo '<p>You rolled a ' . $english[$roll1] . ' and a ' . $english[$roll2] . '</p>';
$birthdays['Kevin'] = '1978-04-12';
$birthdays['Stephanie'] = '1980-05-16';
$birthdays['David'] = '1983-09-09';
$birthdays = [
'Kevin' => '1978-04-12',
'Stephanie' => '1980-05-16',
'David' => '1983-09-09'
];
echo 'Kevin\'s birthday is: ' . $birthdays['Kevin'];
Kevin's contains an apostrophe (single quote) and PHP would see this as the end of the string, it must be escaped with a \ so that PHP treats it as part of the string, rather than marking the end.
User Interaction and Forms
Database-driven websites often need to do more than dynamically generate pages based on database data. You also need to provide some degree of interactivity, even if it’s just a search box. Because JavaScript code can live in the browser, it allows users to have all sorts of immediate interactions with a web page. Server-side scripting languages such as PHP have a more limited scope when it comes to support for user interaction. As PHP code is only activated when a request is made to the server, user interaction occurs solely in a back-and-forth fashion: the user sends requests to the server, and the server replies with dynamically generated pages. The key to creating interactivity with PHP is to understand the techniques we can employ to send information about a user’s interaction, along with a request for a new web page. As it turns out, PHP makes this quite easy. Note: as the Web has evolved, so too have the options for communication between the front and back ends of a web app. JavaScript allows for communication with a back end without page reloading. A JavaScript framework such as Vue.js, for example, can communicate with PHP frameworks like Laravel. For the purposes of this book, however, we’ll focus on what can be done with PHP alone.Passing Variables in Links
The simplest way to send information along with a page request is to use the URL query string. If you’ve ever noticed a URL containing a question mark that follows the filename, you’ve seen this technique in use. For example, if you search for “SitePoint” on Google, it will take you to a search result page with a URL like this:http://www.google.com/search?hl=en&q=SitePoint
SitePoint). That information is being sent along with the request for http://www.google.com/search.
Let’s code up an easy example of our own. Create a regular HTML file called name.html (no .php filename extension is required, since there won’t be any PHP code in this file) and insert this link:
<a href="name.php?name=Tom">Hi, I’m Tom!</a>
name.php, but as well as linking to the file, you’re also passing a variable along with the page request. The variable is passed as part of the query string, which is the portion of the URL that follows the question mark. The variable is called name, and its value is Tom. So, you’ve created a link that loads name.php, and which informs the PHP code contained in that file that name equals Tom.
To really understand the effect of this link, we need to look at name.php. Create it as a new file, but this time, note the .php filename extension. This tells the web server that it can expect to interpret some PHP code in the file. In the body of this new web page, type the following.
Example: PHP-GET
<?php
$name = $_GET['name'];
echo 'Welcome to our website, ' . $name . '!';
?>
name.html and name.php) in the public folder, and load the first file in your browser. (The URL should be https://v.je/name.html.) Click the link in that first page to request the PHP script. The resulting page should say “Welcome to our website, Tom!”, as shown in the image below.
Let’s take a closer look at the code that made this possible. This is the most important line:
$name = $_GET['name'];
'name' element of the array called $_GET to a new variable called $name. But where does the $_GET array come from?
It turns out that $_GET is one of a number of variables that PHP automatically creates when it receives a request from a browser. PHP creates $_GET as an array variable that contains any values passed in the URL query string. $_GET is an associative array, so the value of the name variable passed in the query string can be accessed as $_GET['name']. Your name.php script assigns this value to an ordinary PHP variable ($name), then displays it as part of a text string using an echo statement:
echo 'Welcome to our website, ' . $name . '!';
$name variable is inserted into the output string using the string concatenation operator (.) that we looked at in the “Variables, Operators, and Comments” section.
But watch out! There’s a security hole lurking in this code! Although PHP is an easy programming language to learn, it turns out it’s also especially easy to introduce security issues into websites using PHP if you’re unaware of what precautions to take. Before we go any further with the language, I want to make sure you’re able to spot and fix this particular security issue, since it’s probably the most common one on the Web today.
The security issue here stems from the fact that the name.php script is generating a page containing content that’s under the control of the user — in this case, the $name variable. Although the $name variable will normally receive its value from the URL query string in the link on the name.html page, a malicious user could edit the URL to send a different value for the name variable.
To see how this would work, click the link in name.html again. When you see the resulting page (with the welcome message containing the name “Tom”), take a look at the URL in the address bar of your browser. It should look similar to this:
https://v.je/name.php?name=Tom
<b> tag before the name and a </b> tag following the name:
https://v.je/name.php?name=<b>Tom</b>
< and > characters into URL escape sequences (%3C and %3E respectively), but either way, PHP will receive the same value.
See what’s happening here? The user can type any HTML code into the URL, and your PHP script includes it in the code of the generated page without question. If the code is as innocuous as a <b> tag, there’s no problem, but a malicious user could include sophisticated JavaScript code that performs some low action like stealing the user’s password. All the attacker would have to do is publish the modified link on some other site under the attacker’s control, and then entice one of your users to click it. The attacker could even embed the link in an email and send it to your users. If one of your users clicked the link, the attacker’s code would be included in your page and the trap would be sprung!
I hate to scare you with this talk of malicious hackers attacking your users by turning your own PHP code against you, particularly when you’re only just learning the language. The fact is that PHP’s biggest weakness as a language is how easy it is to introduce security issues like this. Some might say that much of the energy you spend learning to write PHP to a professional standard is spent on avoiding security issues. The sooner you’re exposed to these issues, however, the sooner you become accustomed to avoiding them, and the less of a stumbling block they’ll be for you in future.
So, how can we generate a page containing the user’s name without opening it up to abuse by attackers? The solution is to treat the value supplied for the $name variable as plain text to be displayed on your page, rather than as HTML to be included in the page’s code. This is a subtle distinction, so let me show you what I mean.
Open up your name.php file again and edit the PHP code it contains so that it looks like the code below.
Example: PHP-GET-Sanitized
<?php
$name = $_GET['name'];
echo 'Welcome to our website, ' .
htmlspecialchars($name, ENT_QUOTES, 'UTF-8') . '!';
?>
$name the value of the 'name' element from the $_GET array. But the echo statement that follows it is drastically different. Whereas previously we simply dumped the $name variable — naked — into the echo statement, this version of the code uses the built-in PHP function htmlspecialchars to perform a critical conversion.
Remember, the security hole occurs because, in name.php, HTML code in the $name variable is dumped directly into the code of the generated page, and can therefore do anything that HTML code can do. What htmlspecialchars does is convert “special HTML characters” like < and > into HTML character entities like < and >, which prevents them from being interpreted as HTML code by the browser. I’ll demonstrate this for you in a moment.
First, let’s take a closer look at this new code. The call to the htmlspecialchars function is the first example in this book of a PHP function that takes more than one argument. Here’s the function call all by itself:
htmlspecialchars($name, ENT_QUOTES, 'UTF-8')
$name variable (the text to be converted). The second argument is the PHP “constant” ENT_QUOTES, which tells htmlspecialchars to convert single and double quotes in addition to other special characters.
Note: a PHP constant is like a variable whose value you’re unable to change. Unlike variables, constants don’t start with a dollar sign. PHP comes with a number of built-in constants like ENT_QUOTES that are used to control built-in functions like htmlspecialchars.
The third parameter is the string 'UTF-8', which tells PHP what character encoding to use to interpret the text you give it.
Note: you may have discerned that all the example HTML pages in this book contain the following meta element near the top:
<meta charset="utf-8">htmlspecialchars, assume you’re using the much simpler ISO-8859-1 (or Latin-1) character encoding by default. Therefore, you need to let them know you’re using UTF-8 when utilizing these functions.
If you can, you should also tell your text editor to save your HTML and PHP files as UTF-8 encoded text. This is only required if you want to type advanced characters (such as curly quotes or dashes) or foreign characters (like “é”) into your HTML or PHP code. The code in this book plays it safe and uses HTML entity references (for example, ’ for a curly right quote), which will work regardless.
Open up name.html in your browser and click the link that now points to your updated name.php. Once again, you’ll see the message “Welcome to our website, Tom!” As you did before, modify the URL to include <b> and </b> tags surrounding the name:
https://v.je/name.php?name=<b>Tom</b>
htmlspecialchars function did its job and converted the < and > characters into the < and > entity references respectively. This prevents malicious users from injecting unwanted code into your site. If they try anything like that, the code is harmlessly displayed as plain text on the page.
We’ll make extensive use of the htmlspecialchars function throughout this book to guard against this sort of security hole. No need to worry too much if you’re having trouble grasping the details of how to use it just at the moment. Before long, you’ll find its use becomes second nature. For now, let’s look at some more advanced ways of passing values to PHP scripts when we request them.
Passing a single variable in the query string was nice, but it turns out you can pass more than one value if you want to! Let’s look at a slightly more complex version of the previous example. Open up your name.html file again, and change the link to point to name.php with this more complicated query string:
<a href="name.php?firstname=Tom&lastname=Butler">Hi,
I’m Tom Butler!</a>
firstname and lastname. The variables are separated in the query string by an ampersand (&, which should be written as & in HTML — yes, even in a link URL! … although, if you do wrongly use &, browsers will mostly fix it for you). You can pass even more variables by separating each name=value pair from the next with an ampersand.
As before, we can use the two variable values in our name.php file.
Example: PHP-GET-TwoVars
<?php
$firstName = $_GET['firstname'];
$lastName = $_GET['lastname'];
echo 'Welcome to our website, ' .
htmlspecialchars($firstName, ENT_QUOTES, 'UTF-8') . ' ' .
htmlspecialchars($lastName, ENT_QUOTES, 'UTF-8') . '!';
?>
echo statement is becoming quite sizable now, but it should still make sense to you. Using a series of string concatenations (.), it outputs “Welcome to our website”, followed by the value of $firstName (made safe for display using htmlspecialchars), a space, the value of $lastName (again, treated with htmlspecialchars), and finally an exclamation mark.
The result is pictured below.
This is all well and good, but we’re still yet to achieve our goal of true user interaction, where the user can enter arbitrary information and have it processed by PHP. To continue with our example of a personalized welcome message, we’d like to invite the user to type their name and have it appear in the resulting page. To enable the user to type in a value, we’ll need to use an HTML form.
Passing Variables in Forms
Remove the link code fromname.html and replace it with this HTML code to create the form.
Example: PHP-GET-Form
<form action="name.php" method="get">
<label for="firstname">First name:</label>
<input type="text" name="firstname" id="firstname">
<label for="lastname">Last name:</label>
<input type="text" name="lastname" id="lastname">
<input type="submit" value="GO">
</form>
form.css in the sample code) to make it look a little prettier. The CSS I’ve used is very generic, and can be used to display any form in the format label-input-line break. I’ll be including this CSS file on any page that contains a form.
Since this is a book about PHP and MySQL, however, I won’t go into detail about how the CSS works. Check out SitePoint’s HTML5 & CSS3 for the Real World for advice on styling your forms with CSS.
This form has the exact same effect as the second link we looked at in the “Passing Variables in Links” section above (with firstname=Tom&lastname=Butler in the query string), except that you can now enter whichever names you like. When you click the submit button (labeled GO), the browser will load name.php and add the variables and their values to the query string for you automatically. It retrieves the names of the variables from the name attributes of the type="text" inputs, and obtains the values from the text typed into the text fields by the user.
The method attribute of the form tag is used to tell the browser how to send the variables and their values along with the request. A value of get (as used in name.html above) causes them to be passed via the query string (and appear in PHP’s $_GET array), but there’s an alternative. It can be undesirable — or even technically unfeasible — to have the values appear in the query string. What if we included a <textarea> element in the form, to let the user enter a large amount of text? A URL whose query string contained several paragraphs of text would be ridiculously long, and would possibly exceed the maximum length for a URL in today’s browsers. The alternative is for the browser to pass the information invisibly, behind the scenes.
Edit your name.html file once more. Modify the form method by setting it to post:
<form action="name.php" method="post">
<label for="firstname">First name:</label>
<input type="text" name="firstname" id="firstname">
<label for="lastname">Last name:</label>
<input type="text" name="lastname" id="lastname">
<input type="submit" value="GO">
</form>
$_GET array. Instead, they’re placed in another array reserved especially for “posted” form variables: $_POST. We must therefore modify name.php to retrieve the values from this new array.
Example: PHP-POST-Form
<?php
$firstname = $_POST['firstname'];
$lastname = $_POST['lastname'];
echo 'Welcome to our website, ' .
htmlspecialchars($firstname, ENT_QUOTES, 'UTF-8') . ' ' .
htmlspecialchars($lastname, ENT_QUOTES, 'UTF-8') . '!';
?>
GET forms if, when the form is submitted, nothing on the server changes — such as when you’re requesting a list of search results. Because the search terms are in the URL, the user can bookmark the search results page and get back to it without having to type in the search term again. But if, after submitting the form, a file is deleted, a database is updated, or a record is inserted, you should use POST. The primary reason for this is that if a user bookmarks the page (or presses the back button in their browser) it won’t trigger the form submission again and potentially create a duplicate record.
POST is also more secure. Anything sent via GET appears in the URL and is stored in the user’s history and bookmarks — which are very insecure locations for sensitive data such as passwords and credit card details.
That covers the basics of using forms to produce rudimentary user interaction with PHP. We’ll look at more advanced issues and techniques in later examples.
Hiding the Seams
You’re now armed with a working knowledge of the basic syntax of the PHP programming language. You understand that you can take any HTML web page, rename it with a.php file name extension, and inject PHP code into it to generate page content on the fly. Not bad for a day’s work!
Before we go any further, however, I want to stop and cast a critical eye over the examples we’ve discussed so far. Assuming your objective is to create database-driven websites that hold up to professional standards, there are a few unsightly blemishes we need to clean up.
The techniques in the rest of this chapter will help advance your programming skills beyond the beginner level, giving them a certain professional polish. I’ll rely on these techniques throughout the rest of this book to ensure that, no matter how simple the example, you can feel confident in the quality of the product you’re delivering.
PHP Templates
In the simple examples we’ve seen so far, inserting PHP code directly into your HTML pages has been a reasonable approach. As the amount of PHP code that goes into generating your average page grows, however, maintaining this mixture of HTML and PHP code can become unmanageable. Particularly if you work in a team of web designers who aren’t especially PHP savvy, having large blocks of cryptic PHP code intermingled with the HTML is a recipe for disaster. It’s far too easy for designers to accidentally modify the PHP code, causing errors they’ll be unable to fix. A much more robust approach is to separate out the bulk of your PHP code so that it resides in its own file, leaving the HTML largely unpolluted by PHP code. The key to doing this is the PHPinclude statement. With an include statement, you can insert the contents of another file into your PHP code at the point of the statement. To show you how this works, let’s rebuild the “count to ten” for loop example we looked at earlier.
Start by creating a new file, count.php, in your public directory. Open the file for editing and type in this code:
<?php
$output = '';
for ($count = 1; $count <= 10; $count++) {
$output .= $count . ' ';
}
include 'count.html.php';
for loop should be familiar to you by now, but let me point out the interesting parts of this code:
- Instead of
echoing out the numbers 1 to 10, this script will add these numbers to a variable named$output. At the start of this script, therefore, we set this variable to contain an empty string. - The line
$output .= $count . ' ';adds each number (followed by a space) to the end of the$outputvariable. The.=operator you see here is a shorthand way of adding a value to the end of an existing string variable, by combining the assignment and string concatenation operators into one. The longhand version of this line is$output = $output . $count . ' ';, but the.=operator saves you some typing. - The
includestatement instructs PHP to execute the contents of thecount.html.phpfile at this location. You can think of theincludestatement as a kind of copy and paste. You would get the same result by opening upcount.html.php, copying the contents and pasting them intocount.php, overwriting theincludeline. - Finally, you might have noticed that the file doesn’t end with a
?>to match the opening<?php. You can put it in if you really want to, but it’s not necessary. If a PHP file ends with PHP code, there’s no need to indicate where that code ends; the end of the file does it for you. The big brains of the PHP world generally prefer to leave it off the end of files like this one that contain only PHP code.
include code, as if include were a function like date or htmlspecialchars, which is far from the case. For example, instead of include 'count.html.php';, you might see include('count.html.php');. These parentheses, when used, only serve to complicate the filename expression, and are therefore avoided in this book. The same goes for echo, another popular one-liner.
Since the final line of our count.php file includes the count.html.php file, you should create that file next.
Example: PHP-Count-Template
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
<title>Counting to Ten</title>
</head>
<body>
<p>
<?php echo $output; ?>
</p>
</body>
</html>
$output variable. This is the same $output variable that was created by the count.php file.
What we’ve created here is a PHP template: an HTML page with only very small snippets of PHP code that insert dynamically generated values into an otherwise static HTML page. Rather than embedding the complex PHP code that generates those values in the page, we put the code to generate the values in a separate PHP script — count.php in this case.
Using PHP templates like this enables you to hand over your templates to front-end designers without worrying about what they might do to your PHP code. It also lets you focus on your PHP code without being distracted by the surrounding HTML code.
I like to name my PHP template files so that they end with .html.php. As far as your web server is concerned, though, these are still .php files; the .html.php suffix serves as a useful reminder that these files contain both HTML and PHP code.
To see how our pages work now, type https://v.je/count.php into your browser. You’ll see the results of the count.php script displayed in our count.html.php template.
Security Concerns
One problem with separating out the HTML and PHP code into different files is that someone could potentially run the.html.php code without having had it included from a corresponding PHP file. This isn’t a big problem, but anyone could visit count.html.php directly. If you type https://v.je/count.html.php into your web browser, instead of seeing the count from one to ten, you’ll see an error message: Notice: Undefined variable: output in /websites/default/public/count.html.php on line 9.
It’s better not to let people run code in a manner you’re not expecting. Depending on what the page is doing, this might let them bypass security checks you have in place and view content they shouldn’t have access to. For example, consider the following code:
if ($_POST['password'] == 'secret') {
include 'protected.html.php';
}
secret in the password box to see the protected content in protected.html.php. However, if someone can navigate directly to protected.html.php and see the contents of the page, it makes the security check redundant. There are other potential security issues introduced by making all your files accessible via a URL. Avoiding security problems like these is easy. You can actually include files from a directory other than the public directory.
You may have wondered earlier why the development environment created a public directory inside the default directory and we then wrote all our files to the public directory. Well, this issue of security is the reason why. None of the files outside the public directory are accessible via a URL (by someone typing the file name into their web browser).
The include command can be tweaked to include files from another directory. In our case, that directory is going to be the default directory, which contains the public directory we’ve been writing our files to.
So the question is, when the include file is in a different directory, how does a PHP script find it? The most obvious method is to specify the location of the include file as an absolute path. Here’s how this would look on a Windows server:
<?php include 'C:/Program Files/Apache Software Foundation/Apache2.2/protected.html.php'; ?>
<?php include '/websites/default/protected.html.php'; ?>
include 'count.html.php', this is actually a relative path: count.html.php is being included from the same directory as the script that was executed.
To include a file from the directory above, you can use the following code:
include '../count.html.php';
../ bit tells PHP to look for the file in the directory above the directory of the current script. It will look for count.html.php in the default directory instead of the public directory.
Go ahead and move count.html.php up a level into the default directory and amend count.php to reference the new location.
Example: PHP-Count-Template-Secured
<?php
$output = '';
for ($count = 1; $count <= 10; $count++) {
$output .= $count . ' ';
}
include '../count.html.php';
default/count.html.php and add the line include 'count2.html.php'; you would expect count2.html.php to be included from the default directory. However, the path is relative to something called the current working directory, which, when you run a PHP script, is initially set to the directory that script is stored in. So running include 'count2.html.php'; from count.html.php will actually try to load count2.html.php from the public directory!
The current working directory is set at the start of the script and applies to all the include statements, regardless of what file they are in. To make things even more confusing, it’s possible to change the current working directory using the chdir() function.
Because of this, we can’t rely on the following:
include '../count.html.php';
count.php itself is an include file, it may not have the result we’re expecting.
To overcome this, we do actually need to use absolute paths. Luckily, PHP provides a constant called __DIR__ (that’s two underscores, before and after the word DIR) which will always contain the path that contains the current file.
For example, you could create a file called dir.php inside the public directory with the following code:
echo __DIR__;
/websites/default/public, which is the full path to the directory containing dir.php. To read count.html.php from the directory above public, it’s possible to combine the /../ operator and the __DIR__ constant:
include __DIR__ . '/../count.html.php';
/websites/default/public/../count.html. That is, PHP will look in the public directory, then go up one level into default and include count.html.php.
This approach will work on any server, because __DIR__ will differ depending on where the file is stored, and it doesn’t depend on the changing current working directory. I’ll be using this approach for including files throughout this book.
From now on, we’ll only write files to the public directory that we actually want users to be able to access directly from their web browser. The public directory will contain any PHP scripts the user needs to access directly along with any images, JavaScript and CSS files required by the browser. Any files only referenced by an include statement will be placed outside the public directory so users can’t access them directly.
As the book goes on, I’m going to introduce you to several different types of include files. To keep things organized, it’s sensible to store different types of include files in different directories. We’ll store template files (with a .html.php extension) inside a directory called templates inside the default folder. We can then reference them in an include statement using include __DIR__ . '../templates/file.html.php';.
Many Templates, One Controller
What’s nice about usinginclude statements to load your PHP template files is that you can have multiple include statements in a single PHP script, as well as have it display different templates under various circumstances!
A PHP script that responds to a browser request by selecting one of several PHP templates to fill in and send back is commonly called a “controller”. A controller contains the logic that controls which template is sent to the browser.
Let’s revisit one more example from earlier in this chapter — the welcome form that prompts a visitor for a first and last name.
We’ll start with the PHP template for the form. For this, we can just reuse the name.html file we created earlier. Create a directory templates inside default if you haven’t already, and save a copy of name.html called form.html.php into this directory. The only code you need to change in this file is the action attribute of the form tag.
Example: PHP-Form-Controller
<!doctype html>
<html>
<head>
<title>Enter your name</title>
<link rel="stylesheet" href="form.css" />
<meta charset="utf-8">
</head>
<body>
<form action="" method="post">
<label for="firstname">First name:</label>
<input type="text" name="firstname" id="firstname">
<label for="lastname">Last name:</label>
<input type="text" name="lastname" id="lastname">
<input type="submit" value="GO">
</form>
</body>
</html>
index.php file inside the public directory that contains the following code:
<?php
if (!isset($_POST['firstname'])) {
include __DIR__ . '/../templates/form.html.php';
} else {
$firstName = $_POST['firstname'];
$lastName = $_POST['lastname'];
if ($firstName == 'Tom' && $lastName == 'Butler') {
$output = 'Welcome, oh glorious leader!';
} else {
$output = 'Welcome to our website, ' .
htmlspecialchars($firstName, ENT_QUOTES, 'UTF-8') . ' ' .
htmlspecialchars($lastName, ENT_QUOTES, 'UTF-8') . '!';
}
include __DIR__ . '/../templates/welcome.html.php';
}
name.php script we wrote earlier. Let me explain the differences:
- The controller’s first task is to decide whether the current request is a submission of the form in
form.html.phpor not. You can do this by checking if the request contains afirstnamevariable. If it does, PHP will have stored the value in$_POST['firstname'].issetis a built-in PHP function that will tell you if a particular variable (or array element) has been assigned a value or not. If$_POST['firstname']has a value,isset($_POST['firstname'])will be true. If$_POST['firstname']is unset,isset($_POST['firstname'])will be false. For the sake of readability, I like to put the code that sends the form in my controller first. We need thisifstatement to check if$_POST['firstname']isn’t set. To do this, we use the not operator (!). By putting this operator before the name of a function, you reverse the value that function returns — from true to false, or from false to true. Thus, if the request doesn’t contain afirstnamevariable, then!isset($_POST['firstname'])will return true, and the body of theifstatement will be executed. - If the request isn’t a form submission, the controller includes the
form.html.phpfile to display the form. - If the request is a form submission, the body of the
elsestatement is executed instead. This code pulls thefirstnameandlastnamevariables out of the$_POSTarray, and then generates the appropriate welcome message for the name submitted. - Instead of
echoing the welcome message, the controller stores the welcome message in a variable named$output. - After generating the appropriate welcome message, the controller includes the
welcome.html.phptemplate, which will display that welcome message.
welcome.html.php file into the templates directory. Here it is:
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
<title>Form Example</title>
</head>
<body>
<p>
<?php echo $output; ?>
</p>
</body>
</html>
https://v.je/index.php. You’ll be prompted for your name, and when you submit the form, you’ll see the appropriate welcome message. The URL should stay the same throughout this process.
You’ll have noticed I asked you to name the file index.php instead of name.php or similar. The reason I used index.php is because it has a special meaning. index.php is known as a directory index. If you don’t specify a filename when you visit the URL in your browser, the server will look for a file named index.php and display that. Try typing just https://v.je into your browser and you’ll see the index page.
Note: web servers can have different configurations and specify a different file to be the directory index. However, index.php will work on most web servers without any further configuration.
One of the benefits of maintaining the same URL throughout this process of prompting the user for a name and displaying the welcome message is that the user can bookmark the page at any time during this process and gain a sensible result. Whether it’s the form page or the welcome message that’s bookmarked, when the user returns, the form will be present once again. In the previous version of this example, where the welcome message had its own URL, returning to that URL without submitting the form would have generated a broken welcome message (“Welcome to our website, !”), or a PHP error message if, like ours, the server is running with error reporting enabled.
Note: in Chapter 11, where we discuss “sessions”, I show you how to remember the user’s name between visits.
Bring On the Database
In this chapter, we’ve seen the PHP server-side scripting language in action as we’ve explored all the basic language features: statements, variables, operators, comments, and control structures. The sample applications we’ve seen have been reasonably simple, but we’ve still taken the time to ensure they have attractive URLs, and that the HTML templates for the pages they generate are uncluttered by the PHP code that controls them. As you may have begun to suspect, the real power of PHP is in its hundreds (even thousands) of built-in functions that let you access data in a MySQL database, send email, dynamically generate images, and even create Adobe Acrobat PDF files on the fly. In Chapter 3, we’ll delve into the MySQL functions built into PHP, and then create a database of jokes. Then, in Chapter 4, we’ll see how to publish that joke database to the Web. These tasks will set the scene for the ultimate goal of this book: to create a complete content management system for your website in PHP and MySQL.Frequently Asked Questions (FAQs) about PHP for Beginners
What is the basic syntax of PHP?
PHP scripts start with . A PHP file normally contains HTML tags, and some PHP scripting code. Each line of PHP code must end with a semicolon (;) which is a way to separate PHP statements. Comments in PHP are lines that are not read/executed as part of the program. They are a way for programmers to leave notes for themselves or others, to explain what the code does.
How can I integrate PHP with HTML?
PHP can be easily integrated with HTML. You can start and end PHP codes with tags within your HTML file. The PHP code is executed on the server, and the plain HTML result is sent back to the browser.
How do I use PHP variables?
Variables in PHP are represented by a dollar sign followed by the name of the variable. The variable name is case-sensitive. Variables can store data of different types, such as string, integer, float, boolean, array or object.
What are PHP arrays and how can I use them?
An array in PHP is actually an ordered map. A map is a type that associates values to keys. This type is optimized for several different uses; it can be treated as an array, list (vector), hash table (an implementation of a map), dictionary, collection, stack, queue, and probably more.
How can I handle errors in PHP?
PHP has several functions to handle errors; die(), set_error_handler(), and trigger_error(). PHP sends an error report when an error occurs, and it also has functions to manually generate an error.
How can I use PHP for form handling?
PHP is a great scripting language for form handling. You can use the $_GET or $_POST array to collect data from HTML forms. The $_GET array collects data sent via the HTTP GET method, and the $_POST array collects data sent via the HTTP POST method.
How can I use PHP for file handling?
PHP has several functions for creating, reading, uploading, and editing files. For example, the fopen() function can be used to open a file, the fread() function can be used to read a file, and the fwrite() function can be used to write to a file.
How can I use PHP for database interaction?
PHP has several functions for interacting with databases. The most common way to interact with a database from PHP is by using the MySQLi extension.
How can I use PHP for session management?
PHP session management is a way to preserve certain data across subsequent accesses. A session is started with the session_start() function, and you can store data in the $_SESSION array.
How can I use PHP for sending emails?
PHP has a built-in function, mail(), for sending emails. This function allows you to send email directly from a script.
Tom ButlerTom Butler is a web developer and university lecturer. He has a PhD in the area of software engineering best practices and enjoys evaluating different approaches to programming problems.
PHP
Share this article
